@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (972) hide show
  1. package/dist/esm/applications/services/worker-remote-client-factory.backend.service.d.ts.map +1 -1
  2. package/dist/esm/applications/services/worker-remote-client-factory.backend.service.js +19 -1
  3. package/dist/esm/applications/services/worker-remote-client-factory.backend.service.js.map +1 -1
  4. package/dist/esm/base-classes/models/manual-controllers.backend.definition.d.ts.map +1 -1
  5. package/dist/esm/base-classes/models/manual-controllers.backend.definition.js +4 -0
  6. package/dist/esm/base-classes/models/manual-controllers.backend.definition.js.map +1 -1
  7. package/dist/esm/base-classes/services/batches/child-lifecycle-teardown.batch.backend.service.d.ts +35 -0
  8. package/dist/esm/base-classes/services/batches/child-lifecycle-teardown.batch.backend.service.d.ts.map +1 -0
  9. package/dist/esm/base-classes/services/batches/child-lifecycle-teardown.batch.backend.service.js +111 -0
  10. package/dist/esm/base-classes/services/batches/child-lifecycle-teardown.batch.backend.service.js.map +1 -0
  11. package/dist/esm/base-classes/services/batches/credential-expiry-sweep.batch.backend.service.d.ts +50 -0
  12. package/dist/esm/base-classes/services/batches/credential-expiry-sweep.batch.backend.service.d.ts.map +1 -0
  13. package/dist/esm/base-classes/services/batches/credential-expiry-sweep.batch.backend.service.js +199 -0
  14. package/dist/esm/base-classes/services/batches/credential-expiry-sweep.batch.backend.service.js.map +1 -0
  15. package/dist/esm/base-classes/services/batches/engine-custom-batch-manifests.d.ts +111 -0
  16. package/dist/esm/base-classes/services/batches/engine-custom-batch-manifests.d.ts.map +1 -1
  17. package/dist/esm/base-classes/services/batches/engine-custom-batch-manifests.js +140 -0
  18. package/dist/esm/base-classes/services/batches/engine-custom-batch-manifests.js.map +1 -1
  19. package/dist/esm/base-classes/services/controllers/controller-resource.backend.service.d.ts +14 -3
  20. package/dist/esm/base-classes/services/controllers/controller-resource.backend.service.d.ts.map +1 -1
  21. package/dist/esm/base-classes/services/controllers/controller-resource.backend.service.js +138 -24
  22. package/dist/esm/base-classes/services/controllers/controller-resource.backend.service.js.map +1 -1
  23. package/dist/esm/base-classes/services/controllers/controllers-registry-handler.backend.service.d.ts +3 -1
  24. package/dist/esm/base-classes/services/controllers/controllers-registry-handler.backend.service.d.ts.map +1 -1
  25. package/dist/esm/base-classes/services/controllers/controllers-registry-handler.backend.service.js +8 -3
  26. package/dist/esm/base-classes/services/controllers/controllers-registry-handler.backend.service.js.map +1 -1
  27. package/dist/esm/base-classes/services/repositories/field-clearing-partition.backend.d.ts +11 -0
  28. package/dist/esm/base-classes/services/repositories/field-clearing-partition.backend.d.ts.map +1 -1
  29. package/dist/esm/base-classes/services/repositories/field-clearing-partition.backend.js +11 -2
  30. package/dist/esm/base-classes/services/repositories/field-clearing-partition.backend.js.map +1 -1
  31. package/dist/esm/base-classes/services/repositories/http-api/http-api-provider-access.backend.d.ts +124 -13
  32. package/dist/esm/base-classes/services/repositories/http-api/http-api-provider-access.backend.d.ts.map +1 -1
  33. package/dist/esm/base-classes/services/repositories/http-api/http-api-provider-access.backend.js +207 -21
  34. package/dist/esm/base-classes/services/repositories/http-api/http-api-provider-access.backend.js.map +1 -1
  35. package/dist/esm/base-classes/services/repositories/http-api/http-api-read-client.backend.d.ts +60 -8
  36. package/dist/esm/base-classes/services/repositories/http-api/http-api-read-client.backend.d.ts.map +1 -1
  37. package/dist/esm/base-classes/services/repositories/http-api/http-api-read-client.backend.js +174 -26
  38. package/dist/esm/base-classes/services/repositories/http-api/http-api-read-client.backend.js.map +1 -1
  39. package/dist/esm/base-classes/services/repositories/http-api/http-api-resource-repository.backend.service.d.ts +48 -4
  40. package/dist/esm/base-classes/services/repositories/http-api/http-api-resource-repository.backend.service.d.ts.map +1 -1
  41. package/dist/esm/base-classes/services/repositories/http-api/http-api-resource-repository.backend.service.js +102 -30
  42. package/dist/esm/base-classes/services/repositories/http-api/http-api-resource-repository.backend.service.js.map +1 -1
  43. package/dist/esm/base-classes/services/repositories/http-api/http-api-rest-operation-reference.backend.d.ts +55 -0
  44. package/dist/esm/base-classes/services/repositories/http-api/http-api-rest-operation-reference.backend.d.ts.map +1 -0
  45. package/dist/esm/base-classes/services/repositories/http-api/http-api-rest-operation-reference.backend.js +114 -0
  46. package/dist/esm/base-classes/services/repositories/http-api/http-api-rest-operation-reference.backend.js.map +1 -0
  47. package/dist/esm/base-classes/services/repositories/http-api/http-api-transport.backend.d.ts +89 -14
  48. package/dist/esm/base-classes/services/repositories/http-api/http-api-transport.backend.d.ts.map +1 -1
  49. package/dist/esm/base-classes/services/repositories/http-api/http-api-transport.backend.js +84 -11
  50. package/dist/esm/base-classes/services/repositories/http-api/http-api-transport.backend.js.map +1 -1
  51. package/dist/esm/base-classes/services/repositories/http-api/odata-query-compiler.backend.d.ts.map +1 -1
  52. package/dist/esm/base-classes/services/repositories/http-api/odata-query-compiler.backend.js +16 -0
  53. package/dist/esm/base-classes/services/repositories/http-api/odata-query-compiler.backend.js.map +1 -1
  54. package/dist/esm/base-classes/services/repositories/infrastructure-tier-contract.backend.d.ts +20 -6
  55. package/dist/esm/base-classes/services/repositories/infrastructure-tier-contract.backend.d.ts.map +1 -1
  56. package/dist/esm/base-classes/services/repositories/infrastructure-tier-contract.backend.js +96 -32
  57. package/dist/esm/base-classes/services/repositories/infrastructure-tier-contract.backend.js.map +1 -1
  58. package/dist/esm/base-classes/services/repositories/introspection/introspection-resource-repository.backend.service.d.ts +3 -1
  59. package/dist/esm/base-classes/services/repositories/introspection/introspection-resource-repository.backend.service.d.ts.map +1 -1
  60. package/dist/esm/base-classes/services/repositories/introspection/introspection-resource-repository.backend.service.js +32 -7
  61. package/dist/esm/base-classes/services/repositories/introspection/introspection-resource-repository.backend.service.js.map +1 -1
  62. package/dist/esm/base-classes/services/repositories/introspection/introspection-resource-source.backend.port.d.ts +8 -5
  63. package/dist/esm/base-classes/services/repositories/introspection/introspection-resource-source.backend.port.d.ts.map +1 -1
  64. package/dist/esm/base-classes/services/repositories/introspection/introspection-resource-source.backend.port.js.map +1 -1
  65. package/dist/esm/base-classes/services/repositories/postgresql-resource-repository.backend.service.d.ts +80 -0
  66. package/dist/esm/base-classes/services/repositories/postgresql-resource-repository.backend.service.d.ts.map +1 -1
  67. package/dist/esm/base-classes/services/repositories/postgresql-resource-repository.backend.service.js +298 -23
  68. package/dist/esm/base-classes/services/repositories/postgresql-resource-repository.backend.service.js.map +1 -1
  69. package/dist/esm/base-classes/services/repositories/repositories-registry-handler.backend.service.d.ts +71 -1
  70. package/dist/esm/base-classes/services/repositories/repositories-registry-handler.backend.service.d.ts.map +1 -1
  71. package/dist/esm/base-classes/services/repositories/repositories-registry-handler.backend.service.js +85 -5
  72. package/dist/esm/base-classes/services/repositories/repositories-registry-handler.backend.service.js.map +1 -1
  73. package/dist/esm/base-classes/services/repositories/repository-resource.backend.service.d.ts +21 -0
  74. package/dist/esm/base-classes/services/repositories/repository-resource.backend.service.d.ts.map +1 -1
  75. package/dist/esm/base-classes/services/repositories/repository-resource.backend.service.js +146 -4
  76. package/dist/esm/base-classes/services/repositories/repository-resource.backend.service.js.map +1 -1
  77. package/dist/esm/base-classes/services/services/resource-operation-custom-implementation-base.backend.service.d.ts +22 -0
  78. package/dist/esm/base-classes/services/services/resource-operation-custom-implementation-base.backend.service.d.ts.map +1 -1
  79. package/dist/esm/base-classes/services/services/resource-operation-custom-implementation-base.backend.service.js.map +1 -1
  80. package/dist/esm/base-classes/services/services/resource-operation-implementation-coverage.backend.utils.d.ts +3 -26
  81. package/dist/esm/base-classes/services/services/resource-operation-implementation-coverage.backend.utils.d.ts.map +1 -1
  82. package/dist/esm/base-classes/services/services/resource-operation-implementation-coverage.backend.utils.js +3 -68
  83. package/dist/esm/base-classes/services/services/resource-operation-implementation-coverage.backend.utils.js.map +1 -1
  84. package/dist/esm/base-classes/services/services/resource-status-transition.custom-impl.backend.service.d.ts.map +1 -1
  85. package/dist/esm/base-classes/services/services/resource-status-transition.custom-impl.backend.service.js +4 -1
  86. package/dist/esm/base-classes/services/services/resource-status-transition.custom-impl.backend.service.js.map +1 -1
  87. package/dist/esm/base-classes/services/services/resource-status-transition.definitions.backend.d.ts +11 -0
  88. package/dist/esm/base-classes/services/services/resource-status-transition.definitions.backend.d.ts.map +1 -1
  89. package/dist/esm/base-classes/services/services/resource-status-transition.definitions.backend.js +39 -5
  90. package/dist/esm/base-classes/services/services/resource-status-transition.definitions.backend.js.map +1 -1
  91. package/dist/esm/base-classes/services/services/services-registry-handler.backend.service.d.ts +181 -2
  92. package/dist/esm/base-classes/services/services/services-registry-handler.backend.service.d.ts.map +1 -1
  93. package/dist/esm/base-classes/services/services/services-registry-handler.backend.service.js +533 -43
  94. package/dist/esm/base-classes/services/services/services-registry-handler.backend.service.js.map +1 -1
  95. package/dist/esm/base-classes/services/services/system-access.backend.service.d.ts +36 -3
  96. package/dist/esm/base-classes/services/services/system-access.backend.service.d.ts.map +1 -1
  97. package/dist/esm/base-classes/services/services/system-access.backend.service.js +70 -8
  98. package/dist/esm/base-classes/services/services/system-access.backend.service.js.map +1 -1
  99. package/dist/esm/billing/batches/billing-reconciliation.batch.backend.service.d.ts +28 -0
  100. package/dist/esm/billing/batches/billing-reconciliation.batch.backend.service.d.ts.map +1 -0
  101. package/dist/esm/billing/batches/billing-reconciliation.batch.backend.service.js +90 -0
  102. package/dist/esm/billing/batches/billing-reconciliation.batch.backend.service.js.map +1 -0
  103. package/dist/esm/billing/batches/usage-flush.batch.backend.service.d.ts +44 -0
  104. package/dist/esm/billing/batches/usage-flush.batch.backend.service.d.ts.map +1 -0
  105. package/dist/esm/billing/batches/usage-flush.batch.backend.service.js +99 -0
  106. package/dist/esm/billing/batches/usage-flush.batch.backend.service.js.map +1 -0
  107. package/dist/esm/billing/models/billing-provider-event-settlement.backend.schemas.d.ts +91 -0
  108. package/dist/esm/billing/models/billing-provider-event-settlement.backend.schemas.d.ts.map +1 -0
  109. package/dist/esm/billing/models/billing-provider-event-settlement.backend.schemas.js +152 -0
  110. package/dist/esm/billing/models/billing-provider-event-settlement.backend.schemas.js.map +1 -0
  111. package/dist/esm/billing/services/back-office/billing-reconciliation.backend.service.d.ts +186 -0
  112. package/dist/esm/billing/services/back-office/billing-reconciliation.backend.service.d.ts.map +1 -0
  113. package/dist/esm/billing/services/back-office/billing-reconciliation.backend.service.js +474 -0
  114. package/dist/esm/billing/services/back-office/billing-reconciliation.backend.service.js.map +1 -0
  115. package/dist/esm/billing/services/back-office/product-catalog-sync.backend.service.d.ts +100 -0
  116. package/dist/esm/billing/services/back-office/product-catalog-sync.backend.service.d.ts.map +1 -1
  117. package/dist/esm/billing/services/back-office/product-catalog-sync.backend.service.js +209 -6
  118. package/dist/esm/billing/services/back-office/product-catalog-sync.backend.service.js.map +1 -1
  119. package/dist/esm/billing/services/back-office/usage-metering.backend.service.d.ts +200 -4
  120. package/dist/esm/billing/services/back-office/usage-metering.backend.service.d.ts.map +1 -1
  121. package/dist/esm/billing/services/back-office/usage-metering.backend.service.js +593 -64
  122. package/dist/esm/billing/services/back-office/usage-metering.backend.service.js.map +1 -1
  123. package/dist/esm/billing/services/billing-adapter-registry.backend.d.ts +36 -0
  124. package/dist/esm/billing/services/billing-adapter-registry.backend.d.ts.map +1 -0
  125. package/dist/esm/billing/services/billing-adapter-registry.backend.js +83 -0
  126. package/dist/esm/billing/services/billing-adapter-registry.backend.js.map +1 -0
  127. package/dist/esm/billing/services/billing-checkout-metadata.backend.utils.d.ts +9 -0
  128. package/dist/esm/billing/services/billing-checkout-metadata.backend.utils.d.ts.map +1 -1
  129. package/dist/esm/billing/services/billing-checkout-metadata.backend.utils.js +11 -1
  130. package/dist/esm/billing/services/billing-checkout-metadata.backend.utils.js.map +1 -1
  131. package/dist/esm/billing/services/custom-impl/billing-account.mutations.custom-impl.backend.service.d.ts.map +1 -1
  132. package/dist/esm/billing/services/custom-impl/billing-account.mutations.custom-impl.backend.service.js +54 -13
  133. package/dist/esm/billing/services/custom-impl/billing-account.mutations.custom-impl.backend.service.js.map +1 -1
  134. package/dist/esm/billing/services/custom-impl/billing-custom-impl-utils.backend.d.ts +38 -1
  135. package/dist/esm/billing/services/custom-impl/billing-custom-impl-utils.backend.d.ts.map +1 -1
  136. package/dist/esm/billing/services/custom-impl/billing-custom-impl-utils.backend.js +67 -2
  137. package/dist/esm/billing/services/custom-impl/billing-custom-impl-utils.backend.js.map +1 -1
  138. package/dist/esm/billing/services/custom-impl/billing-custom-implementations.backend.d.ts +30 -1
  139. package/dist/esm/billing/services/custom-impl/billing-custom-implementations.backend.d.ts.map +1 -1
  140. package/dist/esm/billing/services/custom-impl/billing-custom-implementations.backend.js +43 -1
  141. package/dist/esm/billing/services/custom-impl/billing-custom-implementations.backend.js.map +1 -1
  142. package/dist/esm/billing/services/custom-impl/promotion.custom-ops.custom-impl.backend.service.d.ts +11 -3
  143. package/dist/esm/billing/services/custom-impl/promotion.custom-ops.custom-impl.backend.service.d.ts.map +1 -1
  144. package/dist/esm/billing/services/custom-impl/promotion.custom-ops.custom-impl.backend.service.js +30 -16
  145. package/dist/esm/billing/services/custom-impl/promotion.custom-ops.custom-impl.backend.service.js.map +1 -1
  146. package/dist/esm/billing/services/custom-impl/subscription.mutations.custom-impl.backend.service.d.ts.map +1 -1
  147. package/dist/esm/billing/services/custom-impl/subscription.mutations.custom-impl.backend.service.js +104 -25
  148. package/dist/esm/billing/services/custom-impl/subscription.mutations.custom-impl.backend.service.js.map +1 -1
  149. package/dist/esm/billing/services/stripe-standard-billing-provider.backend.service.d.ts +18 -1
  150. package/dist/esm/billing/services/stripe-standard-billing-provider.backend.service.d.ts.map +1 -1
  151. package/dist/esm/billing/services/stripe-standard-billing-provider.backend.service.js +106 -2
  152. package/dist/esm/billing/services/stripe-standard-billing-provider.backend.service.js.map +1 -1
  153. package/dist/esm/billing/services/webhooks/__tests__/settlement-ledger.test-double.d.ts +52 -0
  154. package/dist/esm/billing/services/webhooks/__tests__/settlement-ledger.test-double.d.ts.map +1 -0
  155. package/dist/esm/billing/services/webhooks/__tests__/settlement-ledger.test-double.js +74 -0
  156. package/dist/esm/billing/services/webhooks/__tests__/settlement-ledger.test-double.js.map +1 -0
  157. package/dist/esm/billing/services/webhooks/billing-webhook-event-router.backend.service.d.ts +104 -11
  158. package/dist/esm/billing/services/webhooks/billing-webhook-event-router.backend.service.d.ts.map +1 -1
  159. package/dist/esm/billing/services/webhooks/billing-webhook-event-router.backend.service.js +260 -26
  160. package/dist/esm/billing/services/webhooks/billing-webhook-event-router.backend.service.js.map +1 -1
  161. package/dist/esm/billing/testing/mock-billing-provider.d.ts +30 -1
  162. package/dist/esm/billing/testing/mock-billing-provider.d.ts.map +1 -1
  163. package/dist/esm/billing/testing/mock-billing-provider.js +25 -0
  164. package/dist/esm/billing/testing/mock-billing-provider.js.map +1 -1
  165. package/dist/esm/compliance/audit-trails/batches/audit-logs-archive.batch.backend.service.js +11 -4
  166. package/dist/esm/compliance/audit-trails/batches/audit-logs-archive.batch.backend.service.js.map +1 -1
  167. package/dist/esm/compliance/audit-trails/services/audit-event-dispatcher.backend.service.d.ts +263 -13
  168. package/dist/esm/compliance/audit-trails/services/audit-event-dispatcher.backend.service.d.ts.map +1 -1
  169. package/dist/esm/compliance/audit-trails/services/audit-event-dispatcher.backend.service.js +376 -58
  170. package/dist/esm/compliance/audit-trails/services/audit-event-dispatcher.backend.service.js.map +1 -1
  171. package/dist/esm/compliance/audit-trails/services/audit-logs.backend.service.d.ts +264 -7
  172. package/dist/esm/compliance/audit-trails/services/audit-logs.backend.service.d.ts.map +1 -1
  173. package/dist/esm/compliance/audit-trails/services/audit-logs.backend.service.js +414 -5
  174. package/dist/esm/compliance/audit-trails/services/audit-logs.backend.service.js.map +1 -1
  175. package/dist/esm/compliance/audit-trails/services/composite-audit-log-sink.backend.d.ts.map +1 -1
  176. package/dist/esm/compliance/audit-trails/services/composite-audit-log-sink.backend.js +7 -1
  177. package/dist/esm/compliance/audit-trails/services/composite-audit-log-sink.backend.js.map +1 -1
  178. package/dist/esm/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.d.ts +16 -0
  179. package/dist/esm/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.d.ts.map +1 -0
  180. package/dist/esm/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.js +140 -0
  181. package/dist/esm/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.js.map +1 -0
  182. package/dist/esm/compliance/audit-trails/services/siem-webhook-delivery.backend.service.d.ts +42 -0
  183. package/dist/esm/compliance/audit-trails/services/siem-webhook-delivery.backend.service.d.ts.map +1 -1
  184. package/dist/esm/compliance/audit-trails/services/siem-webhook-delivery.backend.service.js +65 -6
  185. package/dist/esm/compliance/audit-trails/services/siem-webhook-delivery.backend.service.js.map +1 -1
  186. package/dist/esm/compliance/audit-trails/services/utils/leased-value-cache.backend.utils.d.ts +110 -0
  187. package/dist/esm/compliance/audit-trails/services/utils/leased-value-cache.backend.utils.d.ts.map +1 -0
  188. package/dist/esm/compliance/audit-trails/services/utils/leased-value-cache.backend.utils.js +192 -0
  189. package/dist/esm/compliance/audit-trails/services/utils/leased-value-cache.backend.utils.js.map +1 -0
  190. package/dist/esm/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.d.ts.map +1 -1
  191. package/dist/esm/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.js +45 -0
  192. package/dist/esm/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.js.map +1 -1
  193. package/dist/esm/config/bootstrap/application-runtime-profile.backend.d.ts +5 -0
  194. package/dist/esm/config/bootstrap/application-runtime-profile.backend.d.ts.map +1 -1
  195. package/dist/esm/config/bootstrap/application-runtime-profile.backend.js +6 -0
  196. package/dist/esm/config/bootstrap/application-runtime-profile.backend.js.map +1 -1
  197. package/dist/esm/config/custom/application-config-controller.backend.service.d.ts.map +1 -1
  198. package/dist/esm/config/custom/application-config-controller.backend.service.js +7 -1
  199. package/dist/esm/config/custom/application-config-controller.backend.service.js.map +1 -1
  200. package/dist/esm/config/models/app-config.backend.schemas.d.ts +146 -46
  201. package/dist/esm/config/models/app-config.backend.schemas.d.ts.map +1 -1
  202. package/dist/esm/config/models/app-config.backend.schemas.js +121 -12
  203. package/dist/esm/config/models/app-config.backend.schemas.js.map +1 -1
  204. package/dist/esm/config/models/provider-runtime-artifact.backend.schemas.d.ts +38 -15
  205. package/dist/esm/config/models/provider-runtime-artifact.backend.schemas.d.ts.map +1 -1
  206. package/dist/esm/config/models/provider-runtime-artifact.backend.schemas.js +17 -2
  207. package/dist/esm/config/models/provider-runtime-artifact.backend.schemas.js.map +1 -1
  208. package/dist/esm/config/services/app-configuration-loader.backend.service.d.ts +0 -1
  209. package/dist/esm/config/services/app-configuration-loader.backend.service.d.ts.map +1 -1
  210. package/dist/esm/config/services/app-configuration-loader.backend.service.js +68 -76
  211. package/dist/esm/config/services/app-configuration-loader.backend.service.js.map +1 -1
  212. package/dist/esm/config/services/app-configuration.backend.service.d.ts.map +1 -1
  213. package/dist/esm/config/services/app-configuration.backend.service.js +23 -1
  214. package/dist/esm/config/services/app-configuration.backend.service.js.map +1 -1
  215. package/dist/esm/config/services/app-configuration.backend.utils.d.ts +43 -1
  216. package/dist/esm/config/services/app-configuration.backend.utils.d.ts.map +1 -1
  217. package/dist/esm/config/services/app-configuration.backend.utils.js +52 -3
  218. package/dist/esm/config/services/app-configuration.backend.utils.js.map +1 -1
  219. package/dist/esm/config/services/application-startup-config-validator.backend.service.d.ts +25 -0
  220. package/dist/esm/config/services/application-startup-config-validator.backend.service.d.ts.map +1 -1
  221. package/dist/esm/config/services/application-startup-config-validator.backend.service.js +41 -1
  222. package/dist/esm/config/services/application-startup-config-validator.backend.service.js.map +1 -1
  223. package/dist/esm/data-seeding/services/shared/data-seed-scope-iteration.shared.utils.d.ts +2 -2
  224. package/dist/esm/data-seeding/services/shared/data-seed-scope-iteration.shared.utils.js +2 -2
  225. package/dist/esm/data-seeding/services/shared/data-seed-scope-iteration.shared.utils.js.map +1 -1
  226. package/dist/esm/databases/models/filter.backend.schemas.js +2 -2
  227. package/dist/esm/databases/models/filter.backend.schemas.js.map +1 -1
  228. package/dist/esm/databases/services/aggregation/aggregation-authorization.backend.service.d.ts.map +1 -1
  229. package/dist/esm/databases/services/aggregation/aggregation-authorization.backend.service.js +20 -1
  230. package/dist/esm/databases/services/aggregation/aggregation-authorization.backend.service.js.map +1 -1
  231. package/dist/esm/databases/services/postgresql-schema-plan-diff.backend.d.ts.map +1 -1
  232. package/dist/esm/databases/services/postgresql-schema-plan-diff.backend.js +48 -0
  233. package/dist/esm/databases/services/postgresql-schema-plan-diff.backend.js.map +1 -1
  234. package/dist/esm/databases/services/redis.service.d.ts +27 -0
  235. package/dist/esm/databases/services/redis.service.d.ts.map +1 -1
  236. package/dist/esm/databases/services/redis.service.js +29 -0
  237. package/dist/esm/databases/services/redis.service.js.map +1 -1
  238. package/dist/esm/errors/services/error-builder.backend.service.d.ts +13 -1
  239. package/dist/esm/errors/services/error-builder.backend.service.d.ts.map +1 -1
  240. package/dist/esm/errors/services/error-builder.backend.service.js +13 -1
  241. package/dist/esm/errors/services/error-builder.backend.service.js.map +1 -1
  242. package/dist/esm/errors/services/error-handler.backend.service.d.ts +70 -7
  243. package/dist/esm/errors/services/error-handler.backend.service.d.ts.map +1 -1
  244. package/dist/esm/errors/services/error-handler.backend.service.js +134 -8
  245. package/dist/esm/errors/services/error-handler.backend.service.js.map +1 -1
  246. package/dist/esm/errors/services/rate-limit.backend.service.d.ts +66 -0
  247. package/dist/esm/errors/services/rate-limit.backend.service.d.ts.map +1 -1
  248. package/dist/esm/errors/services/rate-limit.backend.service.js +102 -25
  249. package/dist/esm/errors/services/rate-limit.backend.service.js.map +1 -1
  250. package/dist/esm/errors/utils/error-log-level-classification.backend.utils.d.ts +5 -0
  251. package/dist/esm/errors/utils/error-log-level-classification.backend.utils.d.ts.map +1 -1
  252. package/dist/esm/errors/utils/error-log-level-classification.backend.utils.js +25 -0
  253. package/dist/esm/errors/utils/error-log-level-classification.backend.utils.js.map +1 -1
  254. package/dist/esm/errors/utils/rate-limit-environment-relaxation.backend.utils.d.ts +33 -0
  255. package/dist/esm/errors/utils/rate-limit-environment-relaxation.backend.utils.d.ts.map +1 -1
  256. package/dist/esm/errors/utils/rate-limit-environment-relaxation.backend.utils.js +40 -0
  257. package/dist/esm/errors/utils/rate-limit-environment-relaxation.backend.utils.js.map +1 -1
  258. package/dist/esm/external-data/controllers/external-data-admin.backend.contracts.d.ts +41 -0
  259. package/dist/esm/external-data/controllers/external-data-admin.backend.contracts.d.ts.map +1 -0
  260. package/dist/esm/external-data/controllers/external-data-admin.backend.contracts.js +40 -0
  261. package/dist/esm/external-data/controllers/external-data-admin.backend.contracts.js.map +1 -0
  262. package/dist/esm/external-data/controllers/external-data-admin.backend.controller.d.ts +64 -0
  263. package/dist/esm/external-data/controllers/external-data-admin.backend.controller.d.ts.map +1 -0
  264. package/dist/esm/external-data/controllers/external-data-admin.backend.controller.js +193 -0
  265. package/dist/esm/external-data/controllers/external-data-admin.backend.controller.js.map +1 -0
  266. package/dist/esm/external-data/external-data-pipeline-run.backend.service.d.ts +72 -4
  267. package/dist/esm/external-data/external-data-pipeline-run.backend.service.d.ts.map +1 -1
  268. package/dist/esm/external-data/external-data-pipeline-run.backend.service.js +60 -19
  269. package/dist/esm/external-data/external-data-pipeline-run.backend.service.js.map +1 -1
  270. package/dist/esm/external-data/external-data-transform.backend.d.ts.map +1 -1
  271. package/dist/esm/external-data/external-data-transform.backend.js +7 -1
  272. package/dist/esm/external-data/external-data-transform.backend.js.map +1 -1
  273. package/dist/esm/external-data/models/external-data-pipeline-state.backend.schemas.d.ts +2 -0
  274. package/dist/esm/external-data/models/external-data-pipeline-state.backend.schemas.d.ts.map +1 -1
  275. package/dist/esm/external-data/models/external-data-pipeline-state.backend.schemas.js +13 -0
  276. package/dist/esm/external-data/models/external-data-pipeline-state.backend.schemas.js.map +1 -1
  277. package/dist/esm/external-providers/models/provider-selection-resolution-evidence.backend.definitions.d.ts +4 -2
  278. package/dist/esm/external-providers/models/provider-selection-resolution-evidence.backend.definitions.d.ts.map +1 -1
  279. package/dist/esm/external-providers/models/provider-selection-resolution-evidence.backend.definitions.js.map +1 -1
  280. package/dist/esm/external-providers/operations/provider-operation-executor.backend.service.d.ts +256 -0
  281. package/dist/esm/external-providers/operations/provider-operation-executor.backend.service.d.ts.map +1 -0
  282. package/dist/esm/external-providers/operations/provider-operation-executor.backend.service.js +333 -0
  283. package/dist/esm/external-providers/operations/provider-operation-executor.backend.service.js.map +1 -0
  284. package/dist/esm/external-providers/operations/provider-operation-request.backend.d.ts +56 -0
  285. package/dist/esm/external-providers/operations/provider-operation-request.backend.d.ts.map +1 -0
  286. package/dist/esm/external-providers/operations/provider-operation-request.backend.js +211 -0
  287. package/dist/esm/external-providers/operations/provider-operation-request.backend.js.map +1 -0
  288. package/dist/esm/external-providers/operations/provider-request-signing.backend.d.ts +45 -0
  289. package/dist/esm/external-providers/operations/provider-request-signing.backend.d.ts.map +1 -0
  290. package/dist/esm/external-providers/operations/provider-request-signing.backend.js +216 -0
  291. package/dist/esm/external-providers/operations/provider-request-signing.backend.js.map +1 -0
  292. package/dist/esm/external-providers/operations/provider-rest-call-client.backend.d.ts +56 -0
  293. package/dist/esm/external-providers/operations/provider-rest-call-client.backend.d.ts.map +1 -0
  294. package/dist/esm/external-providers/operations/provider-rest-call-client.backend.js +78 -0
  295. package/dist/esm/external-providers/operations/provider-rest-call-client.backend.js.map +1 -0
  296. package/dist/esm/external-providers/services/__tests__/mock-external-providers-registry.service.d.ts +1 -1
  297. package/dist/esm/external-providers/services/__tests__/mock-external-providers-registry.service.d.ts.map +1 -1
  298. package/dist/esm/external-providers/services/__tests__/mock-external-providers-registry.service.js +2 -2
  299. package/dist/esm/external-providers/services/__tests__/mock-external-providers-registry.service.js.map +1 -1
  300. package/dist/esm/external-providers/services/backend-provider-loader.backend.service.d.ts +89 -0
  301. package/dist/esm/external-providers/services/backend-provider-loader.backend.service.d.ts.map +1 -0
  302. package/dist/esm/external-providers/services/backend-provider-loader.backend.service.js +164 -0
  303. package/dist/esm/external-providers/services/backend-provider-loader.backend.service.js.map +1 -0
  304. package/dist/esm/external-providers/services/backend-provider-registry.backend.service.d.ts +26 -27
  305. package/dist/esm/external-providers/services/backend-provider-registry.backend.service.d.ts.map +1 -1
  306. package/dist/esm/external-providers/services/backend-provider-registry.backend.service.js +50 -64
  307. package/dist/esm/external-providers/services/backend-provider-registry.backend.service.js.map +1 -1
  308. package/dist/esm/external-providers/services/document-extraction.backend.service.d.ts.map +1 -1
  309. package/dist/esm/external-providers/services/document-extraction.backend.service.js +3 -3
  310. package/dist/esm/external-providers/services/document-extraction.backend.service.js.map +1 -1
  311. package/dist/esm/external-providers/services/embeddings.backend.service.d.ts.map +1 -1
  312. package/dist/esm/external-providers/services/embeddings.backend.service.js +4 -4
  313. package/dist/esm/external-providers/services/embeddings.backend.service.js.map +1 -1
  314. package/dist/esm/external-providers/services/external-providers-registry.backend.service.d.ts +306 -7
  315. package/dist/esm/external-providers/services/external-providers-registry.backend.service.d.ts.map +1 -1
  316. package/dist/esm/external-providers/services/external-providers-registry.backend.service.js +539 -45
  317. package/dist/esm/external-providers/services/external-providers-registry.backend.service.js.map +1 -1
  318. package/dist/esm/external-providers/services/frontend-bootstrap.backend.service.d.ts.map +1 -1
  319. package/dist/esm/external-providers/services/frontend-bootstrap.backend.service.js +25 -2
  320. package/dist/esm/external-providers/services/frontend-bootstrap.backend.service.js.map +1 -1
  321. package/dist/esm/files/controllers/file.controller.d.ts +24 -1
  322. package/dist/esm/files/controllers/file.controller.d.ts.map +1 -1
  323. package/dist/esm/files/controllers/file.controller.js +83 -11
  324. package/dist/esm/files/controllers/file.controller.js.map +1 -1
  325. package/dist/esm/files/handlers/file-upload-route-locals.backend.types.d.ts +17 -0
  326. package/dist/esm/files/handlers/file-upload-route-locals.backend.types.d.ts.map +1 -0
  327. package/dist/esm/files/handlers/file-upload-route-locals.backend.types.js +1 -0
  328. package/dist/esm/files/handlers/file-upload-route-locals.backend.types.js.map +1 -0
  329. package/dist/esm/files/handlers/resource-file-upload-handler.backend.service.d.ts +5 -1
  330. package/dist/esm/files/handlers/resource-file-upload-handler.backend.service.d.ts.map +1 -1
  331. package/dist/esm/files/handlers/resource-file-upload-handler.backend.service.js +76 -13
  332. package/dist/esm/files/handlers/resource-file-upload-handler.backend.service.js.map +1 -1
  333. package/dist/esm/files/services/file-operation-handler.backend.service.d.ts +18 -0
  334. package/dist/esm/files/services/file-operation-handler.backend.service.d.ts.map +1 -1
  335. package/dist/esm/files/services/file-operation-handler.backend.service.js +36 -28
  336. package/dist/esm/files/services/file-operation-handler.backend.service.js.map +1 -1
  337. package/dist/esm/files/services/file-scanning.backend.service.d.ts +94 -9
  338. package/dist/esm/files/services/file-scanning.backend.service.d.ts.map +1 -1
  339. package/dist/esm/files/services/file-scanning.backend.service.js +197 -17
  340. package/dist/esm/files/services/file-scanning.backend.service.js.map +1 -1
  341. package/dist/esm/files/services/file-text-extraction.backend.service.d.ts +60 -1
  342. package/dist/esm/files/services/file-text-extraction.backend.service.d.ts.map +1 -1
  343. package/dist/esm/files/services/file-text-extraction.backend.service.js +167 -8
  344. package/dist/esm/files/services/file-text-extraction.backend.service.js.map +1 -1
  345. package/dist/esm/files/services/file-upload-grant.backend.service.d.ts +214 -0
  346. package/dist/esm/files/services/file-upload-grant.backend.service.d.ts.map +1 -0
  347. package/dist/esm/files/services/file-upload-grant.backend.service.js +566 -0
  348. package/dist/esm/files/services/file-upload-grant.backend.service.js.map +1 -0
  349. package/dist/esm/files/services/files.backend.service.d.ts +87 -0
  350. package/dist/esm/files/services/files.backend.service.d.ts.map +1 -1
  351. package/dist/esm/files/services/files.backend.service.js +252 -19
  352. package/dist/esm/files/services/files.backend.service.js.map +1 -1
  353. package/dist/esm/files/storage/application-storage-key.backend.utils.d.ts +109 -0
  354. package/dist/esm/files/storage/application-storage-key.backend.utils.d.ts.map +1 -0
  355. package/dist/esm/files/storage/application-storage-key.backend.utils.js +123 -0
  356. package/dist/esm/files/storage/application-storage-key.backend.utils.js.map +1 -0
  357. package/dist/esm/files/storage/file-storage-provider.types.d.ts +16 -10
  358. package/dist/esm/files/storage/file-storage-provider.types.d.ts.map +1 -1
  359. package/dist/esm/files/storage/file-storage-provider.types.js.map +1 -1
  360. package/dist/esm/files/storage/local-directory-storage-provider.backend.service.d.ts +67 -8
  361. package/dist/esm/files/storage/local-directory-storage-provider.backend.service.d.ts.map +1 -1
  362. package/dist/esm/files/storage/local-directory-storage-provider.backend.service.js +101 -28
  363. package/dist/esm/files/storage/local-directory-storage-provider.backend.service.js.map +1 -1
  364. package/dist/esm/files/storage/wildo-managed-storage-provider.backend.service.d.ts.map +1 -1
  365. package/dist/esm/files/storage/wildo-managed-storage-provider.backend.service.js +8 -55
  366. package/dist/esm/files/storage/wildo-managed-storage-provider.backend.service.js.map +1 -1
  367. package/dist/esm/files/utils/file-field-schema-path.backend.utils.d.ts.map +1 -1
  368. package/dist/esm/files/utils/file-field-schema-path.backend.utils.js +20 -0
  369. package/dist/esm/files/utils/file-field-schema-path.backend.utils.js.map +1 -1
  370. package/dist/esm/files/utils/file-uploader.utils.d.ts.map +1 -1
  371. package/dist/esm/files/utils/file-uploader.utils.js +12 -0
  372. package/dist/esm/files/utils/file-uploader.utils.js.map +1 -1
  373. package/dist/esm/files/utils/office-document-text-extraction.backend.utils.d.ts +86 -0
  374. package/dist/esm/files/utils/office-document-text-extraction.backend.utils.d.ts.map +1 -0
  375. package/dist/esm/files/utils/office-document-text-extraction.backend.utils.js +288 -0
  376. package/dist/esm/files/utils/office-document-text-extraction.backend.utils.js.map +1 -0
  377. package/dist/esm/flows-actors/a2a/batches/a2a-abandoned-task-sweep.batch.backend.service.d.ts +15 -0
  378. package/dist/esm/flows-actors/a2a/batches/a2a-abandoned-task-sweep.batch.backend.service.d.ts.map +1 -1
  379. package/dist/esm/flows-actors/a2a/batches/a2a-abandoned-task-sweep.batch.backend.service.js +76 -5
  380. package/dist/esm/flows-actors/a2a/batches/a2a-abandoned-task-sweep.batch.backend.service.js.map +1 -1
  381. package/dist/esm/flows-actors/a2a/controllers/a2a.controller.d.ts.map +1 -1
  382. package/dist/esm/flows-actors/a2a/controllers/a2a.controller.js +6 -1
  383. package/dist/esm/flows-actors/a2a/controllers/a2a.controller.js.map +1 -1
  384. package/dist/esm/flows-actors/a2a/models/a2a.backend.schemas.d.ts +60 -0
  385. package/dist/esm/flows-actors/a2a/models/a2a.backend.schemas.d.ts.map +1 -1
  386. package/dist/esm/flows-actors/a2a/models/a2a.backend.schemas.js +63 -0
  387. package/dist/esm/flows-actors/a2a/models/a2a.backend.schemas.js.map +1 -1
  388. package/dist/esm/flows-actors/a2a/services/a2a-task-cancellation.backend.service.d.ts +74 -0
  389. package/dist/esm/flows-actors/a2a/services/a2a-task-cancellation.backend.service.d.ts.map +1 -1
  390. package/dist/esm/flows-actors/a2a/services/a2a-task-cancellation.backend.service.js +200 -44
  391. package/dist/esm/flows-actors/a2a/services/a2a-task-cancellation.backend.service.js.map +1 -1
  392. package/dist/esm/flows-actors/a2a/services/a2a-task.backend.service.d.ts +7 -1
  393. package/dist/esm/flows-actors/a2a/services/a2a-task.backend.service.d.ts.map +1 -1
  394. package/dist/esm/flows-actors/a2a/services/a2a-task.backend.service.js +53 -1
  395. package/dist/esm/flows-actors/a2a/services/a2a-task.backend.service.js.map +1 -1
  396. package/dist/esm/flows-actors/a2a/services/a2a-token-budget.backend.service.d.ts +18 -0
  397. package/dist/esm/flows-actors/a2a/services/a2a-token-budget.backend.service.d.ts.map +1 -1
  398. package/dist/esm/flows-actors/a2a/services/a2a-token-budget.backend.service.js +18 -0
  399. package/dist/esm/flows-actors/a2a/services/a2a-token-budget.backend.service.js.map +1 -1
  400. package/dist/esm/flows-actors/a2a/services/a2a.backend.service.d.ts +12 -7
  401. package/dist/esm/flows-actors/a2a/services/a2a.backend.service.d.ts.map +1 -1
  402. package/dist/esm/flows-actors/a2a/services/a2a.backend.service.js.map +1 -1
  403. package/dist/esm/flows-actors/models/agent-catalogs.backend.definitions.d.ts +0 -13
  404. package/dist/esm/flows-actors/models/agent-catalogs.backend.definitions.d.ts.map +1 -1
  405. package/dist/esm/flows-actors/models/agent-catalogs.backend.definitions.js +14 -22
  406. package/dist/esm/flows-actors/models/agent-catalogs.backend.definitions.js.map +1 -1
  407. package/dist/esm/flows-actors/models/core-facets.backend.definitions.d.ts +8 -3
  408. package/dist/esm/flows-actors/models/core-facets.backend.definitions.d.ts.map +1 -1
  409. package/dist/esm/flows-actors/models/core-facets.backend.definitions.js +25 -15
  410. package/dist/esm/flows-actors/models/core-facets.backend.definitions.js.map +1 -1
  411. package/dist/esm/flows-actors/models/flows-actors.backend.schemas.d.ts +13 -1
  412. package/dist/esm/flows-actors/models/flows-actors.backend.schemas.d.ts.map +1 -1
  413. package/dist/esm/flows-actors/models/flows-actors.backend.schemas.js.map +1 -1
  414. package/dist/esm/flows-actors/models/function-tools.backend.definitions.d.ts +88 -8
  415. package/dist/esm/flows-actors/models/function-tools.backend.definitions.d.ts.map +1 -1
  416. package/dist/esm/flows-actors/models/function-tools.backend.definitions.js +333 -31
  417. package/dist/esm/flows-actors/models/function-tools.backend.definitions.js.map +1 -1
  418. package/dist/esm/flows-actors/models/market-generation.actors-system.backend.definitions.d.ts.map +1 -1
  419. package/dist/esm/flows-actors/models/market-generation.actors-system.backend.definitions.js +4 -2
  420. package/dist/esm/flows-actors/models/market-generation.actors-system.backend.definitions.js.map +1 -1
  421. package/dist/esm/flows-actors/models/mcp-client.backend.definitions.d.ts +113 -0
  422. package/dist/esm/flows-actors/models/mcp-client.backend.definitions.d.ts.map +1 -0
  423. package/dist/esm/flows-actors/models/mcp-client.backend.definitions.js +62 -0
  424. package/dist/esm/flows-actors/models/mcp-client.backend.definitions.js.map +1 -0
  425. package/dist/esm/flows-actors/services/actors-system.backend.service.d.ts.map +1 -1
  426. package/dist/esm/flows-actors/services/actors-system.backend.service.js +0 -2
  427. package/dist/esm/flows-actors/services/actors-system.backend.service.js.map +1 -1
  428. package/dist/esm/flows-actors/services/agents.backend.service.d.ts +107 -1
  429. package/dist/esm/flows-actors/services/agents.backend.service.d.ts.map +1 -1
  430. package/dist/esm/flows-actors/services/agents.backend.service.js +519 -56
  431. package/dist/esm/flows-actors/services/agents.backend.service.js.map +1 -1
  432. package/dist/esm/flows-actors/services/conversational-execution.backend.service.d.ts +5 -1
  433. package/dist/esm/flows-actors/services/conversational-execution.backend.service.d.ts.map +1 -1
  434. package/dist/esm/flows-actors/services/conversational-execution.backend.service.js +79 -16
  435. package/dist/esm/flows-actors/services/conversational-execution.backend.service.js.map +1 -1
  436. package/dist/esm/flows-actors/services/flows-actors-registry.service.d.ts +34 -5
  437. package/dist/esm/flows-actors/services/flows-actors-registry.service.d.ts.map +1 -1
  438. package/dist/esm/flows-actors/services/flows-actors-registry.service.js +154 -20
  439. package/dist/esm/flows-actors/services/flows-actors-registry.service.js.map +1 -1
  440. package/dist/esm/flows-actors/services/flows.backend.services.d.ts.map +1 -1
  441. package/dist/esm/flows-actors/services/flows.backend.services.js +27 -23
  442. package/dist/esm/flows-actors/services/flows.backend.services.js.map +1 -1
  443. package/dist/esm/flows-actors/services/llm-observability-agent-call-trace-sink.backend.d.ts.map +1 -1
  444. package/dist/esm/flows-actors/services/llm-observability-agent-call-trace-sink.backend.js +7 -1
  445. package/dist/esm/flows-actors/services/llm-observability-agent-call-trace-sink.backend.js.map +1 -1
  446. package/dist/esm/flows-actors/services/mcp-client.backend.service.d.ts +90 -0
  447. package/dist/esm/flows-actors/services/mcp-client.backend.service.d.ts.map +1 -0
  448. package/dist/esm/flows-actors/services/mcp-client.backend.service.js +368 -0
  449. package/dist/esm/flows-actors/services/mcp-client.backend.service.js.map +1 -0
  450. package/dist/esm/flows-actors/services/prompt-compiler.backend.service.d.ts +9 -5
  451. package/dist/esm/flows-actors/services/prompt-compiler.backend.service.d.ts.map +1 -1
  452. package/dist/esm/flows-actors/services/prompt-compiler.backend.service.js +12 -17
  453. package/dist/esm/flows-actors/services/prompt-compiler.backend.service.js.map +1 -1
  454. package/dist/esm/flows-actors/utils/acp-session-runner.backend.utils.d.ts +151 -41
  455. package/dist/esm/flows-actors/utils/acp-session-runner.backend.utils.d.ts.map +1 -1
  456. package/dist/esm/flows-actors/utils/acp-session-runner.backend.utils.js +308 -143
  457. package/dist/esm/flows-actors/utils/acp-session-runner.backend.utils.js.map +1 -1
  458. package/dist/esm/flows-actors/utils/meta-workflow-canonical-json.backend.utils.d.ts +0 -207
  459. package/dist/esm/flows-actors/utils/meta-workflow-canonical-json.backend.utils.d.ts.map +1 -1
  460. package/dist/esm/flows-actors/utils/meta-workflow-canonical-json.backend.utils.js +8 -243
  461. package/dist/esm/flows-actors/utils/meta-workflow-canonical-json.backend.utils.js.map +1 -1
  462. package/dist/esm/flows-actors/utils/meta-workflow-structured-generation-plan.backend.utils.d.ts.map +1 -1
  463. package/dist/esm/flows-actors/utils/meta-workflow-structured-generation-plan.backend.utils.js.map +1 -1
  464. package/dist/esm/guidance/services/milestone-evaluator.backend.service.d.ts +9 -14
  465. package/dist/esm/guidance/services/milestone-evaluator.backend.service.d.ts.map +1 -1
  466. package/dist/esm/guidance/services/milestone-evaluator.backend.service.js +18 -89
  467. package/dist/esm/guidance/services/milestone-evaluator.backend.service.js.map +1 -1
  468. package/dist/esm/guidance/services/progression-state-store.backend.service.d.ts +86 -0
  469. package/dist/esm/guidance/services/progression-state-store.backend.service.d.ts.map +1 -0
  470. package/dist/esm/guidance/services/progression-state-store.backend.service.js +155 -0
  471. package/dist/esm/guidance/services/progression-state-store.backend.service.js.map +1 -0
  472. package/dist/esm/i18n/controllers/i18n-controller.backend.service.d.ts +10 -0
  473. package/dist/esm/i18n/controllers/i18n-controller.backend.service.d.ts.map +1 -1
  474. package/dist/esm/i18n/controllers/i18n-controller.backend.service.js +55 -5
  475. package/dist/esm/i18n/controllers/i18n-controller.backend.service.js.map +1 -1
  476. package/dist/esm/index.d.ts +15 -5
  477. package/dist/esm/index.d.ts.map +1 -1
  478. package/dist/esm/index.js +45 -5
  479. package/dist/esm/index.js.map +1 -1
  480. package/dist/esm/inject/models/container.d.ts.map +1 -1
  481. package/dist/esm/inject/models/container.js +82 -10
  482. package/dist/esm/inject/models/container.js.map +1 -1
  483. package/dist/esm/inject/models/service-types.d.ts +20 -3
  484. package/dist/esm/inject/models/service-types.d.ts.map +1 -1
  485. package/dist/esm/inject/models/service-types.js +21 -3
  486. package/dist/esm/inject/models/service-types.js.map +1 -1
  487. package/dist/esm/mcp/controllers/mcp.controller.d.ts.map +1 -1
  488. package/dist/esm/mcp/controllers/mcp.controller.js +32 -4
  489. package/dist/esm/mcp/controllers/mcp.controller.js.map +1 -1
  490. package/dist/esm/mcp/models/mcp-tool.backend.schemas.d.ts +34 -0
  491. package/dist/esm/mcp/models/mcp-tool.backend.schemas.d.ts.map +1 -1
  492. package/dist/esm/mcp/models/mcp-tool.backend.schemas.js +42 -0
  493. package/dist/esm/mcp/models/mcp-tool.backend.schemas.js.map +1 -1
  494. package/dist/esm/mcp/services/mcp-server.backend.service.d.ts +84 -1
  495. package/dist/esm/mcp/services/mcp-server.backend.service.d.ts.map +1 -1
  496. package/dist/esm/mcp/services/mcp-server.backend.service.js +235 -11
  497. package/dist/esm/mcp/services/mcp-server.backend.service.js.map +1 -1
  498. package/dist/esm/mcp/services/mcp-tool-adapter.backend.service.d.ts +64 -2
  499. package/dist/esm/mcp/services/mcp-tool-adapter.backend.service.d.ts.map +1 -1
  500. package/dist/esm/mcp/services/mcp-tool-adapter.backend.service.js +152 -6
  501. package/dist/esm/mcp/services/mcp-tool-adapter.backend.service.js.map +1 -1
  502. package/dist/esm/monitoring/analytics/controllers/analytics.backend.controller.d.ts.map +1 -1
  503. package/dist/esm/monitoring/analytics/controllers/analytics.backend.controller.js +49 -4
  504. package/dist/esm/monitoring/analytics/controllers/analytics.backend.controller.js.map +1 -1
  505. package/dist/esm/monitoring/analytics/services/value-moment-definition-registry.backend.service.d.ts +66 -0
  506. package/dist/esm/monitoring/analytics/services/value-moment-definition-registry.backend.service.d.ts.map +1 -0
  507. package/dist/esm/monitoring/analytics/services/value-moment-definition-registry.backend.service.js +199 -0
  508. package/dist/esm/monitoring/analytics/services/value-moment-definition-registry.backend.service.js.map +1 -0
  509. package/dist/esm/monitoring/analytics/services/value-moment-engine.backend.service.d.ts +149 -13
  510. package/dist/esm/monitoring/analytics/services/value-moment-engine.backend.service.d.ts.map +1 -1
  511. package/dist/esm/monitoring/analytics/services/value-moment-engine.backend.service.js +411 -19
  512. package/dist/esm/monitoring/analytics/services/value-moment-engine.backend.service.js.map +1 -1
  513. package/dist/esm/monitoring/analytics/services/value-moment-handler-registry.backend.service.d.ts +11 -2
  514. package/dist/esm/monitoring/analytics/services/value-moment-handler-registry.backend.service.d.ts.map +1 -1
  515. package/dist/esm/monitoring/analytics/services/value-moment-handler-registry.backend.service.js.map +1 -1
  516. package/dist/esm/monitoring/logger/models/logger.backend.schemas.d.ts +28 -9
  517. package/dist/esm/monitoring/logger/models/logger.backend.schemas.d.ts.map +1 -1
  518. package/dist/esm/monitoring/logger/models/logger.backend.schemas.js +30 -10
  519. package/dist/esm/monitoring/logger/models/logger.backend.schemas.js.map +1 -1
  520. package/dist/esm/monitoring/logger/services/logger.service.d.ts +12 -0
  521. package/dist/esm/monitoring/logger/services/logger.service.d.ts.map +1 -1
  522. package/dist/esm/monitoring/logger/services/logger.service.js +52 -11
  523. package/dist/esm/monitoring/logger/services/logger.service.js.map +1 -1
  524. package/dist/esm/monitoring/logger/utils/log-severity-floor.backend.utils.d.ts +62 -0
  525. package/dist/esm/monitoring/logger/utils/log-severity-floor.backend.utils.d.ts.map +1 -0
  526. package/dist/esm/monitoring/logger/utils/log-severity-floor.backend.utils.js +78 -0
  527. package/dist/esm/monitoring/logger/utils/log-severity-floor.backend.utils.js.map +1 -0
  528. package/dist/esm/monitoring/observability/audit-observation-emission.backend.d.ts +309 -0
  529. package/dist/esm/monitoring/observability/audit-observation-emission.backend.d.ts.map +1 -0
  530. package/dist/esm/monitoring/observability/audit-observation-emission.backend.js +385 -0
  531. package/dist/esm/monitoring/observability/audit-observation-emission.backend.js.map +1 -0
  532. package/dist/esm/monitoring/observability/models/observability.backend.schemas.d.ts +1 -0
  533. package/dist/esm/monitoring/observability/models/observability.backend.schemas.d.ts.map +1 -1
  534. package/dist/esm/monitoring/observability/models/observability.backend.schemas.js.map +1 -1
  535. package/dist/esm/monitoring/observability/services/metrics.service.d.ts +21 -0
  536. package/dist/esm/monitoring/observability/services/metrics.service.d.ts.map +1 -1
  537. package/dist/esm/monitoring/observability/services/metrics.service.js +38 -0
  538. package/dist/esm/monitoring/observability/services/metrics.service.js.map +1 -1
  539. package/dist/esm/notifications/email/models/email-context-provider.interface.d.ts +0 -80
  540. package/dist/esm/notifications/email/models/email-context-provider.interface.d.ts.map +0 -1
  541. package/dist/esm/notifications/email/models/email-context-provider.interface.js +0 -25
  542. package/dist/esm/notifications/email/models/email-context-provider.interface.js.map +0 -1
  543. package/dist/esm/notifications/email/services/email-context-provider-registry.backend.service.d.ts +0 -49
  544. package/dist/esm/notifications/email/services/email-context-provider-registry.backend.service.d.ts.map +0 -1
  545. package/dist/esm/notifications/email/services/email-context-provider-registry.backend.service.js +0 -141
  546. package/dist/esm/notifications/email/services/email-context-provider-registry.backend.service.js.map +0 -1
  547. package/dist/esm/notifications/email/services/email-template-compiler.backend.service.d.ts +0 -37
  548. package/dist/esm/notifications/email/services/email-template-compiler.backend.service.d.ts.map +0 -1
  549. package/dist/esm/notifications/email/services/email-template-compiler.backend.service.js +0 -121
  550. package/dist/esm/notifications/email/services/email-template-compiler.backend.service.js.map +0 -1
  551. package/dist/esm/notifications/email/services/email-template-registry.backend.service.d.ts +66 -1
  552. package/dist/esm/notifications/email/services/email-template-registry.backend.service.d.ts.map +1 -1
  553. package/dist/esm/notifications/email/services/email-template-registry.backend.service.js +105 -10
  554. package/dist/esm/notifications/email/services/email-template-registry.backend.service.js.map +1 -1
  555. package/dist/esm/notifications/email/services/email-template-sandbox.backend.service.d.ts +0 -58
  556. package/dist/esm/notifications/email/services/email-template-sandbox.backend.service.d.ts.map +0 -1
  557. package/dist/esm/notifications/email/services/email-template-sandbox.backend.service.js +0 -223
  558. package/dist/esm/notifications/email/services/email-template-sandbox.backend.service.js.map +0 -1
  559. package/dist/esm/notifications/email/services/email-template-validator.backend.service.d.ts.map +1 -1
  560. package/dist/esm/notifications/email/services/email-template-validator.backend.service.js +10 -1
  561. package/dist/esm/notifications/email/services/email-template-validator.backend.service.js.map +1 -1
  562. package/dist/esm/notifications/email/services/email.backend.service.d.ts +60 -4
  563. package/dist/esm/notifications/email/services/email.backend.service.d.ts.map +1 -1
  564. package/dist/esm/notifications/email/services/email.backend.service.js +145 -43
  565. package/dist/esm/notifications/email/services/email.backend.service.js.map +1 -1
  566. package/dist/esm/notifications/email/utils/color-conversion.utils.d.ts +0 -1
  567. package/dist/esm/notifications/email/utils/color-conversion.utils.d.ts.map +1 -1
  568. package/dist/esm/notifications/email/utils/color-conversion.utils.js.map +1 -1
  569. package/dist/esm/notifications/services/notification-badge.backend.service.d.ts +142 -21
  570. package/dist/esm/notifications/services/notification-badge.backend.service.d.ts.map +1 -1
  571. package/dist/esm/notifications/services/notification-badge.backend.service.js +283 -58
  572. package/dist/esm/notifications/services/notification-badge.backend.service.js.map +1 -1
  573. package/dist/esm/notifications/services/notifications-dispatcher.backend.service.d.ts +108 -13
  574. package/dist/esm/notifications/services/notifications-dispatcher.backend.service.d.ts.map +1 -1
  575. package/dist/esm/notifications/services/notifications-dispatcher.backend.service.js +432 -101
  576. package/dist/esm/notifications/services/notifications-dispatcher.backend.service.js.map +1 -1
  577. package/dist/esm/notifications/sms/services/sms.backend.service.d.ts +2 -2
  578. package/dist/esm/notifications/sms/services/sms.backend.service.d.ts.map +1 -1
  579. package/dist/esm/notifications/sms/services/sms.backend.service.js +5 -5
  580. package/dist/esm/notifications/sms/services/sms.backend.service.js.map +1 -1
  581. package/dist/esm/notifications/webhooks/controllers/webhook-auto-controller.backend.service.d.ts +117 -5
  582. package/dist/esm/notifications/webhooks/controllers/webhook-auto-controller.backend.service.d.ts.map +1 -1
  583. package/dist/esm/notifications/webhooks/controllers/webhook-auto-controller.backend.service.js +164 -6
  584. package/dist/esm/notifications/webhooks/controllers/webhook-auto-controller.backend.service.js.map +1 -1
  585. package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.d.ts +0 -6
  586. package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.d.ts.map +1 -1
  587. package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.js +54 -7
  588. package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.js.map +1 -1
  589. package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.utils.d.ts +5 -5
  590. package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.utils.d.ts.map +1 -1
  591. package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.utils.js +14 -13
  592. package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.utils.js.map +1 -1
  593. package/dist/esm/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.d.ts +2 -1
  594. package/dist/esm/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.d.ts.map +1 -1
  595. package/dist/esm/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.js +18 -8
  596. package/dist/esm/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.js.map +1 -1
  597. package/dist/esm/notifications/webhooks/outbound/services/webhook-config-test-endpoint.custom-impl.backend.service.d.ts.map +1 -1
  598. package/dist/esm/notifications/webhooks/outbound/services/webhook-config-test-endpoint.custom-impl.backend.service.js +20 -18
  599. package/dist/esm/notifications/webhooks/outbound/services/webhook-config-test-endpoint.custom-impl.backend.service.js.map +1 -1
  600. package/dist/esm/notifications/webhooks/services/webhook-handler.backend.service.d.ts +16 -0
  601. package/dist/esm/notifications/webhooks/services/webhook-handler.backend.service.d.ts.map +1 -1
  602. package/dist/esm/notifications/webhooks/services/webhook-handler.backend.service.js +18 -0
  603. package/dist/esm/notifications/webhooks/services/webhook-handler.backend.service.js.map +1 -1
  604. package/dist/esm/organizations/batches/organization-purge.batch.backend.service.d.ts +2 -2
  605. package/dist/esm/organizations/batches/organization-purge.batch.backend.service.js +2 -2
  606. package/dist/esm/organizations/batches/organization-purge.batch.backend.service.js.map +1 -1
  607. package/dist/esm/organizations/services/organization-custom-implementation.backend.service.d.ts.map +1 -1
  608. package/dist/esm/organizations/services/organization-custom-implementation.backend.service.js +63 -2
  609. package/dist/esm/organizations/services/organization-custom-implementation.backend.service.js.map +1 -1
  610. package/dist/esm/organizations/services/organization-unit-custom-implementation.backend.service.d.ts.map +1 -1
  611. package/dist/esm/organizations/services/organization-unit-custom-implementation.backend.service.js +4 -1
  612. package/dist/esm/organizations/services/organization-unit-custom-implementation.backend.service.js.map +1 -1
  613. package/dist/esm/queue/adapters/in-memory-queue-adapter.backend.service.d.ts +66 -0
  614. package/dist/esm/queue/adapters/in-memory-queue-adapter.backend.service.d.ts.map +1 -0
  615. package/dist/esm/queue/adapters/in-memory-queue-adapter.backend.service.js +257 -0
  616. package/dist/esm/queue/adapters/in-memory-queue-adapter.backend.service.js.map +1 -0
  617. package/dist/esm/queue/adapters/queue-adapter.backend.binding.d.ts +12 -0
  618. package/dist/esm/queue/adapters/queue-adapter.backend.binding.d.ts.map +1 -0
  619. package/dist/esm/queue/adapters/queue-adapter.backend.binding.js +47 -0
  620. package/dist/esm/queue/adapters/queue-adapter.backend.binding.js.map +1 -0
  621. package/dist/esm/queue/adapters/queue-adapter.backend.interface.d.ts +87 -0
  622. package/dist/esm/queue/adapters/queue-adapter.backend.interface.d.ts.map +1 -0
  623. package/dist/esm/queue/adapters/queue-adapter.backend.interface.js +1 -0
  624. package/dist/esm/queue/adapters/queue-adapter.backend.interface.js.map +1 -0
  625. package/dist/esm/queue/adapters/queue-adapter.backend.options.d.ts +31 -0
  626. package/dist/esm/queue/adapters/queue-adapter.backend.options.d.ts.map +1 -0
  627. package/dist/esm/queue/adapters/queue-adapter.backend.options.js +13 -0
  628. package/dist/esm/queue/adapters/queue-adapter.backend.options.js.map +1 -0
  629. package/dist/esm/queue/adapters/rabbitmq-adapter.backend.service.d.ts +19 -25
  630. package/dist/esm/queue/adapters/rabbitmq-adapter.backend.service.d.ts.map +1 -1
  631. package/dist/esm/queue/adapters/rabbitmq-adapter.backend.service.js +33 -0
  632. package/dist/esm/queue/adapters/rabbitmq-adapter.backend.service.js.map +1 -1
  633. package/dist/esm/queue/domain-queue-consumer.backend.service.d.ts +2 -2
  634. package/dist/esm/queue/domain-queue-consumer.backend.service.d.ts.map +1 -1
  635. package/dist/esm/queue/domain-queue-consumer.backend.service.js +1 -4
  636. package/dist/esm/queue/domain-queue-consumer.backend.service.js.map +1 -1
  637. package/dist/esm/queue/job-consumer.backend.service.d.ts +2 -2
  638. package/dist/esm/queue/job-consumer.backend.service.d.ts.map +1 -1
  639. package/dist/esm/queue/job-consumer.backend.service.js +1 -4
  640. package/dist/esm/queue/job-consumer.backend.service.js.map +1 -1
  641. package/dist/esm/queue/job-executor.backend.service.d.ts +2 -2
  642. package/dist/esm/queue/job-executor.backend.service.d.ts.map +1 -1
  643. package/dist/esm/queue/job-executor.backend.service.js +1 -4
  644. package/dist/esm/queue/job-executor.backend.service.js.map +1 -1
  645. package/dist/esm/queue/queue-monitoring.backend.service.d.ts +8 -4
  646. package/dist/esm/queue/queue-monitoring.backend.service.d.ts.map +1 -1
  647. package/dist/esm/queue/queue-monitoring.backend.service.js +25 -17
  648. package/dist/esm/queue/queue-monitoring.backend.service.js.map +1 -1
  649. package/dist/esm/queue/queue-worker-initializer.backend.service.d.ts +16 -1
  650. package/dist/esm/queue/queue-worker-initializer.backend.service.d.ts.map +1 -1
  651. package/dist/esm/queue/queue-worker-initializer.backend.service.js +16 -1
  652. package/dist/esm/queue/queue-worker-initializer.backend.service.js.map +1 -1
  653. package/dist/esm/queue/queue.backend.service.d.ts +3 -3
  654. package/dist/esm/queue/queue.backend.service.d.ts.map +1 -1
  655. package/dist/esm/queue/queue.backend.service.js +26 -4
  656. package/dist/esm/queue/queue.backend.service.js.map +1 -1
  657. package/dist/esm/queue/worker-shutdown-manager.backend.service.d.ts +2 -2
  658. package/dist/esm/queue/worker-shutdown-manager.backend.service.d.ts.map +1 -1
  659. package/dist/esm/queue/worker-shutdown-manager.backend.service.js +18 -3
  660. package/dist/esm/queue/worker-shutdown-manager.backend.service.js.map +1 -1
  661. package/dist/esm/rag/utils/rag-chunking.backend.utils.d.ts +50 -25
  662. package/dist/esm/rag/utils/rag-chunking.backend.utils.d.ts.map +1 -1
  663. package/dist/esm/rag/utils/rag-chunking.backend.utils.js +147 -39
  664. package/dist/esm/rag/utils/rag-chunking.backend.utils.js.map +1 -1
  665. package/dist/esm/rag/utils/rag-context-assembly.backend.utils.d.ts +12 -3
  666. package/dist/esm/rag/utils/rag-context-assembly.backend.utils.d.ts.map +1 -1
  667. package/dist/esm/rag/utils/rag-context-assembly.backend.utils.js +12 -3
  668. package/dist/esm/rag/utils/rag-context-assembly.backend.utils.js.map +1 -1
  669. package/dist/esm/requests/service/websocket.service.d.ts +9 -0
  670. package/dist/esm/requests/service/websocket.service.d.ts.map +1 -1
  671. package/dist/esm/requests/service/websocket.service.js +88 -15
  672. package/dist/esm/requests/service/websocket.service.js.map +1 -1
  673. package/dist/esm/resources/models/custom-service-implementations.backend.definition.d.ts.map +1 -1
  674. package/dist/esm/resources/models/custom-service-implementations.backend.definition.js +16 -2
  675. package/dist/esm/resources/models/custom-service-implementations.backend.definition.js.map +1 -1
  676. package/dist/esm/resources/models/resources-operations.backend.definitions.d.ts.map +1 -1
  677. package/dist/esm/resources/models/resources-operations.backend.definitions.js +2 -0
  678. package/dist/esm/resources/models/resources-operations.backend.definitions.js.map +1 -1
  679. package/dist/esm/resources/models/resources-relationships.backend.definitions.d.ts.map +1 -1
  680. package/dist/esm/resources/models/resources-relationships.backend.definitions.js +14 -0
  681. package/dist/esm/resources/models/resources-relationships.backend.definitions.js.map +1 -1
  682. package/dist/esm/resources/models/resources-types.backend.schemas.d.ts +2 -1
  683. package/dist/esm/resources/models/resources-types.backend.schemas.d.ts.map +1 -1
  684. package/dist/esm/resources/models/resources-types.backend.schemas.js +8 -0
  685. package/dist/esm/resources/models/resources-types.backend.schemas.js.map +1 -1
  686. package/dist/esm/resources/services/resource-id.backend.service.js +3 -3
  687. package/dist/esm/resources/services/resource-id.backend.service.js.map +1 -1
  688. package/dist/esm/resources/services/resources-registry.backend.service.d.ts +60 -5
  689. package/dist/esm/resources/services/resources-registry.backend.service.d.ts.map +1 -1
  690. package/dist/esm/resources/services/resources-registry.backend.service.js +91 -7
  691. package/dist/esm/resources/services/resources-registry.backend.service.js.map +1 -1
  692. package/dist/esm/runtime/controllers/health-controller.backend.service.d.ts +36 -3
  693. package/dist/esm/runtime/controllers/health-controller.backend.service.d.ts.map +1 -1
  694. package/dist/esm/runtime/controllers/health-controller.backend.service.js +32 -10
  695. package/dist/esm/runtime/controllers/health-controller.backend.service.js.map +1 -1
  696. package/dist/esm/runtime/domain-module.backend.definitions.d.ts +24 -0
  697. package/dist/esm/runtime/domain-module.backend.definitions.d.ts.map +1 -1
  698. package/dist/esm/runtime/domain-module.backend.definitions.js +24 -0
  699. package/dist/esm/runtime/domain-module.backend.definitions.js.map +1 -1
  700. package/dist/esm/runtime/services/execution-context-creator.backend.service.d.ts.map +1 -1
  701. package/dist/esm/runtime/services/execution-context-creator.backend.service.js +13 -7
  702. package/dist/esm/runtime/services/execution-context-creator.backend.service.js.map +1 -1
  703. package/dist/esm/runtime/services/health-readiness-contributor.backend.interface.d.ts +51 -0
  704. package/dist/esm/runtime/services/health-readiness-contributor.backend.interface.d.ts.map +1 -1
  705. package/dist/esm/runtime/services/health-readiness-contributor.backend.interface.js.map +1 -1
  706. package/dist/esm/runtime/services/http-server.backend.service.d.ts +26 -0
  707. package/dist/esm/runtime/services/http-server.backend.service.d.ts.map +1 -1
  708. package/dist/esm/runtime/services/http-server.backend.service.js +181 -1
  709. package/dist/esm/runtime/services/http-server.backend.service.js.map +1 -1
  710. package/dist/esm/runtime/services/start-application.backend.service.d.ts +47 -1
  711. package/dist/esm/runtime/services/start-application.backend.service.d.ts.map +1 -1
  712. package/dist/esm/runtime/services/start-application.backend.service.js +343 -77
  713. package/dist/esm/runtime/services/start-application.backend.service.js.map +1 -1
  714. package/dist/esm/security/api-keys/api-keys.custom-impl.backend.service.d.ts +15 -0
  715. package/dist/esm/security/api-keys/api-keys.custom-impl.backend.service.d.ts.map +1 -1
  716. package/dist/esm/security/api-keys/api-keys.custom-impl.backend.service.js +28 -0
  717. package/dist/esm/security/api-keys/api-keys.custom-impl.backend.service.js.map +1 -1
  718. package/dist/esm/security/authentications/batches/anonymous-session-cleanup.batch.backend.service.d.ts +5 -1
  719. package/dist/esm/security/authentications/batches/anonymous-session-cleanup.batch.backend.service.d.ts.map +1 -1
  720. package/dist/esm/security/authentications/batches/anonymous-session-cleanup.batch.backend.service.js +24 -4
  721. package/dist/esm/security/authentications/batches/anonymous-session-cleanup.batch.backend.service.js.map +1 -1
  722. package/dist/esm/security/authentications/controllers/authentication-controller.backend.service.d.ts.map +1 -1
  723. package/dist/esm/security/authentications/controllers/authentication-controller.backend.service.js +29 -4
  724. package/dist/esm/security/authentications/controllers/authentication-controller.backend.service.js.map +1 -1
  725. package/dist/esm/security/authentications/controllers/oauth-provider-controller.backend.service.d.ts +114 -0
  726. package/dist/esm/security/authentications/controllers/oauth-provider-controller.backend.service.d.ts.map +1 -1
  727. package/dist/esm/security/authentications/controllers/oauth-provider-controller.backend.service.js +354 -3
  728. package/dist/esm/security/authentications/controllers/oauth-provider-controller.backend.service.js.map +1 -1
  729. package/dist/esm/security/authentications/models/cimd.backend.schemas.d.ts +1 -0
  730. package/dist/esm/security/authentications/models/cimd.backend.schemas.d.ts.map +1 -1
  731. package/dist/esm/security/authentications/models/cimd.backend.schemas.js +22 -0
  732. package/dist/esm/security/authentications/models/cimd.backend.schemas.js.map +1 -1
  733. package/dist/esm/security/authentications/models/jwt.backend.schemas.d.ts +3 -23
  734. package/dist/esm/security/authentications/models/jwt.backend.schemas.d.ts.map +1 -1
  735. package/dist/esm/security/authentications/models/jwt.backend.schemas.js +20 -45
  736. package/dist/esm/security/authentications/models/jwt.backend.schemas.js.map +1 -1
  737. package/dist/esm/security/authentications/models/oauth2-connection.backend.schemas.d.ts +15 -0
  738. package/dist/esm/security/authentications/models/oauth2-connection.backend.schemas.d.ts.map +1 -1
  739. package/dist/esm/security/authentications/models/oauth2-connection.backend.schemas.js.map +1 -1
  740. package/dist/esm/security/authentications/services/admin-config/auth-organization-configuration.service.d.ts +0 -2
  741. package/dist/esm/security/authentications/services/admin-config/auth-organization-configuration.service.d.ts.map +1 -1
  742. package/dist/esm/security/authentications/services/admin-config/auth-organization-configuration.service.js +23 -14
  743. package/dist/esm/security/authentications/services/admin-config/auth-organization-configuration.service.js.map +1 -1
  744. package/dist/esm/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.d.ts +0 -1
  745. package/dist/esm/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.d.ts.map +1 -1
  746. package/dist/esm/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.js +15 -12
  747. package/dist/esm/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.js.map +1 -1
  748. package/dist/esm/security/authentications/services/admin-config/domain-verification.backend.service.d.ts +113 -3
  749. package/dist/esm/security/authentications/services/admin-config/domain-verification.backend.service.d.ts.map +1 -1
  750. package/dist/esm/security/authentications/services/admin-config/domain-verification.backend.service.js +207 -30
  751. package/dist/esm/security/authentications/services/admin-config/domain-verification.backend.service.js.map +1 -1
  752. package/dist/esm/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.d.ts +95 -2
  753. package/dist/esm/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.d.ts.map +1 -1
  754. package/dist/esm/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.js +153 -9
  755. package/dist/esm/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.js.map +1 -1
  756. package/dist/esm/security/authentications/services/anonymous-session.backend.service.d.ts +190 -0
  757. package/dist/esm/security/authentications/services/anonymous-session.backend.service.d.ts.map +1 -1
  758. package/dist/esm/security/authentications/services/anonymous-session.backend.service.js +377 -53
  759. package/dist/esm/security/authentications/services/anonymous-session.backend.service.js.map +1 -1
  760. package/dist/esm/security/authentications/services/auth-methods/auth-method-management.backend.service.d.ts +9 -1
  761. package/dist/esm/security/authentications/services/auth-methods/auth-method-management.backend.service.d.ts.map +1 -1
  762. package/dist/esm/security/authentications/services/auth-methods/auth-method-management.backend.service.js +77 -2
  763. package/dist/esm/security/authentications/services/auth-methods/auth-method-management.backend.service.js.map +1 -1
  764. package/dist/esm/security/authentications/services/auth-methods/auth-mfa.backend.service.d.ts.map +1 -1
  765. package/dist/esm/security/authentications/services/auth-methods/auth-mfa.backend.service.js +5 -3
  766. package/dist/esm/security/authentications/services/auth-methods/auth-mfa.backend.service.js.map +1 -1
  767. package/dist/esm/security/authentications/services/auth-methods/auth-registration.backend.service.d.ts +41 -0
  768. package/dist/esm/security/authentications/services/auth-methods/auth-registration.backend.service.d.ts.map +1 -1
  769. package/dist/esm/security/authentications/services/auth-methods/auth-registration.backend.service.js +202 -23
  770. package/dist/esm/security/authentications/services/auth-methods/auth-registration.backend.service.js.map +1 -1
  771. package/dist/esm/security/authentications/services/auth-methods/oauth2-authentication.backend.service.d.ts.map +1 -1
  772. package/dist/esm/security/authentications/services/auth-methods/oauth2-authentication.backend.service.js +42 -1
  773. package/dist/esm/security/authentications/services/auth-methods/oauth2-authentication.backend.service.js.map +1 -1
  774. package/dist/esm/security/authentications/services/auth-methods/oauth2-connection-resolver.backend.service.d.ts.map +1 -1
  775. package/dist/esm/security/authentications/services/auth-methods/oauth2-connection-resolver.backend.service.js +34 -4
  776. package/dist/esm/security/authentications/services/auth-methods/oauth2-connection-resolver.backend.service.js.map +1 -1
  777. package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.d.ts +29 -5
  778. package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.d.ts.map +1 -1
  779. package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.js +77 -5
  780. package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.js.map +1 -1
  781. package/dist/esm/security/authentications/services/auth-token-issuer.backend.service.d.ts +41 -1
  782. package/dist/esm/security/authentications/services/auth-token-issuer.backend.service.d.ts.map +1 -1
  783. package/dist/esm/security/authentications/services/auth-token-issuer.backend.service.js +87 -4
  784. package/dist/esm/security/authentications/services/auth-token-issuer.backend.service.js.map +1 -1
  785. package/dist/esm/security/authentications/services/authentication-orchestrator.backend.service.d.ts +43 -1
  786. package/dist/esm/security/authentications/services/authentication-orchestrator.backend.service.d.ts.map +1 -1
  787. package/dist/esm/security/authentications/services/authentication-orchestrator.backend.service.js +277 -97
  788. package/dist/esm/security/authentications/services/authentication-orchestrator.backend.service.js.map +1 -1
  789. package/dist/esm/security/authentications/services/cimd-client-metadata.backend.service.d.ts +28 -5
  790. package/dist/esm/security/authentications/services/cimd-client-metadata.backend.service.d.ts.map +1 -1
  791. package/dist/esm/security/authentications/services/cimd-client-metadata.backend.service.js +72 -12
  792. package/dist/esm/security/authentications/services/cimd-client-metadata.backend.service.js.map +1 -1
  793. package/dist/esm/security/authentications/services/custom-impls/auth-custom-implementations.backend.d.ts.map +1 -1
  794. package/dist/esm/security/authentications/services/custom-impls/auth-custom-implementations.backend.js +3 -0
  795. package/dist/esm/security/authentications/services/custom-impls/auth-custom-implementations.backend.js.map +1 -1
  796. package/dist/esm/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.d.ts +28 -0
  797. package/dist/esm/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.d.ts.map +1 -0
  798. package/dist/esm/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.js +283 -0
  799. package/dist/esm/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.js.map +1 -0
  800. package/dist/esm/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.d.ts +4 -3
  801. package/dist/esm/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.d.ts.map +1 -1
  802. package/dist/esm/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.js +4 -3
  803. package/dist/esm/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.js.map +1 -1
  804. package/dist/esm/security/authentications/services/oauth-provider-token.backend.service.d.ts +35 -0
  805. package/dist/esm/security/authentications/services/oauth-provider-token.backend.service.d.ts.map +1 -1
  806. package/dist/esm/security/authentications/services/oauth-provider-token.backend.service.js +111 -21
  807. package/dist/esm/security/authentications/services/oauth-provider-token.backend.service.js.map +1 -1
  808. package/dist/esm/security/authentications/services/oidc-authorization-code.backend.service.d.ts +14 -1
  809. package/dist/esm/security/authentications/services/oidc-authorization-code.backend.service.d.ts.map +1 -1
  810. package/dist/esm/security/authentications/services/oidc-authorization-code.backend.service.js +49 -8
  811. package/dist/esm/security/authentications/services/oidc-authorization-code.backend.service.js.map +1 -1
  812. package/dist/esm/security/authentications/services/utils/auth-policy-resolution.backend.utils.d.ts.map +1 -1
  813. package/dist/esm/security/authentications/services/utils/auth-policy-resolution.backend.utils.js +4 -0
  814. package/dist/esm/security/authentications/services/utils/auth-policy-resolution.backend.utils.js.map +1 -1
  815. package/dist/esm/security/authentications/services/utils/auth-user-lookup.backend.service.d.ts.map +1 -1
  816. package/dist/esm/security/authentications/services/utils/auth-user-lookup.backend.service.js +6 -0
  817. package/dist/esm/security/authentications/services/utils/auth-user-lookup.backend.service.js.map +1 -1
  818. package/dist/esm/security/authentications/services/utils/external-turn-rate-limit.backend.utils.d.ts +37 -1
  819. package/dist/esm/security/authentications/services/utils/external-turn-rate-limit.backend.utils.d.ts.map +1 -1
  820. package/dist/esm/security/authentications/services/utils/external-turn-rate-limit.backend.utils.js +51 -0
  821. package/dist/esm/security/authentications/services/utils/external-turn-rate-limit.backend.utils.js.map +1 -1
  822. package/dist/esm/security/authentications/utils/enterprise-sso-enforcement.backend.utils.d.ts +41 -0
  823. package/dist/esm/security/authentications/utils/enterprise-sso-enforcement.backend.utils.d.ts.map +1 -1
  824. package/dist/esm/security/authentications/utils/enterprise-sso-enforcement.backend.utils.js +45 -0
  825. package/dist/esm/security/authentications/utils/enterprise-sso-enforcement.backend.utils.js.map +1 -1
  826. package/dist/esm/security/authorizations/cross-tenant-read-observation.backend.d.ts +116 -0
  827. package/dist/esm/security/authorizations/cross-tenant-read-observation.backend.d.ts.map +1 -0
  828. package/dist/esm/security/authorizations/cross-tenant-read-observation.backend.js +162 -0
  829. package/dist/esm/security/authorizations/cross-tenant-read-observation.backend.js.map +1 -0
  830. package/dist/esm/security/authorizations/initiator-organization-confinement.backend.d.ts.map +1 -1
  831. package/dist/esm/security/authorizations/initiator-organization-confinement.backend.js +24 -1
  832. package/dist/esm/security/authorizations/initiator-organization-confinement.backend.js.map +1 -1
  833. package/dist/esm/security/authorizations/organization-owner-floor.backend.utils.d.ts +20 -20
  834. package/dist/esm/security/authorizations/organization-owner-floor.backend.utils.d.ts.map +1 -1
  835. package/dist/esm/security/authorizations/organization-owner-floor.backend.utils.js +27 -28
  836. package/dist/esm/security/authorizations/organization-owner-floor.backend.utils.js.map +1 -1
  837. package/dist/esm/security/authorizations/platform-access-grant-custom-implementation.backend.service.d.ts.map +1 -1
  838. package/dist/esm/security/authorizations/platform-access-grant-custom-implementation.backend.service.js +77 -3
  839. package/dist/esm/security/authorizations/platform-access-grant-custom-implementation.backend.service.js.map +1 -1
  840. package/dist/esm/security/authorizations/privileged-access-review.backend.utils.d.ts +117 -0
  841. package/dist/esm/security/authorizations/privileged-access-review.backend.utils.d.ts.map +1 -0
  842. package/dist/esm/security/authorizations/privileged-access-review.backend.utils.js +104 -0
  843. package/dist/esm/security/authorizations/privileged-access-review.backend.utils.js.map +1 -0
  844. package/dist/esm/security/authorizations/role-ceiling.backend.utils.d.ts +4 -0
  845. package/dist/esm/security/authorizations/role-ceiling.backend.utils.d.ts.map +1 -1
  846. package/dist/esm/security/authorizations/role-ceiling.backend.utils.js +4 -0
  847. package/dist/esm/security/authorizations/role-ceiling.backend.utils.js.map +1 -1
  848. package/dist/esm/security/authorizations/role-conferral.backend.utils.d.ts +93 -0
  849. package/dist/esm/security/authorizations/role-conferral.backend.utils.d.ts.map +1 -0
  850. package/dist/esm/security/authorizations/role-conferral.backend.utils.js +95 -0
  851. package/dist/esm/security/authorizations/role-conferral.backend.utils.js.map +1 -0
  852. package/dist/esm/security/authorizations/scope-root-collection-confinement.backend.d.ts +124 -1
  853. package/dist/esm/security/authorizations/scope-root-collection-confinement.backend.d.ts.map +1 -1
  854. package/dist/esm/security/authorizations/scope-root-collection-confinement.backend.js +142 -5
  855. package/dist/esm/security/authorizations/scope-root-collection-confinement.backend.js.map +1 -1
  856. package/dist/esm/security/authorizations/services/authorizations.backend.service.d.ts +175 -14
  857. package/dist/esm/security/authorizations/services/authorizations.backend.service.d.ts.map +1 -1
  858. package/dist/esm/security/authorizations/services/authorizations.backend.service.js +385 -49
  859. package/dist/esm/security/authorizations/services/authorizations.backend.service.js.map +1 -1
  860. package/dist/esm/security/authorizations/super-admin-floor.backend.utils.d.ts +6 -14
  861. package/dist/esm/security/authorizations/super-admin-floor.backend.utils.d.ts.map +1 -1
  862. package/dist/esm/security/authorizations/super-admin-floor.backend.utils.js +13 -22
  863. package/dist/esm/security/authorizations/super-admin-floor.backend.utils.js.map +1 -1
  864. package/dist/esm/security/connected-accounts/connection-target-authorization.backend.d.ts +60 -0
  865. package/dist/esm/security/connected-accounts/connection-target-authorization.backend.d.ts.map +1 -0
  866. package/dist/esm/security/connected-accounts/connection-target-authorization.backend.js +79 -0
  867. package/dist/esm/security/connected-accounts/connection-target-authorization.backend.js.map +1 -0
  868. package/dist/esm/security/connected-accounts/controllers/provider-connection.controller.backend.service.d.ts +161 -0
  869. package/dist/esm/security/connected-accounts/controllers/provider-connection.controller.backend.service.d.ts.map +1 -0
  870. package/dist/esm/security/connected-accounts/controllers/provider-connection.controller.backend.service.js +512 -0
  871. package/dist/esm/security/connected-accounts/controllers/provider-connection.controller.backend.service.js.map +1 -0
  872. package/dist/esm/security/connected-accounts/organization-provider-credential-resolver.port.d.ts +59 -0
  873. package/dist/esm/security/connected-accounts/organization-provider-credential-resolver.port.d.ts.map +1 -0
  874. package/dist/esm/security/connected-accounts/organization-provider-credential-resolver.port.js +22 -0
  875. package/dist/esm/security/connected-accounts/organization-provider-credential-resolver.port.js.map +1 -0
  876. package/dist/esm/security/connected-accounts/provider-oauth2-refresher.port.d.ts +44 -0
  877. package/dist/esm/security/connected-accounts/provider-oauth2-refresher.port.d.ts.map +1 -0
  878. package/dist/esm/security/connected-accounts/provider-oauth2-refresher.port.js +20 -0
  879. package/dist/esm/security/connected-accounts/provider-oauth2-refresher.port.js.map +1 -0
  880. package/dist/esm/security/connected-accounts/services/organization-provider-credential-store.backend.service.d.ts +191 -0
  881. package/dist/esm/security/connected-accounts/services/organization-provider-credential-store.backend.service.d.ts.map +1 -0
  882. package/dist/esm/security/connected-accounts/services/organization-provider-credential-store.backend.service.js +385 -0
  883. package/dist/esm/security/connected-accounts/services/organization-provider-credential-store.backend.service.js.map +1 -0
  884. package/dist/esm/security/connected-accounts/services/organization-provider-credentials.custom-impl.backend.service.d.ts +41 -0
  885. package/dist/esm/security/connected-accounts/services/organization-provider-credentials.custom-impl.backend.service.d.ts.map +1 -0
  886. package/dist/esm/security/connected-accounts/services/organization-provider-credentials.custom-impl.backend.service.js +358 -0
  887. package/dist/esm/security/connected-accounts/services/organization-provider-credentials.custom-impl.backend.service.js.map +1 -0
  888. package/dist/esm/security/connected-accounts/services/provider-oauth2-exchange.backend.d.ts +160 -0
  889. package/dist/esm/security/connected-accounts/services/provider-oauth2-exchange.backend.d.ts.map +1 -0
  890. package/dist/esm/security/connected-accounts/services/provider-oauth2-exchange.backend.js +266 -0
  891. package/dist/esm/security/connected-accounts/services/provider-oauth2-exchange.backend.js.map +1 -0
  892. package/dist/esm/security/connected-accounts/services/provider-oauth2-pending-authorization.backend.service.d.ts +111 -0
  893. package/dist/esm/security/connected-accounts/services/provider-oauth2-pending-authorization.backend.service.d.ts.map +1 -0
  894. package/dist/esm/security/connected-accounts/services/provider-oauth2-pending-authorization.backend.service.js +107 -0
  895. package/dist/esm/security/connected-accounts/services/provider-oauth2-pending-authorization.backend.service.js.map +1 -0
  896. package/dist/esm/security/connected-accounts/services/provider-oauth2-refresher.backend.service.d.ts +54 -0
  897. package/dist/esm/security/connected-accounts/services/provider-oauth2-refresher.backend.service.d.ts.map +1 -0
  898. package/dist/esm/security/connected-accounts/services/provider-oauth2-refresher.backend.service.js +153 -0
  899. package/dist/esm/security/connected-accounts/services/provider-oauth2-refresher.backend.service.js.map +1 -0
  900. package/dist/esm/security/connected-accounts/services/user-provider-credential-store.backend.service.d.ts +195 -0
  901. package/dist/esm/security/connected-accounts/services/user-provider-credential-store.backend.service.d.ts.map +1 -0
  902. package/dist/esm/security/connected-accounts/services/user-provider-credential-store.backend.service.js +387 -0
  903. package/dist/esm/security/connected-accounts/services/user-provider-credential-store.backend.service.js.map +1 -0
  904. package/dist/esm/security/connected-accounts/services/user-provider-credentials.custom-impl.backend.service.d.ts +45 -0
  905. package/dist/esm/security/connected-accounts/services/user-provider-credentials.custom-impl.backend.service.d.ts.map +1 -0
  906. package/dist/esm/security/connected-accounts/services/user-provider-credentials.custom-impl.backend.service.js +291 -0
  907. package/dist/esm/security/connected-accounts/services/user-provider-credentials.custom-impl.backend.service.js.map +1 -0
  908. package/dist/esm/security/connected-accounts/user-provider-credential-resolver.port.d.ts +62 -0
  909. package/dist/esm/security/connected-accounts/user-provider-credential-resolver.port.d.ts.map +1 -0
  910. package/dist/esm/security/connected-accounts/user-provider-credential-resolver.port.js +29 -0
  911. package/dist/esm/security/connected-accounts/user-provider-credential-resolver.port.js.map +1 -0
  912. package/dist/esm/security/connected-accounts/utils/provider-credential-envelope.backend.utils.d.ts +127 -0
  913. package/dist/esm/security/connected-accounts/utils/provider-credential-envelope.backend.utils.d.ts.map +1 -0
  914. package/dist/esm/security/connected-accounts/utils/provider-credential-envelope.backend.utils.js +277 -0
  915. package/dist/esm/security/connected-accounts/utils/provider-credential-envelope.backend.utils.js.map +1 -0
  916. package/dist/esm/security/connected-accounts/utils/stored-credential-value.backend.utils.d.ts +66 -0
  917. package/dist/esm/security/connected-accounts/utils/stored-credential-value.backend.utils.d.ts.map +1 -0
  918. package/dist/esm/security/connected-accounts/utils/stored-credential-value.backend.utils.js +75 -0
  919. package/dist/esm/security/connected-accounts/utils/stored-credential-value.backend.utils.js.map +1 -0
  920. package/dist/esm/security/consumable-tokens/batches/consumable-tokens-cleanup.batch.backend.service.d.ts +18 -1
  921. package/dist/esm/security/consumable-tokens/batches/consumable-tokens-cleanup.batch.backend.service.d.ts.map +1 -1
  922. package/dist/esm/security/consumable-tokens/batches/consumable-tokens-cleanup.batch.backend.service.js +110 -74
  923. package/dist/esm/security/consumable-tokens/batches/consumable-tokens-cleanup.batch.backend.service.js.map +1 -1
  924. package/dist/esm/security/consumable-tokens/consumable-token-models.exports.d.ts +22 -0
  925. package/dist/esm/security/consumable-tokens/consumable-token-models.exports.d.ts.map +1 -0
  926. package/dist/esm/security/consumable-tokens/consumable-token-models.exports.js +22 -0
  927. package/dist/esm/security/consumable-tokens/consumable-token-models.exports.js.map +1 -0
  928. package/dist/esm/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas.d.ts +17 -3
  929. package/dist/esm/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas.d.ts.map +1 -1
  930. package/dist/esm/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas.js +12 -0
  931. package/dist/esm/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas.js.map +1 -1
  932. package/dist/esm/security/consumable-tokens/services/consumable-token.backend.service.d.ts +41 -3
  933. package/dist/esm/security/consumable-tokens/services/consumable-token.backend.service.d.ts.map +1 -1
  934. package/dist/esm/security/consumable-tokens/services/consumable-token.backend.service.js +83 -20
  935. package/dist/esm/security/consumable-tokens/services/consumable-token.backend.service.js.map +1 -1
  936. package/dist/esm/security/credential-rotation-grace.backend.utils.d.ts +9 -4
  937. package/dist/esm/security/credential-rotation-grace.backend.utils.d.ts.map +1 -1
  938. package/dist/esm/security/credential-rotation-grace.backend.utils.js +9 -4
  939. package/dist/esm/security/credential-rotation-grace.backend.utils.js.map +1 -1
  940. package/dist/esm/security/jwt/services/jwt.backend.service.d.ts.map +1 -1
  941. package/dist/esm/security/jwt/services/jwt.backend.service.js +1 -18
  942. package/dist/esm/security/jwt/services/jwt.backend.service.js.map +1 -1
  943. package/dist/esm/security/oauth-clients/oauth-client-generation.backend.utils.d.ts +26 -0
  944. package/dist/esm/security/oauth-clients/oauth-client-generation.backend.utils.d.ts.map +1 -1
  945. package/dist/esm/security/oauth-clients/oauth-client-generation.backend.utils.js +43 -0
  946. package/dist/esm/security/oauth-clients/oauth-client-generation.backend.utils.js.map +1 -1
  947. package/dist/esm/security/oauth-clients/oauth-clients.custom-impl.backend.service.d.ts +8 -1
  948. package/dist/esm/security/oauth-clients/oauth-clients.custom-impl.backend.service.d.ts.map +1 -1
  949. package/dist/esm/security/oauth-clients/oauth-clients.custom-impl.backend.service.js +49 -0
  950. package/dist/esm/security/oauth-clients/oauth-clients.custom-impl.backend.service.js.map +1 -1
  951. package/dist/esm/security/scim/controllers/scim.backend.controller.d.ts.map +1 -1
  952. package/dist/esm/security/scim/controllers/scim.backend.controller.js +17 -5
  953. package/dist/esm/security/scim/controllers/scim.backend.controller.js.map +1 -1
  954. package/dist/esm/security/scim/models/scim-protocol.backend.schemas.d.ts +67 -29
  955. package/dist/esm/security/scim/models/scim-protocol.backend.schemas.d.ts.map +1 -1
  956. package/dist/esm/security/scim/models/scim-protocol.backend.schemas.js +47 -25
  957. package/dist/esm/security/scim/models/scim-protocol.backend.schemas.js.map +1 -1
  958. package/dist/esm/security/ssrf/outbound-target-guard.backend.utils.d.ts +10 -2
  959. package/dist/esm/security/ssrf/outbound-target-guard.backend.utils.d.ts.map +1 -1
  960. package/dist/esm/security/ssrf/outbound-target-guard.backend.utils.js +10 -2
  961. package/dist/esm/security/ssrf/outbound-target-guard.backend.utils.js.map +1 -1
  962. package/dist/esm/security/ssrf/pinned-outbound-fetch.backend.utils.d.ts +143 -0
  963. package/dist/esm/security/ssrf/pinned-outbound-fetch.backend.utils.d.ts.map +1 -0
  964. package/dist/esm/security/ssrf/pinned-outbound-fetch.backend.utils.js +258 -0
  965. package/dist/esm/security/ssrf/pinned-outbound-fetch.backend.utils.js.map +1 -0
  966. package/dist/esm/users/services/user-read-retained.custom-impl.backend.service.d.ts +39 -0
  967. package/dist/esm/users/services/user-read-retained.custom-impl.backend.service.d.ts.map +1 -0
  968. package/dist/esm/users/services/user-read-retained.custom-impl.backend.service.js +159 -0
  969. package/dist/esm/users/services/user-read-retained.custom-impl.backend.service.js.map +1 -0
  970. package/dist/tsconfig.build.tsbuildinfo +1 -1
  971. package/package.json +17 -9
  972. package/dist/esm/.builder.pid +0 -9
package/dist/esm/runtime/services/execution-context-creator.backend.service.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"execution-context-creator.backend.service.js","sourceRoot":"","sources":["../../../../../src/runtime/services/execution-context-creator.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAqBA,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,cAAc,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,kBAAkB,EAAE,uCAAuC,EAAE,wBAAwB,EAAE,iCAAiC,EAAE,oBAAoB,EAAE,sCAAsC,EAAE,mCAAmC,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAElY,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,SAAS,EAAE,8BAA8B,EAAiC,iBAAiB,EAAE,4BAA4B,EAAE,kCAAkC,EAAE,yBAAyB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEvV,wDAAwD;AACxD,uEAAuE;AACvE,wDAAwD;AAGxD,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,iCAAiC,EAAE,gBAAgB,EAAoD,MAAM,qEAAqE,CAAC;AAC5L,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAG3H,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAEzH;;;;;;;GAOG;AACH;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAE5F,MAAM,uCAAuC,GAAyD;IACpG,sCAAsC;IACtC,mCAAmC;CACpC,CAAC;AAEF,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,wBAAwB,EAAE,MAAM,oFAAoF,CAAC;AAC9H,OAAO,EAAE,cAAc,EAAE,MAAM,wEAAwE,CAAC;AACxG,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,EACL,+BAA+B,EAC/B,wBAAwB,GACzB,MAAM,2FAA2F,CAAC;AAEnG,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,UAAU,EAAE,MAAM,uEAAuE,CAAC;AACnG,OAAO,EAAE,qBAAqB,EAAE,MAAM,iFAAiF,CAAC;AACxH,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAE3H,OAAO,EAAE,qCAAqC,EAAE,MAAM,6CAA6C,CAAC;AAGpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AAExI,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAClG,OAAO,EAAE,kCAAkC,EAAE,wBAAwB,EAAE,MAAM,kGAAkG,CAAC;AAChL,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,qEAAqE,CAAC;AACrI,OAAO,EAAE,kCAAkC,EAAE,MAAM,oEAAoE,CAAC;AACxH,OAAO,EAAE,gCAAgC,EAAE,MAAM,sEAAsE,CAAC;AACxH,OAAO,EACL,2BAA2B,GAE5B,MAAM,6FAA6F,CAAC;AAI9F,IAAM,qCAAqC,GAA3C,MAAM,qCAAqC;IAKU;IACU;IACG;IACW;IACb;IACM;IACW;IACZ;IACV;IACH;IAIqB;IAhB/D,QAAQ,CAA+D;IAExF,YACwD,MAAqB,EACX,gBAAyC,EACtC,YAAwC,EAC7B,8BAAqE,EAClF,UAA6B,EACvB,wBAAyD,EAC9C,oBAA+D,EAC3E,sBAAqD,EAC/D,YAA0B,EAC7B,SAAoB,EAIC,uBAA8D;QAbtF,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QACtC,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,mCAA8B,GAA9B,8BAA8B,CAAuC;QAClF,eAAU,GAAV,UAAU,CAAmB;QACvB,6BAAwB,GAAxB,wBAAwB,CAAiC;QAC9C,yBAAoB,GAApB,oBAAoB,CAA2C;QAC3E,2BAAsB,GAAtB,sBAAsB,CAA+B;QAC/D,iBAAY,GAAZ,YAAY,CAAc;QAC7B,cAAS,GAAT,SAAS,CAAW;QAIC,4BAAuB,GAAvB,uBAAuB,CAAuC;QAE1I,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;IACtE,CAAC;IAED;;;OAGG;IACK,0BAA0B;QAChC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAiC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACxG,CAAC;IAEO,yBAAyB;QAC/B,OAAO;YACL;gBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;gBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;aACtD;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,6BAA6B,CAAC,gBAAuC,EAAE,gBAAyB,KAAK;QACjH,wCAAwC;QACxC,MAAM,4BAA4B,GAChC,gBAAgB,CAAC,YAAY,EAAE,aAAa,KAAK,SAAS;YAC1D,gBAAgB,CAAC,YAAY,EAAE,aAAa,KAAK,IAAI,CAAC;QAExD,qBAAqB;QACrB,MAAM,eAAe,GAAG,CACtB,gBAAgB,CAAC,SAAS,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,WAAW;YACpF,4BAA4B,CAC7B,IAAI,aAAa,CAAC;QAEnB,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,uHAAuH;iBACjI;aACF,CACF,CAAC;QACJ,CAAC;QAED,0FAA0F;QAC1F,YAAY;QACZ,EAAE;QACF,8FAA8F;QAC9F,8FAA8F;QAC9F,8FAA8F;QAC9F,kFAAkF;QAClF,+FAA+F;QAC/F,+EAA+E;QAC/E,EAAE;QACF,8FAA8F;QAC9F,+FAA+F;QAC/F,0FAA0F;QAC1F,+FAA+F;QAC/F,oCAAoC;QACpC,gBAAgB,CAAC,YAAY,CAAC,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;IAC9E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,KAAK,CAAC,gBAAgB;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,WAAW,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAClI,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAClC,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAC7D,8BAA8B,CAAC,4BAA4B,EAC3D,IAAI,GAAG,EAAE,EACT,EAAE,EACF,CAAE,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAE,EAC5G,EAAE,CACH,CAAC;QAEF,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC5F,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAAC,IAAI,CAAc,OAAO,EAAE,EAAG,CAAC,CAAC;QAE/E,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,2HAA2H;iBACrI;aACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,kBAAkB,CAAC,GAAG,CAAC;IAChC,CAAC;IAEM,KAAK,CAAC,sBAAsB,CACjC,MAAsC;QAGtC,IAAI,CAAC,QAAQ,CAAC,2BAA2B,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAC,mBAAmB,EAAE,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAC,kBAAkB,EAAE,MAAM,CAAC,SAAS,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAEtM,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAA6B,CAAC;QAEnH,MAAM,IAAI,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAEvE,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,+BAA+B,EACtC,MAAM,CAAC,YAAY,IAAI,EAAE,EAAE,2DAA2D;QACtF,MAAM,CAAC,cAAc,IAAI,EAAE,EAC3B,MAAM,CAAC,oBAAoB,IAAI,EAAE;QACjC,6FAA6F;QAC7F,gGAAgG;QAChG,6FAA6F;QAC7F,mEAAmE;QACnE,SAAS,EACT,CAAC,EACD,SAAS,EACT,IAAI,EACJ,MAAM,CAAC,gBAAgB,CACxB,CAAC;QAEF,IAAG,SAAS,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,WAAW,EAAE,CAAC;YACvE,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE,EAAE,aAAa,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,gBAAgB,CAAC,qBAAqB,EAAE,CAAC,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC,gBAAgB,CAAC,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QAEhT,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,qBAAqB;QACrB,IAAI,CAAC,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;QAEjD,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACK,yBAAyB,CAAC,gBAAuC;QACvE,IAAI,CAAC;YACH,0EAA0E;YAC1E,2EAA2E;YAC3E,0EAA0E;YAC1E,6EAA6E;YAC7E,oCAAoC;YACpC,IAAI,gBAAgB,CAAC,aAAa,KAAK,8BAA8B,CAAC,4BAA4B,EAAE,CAAC;gBACnG,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,MAAM,UAAU,GAA2B,EAAE,CAAC;YAC9C,IAAI,gBAAgB,CAAC,aAAa,EAAE,CAAC;gBACnC,UAAU,CAAC,qBAAqB,CAAC,GAAG,gBAAgB,CAAC,aAAa,CAAC;YACrE,CAAC;YACD,IAAI,gBAAgB,CAAC,cAAc,EAAE,CAAC;gBACpC,UAAU,CAAC,sBAAsB,CAAC,GAAG,gBAAgB,CAAC,cAAc,CAAC;YACvE,CAAC;YACD,IAAI,gBAAgB,CAAC,MAAM,EAAE,CAAC;gBAC5B,UAAU,CAAC,cAAc,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC;YACvD,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;QAC/E,CAAC;IACH,CAAC;IAGI,KAAK,CAAC,0BAA0B,CACrC,MAA6D;QAG7D,OAAO,IAAI,CAAC,sBAAsB,CAAC;YACjC,GAAG,MAAM;YACT,aAAa,EAAE,8BAA8B,CAAC,4BAA4B;SAC3E,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,KAAK,CAAC,iCAAiC,CAG5C,MAAsC;QAEtC,OAAO,IAAI,CAAC,sBAAsB,CAA2B,MAAM,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACI,KAAK,CAAC,oCAAoC,CAC/C,MAGC;QAED,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC;QACvE,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,yCAAyC,CAC3F,YAAY,EACZ,mBAAmB,CACpB,CAAC;QACF,OAAO,IAAI,CAAC,0BAA0B,CAA2B;YAC/D,GAAG,aAAa;YAChB,SAAS,EAAE,aAAa;SACzB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACI,KAAK,CAAC,iCAAiC,CAC5C,MAGC;QAED,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC;QACvE,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,8BAA8B,CAChF,YAAY,EACZ,mBAAmB,CACpB,CAAC;QACF,OAAO,IAAI,CAAC,0BAA0B,CAA2B;YAC/D,GAAG,aAAa;YAChB,SAAS,EAAE,aAAa;SACzB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACI,KAAK,CAAC,4BAA4B,CACvC,MAIC;QAED,MAAM,EAAE,qBAAqB,EAAE,+BAA+B,EAAE,oBAAoB,EAAE,GAAG,MAAM,CAAC;QAEhG,IAAI,qBAAqB,CAAC,IAAI,KAAK,uBAAuB,CAAC,cAAc,EAAE,CAAC;YAC1E,OAAO,IAAI,CAAC,yCAAyC,CAAC;gBACpD,qBAAqB;gBACrB,+BAA+B;gBAC/B,oBAAoB;aACrB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB;aACjD,oBAAoB,EAAE;aACtB,sBAAsB,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;QAEpE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,iBAAiB,qBAAqB,CAAC,mBAAmB,+BAA+B,qBAAqB,CAAC,kBAAkB,GAAG;oBAC7I,kBAAkB,EAAE,qBAAqB,CAAC,kBAAkB;oBAC5D,mBAAmB,EAAE,qBAAqB,CAAC,mBAAmB;iBAC/D;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,iBAAiB;YACjE,CAAC,CAAC,4BAA4B,CAAC,QAAQ;YACvC,CAAC,CAAC,4BAA4B,CAAC,SAAS,CAAC;QAE3C,MAAM,mBAAmB,GAAG,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACzE,SAAS,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,mBAAmB;eACxE,SAAS,CAAC,WAAW,KAAK,mBAAmB,CACjD,CAAC;QAEF,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,uDAAuD,qBAAqB,CAAC,kBAAkB,IAAI,qBAAqB,CAAC,mBAAmB,GAAG;oBACxJ,kBAAkB,EAAE,qBAAqB,CAAC,kBAAkB;oBAC5D,mBAAmB,EAAE,qBAAqB,CAAC,mBAAmB;oBAC9D,mBAAmB;oBACnB,YAAY,EAAE,mBAAmB,CAAC,MAAM;iBACzC;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,CAAC,CAAC;eAC5C,IAAI,CAAC,uCAAuC,CAAC,cAAc,EAAE,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;QAE7G,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC;YAC7D,SAAS,EAAE,kCAAkC,CAAC,oBAAoB,CAAC,kBAAkB,CAAC;YACtF,+BAA+B;YAC/B,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,IAAI,CAAC,yBAAyB,EAAE;YAChD,oBAAoB;SACrB,CAAC,CAAC;QAEH,MAAM,uBAAuB,GAAmD,mBAAmB,KAAK,4BAA4B,CAAC,QAAQ;YAC3I,CAAC,CAAC;gBACE,GAAG,kBAAkB;gBACrB,mBAAmB,EAAE,qBAAqB,CAAC,mBAAmB;gBAC9D,WAAW,EAAE,4BAA4B,CAAC,QAAQ;gBAClD,cAAc,EAAE,qBAAqB,CAAC,iBAAiB,IAAI,EAAE;gBAC7D,kBAAkB,EAAE,KAAK;gBACzB,KAAK,EAAE,EAAE;aACwC;YACrD,CAAC,CAAC;gBACE,GAAG,kBAAkB;gBACrB,mBAAmB,EAAE,qBAAqB,CAAC,mBAAmB;gBAC9D,WAAW,EAAE,4BAA4B,CAAC,SAAS;gBACnD,kBAAkB,EAAE,KAAK;gBACzB,KAAK,EAAE,EAAE;aACwC,CAAC;QAExD,OAAO,gBAAgB,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACK,KAAK,CAAC,yCAAyC,CACrD,MAOC;QAED,MAAM,EAAE,qBAAqB,EAAE,+BAA+B,EAAE,oBAAoB,EAAE,GAAG,MAAM,CAAC;QAEhG,MAAM,sBAAsB,GAAG,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CAClF,gBAAgB,CAAC,WAAW,EAC5B,qBAAqB,CAAC,IAAI,CAC3B,CAAC;QACF,MAAM,kBAAkB,GAAG,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,CAAC;QAEtG,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC;YAC7D,SAAS,EAAE,kCAAkC,CAAC,oBAAoB,CAAC,kBAAkB,CAAC;YACtF,+BAA+B;YAC/B,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,IAAI,CAAC,yBAAyB,EAAE;YAChD,oBAAoB;SACrB,CAAC,CAAC;QAEH,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,iBAAiB;YACjE,CAAC,CAAC,4BAA4B,CAAC,QAAQ;YACvC,CAAC,CAAC,4BAA4B,CAAC,SAAS,CAAC;QAE3C,MAAM,uBAAuB,GAAmD,mBAAmB,KAAK,4BAA4B,CAAC,QAAQ;YAC3I,CAAC,CAAC;gBACE,GAAG,kBAAkB;gBACrB,mBAAmB,EAAE,qBAAqB,CAAC,mBAAmB;gBAC9D,WAAW,EAAE,4BAA4B,CAAC,QAAQ;gBAClD,cAAc,EAAE,qBAAqB,CAAC,iBAAiB,IAAI,EAAE;gBAC7D,oBAAoB,EAAE,qBAAqB,CAAC,YAAY;gBACxD,kBAAkB,EAAE,KAAK;gBACzB,KAAK,EAAE,EAAE;aACwC;YACrD,CAAC,CAAC;gBACE,GAAG,kBAAkB;gBACrB,mBAAmB,EAAE,qBAAqB,CAAC,mBAAmB;gBAC9D,WAAW,EAAE,4BAA4B,CAAC,SAAS;gBACnD,oBAAoB,EAAE,qBAAqB,CAAC,YAAY;gBACxD,kBAAkB,EAAE,KAAK;gBACzB,KAAK,EAAE,EAAE;aACwC,CAAC;QAExD,OAAO,gBAAgB,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC;IACjE,CAAC;IAGD,KAAK,CAAC,wBAAwB,CAC5B,MAA6D;QAG7D,OAAO,IAAI,CAAC,sBAAsB,CAAC;YACjC,GAAG,MAAM;YACT,aAAa,EAAE,8BAA8B,CAAC,gBAAgB;SAC/D,CAAC,CAAC;IACL,CAAC;IAID;;;;;;OAMG;IACI,KAAK,CAAC,gCAAgC;QAC3C,2DAA2D;QAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CACzE,gBAAgB,CAAC,WAAW,EAC5B,qBAAqB,CAAC,IAAI,CAC3B,CAAC;QACF,MAAM,eAAe,GAAG,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;QAE1F,OAAO,IAAI,CAAC,0BAA0B,CAAC;YACrC,SAAS,EAAE,eAAe;YAC1B,+BAA+B,EAAE,IAAI,GAAG,EAAE;YAC1C,YAAY,EAAE,IAAI,EAAE,+BAA+B;YACnD,cAAc,EAAE,IAAI,CAAC,yBAAyB,EAAE;YAChD,oBAAoB,EAAE,EAAE;SACzB,CAAC,CAAC;IACL,CAAC;IAEO,uCAAuC,CAC7C,cAAwC,EACxC,mBAA2B;QAE3B,MAAM,wBAAwB,GAAG,cAAc,CAAC,UAAU,CAAC,MAAM,CAC/D,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,mBAAmB,KAAK,mBAAmB,CACrE,CAAC;QAEF,+FAA+F;QAC/F,6FAA6F;QAC7F,0FAA0F;QAC1F,sCAAsC;QACtC,EAAE;QACF,wFAAwF;QACxF,gGAAgG;QAChG,4FAA4F;QAC5F,kGAAkG;QAClG,4FAA4F;QAC5F,kGAAkG;QAClG,EAAE;QACF,yFAAyF;QACzF,iGAAiG;QACjG,iGAAiG;QACjG,0EAA0E;QAC1E,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,MAAM,CACvD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,kBAAkB,KAAK,IAAI,CACrD,CAAC;YACF,MAAM,gBAAgB,GAAG,uCAAuC;iBAC7D,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;iBAC5G,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAChD,IAAI,gBAAgB,EAAE,CAAC;gBACrB,OAAO,gBAAgB,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,kHAAkH;oBAC3H,kBAAkB,EAAE,cAAc,CAAC,kBAAkB;oBACrD,mBAAmB;oBACnB,iBAAiB,EAAE,wBAAwB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;wBAC9D,WAAW,EAAE,SAAS,CAAC,WAAW;wBAClC,UAAU,EAAE,SAAS,CAAC,UAAU;wBAChC,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;qBACjD,CAAC,CAAC;iBACJ;aACF,CACF,CAAC;QACJ,CAAC;QACD,MAAM,uBAAuB,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;QAE5D,IAAI,uBAAuB,EAAE,CAAC;YAC5B,OAAO,uBAAuB,CAAC;QACjC,CAAC;QAED,MAAM,qBAAqB,GAAG,cAAc,CAAC,UAAU,CAAC,MAAM,CAC5D,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI;eACtE,SAAS,CAAC,kBAAkB,KAAK,IAAI,CAC3C,CAAC;QACF,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,4FAA4F;oBACrG,kBAAkB,EAAE,cAAc,CAAC,kBAAkB;oBACrD,mBAAmB;oBACnB,iBAAiB,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;wBAC3D,WAAW,EAAE,SAAS,CAAC,WAAW;wBAClC,UAAU,EAAE,SAAS,CAAC,UAAU;qBACjC,CAAC,CAAC;iBACJ;aACF,CACF,CAAC;QACJ,CAAC;QACD,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAEtD,IAAI,oBAAoB,EAAE,CAAC;YACzB,OAAO,oBAAoB,CAAC;QAC9B,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;YACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACP,OAAO,EAAE,iBAAiB,mBAAmB,6DAA6D,cAAc,CAAC,kBAAkB,gEAAgE;gBAC3M,kBAAkB,EAAE,cAAc,CAAC,kBAAkB;gBACrD,mBAAmB;aACpB;SACF,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,wBAAwB,CACnC,aAKC,EACD,WAKC;QAED,8DAA8D;QAC9D,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CACzE,gBAAgB,CAAC,WAAW,EAC5B,qBAAqB,CAAC,IAAI,CAC3B,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;QAEpF,gDAAgD;QAChD,MAAM,YAAY,GAAkC;YAClD,aAAa,EAAE,aAAa,CAAC,aAAa;YAC1C,cAAc,EAAE,aAAa,CAAC,cAAc;YAC5C,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,iBAAiB,EAAE,WAAW,CAAC,WAAW;SAC3C,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,8BAA8B,CAAC,gBAAgB,EAC/C,IAAI,GAAG,EAAE,EACT,YAAY,EACZ,EAAE,EAAE,+DAA+D;QACnE,EAAE,CACH,CAAC;QAEF,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,CAAC,CAAC;QAE3D,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,6BAA6B,CACxC,oBAAwC,EACxC,iBAAqC;QAErC,oDAAoD;QACpD,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAE7E,wDAAwD;QACxD,IAAI,CAAC,oBAAoB,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAChD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE,EAAE,OAAO,EAAE,oEAAoE,EAAE;aAC3F,CACF,CAAC;QACJ,CAAC;QAED,uBAAuB;QACvB,MAAM,OAAO,GAAG,0BAA0B,CAAC,+BAA+B,CAAC,oBAAoB,CAAC,CAAC;QACjG,MAAM,aAAa,GAAG,0BAA0B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,CAAC;QAE7F,uCAAuC;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;QAEpF,mEAAmE;QACnE,oIAAoI;QACpI,+EAA+E;QAC/E,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC;QACtD,IAAI,OAAO,CAAC,+BAA+B,EAAE,CAAC;YAC5C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBAC/E,wFAAwF;gBACxF,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBAClE,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;QACL,CAAC;QAED,+BAA+B;QAC/B,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;QAEhE,gEAAgE;QAChE,IAAI,OAAO,CAAC,aAAa,KAAK,8BAA8B,CAAC,4BAA4B,EAAE,CAAC;YAC1F,OAAO,IAAI,CAAC,0BAA0B,CAAC;gBACrC,SAAS;gBACT,+BAA+B,EAAE,mBAAmB;gBACpD,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,oBAAoB;aACrB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,CAAC,aAAa,KAAK,8BAA8B,CAAC,gBAAgB,EAAE,CAAC;YACrF,OAAO,IAAI,CAAC,wBAAwB,CAAC;gBACnC,SAAS;gBACT,+BAA+B,EAAE,mBAAmB;gBACpD,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,oBAAoB;aACrB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,CAAC,aAAa,KAAK,8BAA8B,CAAC,iBAAiB,EAAE,CAAC;YACtF,iGAAiG;YACjG,OAAO,IAAI,CAAC,sBAAsB,CAAC;gBACjC,aAAa,EAAE,8BAA8B,CAAC,iBAAiB;gBAC/D,SAAS;gBACT,+BAA+B,EAAE,mBAAmB;gBACpD,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;gBAC5I,oBAAoB;aACrB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,CAAC,aAAa,KAAK,8BAA8B,CAAC,gBAAgB,EAAE,CAAC;YACrF,2EAA2E;YAC3E,OAAO,IAAI,CAAC,wBAAwB,CAClC;gBACE,aAAa,EAAE,OAAO,CAAC,YAAY,EAAE,aAAa;gBAClD,cAAc,EAAE,OAAO,CAAC,YAAY,EAAE,cAAc;gBACpD,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,MAAM;aACrC,EACD;gBACE,WAAW,EAAE,OAAO,CAAC,YAAY,EAAE,iBAAiB,IAAI,SAAS;gBACjE,WAAW,EAAE,eAAe;gBAC5B,OAAO,EAAE,eAAe;gBACxB,SAAS,EAAE,eAAe;aAC3B,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,2DAA2D;YAC3D,OAAO,IAAI,CAAC,sBAAsB,CAAC;gBACjC,aAAa,EAAE,OAAO,CAAC,aAA+C;gBACtE,SAAS;gBACT,+BAA+B,EAAE,mBAAmB;gBACpD,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,oBAAoB;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,kCAAkC,CACxC,SAA0D,EAC1D,YAA0B;QAE1B,+FAA+F;QAC/F,gGAAgG;QAChG,kGAAkG;QAClG,uFAAuF;QACvF,MAAM,mBAAmB,GAAG,IAAI,CAAC,wBAAwB,CAAC,2BAA2B,EAAE,CAAC,YAAY,CAAC,CAAC;QACtG,IAAI,CAAC,mBAAmB,EAAE,UAAU,IAAI,CAAC,IAAI,CAAC,uBAAuB;YAAE,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAEjG,MAAM,2BAA2B,GAAG,mBAAmB,CAAC,oBAAoB;YAC1E,CAAC,CAAC,iCAAiC,CAAC,mBAAmB,CAAC,oBAAoB,CAAC;YAC7E,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8C,CAAC;QACvE,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,IAAI,CAAC,uBAAuB;iBAC5C,iCAAiC,CAAC,mBAAmB,CAAC,UAAU,EAAE,eAAe,CAAC;iBAClF,MAAM,GAAG,CAAC,CAAC;YACd,IAAI,UAAU,IAAI,eAAe,KAAK,2BAA2B,EAAE,CAAC;gBAClE,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,QAAQ,CAAC,mFAAmF,EAAE;gBACjG,YAAY;gBACZ,OAAO;gBACP,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,gBAAgB,CACpB,aAAoC,EACpC,YAA0B,EAC1B,mBAA0C,EAC1C,OAAwB,EACxB,UAAmB,EACnB,mBAA0D;QAG1D,oCAAoC;QACpC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,6GAA6G;iBACvH;aACF,CACF,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,MAAM,YAAY,GAAG,aAAa,CAAC,eAAe,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,EAAE,CAAC;QACrB,IAAI,YAAY,IAAI,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,aAAa,EACb;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,uBAAuB,SAAS,2CAA2C;oBACpF,YAAY;oBACZ,mBAAmB;oBACnB,YAAY;iBACb;aACF,CACF,CAAC;QACJ,CAAC;QAED,mGAAmG;QACnG,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,GAAG,YAAY,IAAI,UAAU,EAAE,CAAC;YACjD,IAAI,aAAa,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,aAAa,EACb;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACP,OAAO,EAAE,iCAAiC,QAAQ,iCAAiC;wBACnF,QAAQ;wBACR,YAAY;wBACZ,mBAAmB;qBACpB;iBACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,oDAAoD;QACpD,0EAA0E;QAC1E,6EAA6E;QAC7E,iEAAiE;QACjE,2FAA2F;QAC3F,kEAAkE;QAClE,EAAE;QACF,kFAAkF;QAClF,IAAI,mBAAmB,KAAK,qBAAqB,CAAC,MAAM,IAAI,mBAAmB,EAAE,CAAC;YAChF,MAAM,qBAAqB,GAAG,aAAa,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;YAC5F,IAAI,qBAAqB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBACjD,MAAM,gBAAgB,GAAG,CAAC,GAAG,qBAAqB,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC9E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,aAAa,EACb;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACP,OAAO,EAAE,wDAAwD,YAAY,sEAAsE,gBAAgB,EAAE;wBACrK,YAAY;wBACZ,mBAAmB;wBACnB,gBAAgB;qBACjB;iBACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,2EAA2E;QAC3E,+CAA+C;QAC/C,EAAE;QACF,4EAA4E;QAC5E,sEAAsE;QACtE,6EAA6E;QAC7E,yEAAyE;QACzE,yEAAyE;QACzE,6EAA6E;QAC7E,+DAA+D;QAC/D,IAAI,aAA4D,CAAC;QACjE,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;YACxB,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,YAAY,EAAE,mBAAmB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/H,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;QAClH,CAAC;QAED,qCAAqC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;QAEpF,qGAAqG;QACrG,EAAE;QACF,iGAAiG;QACjG,kGAAkG;QAClG,gGAAgG;QAChG,wFAAwF;QACxF,EAAE;QACF,8FAA8F;QAC9F,oGAAoG;QACpG,gGAAgG;QAChG,kDAAkD;QAClD,EAAE;QACF,8FAA8F;QAC9F,gGAAgG;QAChG,uFAAuF;QACvF,gGAAgG;QAChG,+FAA+F;QAC/F,kEAAkE;QAClE,MAAM,+BAA+B,GAAG,IAAI,CAAC,kCAAkC,CAC7E,aAAa,CAAC,qBAAqB,EAAqD,EACxF,YAAY,CACb,CAAC;QACF,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,IAAI,CAAC,wBAAwB,CAAC,8BAA8B,EAAE,CAAC;YACnF,MAAM,eAAe,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;YAClD,IAAI,eAAe,EAAE,CAAC;gBACpB,+BAA+B,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,yFAAyF;QACzF,EAAE;QACF,iGAAiG;QACjG,+FAA+F;QAC/F,+FAA+F;QAC/F,+FAA+F;QAC/F,8EAA8E;QAC9E,EAAE;QACF,wFAAwF;QACxF,sGAAsG;QACtG,kDAAkD;QAClD,MAAM,oBAAoB,GAAG,CAAC,GAAG,aAAa,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE;YACxF,IAAI,CAAC,SAAS,CAAC,iBAAiB;gBAAE,OAAO,IAAI,CAAC;YAC9C,OAAO,IAAI,CAAC,kCAAkC,CAC5C,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,iBAA4C,EAAE,EAAE,CAAC,CAAC,CAAC,EACvE,YAAY,CACb,CAAC,IAAI,GAAG,CAAC,CAAC;QACb,CAAC,CAAC,CAAC;QACH,IAAI,mBAAmB,EAAE,CAAC;YACxB,oBAAoB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACjD,CAAC;QAED,oEAAoE;QACpE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAS,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC;QAC9E,IAAI,UAAU,EAAE,CAAC;YACf,gBAAgB,CAAC,GAAG,CAAC,GAAG,YAAY,IAAI,UAAU,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,+CAA+C;QAC/C,sEAAsE;QACtE,MAAM,cAAc,GAAG,IAAI,gBAAgB,CACzC,SAAS,EACT,aAAa,CAAC,aAAa,EAAY,wBAAwB;QAC/D,+BAA+B,EAAQ,2BAA2B;QAClE,aAAa,CAAC,YAAY,EAAa,0CAA0C;QACjF,CAAC,GAAG,aAAa,CAAC,cAAc,CAAC,EAAM,gCAAgC;QACvE,oBAAoB,EAAmB,wCAAwC;QAC/E,aAAa,CAAC,aAAa,EAAc,+BAA+B;QACxE,YAAY,GAAG,CAAC,EAAuB,iCAAiC;QACxE,gBAAgB,EAAuB,oCAAoC;QAC3E,aAAa,CAAC,cAAc,EAAW,mCAAmC;QAC1E,iGAAiG;QACjG,gGAAgG;QAChG,gGAAgG;QAChG,wFAAwF;QACxF,aAAa,CAAC,gBAAgB,CAC/B,CAAC;QACF,kGAAkG;QAClG,gGAAgG;QAChG,oGAAoG;QACpG,kGAAkG;QAClG,+FAA+F;QAC/F,IAAI,aAAa,CAAC,eAAe,EAAE,CAAC;YAClC,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QACD,4FAA4F;QAC5F,kGAAkG;QAClG,0FAA0F;QAC1F,6FAA6F;QAC7F,8FAA8F;QAC9F,cAAc,CAAC,sCAAsC,CAAC,aAAa,CAAC,CAAC;QACrE,OAAO,cAAc,CAAC;IACxB,CAAC;IAEM,KAAK,CAAC,iCAAiC,CAK5C,GAAY,EACZ,SAAiG,EACjG,aAA+D;QAG/D,IAAI,CAAC,QAAQ,CAAC,yCAAyC,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,mBAAmB,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAEzI,yCAAyC;QACzC,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,EAAE,gBAAsC,CAAC;QACrE,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,gBAAgB,CAAuB,CAAC;QACxF,MAAM,eAAe,GAAG,qBAAqB,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,MAAM,MAAM,GAAG,eAAe,EAAE,MAAM,CAAC;QAEvC,sDAAsD;QACtD,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,wDAAwD;gBACxD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2CAA2C;oBAC/F,OAAO,EAAE,EAAE,mBAAmB,EAAE,SAAS,CAAC,mBAAmB,EAAE;iBAChE,CAAC,CAAC;YACL,CAAC;YAED,IAAI,MAAM,KAAK,yBAAyB,CAAC,WAAW,EAAE,CAAC;gBACrD,IAAI,CAAC,QAAQ,CAAC,wEAAwE,CAAC,CAAC;gBAExF,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,IAAI,EAAE,CAAC;gBAClD,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAC3E,UAAU,EACV,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CACrD,CAAC;gBAEF,0EAA0E;gBAC1E,MAAM,YAAY,GAA2B,EAAE,CAAC;gBAChD,IAAI,qBAAqB,CAAC,cAAc,EAAE,CAAC;oBACzC,YAAY,CAAC,cAAc,GAAG,qBAAqB,CAAC,cAAc,CAAC;gBACrE,CAAC;gBACD,IAAI,qBAAqB,CAAC,SAAS,EAAE,CAAC;oBACpC,MAAM,uBAAuB,GAAG,IAAI,CAAC,8BAA8B,CAAC,SAAS,CAAC,CAAC;oBAC/E,IAAI,uBAAuB,EAAE,CAAC;wBAC5B,YAAY,CAAC,uBAAuB,CAAC,GAAG,qBAAqB,CAAC,SAAS,CAAC;oBAC1E,CAAC;gBACH,CAAC;gBACD,IAAI,qBAAqB,CAAC,MAAM,EAAE,CAAC;oBACjC,YAAY,CAAC,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC;gBACrD,CAAC;gBAED,MAAM,4BAA4B,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;gBACvG,MAAM,oBAAoB,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC;gBAEzG,MAAM,YAAY,GAAG;oBACnB,iBAAiB,EAAE,qBAAqB,CAAC,GAAG;oBAC5C,cAAc,EAAE,qBAAqB,CAAC,cAAc;oBACpD,MAAM,EAAE,qBAAqB,CAAC,MAAM;oBACpC,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC;iBAC1D,CAAC;gBAEF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,8BAA8B,CAAC,gBAAgB,EAC/C,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,EACrD,YAAY,EACZ,qBAAqB,CAAC,KAAK,IAAI,EAAE,EACjC,oBAAoB,CACrB,CAAC;gBAEF,gBAAgB,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;gBAErD,IAAI,SAAS,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,WAAW,EAAE,CAAC;oBACxE,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,CAAC,CAAC;gBAC7D,CAAC;gBAED,OAAO,gBAAgB,CAAC;YAC1B,CAAC;YAED,yEAAyE;QAC3E,CAAC;QAED,6CAA6C;QAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAuB,CAAC;QAEpF,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,gBAAoD,CAAC;YAEzD,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnC,gBAAgB,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YACtG,CAAC;iBAAM,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChF,0EAA0E;gBAC1E,8EAA8E;gBAC9E,+GAA+G;gBAC/G,kFAAkF;gBAClF,kFAAkF;gBAClF,+EAA+E;gBAC/E,gBAAgB,GAAG,MAAM,IAAI,CAAC,qCAAqC,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YACjH,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;gBAChD,gBAAgB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;gBAE5F,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAuB,CAAC;gBACpF,IAAI,WAAW,EAAE,CAAC;oBAChB,gBAAgB,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;YAED,kEAAkE;YAClE,IAAI,MAAM,KAAK,yBAAyB,CAAC,QAAQ,EAAE,CAAC;gBAClD,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uBAAuB;wBAC3E,OAAO,EAAE,EAAE,mBAAmB,EAAE,SAAS,CAAC,mBAAmB,EAAE;qBAChE,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,aAAa,GAAG,eAAgB,CAAC,KAAK,IAAI,EAAE,CAAC;gBACnD,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAC3E,WAAW,EACX,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CACrD,CAAC;gBAEF,IAAI,qBAAqB,CAAC,MAAM,IAAI,gBAAgB,CAAC,YAAY,EAAE,MAAM;uBACpE,qBAAqB,CAAC,MAAM,KAAK,gBAAgB,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;oBAC3E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;wBACrF,OAAO,EAAE,EAAE,mBAAmB,EAAE,SAAS,CAAC,mBAAmB,EAAE;qBAChE,CAAC,CAAC;gBACL,CAAC;gBAED,gBAAgB,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC;YACxD,CAAC;YAED,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,mFAAmF;QACnF,IAAI,MAAM,KAAK,yBAAyB,CAAC,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uBAAuB;gBAC3E,OAAO,EAAE,EAAE,mBAAmB,EAAE,SAAS,CAAC,mBAAmB,EAAE;aAChE,CAAC,CAAC;QACL,CAAC;QAED,kFAAkF;QAClF,MAAM,qBAAqB,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAuB,CAAC;QACnG,IAAI,qBAAqB,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,oCAAoC,CAAC,qBAAqB,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QACzG,CAAC;QAED,kFAAkF;QAClF,MAAM,sBAAsB,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,sBAAsB,CAAuB,CAAC;QACzG,IAAI,sBAAsB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,0BAA0B,CAAC,sBAAsB,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAChG,CAAC;QAED,wFAAwF;QACxF,IAAI,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,mCAAmC,CAAC,SAAS,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QACjF,CAAC;QAED,uEAAuE;QACvE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC,EAAE,CAAC,CAAC;IACvG,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACI,KAAK,CAAC,yCAAyC,CAAC,GAAY;QACjE,IAAI,CAAC,QAAQ,CAAC,kDAAkD,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAExG,kCAAkC;QAClC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAW,CAAC;QACxE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC,EAAE,CAClG,CAAC;QACJ,CAAC;QAED,kGAAkG;QAClG,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CACzE,gBAAgB,CAAC,WAAW,EAC5B,qBAAqB,CAAC,IAAI,CAC3B,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;QACpF,MAAM,WAAW,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAE7D,mCAAmC;QACnC,MAAM,WAAW,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,0FAA0F;YAC1F,4FAA4F;YAC5F,yCAAyC;YACzC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;YAC7C,MAAM,kCAAkC,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;YAE5I,IAAI,CAAC;gBACH,kEAAkE;gBAClE,8EAA8E;gBAC9E,IAAI,WAAW,KAAK,WAAW,CAAC,YAAY,EAAE,CAAC;oBAC7C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;qBAC/E,CACF,CAAC;gBACJ,CAAC;gBACD,iDAAiD;gBACjD,MAAM,mBAAmB,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;gBAC3G,8EAA8E;gBAC9E,2EAA2E;gBAC3E,mDAAmD;gBACnD,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAoB,WAAW,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;gBAExH,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;oBACvG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,CAC1H,CAAC;gBACJ,CAAC;gBAED,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,8BAA8B,CAAC,mBAAmB,EAClD,IAAI,GAAG,EAAE,EACT,EAAE,iBAAiB,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,GAAG,EAAE,EAAE,EAC7F,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,iBAAiB,EAAE,SAAS,CAAC,aAAa,EAAE,CAAC,EACrI,EAAE,CACH,CAAC;gBACF,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;gBACjE,OAAO,gBAAgB,CAAC;YAC1B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,mCAAmC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAChE,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAEhD,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,gCAAgC,CAAC,KAAK,CAAC,CAAC;YACtF,MAAM,YAAY,GAAG,wBAAwB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YACrE,4FAA4F;YAC5F,4FAA4F;YAC5F,oFAAoF;YACpF,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC;YAEpC,IAAI,YAAY,CAAC,IAAI,KAAK,8BAA8B,CAAC,YAAY,EAAE,CAAC;gBACtE,MAAM,YAAY,GAAG,YAAY,CAAC;gBAClC,qEAAqE;gBACrE,+DAA+D;gBAC/D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,kCAAkC,CAC5D,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,GAAyB,CAC/E,CAAC;gBACF,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;wBACnF,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;qBACzC,CAAC,CAAC;gBACL,CAAC;gBACD,iGAAiG;gBACjG,iGAAiG;gBACjG,2EAA2E;gBAC3E,4CAA4C;gBAC5C,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,MAAM,gCAAgC,CAC1E,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,GAAyB,CAClF,CAAC;gBACF,IAAI,cAAc,EAAE,CAAC;oBACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;wBACnF,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE;qBAC3C,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAC3D,YAAY,CAAC,MAAM,EACnB,WAAW,EACX,YAAY,CAAC,oBAAoB,CAClC,CAAC;gBACF,MAAM,cAAc,GAAG,IAAI,CAAC,qCAAqC,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;gBAEvF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,8BAA8B,CAAC,YAAY,EAC3C,IAAI,GAAG,EAAE,EACT;oBACE,MAAM,EAAE,YAAY,CAAC,MAAM;oBAC3B,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9C,EACD,cAAc,EACd,EAAE,EACF,SAAS,EAAE,gBAAgB;gBAC3B,CAAC,EAAU,eAAe;gBAC1B,SAAS,EAAE,mBAAmB;gBAC9B,YAAY,CAAC,cAAc,IAAI,IAAI,CACpC,CAAC;gBACF,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,CAAC,CAAC;gBAC3D,OAAO,gBAAgB,CAAC;YAC1B,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,CAC7G,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,+BAA+B,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kGAAkG,EAAE;oBACpH,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;oBACpD,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,IAAI,EAAE,GAAG,CAAC,WAAW;iBACtB,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE;oBAC9D,KAAK,EAAE,KAAK,CAAC,sBAAsB;oBACnC,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,IAAI,EAAE,GAAG,CAAC,WAAW;iBACtB,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,KAAK,CAAC,CAAC,yBAAyB;YACxC,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,CAChJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,qCAAqC,CAC3C,GAAY,EACZ,cAA2C;QAE3C,MAAM,wBAAwB,GAAG;YAC/B,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAA4B,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;SAC7G,CAAC;QAEF,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;gBAC7F,OAAO,EAAE;oBACP,eAAe,EAAE,gBAAgB;oBACjC,MAAM,EAAE,wBAAwB;oBAChC,OAAO,EAAE;wBACP,SAAS,EAAE,CAAC,WAAW,CAAC;wBACxB,WAAW,EAAE,wBAAwB;wBACrC,UAAU,EAAE,CAAC,WAAW,CAAC;wBACzB,WAAW,EAAE,CAAC,WAAW,CAAC;qBAC3B;iBACF;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,yBAAyB,GAAG;YAChC,GAAG,IAAI,GAAG,CACR,cAAc,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,aAAa,IAAI,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;iBACrI,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,iBAA2B,CAAC,CAC3D;SACF,CAAC;QAEF,MAAM,uBAAuB,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,uBAAuB,EAAE,CAAC;YAC5B,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;oBAChF,OAAO,EAAE;wBACP,wBAAwB;wBACxB,cAAc,EAAE,uBAAuB;qBACxC;iBACF,CACF,CAAC;YACJ,CAAC;YACD,OAAO,uBAAuB,CAAC;QACjC,CAAC;QAED,OAAO,yBAAyB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACK,KAAK,CAAC,qCAAqC,CAAC,QAA4B;QAC9E,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,oCAAoC,CAAC;gBACjE,YAAY,EAAE,gBAAgB,CAAC,0BAA0B;gBACzD,mBAAmB,EAAE,qBAAqB,CAAC,IAAI;aAChD,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB;iBAC3C,aAAa,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;iBAC1D,IAAI,CAA0B,UAAU,EAAE,QAAQ,CAAC,CAAC;YACvD,oFAAoF;YACpF,OAAO,MAAM,EAAE,cAAc,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qGAAqG,EAAE;gBACtH,QAAQ;gBACR,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE,EAAE,MAAM,EAAE,uCAAuC,EAAE;aAC7D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,iCAAiC,CACvC,uBAA2C,EAC3C,cAA2C,EAC3C,2BAA8D;QAE9D,MAAM,yBAAyB,GAAG;YAChC,GAAG,IAAI,GAAG,CACR,cAAc,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,aAAa,IAAI,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;iBACrI,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,iBAA2B,CAAC,CAC3D;SACF,CAAC;QAEF,IAAI,uBAAuB,IAAI,yBAAyB,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC3F,OAAO,uBAAuB,CAAC;QACjC,CAAC;QAED,iGAAiG;QACjG,uFAAuF;QACvF,IAAI,uBAAuB,IAAI,2BAA2B,KAAK,iCAAiC,CAAC,aAAa,EAAE,CAAC;YAC/G,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,yBAAyB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,CAAC;IAEO,wBAAwB,CAK9B,SAAiG;QAEjG,OAAO,IAAI,gBAAgB,CAAE,SAAS,EAAE,8BAA8B,CAAC,4BAA4B,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAChI,CAAC;IAED;;;;;;;;;;OAUG;IACK,yBAAyB,CAC/B,aAA+D,EAC/D,eAAuC;QAEvC,MAAM,oBAAoB,GAA2C,EAAE,CAAC;QAExE,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;YAC9B,OAAO,oBAAoB,CAAC;QAC9B,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YACrD,IAAI,KAAK,EAAE,CAAC;gBACV,oBAAoB,CAAC,IAAI,CAAC;oBACxB,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;oBAC1C,UAAU,EAAE,KAAK;oBACjB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;iBACzC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED;;;;;;;;OAQG;IACK,qBAAqB,CAAC,MAA0C,EAAE,eAAuB;QAC/F,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,kEAAkE;QAClE,MAAM,WAAW,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;OAWG;IACK,uBAAuB,CAAC,KAA0B,EAAE,eAAuB;QACjF,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,yBAAyB;QACzB,MAAM,WAAW,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/B,8EAA8E;gBAC9E,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,2DAA2D;gBAC3D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YAChE,IAAI,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/B,2DAA2D;oBAC3D,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7E,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;OAQG;IACK,sBAAsB,CAAC,IAAS,EAAE,eAAuB;QAC/D,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,yBAAyB;QACzB,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAC/D,IAAI,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7E,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;OAUG;IACK,uBAAuB,CAAC,YAAiC,EAAE,eAAuB;QACxF,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,yBAAyB;QACzB,MAAM,WAAW,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;YACvE,IAAI,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7E,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,GAAQ,EAAE,IAAY;QAC3C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,OAAO,GAAG,GAAG,CAAC;QAElB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC7E,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,qBAAqB,CAAC,KAAU;QACtC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;IAC/D,CAAC;IAED;;;OAGG;IACK,aAAa,CAAC,KAAU;QAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,gFAAgF;QAChF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAEO,0BAA0B,CAChC,GAAY,EACZ,aAA+D,EAC/D,YAAoC;QAGpC,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE,EAAE,UAAU,EAAE,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAE7H,MAAM,4BAA4B,GAA2B,EAAE,CAAC;QAEhE,IAAI,CAAC,aAAa,CAAC,UAAU,IAAI,aAAa,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvE,OAAO,4BAA4B,CAAC;QACtC,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;YACjD,MAAM,eAAe,GAAG,SAAS,CAAC,eAAe,CAAC;YAElD,0DAA0D;YAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAA4C,EAAE,eAAe,CAAC,CAAC;YAChH,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAC1E,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;YAEhF,MAAM,OAAO,GAAG;gBACd,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;gBACvD,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;gBAC7D,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;gBAC1D,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;aAC9D,CAAC;YAEF,gDAAgD;YAChD,MAAM,SAAS,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,WAAW,EAAE,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC;iBAC5E,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAE1D,gDAAgD;YAChD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,UAAU,EAAE,SAAS,EACjE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;oBACxF,OAAO,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,CAAE,CAAC;YAChD,CAAC;YAED,mCAAmC;YACnC,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;YAC7C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAE,yCAAyC;gBACvE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,UAAU,EAAE,SAAS,EACjE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;oBAC7F,OAAO,EAAE,EAAG,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,CAAE,CAAC;YACvE,CAAC;YAED,qEAAqE;YACrE,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,uBAAuB,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAChE,CAAC;YAED,6BAA6B;YAC7B,IAAI,KAAK,EAAE,CAAC;gBACV,4BAA4B,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC;YACxD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,2CAA2C,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAG,CAAC,CAAC;QAE5H,OAAO,4BAA4B,CAAC;IACtC,CAAC;IAID;;OAEG;IACK,uBAAuB,CAAC,eAAuB,EAAE,KAAa,EAAE,OAAa;QACnF,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAC,CAAC;YAClF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,UAAU,EAAE,SAAS,EACjE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;gBACxF,OAAO,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAE,CAAC;QACvD,CAAC;QAED,0EAA0E;QAC1E,IAAI,eAAe,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,UAAU,EAAE,SAAS,EACjE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,wCAAwC;oBAC5F,OAAO,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,EAAE,CAAE,CAAC;YACnG,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,UAAU,EAAE,SAAS,EACjE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,wCAAwC;gBAC5F,OAAO,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAE,CAAC;QACvE,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,UAAkB;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;QAElC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,CAAE,CAAC;QACpH,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,0BAA0B;QAErE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,CAAE,CAAC;QACpH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,oCAAoC,CAChD,YAAoB,EACpB,GAAY,EACZ,SAAyD,EACzD,aAA+D;QAG/D,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,mBAAmB,EAAE,CAAC,CAAC;QAE7G,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,EAAE,CAAC;YACpD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;aAC9F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAa,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;gBAC7F,OAAO,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,mBAAmB,EAAE,EAAE,wBAAwB;aAClF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,uBAAuB,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAClE,MAAM,EAAE,eAAe,EAAE,GAAG,uBAAuB,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACrF,wGAAwG;QACxG,uGAAuG;QACvG,yGAAyG;QACzG,sGAAsG;QACtG,yGAAyG;QACzG,2EAA2E;QAC3E,MAAM,uBAAuB,CAAC,+BAA+B,CAAC,eAAe,CAAC,CAAC;QAE/E,MAAM,YAAY,GAA2B,EAAE,eAAe,EAAE,CAAC;QACjE,MAAM,4BAA4B,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;QAEvG,MAAM,oBAAoB,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC;QAEzG,iFAAiF;QACjF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAEpD,MAAM,YAAY,GAAkC;YAClD,eAAe;YACf,aAAa;YACb,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC;SAC1D,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,8BAA8B,CAAC,iBAAiB,EAChD,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,EACrD,YAAY,EACZ,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC,EAClG,oBAAoB,CACrB,CAAC;QAEF,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,0BAA0B,CACtC,eAAuB,EACvB,GAAY,EACZ,SAAyD,EACzD,aAA+D;QAG/D,IAAI,CAAC,QAAQ,CAAC,mCAAmC,EAAE,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,CAAC,mBAAmB,EAAE,CAAC,CAAC;QAEpH,IAAI,CAAC,uBAAuB,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;QAEjE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,EAAE,CAAC;YACpD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;aAC9F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAa,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;gBAC7F,OAAO,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,mBAAmB,EAAE,EAAE,wBAAwB;aAClF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAA2B,EAAE,eAAe,EAAE,CAAC;QACjE,MAAM,4BAA4B,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;QAEvG,MAAM,oBAAoB,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC;QAEzG,iFAAiF;QACjF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAEpD,MAAM,YAAY,GAAkC;YAClD,eAAe;YACf,aAAa;YACb,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC;SAC1D,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,8BAA8B,CAAC,iBAAiB,EAChD,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,EACrD,YAAY,EACZ,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC,EAClG,oBAAoB,CACrB,CAAC;QAEF,gBAAgB,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAE/C,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACK,2BAA2B,CAAC,SAAyD;QAC3F,MAAM,KAAK,GAAI,SAAiC,CAAC,KAAK,CAAC;QACvD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,mCAAmC,CAC/C,SAAmC,EACnC,GAAY,EACZ,aAA+D;QAE/D,MAAM,4BAA4B,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAC7F,MAAM,oBAAoB,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC;QACzG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAEpD,OAAO,IAAI,CAAC,wBAAwB,CAA2B;YAC7D,SAAS;YACT,+BAA+B,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;YACtF,YAAY,EAAE,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,EAAE;YAC1F,cAAc,EAAE;gBACd,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE;aAC9F;YACD,oBAAoB;SACZ,CAAC,CAAC;IACd,CAAC;IAED;;OAEG;IACH;;;;;;;;;;;;;;;;;;OAkBG;IACK,8BAA8B,CAAC,SAA2C;QAChF,MAAM,kBAAkB,GAAG,SAAS,EAAE,kBAAkB,CAAC;QACzD,IAAI,OAAO,kBAAkB,KAAK,QAAQ,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAE3F,IAAI,CAAC;YACH,MAAM,mBAAmB,GAAG,IAAI,CAAC,wBAAwB,CAAC,8BAA8B,EAAE,CAAC;YAC3F,+FAA+F;YAC/F,yFAAyF;YACzF,IAAI,mBAAmB,EAAE,CAAC,kBAAkB,CAAC,KAAK,wBAAwB;gBAAE,OAAO,IAAI,CAAC;YAExF,4FAA4F;YAC5F,MAAM,qBAAqB,GAAG,IAAI,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,kBAAkC,CAAC,CAAC;YACzH,OAAO,qBAAqB,EAAE,6BAA6B,KAAK,KAAK,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,mBAAmB,CAAC,cAAsC;QAChE,MAAM,YAAY,GAA2C,EAAE,CAAC;QAEhE,0DAA0D;QAC1D,IAAI,cAAc,CAAC,cAAc,EAAE,CAAC;YAClC,YAAY,CAAC,cAAc,GAAG,cAAc,CAAC,cAAc,CAAC;QAC9D,CAAC;QACD,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;YAC1B,YAAY,CAAC,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC;QAC9C,CAAC;QACD,IAAI,cAAc,CAAC,aAAa,EAAE,CAAC;YACjC,YAAY,CAAC,aAAa,GAAG,cAAc,CAAC,aAAa,CAAC;QAC5D,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,0BAA0B,CAKtC,MAAc,EACd,GAAY,EACZ,SAAiG,EACjG,aAA+D;QAG/D,MAAM,WAAW,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,WAAW,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QACpH,IAAI,CAAC,QAAQ,CAAC,mCAAmC,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QAE7E,iFAAiF;QACjF,mFAAmF;QACnF,sFAAsF;QACtF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,kCAAkC,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAE5I,MAAM,4BAA4B,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAE7F,kDAAkD;QAClD,MAAM,oBAAoB,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC;QAEzG,IAAI,CAAC;YACH,OAAO,CAAC,WAAW,KAAK,WAAW,CAAC,YAAY,CAAC;gBAC/C,CAAC,CAAC,MAAM,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,oBAAoB,CAAC;gBAC5G,CAAC,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;QAChH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,mCAAmC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAChE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,mCAAmC,CAAC,KAAc,EAAE,QAAgB;QAChF,IAAI,mBAAmB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,cAAc,EAAE,CAAC;YAC1E,MAAM,wBAAwB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,wBAAwB,CAKpC,MAAc,EACd,4BAAoD,EACpD,SAAiG,EACjG,oBAA4D;QAG5D,IAAI,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAAC;QAEjD,IAAG,SAAS,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,aAAa,EAAE,CAAC;YACzE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE,YAAY,EAAE,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QACrH,CAAC;QAED,IAAI,CAAC,4BAA4B,CAAC,cAAc,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE,EAAG,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,CAAC;YACH,6DAA6D;YAC7D,MAAM,oBAAoB,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAEtE,MAAM,mBAAmB,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAEnG,wCAAwC;YACxC,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,yDAAyD;YACnG,IAAI,SAAS,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAqB,oBAAoB,EAAE;gBACvF,SAAS,EAAE,aAAa;gBACxB,cAAc,EAAE,4BAA4B,CAAC,cAAc;aAC5D,CAAC,CAAC;YAEH,0EAA0E;YAC1E,6EAA6E;YAC7E,gFAAgF;YAChF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,gBAAgB,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAqB,oBAAoB,EAAE;oBAChG,iBAAiB,EAAE,aAAa;oBAChC,cAAc,EAAE,4BAA4B,CAAC,cAAc;iBAC5D,CAAC,CAAC;gBACH,IAAI,gBAAgB,IAAI,yBAAyB,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,EAAE,CAAC;oBAChG,SAAS,GAAG,gBAAgB,CAAC;gBAC/B,CAAC;YACH,CAAC;YAED,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;oBAClF,OAAO,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,4BAA4B,CAAC,cAAc,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACtK,CAAC;YACJ,CAAC;YAED,6CAA6C;YAC7C,MAAM,YAAY,GAAkC;gBAClD,cAAc,EAAE,4BAA4B,CAAC,cAAc;gBAC3D,2FAA2F;gBAC3F,iBAAiB,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,GAAG,EAAE;gBACzF,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC;aAC1D,CAAC;YAEF,6FAA6F;YAC7F,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,8BAA8B,CAAC,oBAAoB,EACnD,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,EACrD,YAAY,EACZ,CAAE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,aAAa,EAAE,iBAAiB,EAAE,SAAS,CAAC,cAAc,EAAE,CAAE,EAAE,qCAAqC;YACjL,oBAAoB,CACrB,CAAC;YAGF,OAAO,gBAAgB,CAAC;QAE1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,KAAK,CAAC,CAAC,yDAAyD;YACxE,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE;oBACP,cAAc,EAAE,4BAA4B,CAAC,cAAc;oBAC3D,KAAK,EAAG,cAAc;oBACtB,aAAa,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBAC1C,EAAE,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,uBAAuB,CAKnC,MAAc,EACd,4BAAoD,EACpD,SAAiG,EACjG,oBAA4D;QAG5D,IAAI,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;QAEhD,kFAAkF;QAClF,uFAAuF;QACvF,sFAAsF;QACtF,mEAAmE;QACnE,IAAI,SAAS,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,WAAW,EAAE,CAAC;YACxE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE,YAAY,EAAE,SAAS,CAAC,oBAAoB,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAC3I,CAAC;QAED,IAAI,CAAC;YACH,6DAA6D;YAC7D,MAAM,oBAAoB,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAEtE,wCAAwC;YACxC,MAAM,mBAAmB,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;YAC3G,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,yDAAyD;YACnG,IAAI,SAAS,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAoB,oBAAoB,EAAE;gBACtF,SAAS,EAAE,aAAa;aACzB,CAAC,CAAC;YAEH,qEAAqE;YACrE,wDAAwD;YACxD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,gBAAgB,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAoB,oBAAoB,EAAE;oBAC/F,iBAAiB,EAAE,aAAa;iBACjC,CAAC,CAAC;gBACH,IAAI,gBAAgB,IAAI,yBAAyB,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,EAAE,CAAC;oBAChG,SAAS,GAAG,gBAAgB,CAAC;gBAC/B,CAAC;YACH,CAAC;YAED,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EACpE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;oBAClF,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAE,CAAC;YAC9G,CAAC;YAED,MAAM,YAAY,GAAkC;gBAClD,2FAA2F;gBAC3F,iBAAiB,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,GAAG,EAAE;gBACzF,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC;aAC1D,CAAC;YAEF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,8BAA8B,CAAC,mBAAmB,EAClD,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,EACrD,YAAY,EACZ,CAAE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,iBAAiB,EAAE,SAAS,CAAC,aAAa,EAAE,CAAE,EAAE,qCAAqC;YAC9K,oBAAoB,CACrB,CAAC;YAEF,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAGjE,OAAO,gBAAgB,CAAC;QAE1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE;oBACP,KAAK,EAAE,aAAa;oBACpB,aAAa,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBAC1C,EAAE,CAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,qCAAqC,CAKjD,MAAc,EACd,GAAY,EACZ,SAAiG,EACjG,aAA+D;QAG/D,IAAI,CAAC,QAAQ,CAAC,+CAA+C,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;QAEzI,6FAA6F;QAC7F,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,kCAAkC,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAE5I,MAAM,4BAA4B,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAC7F,MAAM,oBAAoB,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC;QAEzG,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;gBACnC,CAAC,CAAC,MAAM,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,oBAAoB,CAAC;gBACjH,CAAC,CAAC,MAAM,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;QACrH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,mCAAmC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAChE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,6BAA6B,CAKzC,MAAc,EACd,4BAAoD,EACpD,SAAiG,EACjG,oBAA4D;QAG5D,IAAI,SAAS,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,aAAa,EAAE,CAAC;YAC1E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EACpE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE,YAAY,EAAE,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QACrH,CAAC;QAED,IAAI,CAAC,4BAA4B,CAAC,cAAc,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EACpE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,oBAAoB,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACtE,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;YAExG,MAAM,aAAa,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAA0B,oBAAoB,EAAE;gBAChF,YAAY,EAAE,aAAa;gBAC3B,cAAc,EAAE,4BAA4B,CAAC,cAAc;aAC5D,CAAC,CAAC;YAEH,0EAA0E;YAC1E,kGAAkG;YAClG,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAA0B,oBAAoB,EAAE;oBACnF,oBAAoB,EAAE,aAAa;oBACnC,cAAc,EAAE,4BAA4B,CAAC,cAAc;iBAC5D,CAAC,CAAC;gBACH,IAAI,OAAO,IAAI,yBAAyB,CAAC,OAAO,CAAC,8BAA8B,CAAC,EAAE,CAAC;oBACjF,MAAM,GAAG,OAAO,CAAC;gBACnB,CAAC;YACH,CAAC;YAED,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EACpE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;oBAClF,OAAO,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,4BAA4B,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACrK,CAAC;YAED,MAAM,YAAY,GAAkC;gBAClD,cAAc,EAAE,4BAA4B,CAAC,cAAc;gBAC3D,8EAA8E;gBAC9E,iBAAiB,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,MAAM,CAAC,GAAG,EAAE;gBAC3F,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC;aAC1D,CAAC;YAEF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,8BAA8B,CAAC,oBAAoB,EACnD,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,EACrD,YAAY,EACZ,CAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,aAAa,EAAE,iBAAiB,EAAE,MAAM,CAAC,cAAc,EAAE,CAAE,EACpI,oBAAoB,CACrB,CAAC;YAEF,OAAO,gBAAgB,CAAC;QAE1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EACpE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE,EAAE,cAAc,EAAE,4BAA4B,CAAC,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACpJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,4BAA4B,CAKxC,MAAc,EACd,4BAAoD,EACpD,SAAiG,EACjG,oBAA4D;QAG5D,qFAAqF;QACrF,gFAAgF;QAChF,IAAI,SAAS,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,WAAW,EAAE,CAAC;YACxE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EACpE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE,YAAY,EAAE,SAAS,CAAC,oBAAoB,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAC3I,CAAC;QAED,IAAI,CAAC;YACH,MAAM,oBAAoB,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACtE,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;YAEvG,MAAM,aAAa,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAyB,oBAAoB,EAAE;gBAC/E,YAAY,EAAE,aAAa;aAC5B,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAyB,oBAAoB,EAAE;oBAClF,oBAAoB,EAAE,aAAa;iBACpC,CAAC,CAAC;gBACH,IAAI,OAAO,IAAI,yBAAyB,CAAC,OAAO,CAAC,8BAA8B,CAAC,EAAE,CAAC;oBACjF,MAAM,GAAG,OAAO,CAAC;gBACnB,CAAC;YACH,CAAC;YAED,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EACpE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;oBAClF,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACvG,CAAC;YAED,MAAM,YAAY,GAAkC;gBAClD,8EAA8E;gBAC9E,iBAAiB,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,MAAM,CAAC,GAAG,EAAE;gBAC3F,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC;aAC1D,CAAC;YAEF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,8BAA8B,CAAC,mBAAmB,EAClD,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,EACrD,YAAY,EACZ,CAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,iBAAiB,EAAE,MAAM,CAAC,aAAa,EAAE,CAAE,EACjI,oBAAoB,CACrB,CAAC;YAEF,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAEjE,OAAO,gBAAgB,CAAC;QAE1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EACpE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,0BAA0B;QAChC,OAAO,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,CAAC;IAC5D,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,uBAAuB,CAKnC,KAAa,EACb,GAAY,EACZ,SAAiG,EACjG,aAA+D;QAG/D,IAAI,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAC;QAE/C,IAAI,CAAC;YAEH,4FAA4F;YAC5F,0FAA0F;YAC1F,qFAAqF;YACrF,yFAAyF;YACzF,4FAA4F;YAC5F,oFAAoF;YACpF,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,cAAc,GAClB,cAAc,KAAK,8BAA8B,CAAC,oBAAoB;gBACtE,cAAc,KAAK,8BAA8B,CAAC,mBAAmB,CAAC;YACxE,MAAM,eAAe,GAAG,cAAc;gBACpC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC;gBACjD,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,gCAAgC,CAAC,KAAK,CAAC,CAAC;YAClE,MAAM,YAAY,GAAG,wBAAwB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YACrE,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC;YAEpC,MAAM,4BAA4B,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;YAE7F,kDAAkD;YAClD,MAAM,oBAAoB,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC;YAEzG,oFAAoF;YACpF,sFAAsF;YACtF,2CAA2C;YAC3C,IAAI,YAAY,CAAC,IAAI,KAAK,8BAA8B,CAAC,YAAY,EAAE,CAAC;gBACtE,MAAM,YAAY,GAAG,YAAY,CAAC;gBAElC,mEAAmE;gBACnE,oEAAoE;gBACpE,0EAA0E;gBAC1E,0EAA0E;gBAC1E,4FAA4F;gBAC5F,4FAA4F;gBAC5F,4FAA4F;gBAC5F,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,kCAAkC,CAC5D,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,GAAyB,CAC/E,CAAC;gBACF,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;wBACnF,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;qBACzC,CAAC,CAAC;gBACL,CAAC;gBAED,6FAA6F;gBAC7F,gGAAgG;gBAChG,gGAAgG;gBAChG,oFAAoF;gBACpF,4CAA4C;gBAC5C,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,MAAM,gCAAgC,CAC1E,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,GAAyB,CAClF,CAAC;gBACF,IAAI,cAAc,EAAE,CAAC;oBACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;wBACnF,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE;qBAC3C,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO,MAAM,IAAI,CAAC,2BAA2B,CAC3C,YAAY,CAAC,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,oBAAoB,EAClF,YAAY,CAAC,mBAAmB,EAAE,YAAY,CAAC,cAAc,EAC7D,YAAY,CAAC,oBAAoB,CAClC,CAAC;YACJ,CAAC;YAED,IACE,YAAY,CAAC,IAAI,KAAK,8BAA8B,CAAC,oBAAoB;gBACzE,YAAY,CAAC,IAAI,KAAK,8BAA8B,CAAC,mBAAmB,EACxE,CAAC;gBACD,4EAA4E;gBAC5E,iFAAiF;gBACjF,oFAAoF;gBACpF,sDAAsD;gBACtD,MAAM,YAAY,GAAG,YAAY,CAAC;gBAClC,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,KAAK,8BAA8B,CAAC,oBAAoB;oBAC5F,CAAC,CAAC,oBAAoB,CAAC,aAAa;oBACpC,CAAC,CAAC,oBAAoB,CAAC,WAAW,CAAC;gBAErC,oFAAoF;gBACpF,qFAAqF;gBACrF,MAAM,gBAAgB,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;gBAC3D,IAAI,CAAC,gBAAgB,IAAI,YAAY,CAAC,GAAG,KAAK,gBAAgB,EAAE,CAAC;oBAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EACpE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;wBAChF,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;gBAChE,CAAC;gBAED,oFAAoF;gBACpF,kFAAkF;gBAClF,6EAA6E;gBAC7E,IAAI,SAAS,CAAC,oBAAoB,KAAK,YAAY,EAAE,CAAC;oBACpD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EACpE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;wBAC9E,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;gBACxL,CAAC;gBAED,8FAA8F;gBAC9F,gGAAgG;gBAChG,6FAA6F;gBAC7F,mGAAmG;gBACnG,mGAAmG;gBACnG,mGAAmG;gBACnG,mGAAmG;gBACnG,oGAAoG;gBACpG,iGAAiG;gBACjG,+FAA+F;gBAC/F,qGAAqG;gBACrG,MAAM,UAAU,GAAG,YAAY,KAAK,oBAAoB,CAAC,aAAa;oBACpE,CAAC,CAAC,4BAA4B,CAAC,cAAc;oBAC7C,CAAC,CAAC,4BAA4B,CAAC,aAAa,CAAC;gBAC/C,IAAI,UAAU,IAAI,UAAU,KAAK,YAAY,CAAC,OAAO,EAAE,CAAC;oBACtD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EACnE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;wBACxF,OAAO,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,UAAU,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;gBACrF,CAAC;gBAED,sFAAsF;gBACtF,uFAAuF;gBACvF,kEAAkE;gBAClE,MAAM,iBAAiB,GAAG,EAAE,UAAU,EAAE,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC;gBAC9G,MAAM,YAAY,GAAkC,YAAY,KAAK,oBAAoB,CAAC,aAAa;oBACrG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,EAAE,cAAc,EAAE,YAAY,CAAC,OAAO,EAAE,iBAAiB,EAAE;oBACxH,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,EAAE,aAAa,EAAE,YAAY,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;gBAE1H,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,YAAY,CAAC,IAAI,EACjB,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,EACrD,YAAY,EACZ,CAAE,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,IAAI,EAAE,EAAE,mBAAmB,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,CAAC,OAAO,EAAE,CAAE,EACnH,oBAAoB,CACrB,CAAC;gBAEF,IAAI,YAAY,KAAK,oBAAoB,CAAC,WAAW,EAAE,CAAC;oBACtD,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;gBACnE,CAAC;gBAED,OAAO,gBAAgB,CAAC;YAC1B,CAAC;YAED,uFAAuF;YACvF,uFAAuF;YACvF,MAAM,gBAAgB,GAAU,YAAY,CAAC;YAC7C,KAAK,gBAAgB,CAAC;YACtB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE,EAAE,SAAS,EAAE,EAAC,CAAE,CAAC;QAEhC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,+BAA+B,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wFAAwF,EAAE;oBAC1G,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;oBACpD,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,IAAI,EAAE,GAAG,CAAC,WAAW;oBACrB,mBAAmB,EAAE,SAAS,CAAC,mBAAmB;iBACnD,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;oBACpD,KAAK,EAAE,KAAK,CAAC,sBAAsB;oBACnC,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,IAAI,EAAE,GAAG,CAAC,WAAW;oBACrB,mBAAmB,EAAE,SAAS,CAAC,mBAAmB;iBACnD,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;YACD,+CAA+C;YAC/C,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;gBACnF,OAAO,EAAE,EAAE,aAAa,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,wDAAwD;IACxD,wDAAwD;IAExD;;;;;;;OAOG;IACK,KAAK,CAAC,uBAAuB,CACnC,MAAc,EACd,WAAkC,EAClC,4BAAqC;QAGrC,6BAA6B;QAC7B,MAAM,cAAc,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACvF,MAAM,IAAI,GACR,MAAM,cAAc,CAAC,IAAI,CACvB,WAAW,EACX,MAAM,CACP,CAAC;QAEJ,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE,EAAE,MAAM,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,4BAA4B,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,2BAA2B,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;YACtE,IACE,2BAA2B,KAAK,IAAI;mBACjC,2BAA2B,KAAK,4BAA4B,EAC/D,CAAC;gBACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;oBACE,sBAAsB,EACpB,2BAA2B,CAAC,+BAA+B;oBAC7D,OAAO,EAAE;wBACP,MAAM,EAAE,oCAAoC;wBAC5C,MAAM;qBACP;iBACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;gBAClF,OAAO,EAAE,EAAE,MAAM,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QAED,oCAAoC;QACpC,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;QACrG,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,IAAI,CAAqB,WAAW,EAAE;YAChF,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,wBAAwB,CAAC,MAAM;SACxC,CAAC,CAAC;QAEH,+EAA+E;QAC/E,kEAAkE;QAClE,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CACnC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBACpD,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,CAA8B,CAAC;oBAClG,OAAO,UAAU,IAAI,MAAM,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,MAAM,CAAC;gBAChB,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CACH,CAAC;QAEF,uEAAuE;QACvE,EAAE;QACF,+FAA+F;QAC/F,qFAAqF;QACrF,2FAA2F;QAC3F,yFAAyF;QACzF,EAAE;QACF,8FAA8F;QAC9F,4FAA4F;QAC5F,2FAA2F;QAC3F,mCAAmC;QACnC,MAAM,8BAA8B,GAClC,MAAM,IAAI,CAAC,mDAAmD,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAE3F,kCAAkC;QAClC,MAAM,cAAc,GAAgC,EAAE,CAAC;QACvD,KAAK,MAAM,UAAU,IAAI,8BAA8B,EAAE,CAAC;YACxD,IAAI,UAAU,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;gBAC5C,cAAc,CAAC,IAAI,CAAC;oBAClB,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,EAAE;oBAC7B,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;oBACvD,iBAAiB,EAAE,UAAU,CAAC,cAAc;iBAC7C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,EAAE;QACF,gGAAgG;QAChG,0FAA0F;QAC1F,+FAA+F;QAC/F,gGAAgG;QAChG,yEAAyE;QACzE,EAAE;QACF,4FAA4F;QAC5F,gGAAgG;QAChG,gGAAgG;QAChG,yCAAyC;QACzC,MAAM,IAAI,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;QAE9F,iDAAiD;QACjD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,cAAc,CAAC,IAAI,CAAC;gBAClB,KAAK,EAAE,IAAI,CAAC,QAAQ;gBACpB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;gBACrD,iBAAiB,EAAE,aAAa;aACjC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;IACjD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACK,KAAK,CAAC,mDAAmD,CAC/D,WAAiC,EACjC,WAAkC;QAElC,MAAM,eAAe,GAAG;YACtB,GAAG,IAAI,GAAG,CACR,WAAW;iBACR,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;iBAC3D,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,CAClD;SACF,CAAC;QACF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAE5C,MAAM,sBAAsB,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;QACvG,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAe,WAAW,EAAE;YACjF,GAAG,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE;SAC9B,CAAC,CAAC;QAEH,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAA8C,CAAC;QACrF,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YACzC,IAAI,YAAY,EAAE,GAAG;gBAAE,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QAC3F,CAAC;QAED,+FAA+F;QAC/F,2FAA2F;QAC3F,KAAK,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,sBAAsB,EAAE,CAAC;YAC9D,IAAI,MAAM,KAAK,SAAS;gBAAE,SAAS;YACnC,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAe,WAAW,EAAE,cAAc,CAAC,CAAC;YAC/F,IAAI,SAAS,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;gBACpC,sBAAsB,CAAC,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QAED,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CACvC,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC;eAChC,uCAAuC,CAAC,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAClG,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACK,KAAK,CAAC,qBAAqB,CACjC,WAAsD,EACtD,cAA2C,EAC3C,WAAkC;QAElC,MAAM,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;QACjH,IAAI,CAAC,oBAAoB;YAAE,OAAO;QAElC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc;gBAAE,SAAS;YAE7D,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAyB,WAAW,EAAE;gBACvF,oBAAoB,EAAE,UAAU,CAAC,GAAG;aACrC,CAAC,CAAC;YAEH,KAAK,MAAM,UAAU,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;gBAC3C,IAAI,CAAC,UAAU,EAAE,kBAAkB,IAAI,CAAC,UAAU,CAAC,IAAI;oBAAE,SAAS;gBAClE,cAAc,CAAC,IAAI,CAAC;oBAClB,KAAK,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;oBACxB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;oBACvD,iBAAiB,EAAE,UAAU,CAAC,cAAc;oBAC5C,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;iBAClD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,8BAA8B;IAC9B,wDAAwD;IAExD;;;OAGG;IACK,KAAK,CAAC,2BAA2B,CAKvC,MAAc,EACd,4BAAoD,EACpD,SAAiG,EACjG,oBAA4D,EAC5D,mBAA4B,EAC5B,iBAA0B,EAC1B,uBAAgC;QAGhC,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;QAEhG,mEAAmE;QACnE,EAAE;QACF,2FAA2F;QAC3F,uFAAuF;QACvF,6FAA6F;QAC7F,iGAAiG;QACjG,kEAAkE;QAClE,EAAE;QACF,+FAA+F;QAC/F,gGAAgG;QAChG,0DAA0D;QAC1D,IACE,4BAA4B,CAAC,MAAM;eAChC,4BAA4B,CAAC,MAAM,KAAK,MAAM;eAC9C,IAAI,CAAC,8BAA8B,CAAC,SAAS,CAAC,EACjD,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;aACnF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,MAAM,oBAAoB,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAEtE,qDAAqD;YACrD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAC3D,MAAM,EACN,oBAAoB,EACpB,uBAAuB,CACxB,CAAC;YAEF,8FAA8F;YAC9F,MAAM,YAAY,GAAkC;gBAClD,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC;gBACzD,MAAM;aACP,CAAC;YAEF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,8BAA8B,CAAC,YAAY,EAC3C,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,EACrD,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,SAAS,EAAE,iCAAiC;YAC5C,CAAC,EAAU,2BAA2B;YACtC,SAAS,EAAE,mBAAmB;YAC9B,iBAAiB,IAAI,IAAI,CAC1B,CAAC;YAEF,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;gBACtC,gBAAgB,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;YAC/D,CAAC;YAED,OAAO,gBAAgB,CAAC;QAE1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;gBACnF,OAAO,EAAE,EAAE,aAAa,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,gCAAgC;IAChC,wDAAwD;IACxD,yDAAyD;IACzD,8CAA8C;IAC9C,kDAAkD;IAClD,+DAA+D;IAE/D;;;;;;;OAOG;IACI,KAAK,CAAC,4BAA4B,CAAC,KAAa,EAAE,uBAAgC;QACvF,IAAI,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAC;QAElD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,gCAAgC,CAAC,KAAK,CAAC,CAAC;QACtF,MAAM,YAAY,GAAG,wBAAwB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC;QAEpC,6FAA6F;QAC7F,IAAI,YAAY,CAAC,IAAI,KAAK,8BAA8B,CAAC,YAAY,EAAE,CAAC;YACtE,MAAM,YAAY,GAAG,YAAY,CAAC;YAElC,8FAA8F;YAC9F,8FAA8F;YAC9F,gGAAgG;YAChG,wFAAwF;YACxF,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,kCAAkC,CAC5D,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,GAAyB,CAC/E,CAAC;YACF,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;oBACnF,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;iBACzC,CAAC,CAAC;YACL,CAAC;YAED,8FAA8F;YAC9F,yFAAyF;YACzF,yFAAyF;YACzF,6FAA6F;YAC7F,gDAAgD;YAChD,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,MAAM,gCAAgC,CAC1E,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,GAAyB,CAClF,CAAC;YACF,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;oBACnF,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE;iBAC3C,CAAC,CAAC;YACL,CAAC;YAED,OAAO,MAAM,IAAI,CAAC,0BAA0B,CAC1C,YAAY,CAAC,MAAM,EACnB,uBAAuB;YACvB,4FAA4F;YAC5F,iCAAiC,CAAC,cAAc,EAChD,YAAY,CAAC,oBAAoB,CAClC,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;YACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;YAChF,OAAO,EAAE,EAAE,SAAS,EAAE;SACvB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,mBAAmB;QACxB,OAAO;YACL,aAAa,EAAE,8BAA8B,CAAC,gBAAgB;YAC9D,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,EAAE;SACnB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACI,KAAK,CAAC,yBAAyB,CAAC,KAAa,EAAE,cAAsB;QAC1E,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,cAAc,GAClB,cAAc,KAAK,8BAA8B,CAAC,oBAAoB;YACtE,cAAc,KAAK,8BAA8B,CAAC,mBAAmB,CAAC;QAExE,IAAI,cAAc,EAAE,CAAC;YACnB,+FAA+F;YAC/F,8FAA8F;YAC9F,8FAA8F;YAC9F,0FAA0F;YAC1F,2FAA2F;YAC3F,+EAA+E;YAC/E,+FAA+F;YAC/F,gGAAgG;YAChG,kGAAkG;YAClG,wFAAwF;YACxF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,wFAAwF;gBACxF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;oBAChF,OAAO,EAAE,EAAE,MAAM,EAAE,mCAAmC,EAAE;iBACzD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;YACrF,MAAM,YAAY,GAAG,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAChE,IACE,YAAY,CAAC,IAAI,KAAK,8BAA8B,CAAC,oBAAoB;gBACzE,YAAY,CAAC,IAAI,KAAK,8BAA8B,CAAC,mBAAmB,EACxE,CAAC;gBACD,oFAAoF;gBACpF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;oBAChF,OAAO,EAAE,EAAE,MAAM,EAAE,gCAAgC,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,EAAE;iBACpF,CAAC,CAAC;YACL,CAAC;YACD,8FAA8F;YAC9F,gGAAgG;YAChG,gGAAgG;YAChG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;oBAChF,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE;iBACpD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,KAAK,8BAA8B,CAAC,oBAAoB;gBAC5F,CAAC,CAAC,oBAAoB,CAAC,aAAa;gBACpC,CAAC,CAAC,oBAAoB,CAAC,WAAW,CAAC;YACrC,MAAM,iBAAiB,GAAG,EAAE,UAAU,EAAE,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC9G,MAAM,YAAY,GAAkC,YAAY,KAAK,oBAAoB,CAAC,aAAa;gBACrG,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,CAAC,OAAO,EAAE,iBAAiB,EAAE;gBAC7D,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;YAC/D,OAAO;gBACL,aAAa,EAAE,YAAY,CAAC,IAAI;gBAChC,YAAY;gBACZ,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,IAAI,EAAE,EAAE,mBAAmB,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC;aAClI,CAAC;QACJ,CAAC;QAED,2FAA2F;QAC3F,wFAAwF;QACxF,+FAA+F;QAC/F,8FAA8F;QAC9F,+FAA+F;QAC/F,+FAA+F;QAC/F,kGAAkG;QAClG,8EAA8E;QAC9E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,gCAAgC,CAAC,KAAK,EAAE,cAAc,CAAC,sBAAsB,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/I,MAAM,YAAY,GAAG,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,YAAY,CAAC,IAAI,KAAK,8BAA8B,CAAC,YAAY,EAAE,CAAC;YACtE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE,EAAE,MAAM,EAAE,gCAAgC,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,EAAE;aACpF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;QACD,qGAAqG;QACrG,oGAAoG;QACpG,mGAAmG;QACnG,iFAAiF;QACjF,yGAAyG;QACzG,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,kCAAkC,CAC5D,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,GAAyB,CAC/E,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;gBACnF,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;aACzC,CAAC,CAAC;QACL,CAAC;QACD,kGAAkG;QAClG,qGAAqG;QACrG,oGAAoG;QACpG,qGAAqG;QACrG,mGAAmG;QACnG,kGAAkG;QAClG,sGAAsG;QACtG,mGAAmG;QACnG,8FAA8F;QAC9F,wGAAwG;QACxG,sGAAsG;QACtG,sGAAsG;QACtG,iGAAiG;QACjG,yFAAyF;QACzF,iGAAiG;QACjG,2FAA2F;QAC3F,4FAA4F;QAC5F,kGAAkG;QAClG,kGAAkG;QAClG,+EAA+E;QAC/E,6CAA6C;QAC7C,MAAM,8BAA8B,GAAG,MAAM,IAAI,CAAC,qCAAqC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC1G,OAAO,MAAM,IAAI,CAAC,0BAA0B,CAC1C,YAAY,CAAC,MAAM,EACnB,8BAA8B,EAC9B,8BAA8B;YAC5B,CAAC,CAAC,iCAAiC,CAAC,aAAa;YACjD,wFAAwF;YACxF,4FAA4F;YAC5F,CAAC,CAAC,iCAAiC,CAAC,cAAc,EACpD,YAAY,CAAC,oBAAoB,CAClC,CAAC;IACJ,CAAC;IAED,4EAA4E;IACpE,iBAAiB,CAAC,GAAY,EAAE,QAAgB;QACtD,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,GAAG,KAAK,QAAQ,CAAC;QACrD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH;;;;;;;;;;;;;;;;OAgBG;IACK,oCAAoC,CAAC,SAAyD;QACpG,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC3C,IAAI,gBAAgB,IAAI,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7E,KAAK,MAAM,aAAa,IAAI,SAAS,CAAC,cAAoE,EAAE,CAAC;gBAC3G,KAAK,MAAM,SAAS,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;oBACjD,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAEO,+CAA+C,CAAC,0BAAkD;QACxG,MAAM,2BAA2B,GAAG,IAAI,CAAC,wBAAwB,CAAC,8BAA8B,EAAE,CAAC;QACnG,MAAM,UAAU,GAAG,IAAI,GAAG,EAA8C,CAAC;QACzE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,CAAC;YACtE,MAAM,eAAe,GAAG,2BAA2B,CAAC,GAAmB,CAAC,IAAI,GAAG,CAAC;YAChF,UAAU,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,0BAA0B,CAGrC,IAAsB,EACtB,SAAmC,EACnC,0BAAkD;QAGlD,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE;YAC3D,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,YAAY,EAAE,SAAS,CAAC,kBAAkB;YAC1C,mBAAmB,EAAE,SAAS,CAAC,mBAAmB;YAClD,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC;SACrD,CAAC,CAAC;QAEH,8EAA8E;QAC9E,4EAA4E;QAC5E,+EAA+E;QAC/E,uFAAuF;QACvF,MAAM,UAAU,GAAG,IAAI,CAAC,+CAA+C,CAAC,0BAA0B,CAAC,CAAC;QAEpG,0EAA0E;QAC1E,8DAA8D;QAC9D,wCAAwC;QACxC,EAAE;QACF,kEAAkE;QAClE,wEAAwE;QACxE,yEAAyE;QACzE,6EAA6E;QAC7E,wDAAwD;QACxD,6EAA6E;QAC7E,uEAAuE;QACvE,8EAA8E;QAC9E,8EAA8E;QAC9E,sEAAsE;QACtE,sEAAsE;QACtE,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,4EAA4E;QAC5E,8EAA8E;QAC9E,gEAAgE;QAChE,4EAA4E;QAC5E,EAAE;QACF,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,kCAAkC;QAClC,MAAM,6BAA6B,GAAG,IAAI,CAAC,oCAAoC,CAAC,SAAS,CAAC,CAAC;QAC3F,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC3C,KAAK,MAAM,eAAe,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACrD,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;oBACxD,IAAI,CAAC,QAAQ,CAAC,6DAA6D,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;oBAClG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;QAED,mGAAmG;QACnG,EAAE;QACF,gGAAgG;QAChG,oGAAoG;QACpG,oGAAoG;QACpG,mGAAmG;QACnG,oGAAoG;QACpG,8FAA8F;QAC9F,qFAAqF;QACrF,EAAE;QACF,oGAAoG;QACpG,8FAA8F;QAC9F,kGAAkG;QAClG,4FAA4F;QAC5F,oGAAoG;QACpG,6FAA6F;QAC7F,MAAM,uBAAuB,GAAG,kCAAkC,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC/F,IACE,SAAS,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,SAAS;eAC9D,IAAI,CAAC,YAAY,EAAE,MAAM;eACzB,6BAA6B,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAC7D,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;QAED,wEAAwE;QACxE,8DAA8D;QAC9D,yDAAyD;QACzD,8FAA8F;QAC9F,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EAAgB,yBAAyB;QAClD,IAAI,CAAC,aAAa,EAAO,iDAAiD;QAC1E,UAAU,EAAe,+CAA+C;QACxE,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,gDAAgD;QACzE,IAAI,CAAC,cAAc,EAAM,8CAA8C;QACvE,EAAE,CAAuB,6DAA6D;SACvF,CAAC;QAEF,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9B,gBAAgB,CAAC,uBAAuB,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACtE,CAAC;QAED,kDAAkD;QAClD,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;QAElE,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,0BAA0B,CACtC,MAAc,EACd,uBAA2C,EAC3C,2BAA8D,EAC9D,4BAAqC;QAErC,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;QAE5F,kCAAkC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAClE,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,WAAW,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAChH,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAE7D,8CAA8C;QAC9C,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,GACrC,MAAM,IAAI,CAAC,uBAAuB,CAChC,MAAM,EACN,WAAW,EACX,4BAA4B,CAC7B,CAAC;QAEJ,+EAA+E;QAC/E,+EAA+E;QAC/E,+EAA+E;QAC/E,4EAA4E;QAC5E,iFAAiF;QACjF,8EAA8E;QAC9E,8EAA8E;QAC9E,oFAAoF;QACpF,iGAAiG;QACjG,qDAAqD;QACrD,MAAM,cAAc,GAAG,IAAI,CAAC,iCAAiC,CAAC,uBAAuB,EAAE,cAAc,EAAE,2BAA2B,CAAC,CAAC;QAEpI,OAAO;YACL,aAAa,EAAE,8BAA8B,CAAC,YAAY;YAC1D,YAAY,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACtF,cAAc;SACf,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,8BAA8B,CAAC,SAAyD;QAC9F,OAAO,SAAS,CAAC,uBAA6C,CAAC;IACjE,CAAC;CAEF,CAAA;AAjtHY,qCAAqC;IADjD,UAAU,EAAE;IAMJ,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAC5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAClD,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAC7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,WAAA,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAA;IAIpC,YAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;qCAbE,aAAa;QACO,uBAAuB;QACxB,0BAA0B;QACG,qCAAqC;QACtE,iBAAiB;QACG,+BAA+B;QACxB,yCAAyC;QACnD,6BAA6B;QACjD,YAAY;QAClB,SAAS;GAdtE,qCAAqC,CAitHjD","sourcesContent":["import type {\n ApiKeyApplication,\n ApiKeyOrganization,\n OAuthClientApplication,\n OAuthClientOrganization,\n Application,\n AnyResourceConfiguration,\n ExecutionContext_RoleInfo,\n Organization,\n OrganizationMember,\n OrganizationUnitMember,\n ResourceConfiguration_Operation,\n ResourceConfiguration_Operation_UrlInitiatorInfo,\n User,\n ExecutionContext_RelationshipContext,\n ResourceFieldIdentifier,\n ResourceType,\n ResourceConfiguration_OperationPath\n} from '@wildo-ai/saas-models';\nimport { EnumLikeType } from '@wildo-ai/zod-decorators';\nimport { Request } from 'express';\nimport { Container, inject, injectable } from 'inversify';\nimport 'reflect-metadata';\nimport { z } from 'zod';\nimport { trace } from '@opentelemetry/api';\n\nimport { ApiKeyScope, apiKeyScopeForCredential, CORE_APP_ROLES, CoreResourceType, coreResourceShared_FieldIdentifier, isApiKeyCredential, isAuthorityConferringOrganizationStatus, OrganizationMemberStatus, PRIMARY_SCOPE_TO_FIELD_IDENTIFIER, ResourcePrimaryScope, SERVICE_NATIVE_OPERATION_VARIANT_TYPES, URL_BEARING_OPERATION_VARIANT_TYPES, WildoHeaderKeys } from '@wildo-ai/saas-models';\n\nimport { ApiKeyStatus, OAuthClientStatus, CoreResourceOperation, ErrorCustomMessageReference, ErrorType, ExecutionContext_ExecutionType, ExecutionContext_InitiatorIds, MachineAuthMethod, ResourceOperationVariantType, ResourcesConfig_OperationPathUtils, TokenAuthenticationPolicy, UserStatus, isWildoBackendError } from '@wildo-ai/saas-models';\n\n// =====================================================\n// Socket Authentication Types (reuses existing ExecutionContext types)\n// =====================================================\n\n\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ActiveOrganizationSelectionSource, ExecutionContext, ExecutionContext_FactoryParams, SocketAuthResult } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { ServiceOptions } from '~wildo-backend-lib/base-classes/models/repositories.backend.schemas';\nimport type { BatchesCronjobsCustomExecution_Context } from '~wildo-backend-lib/base-classes/services/batches/batches-cronjobs-custom-execution.service';\nimport { CustomBatchManifestKind } from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\n\n/**\n * Transport preference used to disambiguate a multi-variant custom-batch anchor operation.\n *\n * Ordered, and deliberately identical to `getServiceOperationPathDefault`'s own preference — the\n * service layer's native transport first, URL-bearing second — so a batch bootstraps on exactly the\n * operation its `servicesRegistry.<verb>()` call will later resolve to. Two rules that could drift\n * apart would reintroduce the class of bug this ordering exists to prevent.\n */\n/**\n * The URL segment that carries a person's identity — derived from the canonical field-identifier map\n * rather than re-typed, so a rename moves this with it instead of silently disabling the\n * identity-coherence guard.\n */\nconst USER_ID_FIELD_IDENTIFIER = coreResourceShared_FieldIdentifier[CoreResourceType.USERS];\n\nconst SERVICE_RESOLVABLE_TRANSPORT_PREFERENCE: readonly (readonly ResourceOperationVariantType[])[] = [\n SERVICE_NATIVE_OPERATION_VARIANT_TYPES,\n URL_BEARING_OPERATION_VARIANT_TYPES,\n];\n\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { JwtClaim_App_Auth_Schema } from '~wildo-backend-lib/security/authentications/models/authentications.backend.schemas';\nimport { JwtPrivateKeys } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport {\n isExpiredJwtVerificationFailure,\n isJwtVerificationFailure,\n} from '~wildo-backend-lib/security/jwt/utils/jwt-verification-error-classification.backend.utils';\nimport { AuthorizationsBackendService } from '~wildo-backend-lib/security/authorizations/services/authorizations.backend.service';\nimport { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { hashApiKey } from '~wildo-backend-lib/security/api-keys/api-key-generation.backend.utils';\nimport { hashOAuthClientSecret } from '~wildo-backend-lib/security/oauth-clients/oauth-client-generation.backend.utils';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ErrorHandlerService } from '~wildo-backend-lib/errors/services/error-handler.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ResourceOperationHelperBackendService } from '~wildo-backend-lib/base-classes/services/resource-operations-helper.backend.service';\nimport { ExecutionContextHandlerBackendService } from './execution-context-handler.backend.service';\nimport { BackendResourceType } from '~wildo-backend-lib/resources/models/resources-types.backend.schemas';\nimport { ConsumableToken } from '~wildo-backend-lib/security/consumable-tokens/models/consumable-tokens.shared.schemas';\nimport { ConsumableTokenBackendService } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport { AnonymousSessionBackendService } from '~wildo-backend-lib/security/authentications/services/anonymous-session.backend.service';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { getClientIpFromRequest } from '~wildo-backend-lib/runtime/utils/request-client-ip.utils';\nimport { assertMachineAuthAttemptWithinRate, recordMachineAuthFailure } from '~wildo-backend-lib/security/authentications/services/utils/machine-auth-rate-limit.backend.utils';\nimport { isRotationGraceWindowOpen, isCredentialExpired } from '~wildo-backend-lib/security/credential-rotation-grace.backend.utils';\nimport { evaluateUserTokenInvalidationFence } from '~wildo-backend-lib/security/token-invalidation-fence.backend.utils';\nimport { evaluateSessionInvalidationFence } from '~wildo-backend-lib/security/session-invalidation-fence.backend.utils';\nimport {\n getUserAuthorizationVersion,\n type AuthorizationVersionedUser,\n} from '~wildo-backend-lib/security/authentications/models/user-authorization-version.backend.utils';\n\n\n@injectable()\nexport class ExecutionContextCreatorBackendService {\n\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ExecutionContextHandlerService) private readonly executionContextHandlerService: ExecutionContextHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.JwtBackendService) private readonly jwtService: JwtBackendService,\n @inject(SAAS_SERVICE_TYPES.ResourceRegistryService) private readonly resourcesRegistryService: ResourcesRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) private readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.ConsumableTokenService) private readonly consumableTokenService: ConsumableTokenBackendService,\n @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,\n @inject(SAAS_SERVICE_TYPES.Container) private readonly container: Container,\n // Appended LAST on purpose: several tests construct this service positionally, so a new\n // dependency must not shift the existing parameter order. Used only by\n // `retainContextFieldsKnownToResource`.\n @inject(SAAS_SERVICE_TYPES.ResourceOperationHelperService) private readonly resourceOperationHelper: ResourceOperationHelperBackendService,\n ) {\n this.logDebug = this.logger.debugByType('ExecutionContextCreator');\n this.logger.setDebugTypeLogging('ExecutionContextCreator', false);\n }\n\n /**\n * Anonymous session handling eventually calls back into the services registry,\n * so we resolve it lazily to avoid a hard DI cycle during backend startup.\n */\n private getAnonymousSessionService(): AnonymousSessionBackendService {\n return this.container.get<AnonymousSessionBackendService>(SAAS_SERVICE_TYPES.AnonymousSessionService);\n }\n\n private createInternalSystemRoles(): ExecutionContext_RoleInfo[] {\n return [\n {\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n }\n ];\n }\n\n private async populateApplicationIdIfNeeded(executionContext: ExecutionContext<any>, forcePopulate: boolean = false) {\n // Check if applicationId is already set\n const applicationIdUndefinedOrNull =\n executionContext.initiatorIds?.applicationId === undefined ||\n executionContext.initiatorIds?.applicationId === null;\n\n // Populate if needed\n const needsPopulation = (\n executionContext.operation.resourcePrimaryScope === ResourcePrimaryScope.APPLICATION &&\n applicationIdUndefinedOrNull\n ) || forcePopulate;\n\n if (!needsPopulation) {\n return;\n }\n\n // initiatorIds should always exist (validated in ExecutionContext constructor)\n if (!executionContext.initiatorIds) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n executionContext,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'ExecutionContext.initiatorIds is null - this should not happen after validation. Check ExecutionContext construction.'\n }\n }\n );\n }\n\n // Resolve through the canonical resolver, NOT by reading APPLICATION on the context being\n // enriched.\n //\n // That read used to pass `executionContext` — the very context this method is populating — so\n // the repository's contextual filter applied whatever that context carried to `applications`.\n // The filter is fail-closed: a field the application schema does not model (`organizationId`,\n // for one) throws CONFIGURATION / `context_filter` rather than being ignored. Any\n // APPLICATION-scoped operation whose context carried a tenant therefore failed here, and it is\n // how giving the audit write context a tenant briefly broke EVERY audit write.\n //\n // There is one APPLICATION row, so no caller context can usefully narrow this lookup — it can\n // only break it. `getApplicationId` owns the context-free read; delegating leaves ONE resolver\n // rather than two copies that drift. Safe to call only because that method now builds its\n // context DIRECTLY: routing it through `createForInternalOperation` would re-enter this method\n // and recurse until the stack blew.\n executionContext.initiatorIds.applicationId = await this.getApplicationId();\n }\n\n /**\n * Resolve the singleton APPLICATION row's id — the ONE way to do it in this class.\n *\n * ## Why the read context is constructed DIRECTLY here\n *\n * This used to build its context through `createForInternalOperation`, which is the ordinary\n * path — but that path calls {@link populateApplicationIdIfNeeded} for any APPLICATION-scoped\n * operation, and this operation is APPLICATION-scoped by definition. Two consequences followed:\n *\n * - the APPLICATION row was read TWICE per call (once by the nested populate, once below);\n * - and `populateApplicationIdIfNeeded` could not delegate here, because doing so recursed\n * until the stack blew — which surfaces as a vitest \"worker exited unexpectedly\" and reads\n * like load flakiness rather than a stack overflow.\n *\n * Constructing the context directly breaks that re-entry. It is the idiomatic move in this class\n * (which builds `ExecutionContext` directly in a dozen places), and it lets the enrichment path\n * delegate here so there is exactly one resolver instead of two divergent copies.\n *\n * The context is deliberately EMPTY of context resources: there is one APPLICATION row, so\n * nothing can usefully narrow this read — while a borrowed caller context CAN break it, because\n * the repository's contextual filter is fail-closed on any field `applications` does not model.\n * `validateOperation` is skipped along with the generic path; this is a fixed, framework-owned\n * bootstrap read of a single known operation, not caller-authored input.\n */\n private async getApplicationId(): Promise<string> {\n const appReadOp = this.resourcesRegistryService.getOperationPathDefault(CoreResourceType.APPLICATION, CoreResourceOperation.READ);\n const execCtx = new ExecutionContext(\n this.resourcesRegistryService.getOperationFromPath(appReadOp),\n ExecutionContext_ExecutionType.INTERNALLY_INITIATED_REQUEST,\n new Map(),\n {},\n [ { roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION } ],\n [],\n );\n\n const appRepository = this.repositoriesRegistry.getRepository(CoreResourceType.APPLICATION);\n const currentApplication = await appRepository.read<Application>(execCtx, { });\n\n if (!currentApplication) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'No APPLICATION record found in database. The application must be seeded with an APPLICATION record during initialization.'\n }\n }\n );\n }\n\n return currentApplication._id;\n }\n\n public async createExecutionContext<TResourceConfigOperation extends ResourceConfiguration_Operation<any, any, any> >(\n params: ExecutionContext_FactoryParams\n ): Promise<ExecutionContext<TResourceConfigOperation>> {\n\n this.logDebug('Creating ExecutionContext', { executionType: params.executionType,operationIdentifier: params.operation.operationIdentifier,resourceIdentifier: params.operation.resourceIdentifier });\n\n const operation = this.resourcesRegistryService.getOperationFromPath(params.operation) as TResourceConfigOperation;\n\n await this.executionContextHandlerService.validateOperation(operation);\n\n const executionContext = new ExecutionContext<TResourceConfigOperation>(\n operation,\n params.executionType,\n params.contextResourcesFieldIdentifier,\n params.initiatorIds ?? {}, // Use nullish coalescing - handles both null and undefined\n params.initiatorRoles ?? [],\n params.relationshipContexts ?? [],\n // The four positional slots between `relationshipContexts` and the audit actor are passed as\n // their own defaults verbatim (mint a correlationId, depth 0, fresh visited set, no active user\n // type) — they exist only so the on-behalf-of principal, which is the last parameter, can be\n // supplied at all. Behaviour here is unchanged from omitting them.\n undefined,\n 0,\n undefined,\n null,\n params.auditActorUserId\n );\n\n if(operation.resourcePrimaryScope === ResourcePrimaryScope.APPLICATION) {\n await this.populateApplicationIdIfNeeded(executionContext);\n }\n\n this.logDebug('ExecutionContext created successfully', { executionType: executionContext.executionType, contextResourcesCount: executionContext.getContextResourceIds().size, hasExecutionContext_InitiatorIds: !!executionContext.initiatorIds, initiatorRolesCount: executionContext.initiatorRoles.length });\n\n // Slice 2 Phase 3 — enrich the active OTel span with the resolved tenant\n // identity so exported traces are filterable per-organization / per-user.\n // No-op when no span is active (internal/worker contexts) or telemetry is\n // off; never throws.\n this.enrichActiveSpanWithScope(executionContext);\n\n return executionContext;\n }\n\n /**\n * Attach the resolved tenant identity (organization / user) to the active\n * OpenTelemetry span as `saas.*` attributes, so exported traces are\n * filterable per-organization / per-user in the telemetry backend.\n *\n * The span is created by the HTTP auto-instrumentation in the OTLP preload\n * (`otel-preload.ts`); this method only ENRICHES it — it never creates a\n * span. `trace.getActiveSpan()` returns the in-flight request span from\n * anywhere in the handler (the auto-instrumentation runs the request inside\n * the span's context), so enriching at this single central funnel covers\n * every authenticated operation — the HTTP server has no global auth\n * middleware (scope resolves here), so a per-route Express middleware could\n * not see org/user at all.\n *\n * Enriches INBOUND-REQUEST contexts only. `createExecutionContext` is also the\n * funnel for `INTERNALLY_INITIATED_REQUEST` sub-operations, which a request\n * handler can spawn while the request's span is still active; enriching from one\n * of those would let a nested op's scope CLOBBER the request principal on the\n * span. So internal contexts are skipped here — inbound-request types\n * (USER_REQUEST / ANONYMOUS_SESSION / WEBHOOK_CALLBACK / PUBLIC_EXECUTION) stamp\n * the identity exactly once. Webhooks ARE enriched (inbound HTTP with a span and\n * a resolved tenant scope).\n *\n * Root-span invariant: an inbound-request context is resolved in the controller\n * layer BEFORE the service/repository layer runs, so no auto-instrumentation child\n * span (DB / redis / outbound-http) has started yet when this fires —\n * `getActiveSpan()` is therefore the root HTTP server span, which is exactly the\n * span we want stamped (not a nested child). Skipping internal sub-ops (above)\n * upholds this: those are the only contexts created mid-execution, when a child\n * span could be the active one.\n *\n * Pure side-effect, fail-open: when no preload is active, or the context is built\n * outside an HTTP request (internal / worker / cron), `getActiveSpan()` is\n * undefined and this is a no-op anyway. Wrapped so a telemetry error can never\n * affect request handling.\n *\n * Also stamps `saas.correlation_id` (Phase 6). The span's own `trace_id` identifies\n * ONE trace, but the Wildo correlationId is the join key that survives the seams\n * OTel does not automatically cross here — the queue hop (carried as\n * `originCorrelationId` and re-adopted on the worker) and every structured log line\n * (which carries correlationId, not trace_id). Bridging it onto the span lets an\n * operator pivot from a log line's correlationId to the trace and back. It is NOT\n * derived from `trace_id` (they are independent ids) — it is the EC's own\n * correlationId, the same value the logs and audit rows carry.\n */\n private enrichActiveSpanWithScope(executionContext: ExecutionContext<any>): void {\n try {\n // Skip nested internal sub-operations — see the \"INBOUND-REQUEST contexts\n // only\" rationale above. A non-HTTP internal context is also caught by the\n // `!span` guard below, but an internal op nested INSIDE a request has the\n // parent request's span active, so this type check is the real guard against\n // clobbering the request principal.\n if (executionContext.executionType === ExecutionContext_ExecutionType.INTERNALLY_INITIATED_REQUEST) {\n return;\n }\n const span = trace.getActiveSpan();\n if (!span) {\n return;\n }\n const attributes: Record<string, string> = {};\n if (executionContext.correlationId) {\n attributes['saas.correlation_id'] = executionContext.correlationId;\n }\n if (executionContext.organizationId) {\n attributes['saas.organization_id'] = executionContext.organizationId;\n }\n if (executionContext.userId) {\n attributes['saas.user_id'] = executionContext.userId;\n }\n if (Object.keys(attributes).length > 0) {\n span.setAttributes(attributes);\n }\n } catch {\n // best-effort enrichment — never let a telemetry failure affect the request.\n }\n }\n\n\n public async createForInternalOperation<TResourceConfigOperation extends ResourceConfiguration_Operation<any, any, any> >(\n params: Omit<ExecutionContext_FactoryParams, 'executionType'>\n ): Promise<ExecutionContext<TResourceConfigOperation>> {\n\n return this.createExecutionContext({\n ...params,\n executionType: ExecutionContext_ExecutionType.INTERNALLY_INITIATED_REQUEST,\n });\n }\n\n /**\n * Reconstruct the attribution and scope of an operation that already\n * committed, solely to finish one of its persisted post-commit effects.\n *\n * This is intentionally distinct from {@link createForInternalOperation}.\n * A deferred effect is executed by a worker, but it still belongs to the\n * original authenticated principal. Relabelling that principal as INTERNAL\n * either violates `ExecutionContext` identity invariants or tempts workers to\n * fabricate elevated roles. The durable record must therefore persist the\n * original execution type, initiator IDs, roles, relationship paths, and\n * scope; this seam reconstructs them through the normal constructor so every\n * principal-category validation remains active.\n *\n * SECURITY: callers must source these parameters from immutable framework\n * state written atomically with the completed operation. This is not an\n * authentication entry point and must never accept client-authored data.\n */\n public async createForDeferredAuthorizedEffect<\n TResourceConfigOperation extends ResourceConfiguration_Operation<any, any, any>\n >(\n params: ExecutionContext_FactoryParams,\n ): Promise<ExecutionContext<TResourceConfigOperation>> {\n return this.createExecutionContext<TResourceConfigOperation>(params);\n }\n\n /**\n * Bootstrap an INTERNAL execution context for a repository operation on the\n * given resource, resolving the operation path `REPOSITORY_ONLY`-preferred with\n * a URL-bearing fallback (see\n * {@link ResourcesRegistryBackendService.getInternalRepositoryOperationPathDefault}).\n *\n * This is the single seam REPOSITORY-DIRECT internal-context builders should\n * use (`FilesBackendService`, the queue services, `ResourceContextBackendService`,\n * `NotificationBadgeBackendService`, the data-seed ledger). It replaces the hand-rolled\n * `getOperationPathDefault(...) → createForInternalOperation(...)` pattern that\n * repeatedly drifted to the URL-only resolver and threw\n * `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` on `REPOSITORY_ONLY`-only\n * resources (FILES, JOB_*). Variant-correct path resolution and context\n * construction live together here so a new builder cannot reintroduce that\n * bug by reaching for the wrong sibling resolver.\n *\n * Use this ONLY for resources whose internal CRUD is repository-direct and\n * bypasses the service pipeline (the `FilesBackendService` pattern). For\n * resources whose internal CRUD runs THROUGH the service pipeline (ACL, hooks,\n * lifecycle) but has no HTTP surface — the billing back-office — use\n * {@link createForInternalServiceOperation} instead, which resolves the\n * `INTERNAL_CALL` default.\n *\n * Identity (`initiatorIds`, `initiatorRoles`) and scope\n * (`contextResourcesFieldIdentifier`, `relationshipContexts`) are forwarded\n * verbatim to {@link createForInternalOperation}; omit them for an unattributed\n * system context.\n */\n public async createForInternalRepositoryOperation<TResourceConfigOperation extends ResourceConfiguration_Operation<any, any, any> >(\n params: Omit<ExecutionContext_FactoryParams, 'executionType' | 'operation'> & {\n resourceType: ResourceType;\n operationIdentifier: string;\n }\n ): Promise<ExecutionContext<TResourceConfigOperation>> {\n const { resourceType, operationIdentifier, ...contextParams } = params;\n const operationPath = this.resourcesRegistryService.getInternalRepositoryOperationPathDefault(\n resourceType,\n operationIdentifier,\n );\n return this.createForInternalOperation<TResourceConfigOperation>({\n ...contextParams,\n operation: operationPath,\n });\n }\n\n /**\n * Bootstrap an INTERNAL execution context for a SERVICE-pipeline operation on\n * the given resource, resolving the operation path `INTERNAL_CALL`-preferred\n * with a URL-bearing fallback (see\n * {@link ResourcesRegistryBackendService.getServiceOperationPathDefault}).\n *\n * This is the seam for internal SERVICE-pipeline operations (`INTERNAL_CALL`):\n * resources whose internal CRUD runs through `doOperation` (ACL, hooks,\n * lifecycle) via `ServicesRegistryHandlerBackendService.list/create/read/update`\n * but has NO HTTP surface — the billing back-office\n * (`AbstractBillingBackendService` subclasses such as\n * `ProductCatalogSyncBackendService`, and billing-account auto-create). Their\n * catalog + internal-write operations are declared `INTERNAL_CALL`, so the\n * service dispatcher accepts them and this resolver returns their path.\n *\n * Contrast with {@link createForInternalRepositoryOperation}\n * (`REPOSITORY_ONLY`, repository-direct, bypasses the service pipeline — the\n * `FilesBackendService` pattern). Reaching for the repository seam on a\n * service-pipeline resource resolves to NOTHING (no `REPOSITORY_ONLY` default)\n * and vice-versa; pick the seam that matches the resource's declared transport.\n *\n * Identity (`initiatorIds`, `initiatorRoles`) and scope\n * (`contextResourcesFieldIdentifier`, `relationshipContexts`) are forwarded\n * verbatim to {@link createForInternalOperation}; omit them for an unattributed\n * system context.\n */\n public async createForInternalServiceOperation<TResourceConfigOperation extends ResourceConfiguration_Operation<any, any, any> >(\n params: Omit<ExecutionContext_FactoryParams, 'executionType' | 'operation'> & {\n resourceType: ResourceType;\n operationIdentifier: string;\n }\n ): Promise<ExecutionContext<TResourceConfigOperation>> {\n const { resourceType, operationIdentifier, ...contextParams } = params;\n const operationPath = this.resourcesRegistryService.getServiceOperationPathDefault(\n resourceType,\n operationIdentifier,\n );\n return this.createForInternalOperation<TResourceConfigOperation>({\n ...contextParams,\n operation: operationPath,\n });\n }\n\n /**\n * Create an internal execution context for a custom batch definition.\n *\n * Custom batches are authored outside the resource-operation registry, so\n * some of them either:\n *\n * 1. point at semantic operation identifiers that do not exist as concrete\n * `CRON_JOB` / `BATCH_JOB` registry variants on a real resource\n * (`kind: CustomBatchManifestKind.RESOURCE_ANCHORED`), or\n * 2. are event-triggered cross-resource workers with no honest target\n * resource at all (`kind: CustomBatchManifestKind.SCOPE_ANCHORED` — e.g. `email.batch-send`,\n * `m2m-webhook-delivery`).\n *\n * In both cases we bootstrap through a real registered operation so that\n * `populateApplicationIdIfNeeded` and the rest of the EC creator wiring run\n * unmodified, then swap the operation for the custom batch's synthetic\n * identity via {@link ExecutionContext.withOperation}, which preserves\n * `_initiatorIds` (including the freshly populated `applicationId`),\n * `_subCallDepth`, `_visitedResources`, and the request UUID — i.e. the\n * audit-relevant identity carried by the bootstrap context survives the\n * swap, only the operation slot changes.\n *\n * Resource-anchored batches resolve the bootstrap on their declared\n * `(resourceIdentifier, operationIdentifier)` pair (matching the existing\n * registry-backed behavior). Scope-anchored batches deliberately bootstrap\n * on `APPLICATION.READ` instead of pretending to be operations on an\n * unrelated resource — the synthetic operation then carries the declared\n * `primaryScope` so downstream authorization and audit logs see the honest\n * scope rather than the bootstrap one.\n */\n public async createForInternalCustomBatch(\n params: {\n batchOperationContext: BatchesCronjobsCustomExecution_Context;\n contextResourcesFieldIdentifier: Map<ResourceFieldIdentifier, string>;\n relationshipContexts?: ExecutionContext_RelationshipContext[];\n }\n ): Promise<ExecutionContext<any>> {\n const { batchOperationContext, contextResourcesFieldIdentifier, relationshipContexts } = params;\n\n if (batchOperationContext.kind === CustomBatchManifestKind.SCOPE_ANCHORED) {\n return this.createForInternalScopeAnchoredCustomBatch({\n batchOperationContext,\n contextResourcesFieldIdentifier,\n relationshipContexts,\n });\n }\n\n const resourceConfig = this.resourcesRegistryService\n .getResourcesRegistry()\n .resourceConfigurations[batchOperationContext.resourceIdentifier];\n\n if (!resourceConfig) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: `Custom batch '${batchOperationContext.operationIdentifier}' targets unknown resource '${batchOperationContext.resourceIdentifier}'`,\n resourceIdentifier: batchOperationContext.resourceIdentifier,\n operationIdentifier: batchOperationContext.operationIdentifier,\n }\n }\n );\n }\n\n const expectedVariantType = batchOperationContext.cronJobExpression\n ? ResourceOperationVariantType.CRON_JOB\n : ResourceOperationVariantType.BATCH_JOB;\n\n const exactVariantMatches = resourceConfig.operations.filter((operation) =>\n operation.operationIdentifier === batchOperationContext.operationIdentifier\n && operation.variantType === expectedVariantType\n );\n\n if (exactVariantMatches.length > 1) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: `Custom batch operation resolution is ambiguous for '${batchOperationContext.resourceIdentifier}.${batchOperationContext.operationIdentifier}'`,\n resourceIdentifier: batchOperationContext.resourceIdentifier,\n operationIdentifier: batchOperationContext.operationIdentifier,\n expectedVariantType,\n matchedCount: exactVariantMatches.length,\n }\n }\n );\n }\n\n const bootstrapOperation = exactVariantMatches[0]\n ?? this.resolveBootstrapOperationForCustomBatch(resourceConfig, batchOperationContext.operationIdentifier);\n\n const bootstrapContext = await this.createForInternalOperation({\n operation: ResourcesConfig_OperationPathUtils.extractOperationPath(bootstrapOperation),\n contextResourcesFieldIdentifier,\n initiatorIds: null,\n initiatorRoles: this.createInternalSystemRoles(),\n relationshipContexts,\n });\n\n const syntheticBatchOperation: ResourceConfiguration_Operation<any, any, any> = expectedVariantType === ResourceOperationVariantType.CRON_JOB\n ? {\n ...bootstrapOperation,\n operationIdentifier: batchOperationContext.operationIdentifier,\n variantType: ResourceOperationVariantType.CRON_JOB,\n cronExpression: batchOperationContext.cronJobExpression ?? '',\n isOperationDefault: false,\n roles: [],\n } as ResourceConfiguration_Operation<any, any, any>\n : {\n ...bootstrapOperation,\n operationIdentifier: batchOperationContext.operationIdentifier,\n variantType: ResourceOperationVariantType.BATCH_JOB,\n isOperationDefault: false,\n roles: [],\n } as ResourceConfiguration_Operation<any, any, any>;\n\n return bootstrapContext.withOperation(syntheticBatchOperation);\n }\n\n /**\n * Bootstrap an `ExecutionContext` for a `scope_anchored` custom batch.\n *\n * Strategy (OD-2.c \"spread-and-override\"):\n *\n * 1. Resolve the canonical `APPLICATION.READ` operation as the bootstrap\n * anchor. APPLICATION.READ is always registered and always\n * APPLICATION-scoped, which is exactly what we need to make\n * `populateApplicationIdIfNeeded` fire during\n * `createForInternalOperation` so the bootstrap context carries a\n * populated `applicationId` before the operation swap.\n * 2. Spread the bootstrap operation and override the identity-carrying\n * fields with the batch's synthetic shape: the declared\n * `operationIdentifier`, `BATCH_JOB`/`CRON_JOB` variant type, the\n * optional cron expression, `isOperationDefault: false`, an empty\n * `roles` list, and — crucially — `resourcePrimaryScope` from the\n * batch context so downstream authorization sees the honest scope\n * rather than the bootstrap APPLICATION scope.\n * 3. Swap the operation via {@link ExecutionContext.withOperation}, which\n * preserves `_initiatorIds` (and therefore the `applicationId` populated\n * in step 1), `_subCallDepth`, `_visitedResources`, and the request\n * UUID. Only the `operation` slot changes; the audit-relevant identity\n * of the bootstrap context survives.\n *\n * This is the engine-level seam that lets event-triggered batches stop\n * pretending to be operations on an unrelated resource. The synthetic\n * `roles: []` is intentional: the bootstrap context already carries the\n * `APP_ADMIN_SUPER_ADMIN` system role via `createInternalSystemRoles()`,\n * and the synthetic operation must not advertise additional public roles.\n */\n private async createForInternalScopeAnchoredCustomBatch(\n params: {\n batchOperationContext: Extract<\n BatchesCronjobsCustomExecution_Context,\n { kind: CustomBatchManifestKind.SCOPE_ANCHORED }\n >;\n contextResourcesFieldIdentifier: Map<ResourceFieldIdentifier, string>;\n relationshipContexts?: ExecutionContext_RelationshipContext[];\n }\n ): Promise<ExecutionContext<any>> {\n const { batchOperationContext, contextResourcesFieldIdentifier, relationshipContexts } = params;\n\n const bootstrapOperationPath = this.resourcesRegistryService.getOperationPathDefault(\n CoreResourceType.APPLICATION,\n CoreResourceOperation.READ,\n );\n const bootstrapOperation = this.resourcesRegistryService.getOperationFromPath(bootstrapOperationPath);\n\n const bootstrapContext = await this.createForInternalOperation({\n operation: ResourcesConfig_OperationPathUtils.extractOperationPath(bootstrapOperation),\n contextResourcesFieldIdentifier,\n initiatorIds: null,\n initiatorRoles: this.createInternalSystemRoles(),\n relationshipContexts,\n });\n\n const expectedVariantType = batchOperationContext.cronJobExpression\n ? ResourceOperationVariantType.CRON_JOB\n : ResourceOperationVariantType.BATCH_JOB;\n\n const syntheticBatchOperation: ResourceConfiguration_Operation<any, any, any> = expectedVariantType === ResourceOperationVariantType.CRON_JOB\n ? {\n ...bootstrapOperation,\n operationIdentifier: batchOperationContext.operationIdentifier,\n variantType: ResourceOperationVariantType.CRON_JOB,\n cronExpression: batchOperationContext.cronJobExpression ?? '',\n resourcePrimaryScope: batchOperationContext.primaryScope,\n isOperationDefault: false,\n roles: [],\n } as ResourceConfiguration_Operation<any, any, any>\n : {\n ...bootstrapOperation,\n operationIdentifier: batchOperationContext.operationIdentifier,\n variantType: ResourceOperationVariantType.BATCH_JOB,\n resourcePrimaryScope: batchOperationContext.primaryScope,\n isOperationDefault: false,\n roles: [],\n } as ResourceConfiguration_Operation<any, any, any>;\n\n return bootstrapContext.withOperation(syntheticBatchOperation);\n }\n\n\n async createForPublicOperation<TResourceConfigOperation extends ResourceConfiguration_Operation<any, any, any>>(\n params: Omit<ExecutionContext_FactoryParams, 'executionType'>\n ): Promise<ExecutionContext<TResourceConfigOperation>> {\n\n return this.createExecutionContext({\n ...params,\n executionType: ExecutionContext_ExecutionType.PUBLIC_EXECUTION,\n });\n }\n\n\n\n /**\n * Create internal execution context for system operations (no specific operation context needed).\n * Convenience method for queue services, tracking, and other internal operations.\n *\n * Uses a generic \"system\" operation that grants full access within the application scope.\n * This is used by queue services for internal DB operations that don't have a specific user context.\n */\n public async createForInternalSystemOperation(): Promise<ExecutionContext<any>> {\n // Use a generic internal operation for system-level access\n const operationPath = this.resourcesRegistryService.getOperationPathDefault(\n CoreResourceType.APPLICATION,\n CoreResourceOperation.READ\n );\n const systemOperation = this.resourcesRegistryService.getOperationFromPath(operationPath);\n\n return this.createForInternalOperation({\n operation: systemOperation,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null, // Null for internal operations\n initiatorRoles: this.createInternalSystemRoles(),\n relationshipContexts: [],\n });\n }\n\n private resolveBootstrapOperationForCustomBatch(\n resourceConfig: AnyResourceConfiguration,\n operationIdentifier: string,\n ): AnyResourceConfiguration['operations'][number] {\n const sameIdentifierOperations = resourceConfig.operations.filter(\n (operation) => operation.operationIdentifier === operationIdentifier\n );\n\n // A multi-variant anchor is NOT ambiguous when the configuration declares which variant is the\n // default: that is the one the batch's own `servicesRegistry.<verb>()` will dispatch through\n // (`getServiceOperationPathDefault`), so bootstrapping on anything else would describe an\n // operation the batch never performs.\n //\n // Without this, ANY resource whose anchor verb declares more than one variant makes its\n // resource-anchored batch unrunnable — it throws CONFIGURATION on every invocation. That is not\n // hypothetical: `organization-purge` anchors on `ORGANIZATIONS | DELETE`, which declares an\n // INTERNAL_CALL default (the purge door) plus an `admin` API_CALL variant, so the tenant-teardown\n // batch failed on every run and marked tenants were never destroyed — the exact failure the\n // retention window exists to prevent, and silent because a batch failure is logged, not surfaced.\n //\n // Defaults are variant-type-LOCAL, so several transport groups can each declare one. The\n // tie-break mirrors the service resolver's own transport preference (native INTERNAL first, then\n // URL-bearing) rather than inventing a second, divergent rule. Genuine ambiguity — no default at\n // all, or two within the same preference tier — still fails closed below.\n if (sameIdentifierOperations.length > 1) {\n const defaultOperations = sameIdentifierOperations.filter(\n (operation) => operation.isOperationDefault === true\n );\n const preferredDefault = SERVICE_RESOLVABLE_TRANSPORT_PREFERENCE\n .map((variantTypes) => defaultOperations.filter((operation) => variantTypes.includes(operation.variantType)))\n .find((matches) => matches.length === 1)?.[0];\n if (preferredDefault) {\n return preferredDefault;\n }\n }\n\n if (sameIdentifierOperations.length > 1) {\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'Custom batch bootstrap operation is ambiguous because multiple variants share the requested operation identifier',\n resourceIdentifier: resourceConfig.resourceIdentifier,\n operationIdentifier,\n candidateVariants: sameIdentifierOperations.map((operation) => ({\n variantType: operation.variantType,\n variantKey: operation.variantKey,\n isOperationDefault: operation.isOperationDefault,\n })),\n }\n }\n );\n }\n const sameIdentifierOperation = sameIdentifierOperations[0];\n\n if (sameIdentifierOperation) {\n return sameIdentifierOperation;\n }\n\n const defaultReadOperations = resourceConfig.operations.filter(\n (operation) => operation.operationIdentifier === CoreResourceOperation.READ\n && operation.isOperationDefault === true\n );\n if (defaultReadOperations.length > 1) {\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'Custom batch bootstrap READ operation is ambiguous because multiple default variants exist',\n resourceIdentifier: resourceConfig.resourceIdentifier,\n operationIdentifier,\n candidateVariants: defaultReadOperations.map((operation) => ({\n variantType: operation.variantType,\n variantKey: operation.variantKey,\n })),\n }\n }\n );\n }\n const defaultReadOperation = defaultReadOperations[0];\n\n if (defaultReadOperation) {\n return defaultReadOperation;\n }\n\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: `Custom batch '${operationIdentifier}' cannot bootstrap an execution context because resource '${resourceConfig.resourceIdentifier}' exposes no requested operation and no default READ operation`,\n resourceIdentifier: resourceConfig.resourceIdentifier,\n operationIdentifier,\n }\n }\n );\n }\n\n /**\n * Create an ExecutionContext for a webhook callback.\n *\n * Webhook events are not tied to a single resource operation — a single event\n * (e.g., invoice.paid) may trigger multiple operations (update subscription, create invoice record, adjust credits).\n * Uses APPLICATION.READ as a generic \"entry\" operation for the pipeline.\n * Capability handlers create per-resource sub-contexts via createForSubCall() for specific operations.\n *\n * @param resolvedScope - Scope identifiers resolved from the webhook event payload\n * @param parsedEvent - The parsed webhook event (for providerRef metadata)\n */\n public async createForWebhookCallback(\n resolvedScope: {\n applicationId?: string;\n organizationId?: string;\n userId?: string;\n providerScopeIds?: Record<string, string>;\n },\n parsedEvent: {\n providerRef: string;\n endpointKey: string;\n eventId: string;\n eventType: string;\n }\n ): Promise<ExecutionContext<any>> {\n // Use a generic APPLICATION.READ operation as the entry point\n const operationPath = this.resourcesRegistryService.getOperationPathDefault(\n CoreResourceType.APPLICATION,\n CoreResourceOperation.READ,\n );\n const operation = this.resourcesRegistryService.getOperationFromPath(operationPath);\n\n // Map all resolved scope fields to initiatorIds\n const initiatorIds: ExecutionContext_InitiatorIds = {\n applicationId: resolvedScope.applicationId,\n organizationId: resolvedScope.organizationId,\n userId: resolvedScope.userId,\n webhookProviderId: parsedEvent.providerRef,\n };\n\n const executionContext = new ExecutionContext(\n operation,\n ExecutionContext_ExecutionType.WEBHOOK_CALLBACK,\n new Map(),\n initiatorIds,\n [], // No roles — webhooks are trusted after signature verification\n []\n );\n\n await this.populateApplicationIdIfNeeded(executionContext);\n\n return executionContext;\n }\n\n /**\n * Reconstruct ExecutionContext from serialized data (for queue workers).\n *\n * This method:\n * 1. Deserializes the operationPathJson to get the OperationPath\n * 2. Gets the full Operation from the registry\n * 3. Reconstructs ExecutionContext with the original execution type, initiator IDs, and roles\n *\n * @param executionContextJson - Serialized execution context data (optional for CUSTOM_BATCH/SCHEDULED_CRON)\n * @param operationPathJson - Serialized operation path from JobPayload (optional for CUSTOM_BATCH)\n * @returns Reconstructed ExecutionContext ready for execution\n */\n public async reconstructFromSerializedData(\n executionContextJson: string | undefined,\n operationPathJson: string | undefined\n ): Promise<ExecutionContext<any>> {\n // Import dynamically to avoid circular dependencies\n const { ResourceSerializationUtils } = await import('@wildo-ai/saas-models');\n\n // If no serialized data, return internal system context\n if (!executionContextJson || !operationPathJson) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.JOB_EXECUTION_CONTEXT_INVALID,\n context: { message: 'Cannot reconstruct ExecutionContext from undefined serialized data' },\n }\n );\n }\n\n // Deserialize the data\n const ctxData = ResourceSerializationUtils.deserializeExecutionContextData(executionContextJson);\n const operationPath = ResourceSerializationUtils.deserializeOperationPath(operationPathJson);\n\n // Get the full operation from registry\n const operation = this.resourcesRegistryService.getOperationFromPath(operationPath);\n\n // Convert contextResourcesFieldIdentifier from plain object to Map\n // Note: The schema accepts Map<string, string> but the actual ExecutionContext uses Map<ResourceFieldIdentifier, string | string[]>\n // We convert arrays to comma-separated strings for factory param compatibility\n const contextResourcesMap = new Map<string, string>();\n if (ctxData.contextResourcesFieldIdentifier) {\n Object.entries(ctxData.contextResourcesFieldIdentifier).forEach(([key, value]) => {\n // Convert arrays to first value (most common case) or comma-separated for compatibility\n const stringValue = Array.isArray(value) ? value[0] ?? '' : value;\n contextResourcesMap.set(key, stringValue);\n });\n }\n\n // Convert relationshipContexts\n const relationshipContexts = ctxData.relationshipContexts || [];\n\n // Reconstruct ExecutionContext based on original execution type\n if (ctxData.executionType === ExecutionContext_ExecutionType.INTERNALLY_INITIATED_REQUEST) {\n return this.createForInternalOperation({\n operation,\n contextResourcesFieldIdentifier: contextResourcesMap,\n initiatorIds: ctxData.initiatorIds,\n initiatorRoles: ctxData.initiatorRoles,\n relationshipContexts,\n });\n } else if (ctxData.executionType === ExecutionContext_ExecutionType.PUBLIC_EXECUTION) {\n return this.createForPublicOperation({\n operation,\n contextResourcesFieldIdentifier: contextResourcesMap,\n initiatorIds: ctxData.initiatorIds,\n initiatorRoles: ctxData.initiatorRoles,\n relationshipContexts,\n });\n } else if (ctxData.executionType === ExecutionContext_ExecutionType.ANONYMOUS_SESSION) {\n // W7.3a: Reconstruct anonymous session context with anonymousUserId from serialized initiatorIds\n return this.createExecutionContext({\n executionType: ExecutionContext_ExecutionType.ANONYMOUS_SESSION,\n operation,\n contextResourcesFieldIdentifier: contextResourcesMap,\n initiatorIds: ctxData.initiatorIds,\n initiatorRoles: ctxData.initiatorRoles ?? [{ roles: [CORE_APP_ROLES.APP_ANONYMOUS], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n relationshipContexts,\n });\n } else if (ctxData.executionType === ExecutionContext_ExecutionType.WEBHOOK_CALLBACK) {\n // Webhook callback — reconstruct with the resolved scope from initiatorIds\n return this.createForWebhookCallback(\n {\n applicationId: ctxData.initiatorIds?.applicationId,\n organizationId: ctxData.initiatorIds?.organizationId,\n userId: ctxData.initiatorIds?.userId,\n },\n {\n providerRef: ctxData.initiatorIds?.webhookProviderId ?? 'unknown',\n endpointKey: 'reconstructed',\n eventId: 'reconstructed',\n eventType: 'reconstructed',\n }\n );\n } else {\n // USER_REQUEST, API_KEY, etc. - use createExecutionContext\n return this.createExecutionContext({\n executionType: ctxData.executionType as ExecutionContext_ExecutionType,\n operation,\n contextResourcesFieldIdentifier: contextResourcesMap,\n initiatorIds: ctxData.initiatorIds,\n initiatorRoles: ctxData.initiatorRoles,\n relationshipContexts,\n });\n }\n }\n\n /**\n * Keep only the context fields the TARGET resource can actually be filtered by.\n *\n * The predicate deliberately mirrors the repository's own contextual-filter rule, so this never\n * drops a field the repository would have honoured:\n *\n * - the field resolves to a path in the target's `mainSchema` (the NON-throwing lookup, the same\n * one the write path uses to decide where to inject); or\n * - it is the target's own primary-scope field identifier, which a scoped resource carries as a\n * top-level column even when the Zod schema does not model it (`auditLogs.applicationId`, the\n * shared `ScopeFeaturesWithOverridesSchema` resources, …).\n *\n * Anything else would make the repository throw `context_filter`. An unresolvable target\n * configuration returns the map untouched: this is a defensive narrowing, not an authority, and it\n * must never be the reason a context silently loses its scope.\n */\n private retainContextFieldsKnownToResource(\n inherited: Map<ResourceFieldIdentifier, string | string[]>,\n resourceType: ResourceType,\n ): Map<ResourceFieldIdentifier, string | string[]> {\n // Optional calls, deliberately. This narrowing is a REPAIR, never a gate: when the registry or\n // the helper cannot answer (a minimal test container, a partially-wired bootstrap), the correct\n // fallback is to inherit unchanged — i.e. the pre-existing behaviour, which is fail-CLOSED at the\n // repository. Declining an optional repair is not the same as relaxing an enforcement.\n const targetConfiguration = this.resourcesRegistryService.tryGetResourceConfiguration?.(resourceType);\n if (!targetConfiguration?.mainSchema || !this.resourceOperationHelper) return new Map(inherited);\n\n const primaryScopeFieldIdentifier = targetConfiguration.resourcePrimaryScope\n ? PRIMARY_SCOPE_TO_FIELD_IDENTIFIER[targetConfiguration.resourcePrimaryScope]\n : undefined;\n\n const retained = new Map<ResourceFieldIdentifier, string | string[]>();\n const dropped: string[] = [];\n for (const [fieldIdentifier, value] of inherited) {\n const isModelled = this.resourceOperationHelper\n .findNestedFieldPathsFromZodSchema(targetConfiguration.mainSchema, fieldIdentifier)\n .length > 0;\n if (isModelled || fieldIdentifier === primaryScopeFieldIdentifier) {\n retained.set(fieldIdentifier, value);\n } else {\n dropped.push(fieldIdentifier);\n }\n }\n\n if (dropped.length > 0) {\n this.logDebug('Sub-call context dropped parent context fields the target resource does not model', {\n resourceType,\n dropped,\n retained: [...retained.keys()],\n });\n }\n return retained;\n }\n\n /**\n * Create a new ExecutionContext for an internal sub-call.\n * Inherits security context from parent but uses the correct operation for the sub-resource.\n *\n * @param parentContext - The parent execution context to inherit from\n * @param resourceType - The resource type for the sub-call\n * @param operationIdentifier - The operation (READ, LIST, etc.)\n * @param options - ServiceOptions with variantKey, dataMode\n * @param resourceId - Optional resource ID for single-resource operations (undefined for LIST)\n * @param relationshipContext - Optional relationship context tracking how we got to this sub-resource.\n * Should be provided when there's an FK relationship between parent and sub-resource.\n * Example: { resourceType: 'USER_SELF', relationshipField: 'userId', resourceId: '...' }\n */\n async createForSubCall(\n parentContext: ExecutionContext<any>,\n resourceType: ResourceType,\n operationIdentifier: CoreResourceOperation,\n options?: ServiceOptions,\n resourceId?: string,\n relationshipContext?: ExecutionContext_RelationshipContext\n ): Promise<ExecutionContext<any>> {\n\n // 0. Validate parent context exists\n if (!parentContext) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'Parent context is required for sub-calls. Use createForInternalOperation for top-level internal operations.'\n }\n }\n );\n }\n\n // 1. Cycle detection and depth check\n const currentDepth = parentContext.getSubCallDepth();\n const MAX_DEPTH = 15;\n if (currentDepth >= MAX_DEPTH) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n parentContext,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: `Max sub-call depth (${MAX_DEPTH}) exceeded. Possible circular dependency.`,\n resourceType,\n operationIdentifier,\n currentDepth\n }\n }\n );\n }\n\n // 2a. Instance-level cycle detection (UPDATE/DELETE — same resourceType:resourceId visited before)\n if (resourceId) {\n const visitKey = `${resourceType}:${resourceId}`;\n if (parentContext.hasVisitedResource(visitKey)) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n parentContext,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: `Circular dependency detected: ${visitKey} already visited in call chain.`,\n visitKey,\n resourceType,\n operationIdentifier\n }\n }\n );\n }\n }\n\n // 2b. Type-level cycle detection for nested CREATE.\n // CREATE has no resourceId, so the instance-level check above is skipped.\n // Instead, detect schema-level cycles by checking if the child resource type\n // already appears as a parent in the relationship context chain.\n // Example: A→B→A cycle would have relationshipContexts=[{resourceType:A},{resourceType:B}]\n // and we're about to create another A — the chain proves a cycle.\n //\n // Performance: O(n) where n = relationship chain depth, typically <5. Negligible.\n if (operationIdentifier === CoreResourceOperation.CREATE && relationshipContext) {\n const ancestorResourceTypes = parentContext.relationshipContexts.map(rc => rc.resourceType);\n if (ancestorResourceTypes.includes(resourceType)) {\n const chainDescription = [...ancestorResourceTypes, resourceType].join(' → ');\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n parentContext,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: `Circular dependency in nested CREATE: resource type \"${resourceType}\" already appears as an ancestor in the relationship chain. Chain: ${chainDescription}`,\n resourceType,\n operationIdentifier,\n chainDescription,\n }\n }\n );\n }\n }\n\n // 3. Get the correct operation path. A provided variant key is part of the\n // caller's intended DTO/policy surface, so missing variants must fail loud\n // instead of silently falling back to default.\n //\n // SERVICE-dispatch resolver (not the URL-only `getOperationPath*`): this is\n // the generic internal-operation context builder and `resourceType` /\n // `operationIdentifier` are arbitrary — including resources whose operations\n // are declared `INTERNAL_CALL` (e.g. nested child creates). The URL-only\n // resolver would throw `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` for\n // those. (The hardcoded `APPLICATION.READ` bootstrap sites elsewhere in this\n // file stay on the URL resolver — that op is always API_CALL.)\n let operationPath: ResourceConfiguration_OperationPath<any, any>;\n if (options?.variantKey) {\n operationPath = this.resourcesRegistryService.getServiceOperationPath(resourceType, operationIdentifier, options.variantKey);\n } else {\n operationPath = this.resourcesRegistryService.getServiceOperationPathDefault(resourceType, operationIdentifier);\n }\n\n // 4. Get the operation configuration\n const operation = this.resourcesRegistryService.getOperationFromPath(operationPath);\n\n // 5. Build contextual FK fields: INHERIT the parent's fields THAT THE TARGET ACTUALLY HAS + add new.\n //\n // Inheriting the parent's map WHOLESALE was a defect. A sub-call changes resource by definition,\n // and the parent's context is keyed to the PARENT's resource — so it routinely carries fields the\n // target has no column for. The repository's contextual filter is (correctly) fail-closed on an\n // unknown context field, so those foreign fields did not degrade the query, they THREW.\n //\n // Concretely (2026-08-05): assigning a member to an organization unit 500'd for every caller.\n // `ORGANIZATION_UNIT_MEMBERS | CREATE` carries `organizationMemberId`; its cross-tenant guard reads\n // ORGANIZATION_UNITS, which has no such field → CONFIGURATION / `context_filter`, and the whole\n // unit-assignment feature was unusable over HTTP.\n //\n // WHY DROPPING IS SAFE — it cannot widen a query. A field removed here is exactly a field the\n // repository would have REFUSED to filter on; there is no case where it would have been applied\n // as a scope and now silently is not. Fields the target does model — including its own\n // primary-scope FK, which scoped resources carry as a top-level column even when the Zod schema\n // does not model it — are all retained, so tenant scoping is untouched. That mirrors the write\n // path's own non-throwing lookup (`enrichDataWithContextFields`).\n const contextResourcesFieldIdentifier = this.retainContextFieldsKnownToResource(\n parentContext.getContextResourceIds() as Map<ResourceFieldIdentifier, string | string[]>,\n resourceType,\n );\n if (resourceId) {\n const allFieldIds = this.resourcesRegistryService.getAllResourceFieldIdentifiers();\n const fieldIdentifier = allFieldIds[resourceType];\n if (fieldIdentifier) {\n contextResourcesFieldIdentifier.set(fieldIdentifier, resourceId);\n }\n }\n\n // 6. Build relationship contexts: inherit the parent's THAT THE TARGET MODELS + add new.\n //\n // The SECOND inheritance channel, and it needs the same narrowing as the context map in step 5 —\n // for the same reason and with the same safety argument. A relationship context drives FK-PATH\n // filtering (`fk_filter`), which is equally fail-closed: a `relationshipField` the target does\n // not model throws rather than degrading the query. Narrowing step 5 alone just moved the unit\n // assignment 500 from `context_filter` to `fk_filter` on the very same field.\n //\n // Entries WITHOUT a `relationshipField` are always kept: they carry no filter, only the\n // ancestry the CREATE cycle-detector above reads (`relationshipContexts.map(rc => rc.resourceType)`),\n // so dropping them could mask a real A→B→A cycle.\n const relationshipContexts = [...parentContext.relationshipContexts].filter((candidate) => {\n if (!candidate.relationshipField) return true;\n return this.retainContextFieldsKnownToResource(\n new Map([[candidate.relationshipField as ResourceFieldIdentifier, '']]),\n resourceType,\n ).size > 0;\n });\n if (relationshipContext) {\n relationshipContexts.push(relationshipContext);\n }\n\n // 7. Build visited resources set: inherit from parent + add current\n const visitedResources = new Set<string>(parentContext.getVisitedResources());\n if (resourceId) {\n visitedResources.add(`${resourceType}:${resourceId}`);\n }\n\n // 8. Create new context inheriting from parent\n // Note: ExecutionType and correlationId inherited (same request flow)\n const subCallContext = new ExecutionContext(\n operation,\n parentContext.executionType, // Inherit - same origin\n contextResourcesFieldIdentifier, // Inherit parent + add new\n parentContext.initiatorIds, // Inherit (readonly, passed as reference)\n [...parentContext.initiatorRoles], // Inherit (spread to new array)\n relationshipContexts, // Inherit parent + add new relationship\n parentContext.correlationId, // INHERIT - same request trace\n currentDepth + 1, // Increment depth for next level\n visitedResources, // Track visited for cycle detection\n parentContext.activeUserType, // Inherit - same user type context\n // Inherit: a nested operation performed as part of an on-behalf-of act is still on behalf of the\n // same principal. Unlike the request-entry setter flags below, this is identity-shaped (it sits\n // with `initiatorIds`, which is also inherited) and confers NO authority, so propagating it can\n // never widen what a sub-call may do — only what the trail can say about who caused it.\n parentContext.auditActorUserId,\n );\n // M5b: propagate the retention see-through flag DOWN the sub-call chain. Unlike the request-entry\n // setter flags (consumable-token / anonymous-session), which are intentionally NOT inherited by\n // sub-calls, a see-through read that traverses relations must keep revealing retained rows at every\n // hop — otherwise a populated / context-embedded retained record silently re-hides mid-traversal.\n // Fail-closed: only propagates when the parent already carries it (default false stays false).\n if (parentContext.seeRetainedData) {\n subCallContext.setSeeRetainedData(true);\n }\n // WS-C: carry the parent's organization-unit narrowing decisions down the sub-call chain. A\n // sub-call does not re-run the request gate, so without this a nested read of a narrowed resource\n // would find no stamp and fail closed to zero rows mid-traversal. The stamps are keyed by\n // resource, so inheriting them can never answer for a resource the gate did not evaluate — a\n // sub-call reaching a DIFFERENT narrowed resource still finds nothing and still fails closed.\n subCallContext.inheritOrganizationUnitNarrowingStamps(parentContext);\n return subCallContext;\n }\n\n public async createExecutionContextFromRequest<\n TCustomOperationEnum extends EnumLikeType | undefined = undefined,\n TCoreOperationEnum extends Partial<CoreResourceOperation> | undefined = undefined,\n TMainSchema extends z.ZodTypeAny = z.ZodTypeAny\n >(\n req: Request,\n operation: ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>,\n initiatorInfo: ResourceConfiguration_Operation_UrlInitiatorInfo\n ): Promise<ExecutionContext<typeof operation>> {\n\n this.logDebug('Creating execution context from request', { operation: operation.operationIdentifier, url: req.url, method: req.method });\n\n // ── Token and authentication sources ──\n const queryToken = req.query?.consumable_token as string | undefined;\n const headerToken = req.headers[WildoHeaderKeys.CONSUMABLE_TOKEN] as string | undefined;\n const tokenAuthConfig = 'tokenAuthentication' in operation ? operation.tokenAuthentication : undefined;\n const policy = tokenAuthConfig?.policy;\n\n // ── GATE 1: Query token present — route by policy ──\n if (queryToken) {\n if (!tokenAuthConfig) {\n // Trap 6: operation doesn't accept token authentication\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_NOT_ACCEPTED_FOR_OPERATION,\n context: { operationIdentifier: operation.operationIdentifier },\n });\n }\n\n if (policy === TokenAuthenticationPolicy.ALTERNATIVE) {\n this.logDebug('Consumable token provided, processing ALTERNATIVE token authentication');\n\n const expectedTypes = tokenAuthConfig.types || [];\n const consumableTokenObject = await this.consumableTokenService.validateToken(\n queryToken,\n expectedTypes.length > 0 ? expectedTypes : undefined,\n );\n\n // Build context from typed token fields (Trap 3: no untyped metadata bag)\n const tokenContext: Record<string, string> = {};\n if (consumableTokenObject.organizationId) {\n tokenContext.organizationId = consumableTokenObject.organizationId;\n }\n if (consumableTokenObject.relatedId) {\n const resourceFieldIdentifier = this.resolveResourceFieldIdentifier(operation);\n if (resourceFieldIdentifier) {\n tokenContext[resourceFieldIdentifier] = consumableTokenObject.relatedId;\n }\n }\n if (consumableTokenObject.userId) {\n tokenContext.userId = consumableTokenObject.userId;\n }\n\n const initiatorCriticalParamsValue = this.validateParameterCoherence(req, initiatorInfo, tokenContext);\n const relationshipContexts = this.buildRelationshipContexts(initiatorInfo, initiatorCriticalParamsValue);\n\n const initiatorIds = {\n consumableTokenId: consumableTokenObject._id,\n organizationId: consumableTokenObject.organizationId,\n userId: consumableTokenObject.userId,\n ...this.extractInitiatorIds(initiatorCriticalParamsValue),\n };\n\n const executionContext = new ExecutionContext(\n operation,\n ExecutionContext_ExecutionType.CONSUMABLE_TOKEN,\n new Map(Object.entries(initiatorCriticalParamsValue)),\n initiatorIds,\n consumableTokenObject.roles || [],\n relationshipContexts\n );\n\n executionContext.setConsumableTokenValue(queryToken);\n\n if (operation.resourcePrimaryScope === ResourcePrimaryScope.APPLICATION) {\n await this.populateApplicationIdIfNeeded(executionContext);\n }\n\n return executionContext;\n }\n\n // ADDITIVE: query token is irrelevant — fall through to JWT/API-key auth\n }\n\n // ── GATE 2: JWT / API-key authentication ──\n const authHeader = req.headers[WildoHeaderKeys.AUTHORIZATION] as string | undefined;\n\n if (authHeader) {\n let executionContext: ExecutionContext<typeof operation>;\n\n if (isApiKeyCredential(authHeader)) {\n executionContext = await this.handleApiKeyAuthentication(authHeader, req, operation, initiatorInfo);\n } else if (authHeader.startsWith('oc_org_') || authHeader.startsWith('oc_app_')) {\n // Direct OAuth-client secret front (D2): a registered client presents its\n // long-lived `oc_*` secret per-request (api-key style) and authenticates as a\n // machine principal (ORGANIZATION_MACHINE / APPLICATION_MACHINE). The exchanged short-lived-token front is the\n // Bearer-JWT path below (handleJwtAuthentication), which routes machine tokens to\n // `verifyMachineToken` (iss=aud=the API resource) and enforces the RFC 8707 `aud`\n // gate in its machine arm — both fronts resolve to the same machine principal.\n executionContext = await this.handleOAuthClientSecretAuthentication(authHeader, req, operation, initiatorInfo);\n } else {\n const token = this.parseBearerToken(authHeader);\n executionContext = await this.handleJwtAuthentication(token, req, operation, initiatorInfo);\n\n const reAuthToken = req.headers[WildoHeaderKeys.REAUTH_TOKEN] as string | undefined;\n if (reAuthToken) {\n executionContext.setReAuthTokenValue(reAuthToken);\n }\n }\n\n // ── GATE 3: ADDITIVE check (after JWT/API-key auth succeeded) ──\n if (policy === TokenAuthenticationPolicy.ADDITIVE) {\n if (!headerToken) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.ADDITIVE_TOKEN_REQUIRED,\n context: { operationIdentifier: operation.operationIdentifier },\n });\n }\n const expectedTypes = tokenAuthConfig!.types || [];\n const consumableTokenObject = await this.consumableTokenService.validateToken(\n headerToken,\n expectedTypes.length > 0 ? expectedTypes : undefined,\n );\n\n if (consumableTokenObject.userId && executionContext.initiatorIds?.userId\n && consumableTokenObject.userId !== executionContext.initiatorIds.userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_CONTEXT_MISMATCH,\n context: { operationIdentifier: operation.operationIdentifier },\n });\n }\n\n executionContext.setConsumableTokenValue(headerToken);\n }\n\n return executionContext;\n }\n\n // ADDITIVE operations require JWT/API-key — anonymous sessions cannot satisfy them\n if (policy === TokenAuthenticationPolicy.ADDITIVE) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.ADDITIVE_TOKEN_REQUIRED,\n context: { operationIdentifier: operation.operationIdentifier },\n });\n }\n\n // Step 3: x-anonymous-session header — existing anonymous session with signed JWT\n const anonymousSessionToken = req.headers[WildoHeaderKeys.ANONYMOUS_SESSION] as string | undefined;\n if (anonymousSessionToken) {\n return this.handleAnonymousSessionAuthentication(anonymousSessionToken, req, operation, initiatorInfo);\n }\n\n // Step 4: x-anonymous-session-init header — new session initialization (raw UUID)\n const anonymousSessionInitId = req.headers[WildoHeaderKeys.ANONYMOUS_SESSION_INIT] as string | undefined;\n if (anonymousSessionInitId) {\n return this.handleAnonymousSessionInit(anonymousSessionInitId, req, operation, initiatorInfo);\n }\n\n // Step 5: the operation may be declared PUBLIC — accessible to everyone, no credential.\n if (this.operationAdmitsPublicAccess(operation)) {\n return this.createPublicRequestExecutionContext(operation, req, initiatorInfo);\n }\n\n // Step 6: No authentication provided, and the operation requires some.\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_NO_AUTHENTICATION_PROVIDED });\n }\n\n /**\n * Create an ExecutionContext for manual controller requests (charts, billing, etc.).\n *\n * Manual controllers are NOT resource controllers — they don't have a\n * ResourceConfiguration_Operation or URL initiatorInfo. This method provides a\n * lightweight alternative to createExecutionContextFromRequest that:\n *\n * 1. Extracts the Authorization header (Bearer JWT or API key)\n * 2. Verifies the token and fetches user from the database\n * 3. Builds initiator roles from org memberships\n * 4. Returns an ExecutionContext bound to APPLICATION.READ as a generic operation\n *\n * The returned context carries full identity (userId, roles, orgMemberships)\n * which is sufficient for:\n * - AggregationAuthorizationService (chart queries)\n * - Role-based guards (billing endpoints)\n * - Any service that needs initiatorIds / initiatorRoles\n *\n * @param req - Express Request object with Authorization header\n * @returns ExecutionContext<any> with the caller's identity and roles\n * @throws AUTHENTICATION error if no token, invalid token, or user not found/active\n */\n public async createExecutionContextForManualController(req: Request): Promise<ExecutionContext<any>> {\n this.logDebug('Creating execution context for manual controller', { url: req.url, method: req.method });\n\n // 1. Extract authorization header\n const authHeader = req.headers[WildoHeaderKeys.AUTHORIZATION] as string;\n if (!authHeader) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_NO_AUTHENTICATION_PROVIDED },\n );\n }\n\n // 2. Get a generic operation for the context (APPLICATION.READ — lightweight, application-scoped)\n const operationPath = this.resourcesRegistryService.getOperationPathDefault(\n CoreResourceType.APPLICATION,\n CoreResourceOperation.READ,\n );\n const operation = this.resourcesRegistryService.getOperationFromPath(operationPath);\n const tempContext = this._getTempExecutionContext(operation);\n\n // 3. Handle API key authentication\n const apiKeyScope = apiKeyScopeForCredential(authHeader);\n if (apiKeyScope !== null) {\n // Brute-force / DB-read-exhaustion guard on the presented-secret lookup (identical to the\n // api-key / oauth-client request-auth handlers): reject a saturated source before the read,\n // record a failure after a rejected one.\n const clientIp = getClientIpFromRequest(req);\n await assertMachineAuthAttemptWithinRate(this.redisService, this.errorBuilder, this.logger, clientIp, this.appConfigService.applicationEnv);\n\n try {\n // API keys for manual controllers: only app-level keys make sense\n // (org keys require ORGANIZATIONS-scoped operations which we don't have here)\n if (apiKeyScope === ApiKeyScope.ORGANIZATION) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.API_ORG_KEY_WRONG_RESOURCE,\n },\n );\n }\n // App-level API key — validate and build context\n const appApiKeyRepository = this.repositoriesRegistry.getRepository(CoreResourceType.APPLICATION_API_KEYS);\n // Resolve by the deterministic sha256 of the presented key — only `hashedKey`\n // is persisted (the plaintext never is). MUST stay in sync with the create\n // generation (`api-key-generation.backend.utils`).\n const appApiKey = await appApiKeyRepository.read<ApiKeyApplication>(tempContext, { hashedKey: hashApiKey(authHeader) });\n\n if (!appApiKey || appApiKey.status !== ApiKeyStatus.ACTIVE || isCredentialExpired(appApiKey.expiresAt)) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID, context: { scope: 'application' } },\n );\n }\n\n const executionContext = new ExecutionContext(\n operation,\n ExecutionContext_ExecutionType.APPLICATION_MACHINE,\n new Map(),\n { machineCredential: { authMethod: MachineAuthMethod.API_KEY, credentialId: appApiKey._id } },\n [{ roles: appApiKey.roles || [], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION, relatedResourceId: appApiKey.applicationId }],\n [],\n );\n await this.populateApplicationIdIfNeeded(executionContext, true);\n return executionContext;\n } catch (error) {\n await this.recordMachineAuthFailureIfAuthError(error, clientIp);\n throw error;\n }\n }\n\n // 4. Handle JWT Bearer token\n const token = this.parseBearerToken(authHeader);\n\n try {\n const rawDecodedToken = await this.jwtService.verifyWithoutBackendErrorActions(token);\n const decodedToken = JwtClaim_App_Auth_Schema.parse(rawDecodedToken);\n // Manual controllers accept USER_REQUEST JWTs only — machine tokens (ORGANIZATION_MACHINE /\n // APPLICATION_MACHINE) are intentionally rejected via the fallback throw below. `tokenType`\n // is captured for that error context; the USER arm narrows `decodedToken` directly.\n const tokenType = decodedToken.type;\n\n if (decodedToken.type === ExecutionContext_ExecutionType.USER_REQUEST) {\n const userJwtToken = decodedToken;\n // All-session revocation fence — shared fail-closed `<=` policy, see\n // {@link evaluateUserTokenInvalidationFence} (GRACE-BOUNDARY).\n const { isRevoked } = await evaluateUserTokenInvalidationFence(\n this.redisService, userJwtToken.userId, userJwtToken.iat as number | undefined,\n );\n if (isRevoked) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n context: { reason: 'token_invalidated' },\n });\n }\n // revocation-C: PER-SESSION fence (companion to the user-wide fence above). A first-party access\n // token carries `sessionId`, so an OIDC end_session / per-device logout terminating THAT session\n // reaches this manual-controller front too, not only the resource API. See\n // {@link evaluateSessionInvalidationFence}.\n const { isRevoked: sessionRevoked } = await evaluateSessionInvalidationFence(\n this.redisService, userJwtToken.sessionId, userJwtToken.iat as number | undefined,\n );\n if (sessionRevoked) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n context: { reason: 'session_invalidated' },\n });\n }\n const { initiatorRoles } = await this._fetchUserAndBuildRoles(\n userJwtToken.userId,\n tempContext,\n userJwtToken.authorizationVersion,\n );\n const organizationId = this.resolveManualControllerOrganizationId(req, initiatorRoles);\n\n const executionContext = new ExecutionContext(\n operation,\n ExecutionContext_ExecutionType.USER_REQUEST,\n new Map(),\n {\n userId: userJwtToken.userId,\n ...(organizationId ? { organizationId } : {}),\n },\n initiatorRoles,\n [],\n undefined, // correlationId\n 0, // subCallDepth\n undefined, // visitedResources\n userJwtToken.activeUserType ?? null,\n );\n await this.populateApplicationIdIfNeeded(executionContext);\n return executionContext;\n }\n\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN, context: { tokenType } },\n );\n } catch (error) {\n if (isExpiredJwtVerificationFailure(error)) {\n this.logger.debug('API manual-controller authentication rejected expired access token; client may refresh and retry', {\n customMessageReference: error.customMessageReference,\n statusCode: error.statusCode,\n path: req.originalUrl,\n });\n throw error;\n }\n if (isJwtVerificationFailure(error)) {\n this.logger.warn('API manual-controller authentication failed', {\n error: error.customMessageReference,\n statusCode: error.statusCode,\n path: req.originalUrl,\n });\n throw error;\n }\n if (isWildoBackendError(error)) {\n throw error; // Re-throw engine errors\n }\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED, context: { originalError: describeCaughtError(error) } },\n );\n }\n }\n\n /**\n * Manual endpoints like chart execution are not mounted on resource URLs, so\n * they do not get organization scope from initiatorInfo / URL-param validation.\n *\n * Resolution policy:\n * - If the request explicitly provides `organizationId`, validate it against\n * the caller's active organization memberships and use it.\n * - Otherwise, if the caller belongs to exactly one active organization,\n * infer that org to preserve the common single-tenant case.\n * - Otherwise, leave the org undefined and let downstream org-scoped\n * authorization fail closed instead of widening scope silently.\n */\n private resolveManualControllerOrganizationId(\n req: Request,\n initiatorRoles: ExecutionContext_RoleInfo[],\n ): string | undefined {\n const requestedOrganizationIds = [\n ...new Set(this.getQueryParameterValues(req.query as Record<string, any>, 'organizationId').filter(Boolean)),\n ];\n\n if (requestedOrganizationIds.length > 1) {\n throw this.errorBuilder.buildError(\n ErrorType.VALIDATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.API_CALL_INITIATOR_PARAMETER_INCONSISTENT,\n context: {\n fieldIdentifier: 'organizationId',\n values: requestedOrganizationIds,\n sources: {\n urlValues: ['undefined'],\n queryValues: requestedOrganizationIds,\n bodyValues: ['undefined'],\n tokenValues: ['undefined'],\n },\n },\n },\n );\n }\n\n const membershipOrganizationIds = [\n ...new Set(\n initiatorRoles.filter((roleInfo) => roleInfo.relatedPrimaryScope === ResourcePrimaryScope.ORGANIZATIONS && !!roleInfo.relatedResourceId)\n .map((roleInfo) => roleInfo.relatedResourceId as string),\n ),\n ];\n\n const requestedOrganizationId = requestedOrganizationIds[0];\n if (requestedOrganizationId) {\n if (!membershipOrganizationIds.includes(requestedOrganizationId)) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHORIZATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED,\n context: {\n // diagnostic (log-only)\n organizationId: requestedOrganizationId,\n },\n },\n );\n }\n return requestedOrganizationId;\n }\n\n return membershipOrganizationIds.length === 1 ? membershipOrganizationIds[0] : undefined;\n }\n\n /**\n * Resolve the active organization for a socket connection from server-verified\n * state. Mirrors the membership authority of `resolveManualControllerOrganizationId`\n * (the HTTP no-URL-scope path) but is **non-throwing**: a stale or non-member\n * client-supplied `requestedOrganizationId` is ignored (not trusted, not fatal)\n * rather than failing the whole websocket connection. The result is only ever an\n * org the caller is a verified member of, so it is safe to seed\n * `initiatorIds.organizationId` — which the org-scope authorization gate\n * (`authorizeOrganizations`) compares against the requested resource.\n *\n * - requested + member → the requested org (either source)\n * - `CLIENT_PINNED` + non-member → **undefined — decline, never substitute** (see below)\n * - `USER_REQUESTED` + non-member, OR absent, with 1 membership → infer the sole membership\n * - otherwise (multi-org, no valid selector) → undefined (org-scoped resource\n * subscribes then fail closed until the client pins one via ORGANIZATION_SWITCH)\n *\n * SECURITY: never returns a value not present in `initiatorRoles` under EITHER source, so neither a\n * handshake selector nor a delegating OAuth client can widen the caller's org scope.\n *\n * ## Why the source matters on a MISS (the attribution bug this branch exists to prevent)\n *\n * Membership gating protects AUTHORIZATION, but silent substitution corrupts ATTRIBUTION. A\n * consultant who is a member of Globex only may legitimately consent to ACME's agent client — the\n * consent gate deliberately FORCES the consent screen for a non-member rather than rejecting them\n * (see `OidcAuthorizationCodeBackendService.resolveAuthorizationClientConsent`), so such a token is\n * valid by design. Falling through to single-membership inference would then resolve Acme's pin to\n * **Globex**, and Acme's registered client would operate in — and spend against — Globex's budget,\n * for a client Globex never registered. No data crosses, but the tenant attribution is wrong and\n * silent. A `CLIENT_PINNED` miss therefore declines to self scope instead of inferring.\n */\n /**\n * Resolve the ORGANIZATION that a user-delegated token's issuing OAuth client belongs to, from the\n * token's `azp` (authorized-party) claim. This is what gives a delegated A2A / MCP turn an active\n * organization at all — without it every such turn resolves to no-org.\n *\n * ## Why `azp` is a sufficient and safe tenant signal\n *\n * `azp` is MANDATORY on every delegated user token (hard-enforced at mint in\n * `JwtBackendService.createJwtForDelegatedUserToken`), and it is a SERVER-verified claim on a\n * signature-checked token — not a caller-supplied header. Org-scoped OAuth clients live in their own\n * resource type (`OAUTH_CLIENTS_ORGANIZATION`), each carrying a required `organizationId`, so a hit\n * here means \"the user consented to a client that BELONGS to this organization\" — the same model as\n * an installation-scoped token. The value is still re-validated against live membership downstream\n * by {@link resolveSocketActiveOrganizationId}, so a stale or tampered record cannot widen scope.\n *\n * Returns `undefined` when the client is not org-scoped (an APPLICATION-scoped client has no tenant\n * to pin; the caller then falls back to `USER_REQUESTED` inference, which is correct for it).\n *\n * ## Failure posture: THROW rather than degrade (deliberate)\n *\n * A read failure means we cannot determine tenancy. Silently proceeding would fall through to\n * single-membership inference and risk attributing the turn — and its SPEND — to an organization\n * that never registered this client, which is a silent, persistent, cross-tenant error. A thrown\n * auth error is loud, transient and retryable. Loud-and-transient beats silent-and-persistent, so\n * this fails closed. The exposure window is narrow: `_fetchUserAndBuildRoles` reads the user and\n * roles moments later, so a broad datastore outage already fails the request regardless.\n *\n * NOTE (out of scope, tracked separately): client `status` is deliberately NOT gated here. Whether a\n * REVOKED client's already-minted delegated tokens should still authenticate is a distinct question\n * from which tenant that client belongs to — revoking a client must not retroactively re-attribute\n * its in-flight turns to a different organization.\n */\n private async resolveDelegatingClientOrganizationId(clientId: string | undefined): Promise<string | undefined> {\n if (!clientId) return undefined;\n try {\n const internalEc = await this.createForInternalRepositoryOperation({\n resourceType: CoreResourceType.OAUTH_CLIENTS_ORGANIZATION,\n operationIdentifier: CoreResourceOperation.READ,\n });\n const client = await this.repositoriesRegistry\n .getRepository(CoreResourceType.OAUTH_CLIENTS_ORGANIZATION)\n .read<OAuthClientOrganization>(internalEc, clientId);\n // A miss is the APPLICATION-scoped (or unknown) client case — no tenant pin exists.\n return client?.organizationId;\n } catch (error) {\n this.logger.warn('Delegating OAuth client tenant lookup failed — failing closed rather than inferring an organization', {\n clientId,\n ...projectCaughtErrorLogFields(error),\n });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { reason: 'delegating_client_tenant_unresolvable' },\n });\n }\n }\n\n private resolveSocketActiveOrganizationId(\n requestedOrganizationId: string | undefined,\n initiatorRoles: ExecutionContext_RoleInfo[],\n organizationSelectionSource: ActiveOrganizationSelectionSource,\n ): string | undefined {\n const membershipOrganizationIds = [\n ...new Set(\n initiatorRoles.filter((roleInfo) => roleInfo.relatedPrimaryScope === ResourcePrimaryScope.ORGANIZATIONS && !!roleInfo.relatedResourceId)\n .map((roleInfo) => roleInfo.relatedResourceId as string),\n ),\n ];\n\n if (requestedOrganizationId && membershipOrganizationIds.includes(requestedOrganizationId)) {\n return requestedOrganizationId;\n }\n\n // A client-pinned org that is NOT a membership positively contradicts inference — decline rather\n // than silently substituting a different tenant (see the attribution rationale above).\n if (requestedOrganizationId && organizationSelectionSource === ActiveOrganizationSelectionSource.CLIENT_PINNED) {\n return undefined;\n }\n\n return membershipOrganizationIds.length === 1 ? membershipOrganizationIds[0] : undefined;\n }\n\n private _getTempExecutionContext<\n TCustomOperationEnum extends EnumLikeType | undefined = undefined,\n TCoreOperationEnum extends Partial<CoreResourceOperation> | undefined = undefined,\n TMainSchema extends z.ZodTypeAny = z.ZodTypeAny\n >(\n operation: ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>\n ){\n return new ExecutionContext( operation, ExecutionContext_ExecutionType.INTERNALLY_INITIATED_REQUEST, new Map(), null, [], []);\n }\n\n /**\n * Build relationship contexts from initiator info parameters and extracted values.\n *\n * This extracts FK relationship information from URL parameters to enable:\n * 1. Authorization checks that understand which FK path was used (e.g., assignedToUserId vs createdByUserId)\n * 2. Repository filtering based on the FK relationship\n *\n * @param initiatorInfo The URL initiator info containing parameter definitions\n * @param extractedValues The extracted parameter values from the request\n * @returns Array of relationship contexts for the ExecutionContext\n */\n private buildRelationshipContexts(\n initiatorInfo: ResourceConfiguration_Operation_UrlInitiatorInfo,\n extractedValues: Record<string, string>\n ): ExecutionContext_RelationshipContext[] {\n const relationshipContexts: ExecutionContext_RelationshipContext[] = [];\n\n if (!initiatorInfo.parameters) {\n return relationshipContexts;\n }\n\n for (const param of initiatorInfo.parameters) {\n const value = extractedValues[param.fieldIdentifier];\n if (value) {\n relationshipContexts.push({\n resourceType: param.resourceType,\n relationshipField: param.relationshipField,\n resourceId: value,\n scopeViaJunction: param.scopeViaJunction,\n });\n }\n }\n\n return relationshipContexts;\n }\n\n /**\n * Extract all potential values from URL parameters (req.params)\n * According to Express.js specification, URL params are always flat key-value pairs\n * automatically URL-decoded from route parameters like /users/:userId\n *\n * Examples:\n * - Route: /users/:userId → req.params = { userId: '123' }\n * - Route: /users/:userId/posts/:postId → req.params = { userId: '123', postId: '456' }\n */\n private getUrlParameterValues(params: Record<string, string | undefined>, fieldIdentifier: string): string[] {\n const values: string[] = [];\n\n // Direct access to field (URL params are always flat, no nesting)\n const directValue = params[fieldIdentifier];\n if (this.isValidParameterValue(directValue)) {\n values.push(this.safeStringify(directValue));\n }\n\n return values;\n }\n\n /**\n * Extract all potential values from query parameters (req.query)\n * Handles Express.js query serialization via the `qs` library:\n *\n * Examples of how Express/qs parses query strings:\n * - ?name=John → { name: 'John' }\n * - ?tags=red&tags=blue → { tags: ['red', 'blue'] } (repeated keys = array)\n * - ?tags=red,blue → { tags: 'red,blue' } (comma-separated = single string)\n * - ?user[name]=John&user[age]=25 → { user: { name: 'John', age: '25' } }\n * - ?user[tags]=red&user[tags]=blue → { user: { tags: ['red', 'blue'] } }\n * - ?items[0]=apple&items[1]=banana → { items: ['apple', 'banana'] }\n */\n private getQueryParameterValues(query: Record<string, any>, fieldIdentifier: string): string[] {\n const values: string[] = [];\n\n // Direct access to field\n const directValue = query[fieldIdentifier];\n if (this.isValidParameterValue(directValue)) {\n if (Array.isArray(directValue)) {\n // Handle arrays created by qs from repeated query params (?key=val1&key=val2)\n values.push(...directValue.map(v => this.safeStringify(v)).filter(v => v));\n } else {\n // Handle single values (including comma-separated strings)\n values.push(this.safeStringify(directValue));\n }\n }\n\n // Nested object access (e.g., user.id -> query.user?.id)\n if (fieldIdentifier.includes('.')) {\n const nestedValue = this.getNestedValue(query, fieldIdentifier);\n if (this.isValidParameterValue(nestedValue)) {\n if (Array.isArray(nestedValue)) {\n // Handle nested arrays like user[tags]=red&user[tags]=blue\n values.push(...nestedValue.map(v => this.safeStringify(v)).filter(v => v));\n } else {\n values.push(this.safeStringify(nestedValue));\n }\n }\n }\n\n return values;\n }\n\n /**\n * Extract all potential values from body parameters (req.body)\n * Handles deep object access and arrays according to body parser specifications\n *\n * Examples based on body parser type:\n * - JSON: { \"user\": { \"id\": \"123\", \"tags\": [\"red\", \"blue\"] } }\n * - URL-encoded: user[id]=123&user[tags]=red&user[tags]=blue (parsed to nested object)\n * - Form-data: Can include files and nested structures\n */\n private getBodyParameterValues(body: any, fieldIdentifier: string): string[] {\n const values: string[] = [];\n\n if (!body || typeof body !== 'object') {\n return values;\n }\n\n // Direct access to field\n const directValue = body[fieldIdentifier];\n if (this.isValidParameterValue(directValue)) {\n if (Array.isArray(directValue)) {\n values.push(...directValue.map(v => this.safeStringify(v)).filter(v => v));\n } else {\n values.push(this.safeStringify(directValue));\n }\n }\n\n // Nested object access (e.g., user.id -> body.user?.id)\n if (fieldIdentifier.includes('.')) {\n const nestedValue = this.getNestedValue(body, fieldIdentifier);\n if (this.isValidParameterValue(nestedValue)) {\n if (Array.isArray(nestedValue)) {\n values.push(...nestedValue.map(v => this.safeStringify(v)).filter(v => v));\n } else {\n values.push(this.safeStringify(nestedValue));\n }\n }\n }\n\n return values;\n }\n\n /**\n * Extract all potential values from token context\n * Handles deep object access if token context contains nested objects\n *\n * Token context is application-specific and can contain any structure\n * depending on how the token was parsed and what data it contains.\n *\n * Examples:\n * - JWT claims: { \"userId\": \"123\", \"organizationId\": \"org456\" }\n * - Consumable token data: { \"permissions\": [\"read\", \"write\"], \"scope\": \"user.profile\" }\n */\n private getTokenParameterValues(tokenContext: Record<string, any>, fieldIdentifier: string): string[] {\n const values: string[] = [];\n\n if (!tokenContext || typeof tokenContext !== 'object') {\n return values;\n }\n\n // Direct access to field\n const directValue = tokenContext[fieldIdentifier];\n if (this.isValidParameterValue(directValue)) {\n if (Array.isArray(directValue)) {\n values.push(...directValue.map(v => this.safeStringify(v)).filter(v => v));\n } else {\n values.push(this.safeStringify(directValue));\n }\n }\n\n // Nested object access (e.g., user.id -> tokenContext.user?.id)\n if (fieldIdentifier.includes('.')) {\n const nestedValue = this.getNestedValue(tokenContext, fieldIdentifier);\n if (this.isValidParameterValue(nestedValue)) {\n if (Array.isArray(nestedValue)) {\n values.push(...nestedValue.map(v => this.safeStringify(v)).filter(v => v));\n } else {\n values.push(this.safeStringify(nestedValue));\n }\n }\n }\n\n return values;\n }\n\n /**\n * Get nested value from object using dot notation (e.g., 'user.profile.name')\n */\n private getNestedValue(obj: any, path: string): any {\n if (!obj || typeof obj !== 'object') {\n return undefined;\n }\n\n const keys = path.split('.');\n let current = obj;\n\n for (const key of keys) {\n if (current === null || current === undefined || typeof current !== 'object') {\n return undefined;\n }\n current = current[key];\n }\n\n return current;\n }\n\n /**\n * Check if a parameter value is valid (not null, undefined, or empty string)\n * According to Express.js specification, these values should be ignored\n */\n private isValidParameterValue(value: any): boolean {\n return value !== undefined && value !== null && value !== '';\n }\n\n /**\n * Safely convert a value to string, handling edge cases\n * According to Express.js specification, all parameter values are strings or arrays of strings\n */\n private safeStringify(value: any): string {\n if (value === null || value === undefined) {\n return '';\n }\n if (typeof value === 'string') {\n return value;\n }\n if (typeof value === 'number' || typeof value === 'boolean') {\n return String(value);\n }\n // For objects, convert to string (though this should be rare in Express params)\n return String(value);\n }\n\n private validateParameterCoherence(\n req: Request,\n initiatorInfo: ResourceConfiguration_Operation_UrlInitiatorInfo,\n tokenContext: Record<string, string>\n ): Record<string, string> {\n\n this.logDebug('Validating parameter coherence', { parameters: initiatorInfo.parameters?.map(p => p.fieldIdentifier) || [] });\n\n const initiatorCriticalParamsValue: Record<string, string> = {};\n\n if (!initiatorInfo.parameters || initiatorInfo.parameters.length === 0) {\n return initiatorCriticalParamsValue;\n }\n\n for (const paramInfo of initiatorInfo.parameters) {\n const fieldIdentifier = paramInfo.fieldIdentifier;\n\n // Extract ALL potential values from each source as arrays\n const urlValues = this.getUrlParameterValues(req.params as Record<string, string | undefined>, fieldIdentifier);\n const queryValues = this.getQueryParameterValues(req.query, fieldIdentifier);\n const bodyValues = this.getBodyParameterValues(req.body, fieldIdentifier);\n const tokenValues = this.getTokenParameterValues(tokenContext, fieldIdentifier);\n\n const sources = {\n urlValues: urlValues.length ? urlValues : ['undefined'],\n queryValues: queryValues.length ? queryValues : ['undefined'],\n bodyValues: bodyValues.length ? bodyValues : ['undefined'],\n tokenValues: tokenValues.length ? tokenValues : ['undefined']\n };\n\n // Combine all non-empty values from all sources\n const allValues = [...urlValues, ...queryValues, ...bodyValues, ...tokenValues]\n .filter(v => v !== null && v !== undefined && v !== '');\n\n // check if all mandatory parameters are present\n if (allValues.length === 0) {\n throw this.errorBuilder.buildError( ErrorType.VALIDATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_CALL_INITIATOR_PARAMETER_MISSING,\n context: { fieldIdentifier, sources } } );\n }\n\n // Check if all values are the same\n const uniqueValues = [...new Set(allValues)];\n if (uniqueValues.length > 1) { // Values are inconsistent across sources\n throw this.errorBuilder.buildError( ErrorType.VALIDATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_CALL_INITIATOR_PARAMETER_INCONSISTENT,\n context: { fieldIdentifier, values: uniqueValues, sources } } );\n }\n\n // 🔒 SECURE: Validate parameter format for security-sensitive fields\n const value = uniqueValues[0];\n if (value) {\n this.validateParameterFormat(fieldIdentifier, value, sources);\n }\n\n // Store the consistent value\n if (value) {\n initiatorCriticalParamsValue[fieldIdentifier] = value;\n }\n }\n\n this.logDebug('Parameter coherence validation successful', { extractedParams: Object.keys(initiatorCriticalParamsValue) });\n\n return initiatorCriticalParamsValue;\n }\n\n\n\n /**\n * 🔒 SECURE: Validate parameter format for security-sensitive fields\n */\n private validateParameterFormat(fieldIdentifier: string, value: string, sources?: any): void {\n if (value === 'undefined' || value === null || value === undefined || value === ''){\n throw this.errorBuilder.buildError( ErrorType.VALIDATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_CALL_INITIATOR_PARAMETER_MISSING,\n context: { fieldIdentifier, value, sources } } );\n }\n\n // Validate ID formats (should be alphanumeric, hyphens, underscores only)\n if (fieldIdentifier.toLowerCase().endsWith('id')) {\n if (!/^[a-zA-Z0-9_-]+$/.test(value)) {\n throw this.errorBuilder.buildError( ErrorType.VALIDATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_CALL_INITIATOR_PARAMETER_UNSUPPORTED,\n context: { fieldIdentifier, value, sources, regexStringForIdFormat: '^[a-zA-Z0-9_-]+$' } } );\n }\n }\n\n if (value.length > 255) {\n throw this.errorBuilder.buildError( ErrorType.VALIDATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_CALL_INITIATOR_PARAMETER_UNSUPPORTED,\n context: { fieldIdentifier, value, sources, maxLength: 255 } } );\n }\n }\n\n private parseBearerToken(authHeader: string): string {\n const trimmed = authHeader.trim();\n\n if (!trimmed.toLowerCase().startsWith('bearer ')) {\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN, context: { authHeader } } );\n }\n\n const token = trimmed.substring(7).trim(); // Remove 'Bearer ' prefix\n\n if (!token) {\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN, context: { authHeader } } );\n }\n\n return token;\n }\n\n /**\n * W7.3a: Handle x-anonymous-session header — verify existing session JWT,\n * validate parameter coherence, and create ANONYMOUS_SESSION execution context.\n */\n private async handleAnonymousSessionAuthentication(\n sessionToken: string,\n req: Request,\n operation: ResourceConfiguration_Operation<any, any, any>,\n initiatorInfo: ResourceConfiguration_Operation_UrlInitiatorInfo\n ): Promise<ExecutionContext<any>> {\n\n this.logDebug('Processing anonymous session authentication', { operationId: operation.operationIdentifier });\n\n if (!this.appConfigService.anonymousSessionsEnabled) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_NO_AUTHENTICATION_PROVIDED,\n });\n }\n\n const operationRoles: string[] = operation.roles ?? [];\n if (!operationRoles.includes(CORE_APP_ROLES.APP_ANONYMOUS)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_NO_AUTHENTICATION_PROVIDED,\n context: { operationId: operation.operationIdentifier }, // diagnostic (log-only)\n });\n }\n\n const anonymousSessionService = this.getAnonymousSessionService();\n const { anonymousUserId } = anonymousSessionService.verifySessionToken(sessionToken);\n // Liveness: the anon JWT is stateless — no `TOKEN_INVALID_BEFORE` fence (it carries no `userId`) and no\n // refresh — so a cryptographically-valid token says NOTHING about whether the SUBJECT is still a live,\n // un-converted anonymous identity. Re-read the row and reject a converted / erased / swept subject, so a\n // retained token cannot keep acting — and, post-conversion, cannot mint fresh anon rows under the old\n // `uuidRef`, re-establishing the linkage conversion severs. This is the anon-plane analogue of the USERS\n // front's row re-read + version/status checks (`_fetchUserAndBuildRoles`).\n await anonymousSessionService.assertAnonymousSubjectStillLive(anonymousUserId);\n\n const tokenContext: Record<string, string> = { anonymousUserId };\n const initiatorCriticalParamsValue = this.validateParameterCoherence(req, initiatorInfo, tokenContext);\n\n const relationshipContexts = this.buildRelationshipContexts(initiatorInfo, initiatorCriticalParamsValue);\n\n // Pre-fetch applicationId — the EC constructor requires it for ANONYMOUS_SESSION\n const applicationId = await this.getApplicationId();\n\n const initiatorIds: ExecutionContext_InitiatorIds = {\n anonymousUserId,\n applicationId,\n ...this.extractInitiatorIds(initiatorCriticalParamsValue),\n };\n\n const executionContext = new ExecutionContext(\n operation,\n ExecutionContext_ExecutionType.ANONYMOUS_SESSION,\n new Map(Object.entries(initiatorCriticalParamsValue)),\n initiatorIds,\n [{ roles: [CORE_APP_ROLES.APP_ANONYMOUS], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n relationshipContexts\n );\n\n return executionContext;\n }\n\n /**\n * W7.3a: Handle x-anonymous-session-init header — validate UUID, check feature\n * flag and operation roles, create ANONYMOUS_SESSION execution context with\n * anonymousUserCreated flag for the controller to create the AnonymousUser record.\n */\n private async handleAnonymousSessionInit(\n anonymousUserId: string,\n req: Request,\n operation: ResourceConfiguration_Operation<any, any, any>,\n initiatorInfo: ResourceConfiguration_Operation_UrlInitiatorInfo\n ): Promise<ExecutionContext<any>> {\n\n this.logDebug('Processing anonymous session init', { anonymousUserId, operationId: operation.operationIdentifier });\n\n this.validateParameterFormat('anonymousUserId', anonymousUserId);\n\n if (!this.appConfigService.anonymousSessionsEnabled) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_NO_AUTHENTICATION_PROVIDED,\n });\n }\n\n const operationRoles: string[] = operation.roles ?? [];\n if (!operationRoles.includes(CORE_APP_ROLES.APP_ANONYMOUS)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_NO_AUTHENTICATION_PROVIDED,\n context: { operationId: operation.operationIdentifier }, // diagnostic (log-only)\n });\n }\n\n const tokenContext: Record<string, string> = { anonymousUserId };\n const initiatorCriticalParamsValue = this.validateParameterCoherence(req, initiatorInfo, tokenContext);\n\n const relationshipContexts = this.buildRelationshipContexts(initiatorInfo, initiatorCriticalParamsValue);\n\n // Pre-fetch applicationId — the EC constructor requires it for ANONYMOUS_SESSION\n const applicationId = await this.getApplicationId();\n\n const initiatorIds: ExecutionContext_InitiatorIds = {\n anonymousUserId,\n applicationId,\n ...this.extractInitiatorIds(initiatorCriticalParamsValue),\n };\n\n const executionContext = new ExecutionContext(\n operation,\n ExecutionContext_ExecutionType.ANONYMOUS_SESSION,\n new Map(Object.entries(initiatorCriticalParamsValue)),\n initiatorIds,\n [{ roles: [CORE_APP_ROLES.APP_ANONYMOUS], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n relationshipContexts\n );\n\n executionContext.setAnonymousUserCreated(true);\n\n return executionContext;\n }\n\n /**\n * Does this operation declare `APP_PUBLIC` — accessible to everyone, without access control?\n *\n * ## Why this check exists\n *\n * `CORE_APP_ROLES.APP_PUBLIC` is documented on the enum as \"Unauthenticated access. Operations\n * with APP_PUBLIC are accessible without auth\", and the OpenAPI generator has always PUBLISHED it\n * that way — `roles` containing `APP_PUBLIC` emits an empty `security` array, which the spec\n * defines as no authentication required. The runtime did not implement it: authentication ran to\n * the end of its chain and threw `AUTHENTICATION_NO_AUTHENTICATION_PROVIDED` without ever\n * consulting the operation's roles.\n *\n * So the published API contract and the runtime disagreed. The contract is the one that is right:\n * a public price list, a frontend application configuration, an i18n bundle are genuinely\n * readable by anyone, and today each is reachable only by escaping the resource system into a\n * manual controller. That is a workaround for this gap, not a design.\n *\n * ## Blast radius, measured before writing this\n *\n * ZERO resource configurations in the repository declare `APP_PUBLIC` on an operation — 39\n * declare `APP_ADMIN_SUPER_ADMIN` and 3 declare `APP_ANONYMOUS`, by the same search. So no\n * existing operation changes behaviour: this makes a declaration that nobody could use mean what\n * it says, rather than altering what any shipped route does.\n *\n * ## Read against the DEFAULT variant only\n *\n * The operation reaching this point is already the resolved one for the request. Consulting its\n * declared roles is the same question the authorizer asks later — this is not a second authority,\n * it is the authentication tier declining to demand a credential the operation never required.\n */\n private operationAdmitsPublicAccess(operation: ResourceConfiguration_Operation<any, any, any>): boolean {\n const roles = (operation as { roles?: unknown }).roles;\n return Array.isArray(roles) && roles.includes(CORE_APP_ROLES.APP_PUBLIC);\n }\n\n /**\n * Build the execution context for a public request — no caller identity, minimal privilege.\n *\n * Mirrors `AuthExecutionContextFactory.createForPreAuthOperation`, which has always produced\n * exactly this pair (`PUBLIC_EXECUTION` + `APP_PUBLIC` at APPLICATION scope) for flows whose\n * caller is unknown. Nothing new is invented here; the shape is reused so a public resource read\n * and a pre-auth flow are the same kind of principal.\n *\n * `initiatorIds` carries only the application: there is no user, no organization and no anonymous\n * subject to attribute, and inventing one would make an unattributable request look attributed.\n */\n private async createPublicRequestExecutionContext<TResourceConfigOperation extends ResourceConfiguration_Operation<any, any, any>>(\n operation: TResourceConfigOperation,\n req: Request,\n initiatorInfo: ResourceConfiguration_Operation_UrlInitiatorInfo,\n ): Promise<ExecutionContext<TResourceConfigOperation>> {\n const initiatorCriticalParamsValue = this.validateParameterCoherence(req, initiatorInfo, {});\n const relationshipContexts = this.buildRelationshipContexts(initiatorInfo, initiatorCriticalParamsValue);\n const applicationId = await this.getApplicationId();\n\n return this.createForPublicOperation<TResourceConfigOperation>({\n operation,\n contextResourcesFieldIdentifier: new Map(Object.entries(initiatorCriticalParamsValue)),\n initiatorIds: { applicationId, ...this.extractInitiatorIds(initiatorCriticalParamsValue) },\n initiatorRoles: [\n { roles: [CORE_APP_ROLES.APP_PUBLIC], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION },\n ],\n relationshipContexts,\n } as never);\n }\n\n /**\n * Extract initiator IDs from critical parameters\n */\n /**\n * Does a `userId` URL segment on THIS operation denote the CALLER (so a value differing from the\n * JWT is a contradiction), or the SUBJECT (so it legitimately differs)?\n *\n * Three cases, and the middle one is the reason this is a predicate rather than a lookup:\n *\n * 1. **`userId` is a PARENT segment** — `/users/{userId}/draft-notes`. The operation's resource is\n * `DRAFT_NOTES`, whose own identifier is `draftNoteId`, so `userId` is scoping the request to\n * whose rows these are. It DOES denote the caller. Guard applies. This case is decided by the\n * field-identifier comparison below and never reaches the declaration.\n * 2. **`userId` is the operation's OWN primary key** — `/users/{userId}` and\n * `/user-self/{userId}`. Structurally identical, semantically opposite, so the owning resource's\n * `primaryKeyIdentifiesInitiator` decides. `USER_SELF` says caller; `USERS` says subject.\n * 3. **The resource cannot be resolved** — a mock, a hand-built config, an unregistered type.\n * Returns `true` (guard applies). Fail-closed: an unknown resource keeps the refusal.\n *\n * The default is `true` at every layer — the factory materialises it, and this reads\n * `!== false` — so a resource can only lose the guard by declaring so deliberately.\n */\n private doesUserIdParamDenoteInitiator(operation: { resourceIdentifier?: unknown }): boolean {\n const resourceIdentifier = operation?.resourceIdentifier;\n if (typeof resourceIdentifier !== 'string' || resourceIdentifier.length === 0) return true;\n\n try {\n const allFieldIdentifiers = this.resourcesRegistryService.getAllResourceFieldIdentifiers();\n // Case 1: the segment belongs to a PARENT, not to this operation's own resource. It scopes the\n // request to a user's rows and must stay guarded, whatever the parent resource declares.\n if (allFieldIdentifiers?.[resourceIdentifier] !== USER_ID_FIELD_IDENTIFIER) return true;\n\n // Case 2: it IS this resource's own primary key — only a deliberate declaration relaxes it.\n const resourceConfiguration = this.resourcesRegistryService.getResourceConfiguration(resourceIdentifier as ResourceType);\n return resourceConfiguration?.primaryKeyIdentifiesInitiator !== false;\n } catch {\n // Case 3: unresolvable resource — fail closed.\n return true;\n }\n }\n\n private extractInitiatorIds(criticalParams: Record<string, string>): Partial<ExecutionContext_InitiatorIds> {\n const initiatorIds: Partial<ExecutionContext_InitiatorIds> = {};\n\n // Map common field identifiers to initiator ID properties\n if (criticalParams.organizationId) {\n initiatorIds.organizationId = criticalParams.organizationId;\n }\n if (criticalParams.userId) {\n initiatorIds.userId = criticalParams.userId;\n }\n if (criticalParams.applicationId) {\n initiatorIds.applicationId = criticalParams.applicationId;\n }\n return initiatorIds;\n }\n\n /**\n * Handle API key authentication (org and app keys)\n */\n private async handleApiKeyAuthentication<\n TCustomOperationEnum extends EnumLikeType | undefined = undefined,\n TCoreOperationEnum extends Partial<CoreResourceOperation> | undefined = undefined,\n TMainSchema extends z.ZodTypeAny = z.ZodTypeAny\n >(\n apiKey: string,\n req: Request,\n operation: ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>,\n initiatorInfo: ResourceConfiguration_Operation_UrlInitiatorInfo\n ): Promise<ExecutionContext<typeof operation>> {\n\n const apiKeyScope = apiKeyScopeForCredential(apiKey);\n if (apiKeyScope === null) throw new Error('API-key authentication requires a recognized API-key credential prefix');\n this.logDebug('Processing API key authentication', { keyType: apiKeyScope });\n\n // Brute-force / DB-read-exhaustion guard on the presented-secret lookup (see the\n // machine-auth-rate-limit utils): reject before the lookup once this source IP has\n // saturated its failed-presentation window; record a failure after a rejected lookup.\n const clientIp = getClientIpFromRequest(req);\n await assertMachineAuthAttemptWithinRate(this.redisService, this.errorBuilder, this.logger, clientIp, this.appConfigService.applicationEnv);\n\n const initiatorCriticalParamsValue = this.validateParameterCoherence(req, initiatorInfo, {});\n\n // Build relationship contexts from URL parameters\n const relationshipContexts = this.buildRelationshipContexts(initiatorInfo, initiatorCriticalParamsValue);\n\n try {\n return (apiKeyScope === ApiKeyScope.ORGANIZATION)\n ? await this.handleOrganizationApiKey(apiKey, initiatorCriticalParamsValue, operation, relationshipContexts)\n : await this.handleApplicationApiKey(apiKey, initiatorCriticalParamsValue, operation, relationshipContexts);\n } catch (error) {\n await this.recordMachineAuthFailureIfAuthError(error, clientIp);\n throw error;\n }\n }\n\n /**\n * Feed the per-source-IP machine-auth failure lockout (see the machine-auth-rate-limit utils)\n * ONLY when the thrown error is an authentication failure. Non-auth errors are not counted so a\n * transient backend fault cannot lock out an honest source.\n */\n private async recordMachineAuthFailureIfAuthError(error: unknown, clientIp: string): Promise<void> {\n if (isWildoBackendError(error) && error.type === ErrorType.AUTHENTICATION) {\n await recordMachineAuthFailure(this.redisService, this.logger, clientIp);\n }\n }\n\n /**\n * Handle organization API key authentication with repository validation\n */\n private async handleOrganizationApiKey<\n TCustomOperationEnum extends EnumLikeType | undefined = undefined,\n TCoreOperationEnum extends Partial<CoreResourceOperation> | undefined = undefined,\n TMainSchema extends z.ZodTypeAny = z.ZodTypeAny\n >(\n apiKey: string,\n initiatorCriticalParamsValue: Record<string, string>,\n operation: ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>,\n relationshipContexts: ExecutionContext_RelationshipContext[]\n ): Promise<ExecutionContext<typeof operation>> {\n\n this.logDebug('Processing organization API key');\n\n if(operation.resourcePrimaryScope !== ResourcePrimaryScope.ORGANIZATIONS) {\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_ORG_KEY_WRONG_RESOURCE,\n context: { resourceIdentifier: operation.resourceIdentifier, primaryScope: operation.resourcePrimaryScope } });\n }\n\n if (!initiatorCriticalParamsValue.organizationId) {\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_ORG_KEY_WITHOUT_ORG_ID,\n context: { providedParams: Object.keys(initiatorCriticalParamsValue) } });\n }\n\n try {\n // Create a temporary execution context for repository access\n const tempExecutionContext = this._getTempExecutionContext(operation);\n\n const orgApiKeyRepository = this.repositoriesRegistry.getRepository(CoreResourceType.ORG_API_KEYS);\n\n // Validate API key exists and is active\n const presentedHash = hashApiKey(apiKey); // Resolve by the persisted sha256, not the raw plaintext\n let orgApiKey = await orgApiKeyRepository.read<ApiKeyOrganization>(tempExecutionContext, {\n hashedKey: presentedHash,\n organizationId: initiatorCriticalParamsValue.organizationId\n });\n\n // Rotation grace window: a rotated-out secret still authenticates against\n // `previousHashedKey` until `previousKeyInvalidationDate` (null = open-ended\n // REGENERATE overlap). The ACTIVE gate below still applies to the resolved key.\n if (!orgApiKey) {\n const rotatedOrgApiKey = await orgApiKeyRepository.read<ApiKeyOrganization>(tempExecutionContext, {\n previousHashedKey: presentedHash,\n organizationId: initiatorCriticalParamsValue.organizationId\n });\n if (rotatedOrgApiKey && isRotationGraceWindowOpen(rotatedOrgApiKey.previousKeyInvalidationDate)) {\n orgApiKey = rotatedOrgApiKey;\n }\n }\n\n if (!orgApiKey || orgApiKey.status !== ApiKeyStatus.ACTIVE || isCredentialExpired(orgApiKey.expiresAt)) {\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID,\n context: { scope: \"organization\", organizationId: initiatorCriticalParamsValue.organizationId, ...(orgApiKey?.status ? { apiKeyStatus: orgApiKey.status } : {}) } }\n );\n }\n\n // Create execution context with API key info\n const initiatorIds: ExecutionContext_InitiatorIds = {\n organizationId: initiatorCriticalParamsValue.organizationId,\n // Machine credential provenance: a static API key (the ApiKey row `_id`, not the raw key).\n machineCredential: { authMethod: MachineAuthMethod.API_KEY, credentialId: orgApiKey._id },\n ...this.extractInitiatorIds(initiatorCriticalParamsValue)\n };\n\n // Create initial execution context (roles will be validated by AuthorizationsBackendService)\n const executionContext = new ExecutionContext(\n operation,\n ExecutionContext_ExecutionType.ORGANIZATION_MACHINE,\n new Map(Object.entries(initiatorCriticalParamsValue)),\n initiatorIds,\n [ { roles: orgApiKey.roles || [], relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS, relatedResourceId: orgApiKey.organizationId } ], // Use API key roles as initial roles\n relationshipContexts\n );\n\n\n return executionContext;\n\n } catch (error) {\n if (isWildoBackendError(error)) {\n throw error; // Re-throw our own errors (including WildoError_Backend)\n }\n\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_API_KEY_FAILED,\n context: {\n organizationId: initiatorCriticalParamsValue.organizationId,\n scope : \"organization\",\n originalError: describeCaughtError(error)\n } });\n }\n }\n\n /**\n * Handle application API key authentication with repository validation\n */\n private async handleApplicationApiKey<\n TCustomOperationEnum extends EnumLikeType | undefined = undefined,\n TCoreOperationEnum extends Partial<CoreResourceOperation> | undefined = undefined,\n TMainSchema extends z.ZodTypeAny = z.ZodTypeAny\n >(\n apiKey: string,\n initiatorCriticalParamsValue: Record<string, string>,\n operation: ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>,\n relationshipContexts: ExecutionContext_RelationshipContext[]\n ): Promise<ExecutionContext<typeof operation>> {\n\n this.logDebug('Processing application API key');\n\n // Fail-closed scope guard (symmetric with the organization handler above): an app\n // machine credential may only authenticate APPLICATION-scoped operations. Without this\n // the app path deferred scope enforcement entirely to downstream role authorization —\n // a defense-in-depth gap the machine-principal unification closes.\n if (operation.resourcePrimaryScope !== ResourcePrimaryScope.APPLICATION) {\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_ORG_KEY_WRONG_RESOURCE,\n context: { resourceIdentifier: operation.resourceIdentifier, primaryScope: operation.resourcePrimaryScope, scope: 'application' } });\n }\n\n try {\n // Create a temporary execution context for repository access\n const tempExecutionContext = this._getTempExecutionContext(operation);\n\n // Validate API key exists and is active\n const appApiKeyRepository = this.repositoriesRegistry.getRepository(CoreResourceType.APPLICATION_API_KEYS);\n const presentedHash = hashApiKey(apiKey); // Resolve by the persisted sha256, not the raw plaintext\n let appApiKey = await appApiKeyRepository.read<ApiKeyApplication>(tempExecutionContext, {\n hashedKey: presentedHash,\n });\n\n // Rotation grace window (see the organization handler): fall back to\n // `previousHashedKey` while the overlap window is open.\n if (!appApiKey) {\n const rotatedAppApiKey = await appApiKeyRepository.read<ApiKeyApplication>(tempExecutionContext, {\n previousHashedKey: presentedHash,\n });\n if (rotatedAppApiKey && isRotationGraceWindowOpen(rotatedAppApiKey.previousKeyInvalidationDate)) {\n appApiKey = rotatedAppApiKey;\n }\n }\n\n if (!appApiKey || appApiKey.status !== ApiKeyStatus.ACTIVE || isCredentialExpired(appApiKey.expiresAt)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID,\n context: { scope: \"application\", ...(appApiKey?.status ? { apiKeyStatus: appApiKey.status } : {}) } } );\n }\n\n const initiatorIds: ExecutionContext_InitiatorIds = {\n // Machine credential provenance: a static API key (the ApiKey row `_id`, not the raw key).\n machineCredential: { authMethod: MachineAuthMethod.API_KEY, credentialId: appApiKey._id },\n ...this.extractInitiatorIds(initiatorCriticalParamsValue)\n };\n\n const executionContext = new ExecutionContext(\n operation,\n ExecutionContext_ExecutionType.APPLICATION_MACHINE,\n new Map(Object.entries(initiatorCriticalParamsValue)),\n initiatorIds,\n [ { roles: appApiKey.roles || [], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION, relatedResourceId: appApiKey.applicationId } ], // Use API key roles as initial roles\n relationshipContexts\n );\n\n await this.populateApplicationIdIfNeeded(executionContext, true);\n\n\n return executionContext;\n\n } catch (error) {\n if (isWildoBackendError(error)) {\n throw error;\n }\n\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_API_KEY_FAILED,\n context: {\n scope: \"application\",\n originalError: describeCaughtError(error)\n } } );\n }\n }\n\n /**\n * Direct OAuth-client secret authentication (D2 \"front a\"). A registered OAuth client\n * presents its long-lived `oc_org_`/`oc_app_` secret per-request; it authenticates as\n * a machine principal via an OAuth client (a distinct credential from an api-key, same principal). Faithful\n * mirror of `handleApiKeyAuthentication` — same hash-lookup + rotation-grace + ACTIVE\n * gate — differing only in the resource (OAUTH_CLIENTS_*), the execution type, and the\n * granted-scopes projection.\n */\n private async handleOAuthClientSecretAuthentication<\n TCustomOperationEnum extends EnumLikeType | undefined = undefined,\n TCoreOperationEnum extends Partial<CoreResourceOperation> | undefined = undefined,\n TMainSchema extends z.ZodTypeAny = z.ZodTypeAny\n >(\n secret: string,\n req: Request,\n operation: ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>,\n initiatorInfo: ResourceConfiguration_Operation_UrlInitiatorInfo\n ): Promise<ExecutionContext<typeof operation>> {\n\n this.logDebug('Processing OAuth client secret authentication', { scope: secret.startsWith('oc_org_') ? 'organization' : 'application' });\n\n // Same brute-force / DB-read-exhaustion guard as the api-key path — the `oc_*` direct-secret\n // front re-hashes and looks up the presented secret exactly like an api-key.\n const clientIp = getClientIpFromRequest(req);\n await assertMachineAuthAttemptWithinRate(this.redisService, this.errorBuilder, this.logger, clientIp, this.appConfigService.applicationEnv);\n\n const initiatorCriticalParamsValue = this.validateParameterCoherence(req, initiatorInfo, {});\n const relationshipContexts = this.buildRelationshipContexts(initiatorInfo, initiatorCriticalParamsValue);\n\n try {\n return (secret.startsWith('oc_org_'))\n ? await this.handleOrganizationOAuthClient(secret, initiatorCriticalParamsValue, operation, relationshipContexts)\n : await this.handleApplicationOAuthClient(secret, initiatorCriticalParamsValue, operation, relationshipContexts);\n } catch (error) {\n await this.recordMachineAuthFailureIfAuthError(error, clientIp);\n throw error;\n }\n }\n\n private async handleOrganizationOAuthClient<\n TCustomOperationEnum extends EnumLikeType | undefined = undefined,\n TCoreOperationEnum extends Partial<CoreResourceOperation> | undefined = undefined,\n TMainSchema extends z.ZodTypeAny = z.ZodTypeAny\n >(\n secret: string,\n initiatorCriticalParamsValue: Record<string, string>,\n operation: ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>,\n relationshipContexts: ExecutionContext_RelationshipContext[]\n ): Promise<ExecutionContext<typeof operation>> {\n\n if (operation.resourcePrimaryScope !== ResourcePrimaryScope.ORGANIZATIONS) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_ORG_KEY_WRONG_RESOURCE,\n context: { resourceIdentifier: operation.resourceIdentifier, primaryScope: operation.resourcePrimaryScope } });\n }\n\n if (!initiatorCriticalParamsValue.organizationId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_ORG_KEY_WITHOUT_ORG_ID,\n context: { providedParams: Object.keys(initiatorCriticalParamsValue) } });\n }\n\n try {\n const tempExecutionContext = this._getTempExecutionContext(operation);\n const repository = this.repositoriesRegistry.getRepository(CoreResourceType.OAUTH_CLIENTS_ORGANIZATION);\n\n const presentedHash = hashOAuthClientSecret(secret);\n let client = await repository.read<OAuthClientOrganization>(tempExecutionContext, {\n hashedSecret: presentedHash,\n organizationId: initiatorCriticalParamsValue.organizationId,\n });\n\n // Rotation grace window: a rotated-out secret still authenticates against\n // `previousHashedSecret` until `previousSecretInvalidationDate`. ACTIVE gate below still applies.\n if (!client) {\n const rotated = await repository.read<OAuthClientOrganization>(tempExecutionContext, {\n previousHashedSecret: presentedHash,\n organizationId: initiatorCriticalParamsValue.organizationId,\n });\n if (rotated && isRotationGraceWindowOpen(rotated.previousSecretInvalidationDate)) {\n client = rotated;\n }\n }\n\n if (!client || client.status !== OAuthClientStatus.ACTIVE || isCredentialExpired(client.expiresAt)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID,\n context: { scope: 'organization', organizationId: initiatorCriticalParamsValue.organizationId, ...(client?.status ? { clientStatus: client.status } : {}) } });\n }\n\n const initiatorIds: ExecutionContext_InitiatorIds = {\n organizationId: initiatorCriticalParamsValue.organizationId,\n // Machine credential provenance: an OAuth client (the OAuthClient row `_id`).\n machineCredential: { authMethod: MachineAuthMethod.OAUTH_CLIENT, credentialId: client._id },\n ...this.extractInitiatorIds(initiatorCriticalParamsValue)\n };\n\n const executionContext = new ExecutionContext(\n operation,\n ExecutionContext_ExecutionType.ORGANIZATION_MACHINE,\n new Map(Object.entries(initiatorCriticalParamsValue)),\n initiatorIds,\n [ { roles: client.roles || [], relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS, relatedResourceId: client.organizationId } ],\n relationshipContexts\n );\n\n return executionContext;\n\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_API_KEY_FAILED,\n context: { organizationId: initiatorCriticalParamsValue.organizationId, scope: 'organization', originalError: describeCaughtError(error) } });\n }\n }\n\n private async handleApplicationOAuthClient<\n TCustomOperationEnum extends EnumLikeType | undefined = undefined,\n TCoreOperationEnum extends Partial<CoreResourceOperation> | undefined = undefined,\n TMainSchema extends z.ZodTypeAny = z.ZodTypeAny\n >(\n secret: string,\n initiatorCriticalParamsValue: Record<string, string>,\n operation: ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>,\n relationshipContexts: ExecutionContext_RelationshipContext[]\n ): Promise<ExecutionContext<typeof operation>> {\n\n // Fail-closed scope guard (symmetric with the organization OAuth-client handler): an\n // application OAuth client may only authenticate APPLICATION-scoped operations.\n if (operation.resourcePrimaryScope !== ResourcePrimaryScope.APPLICATION) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_ORG_KEY_WRONG_RESOURCE,\n context: { resourceIdentifier: operation.resourceIdentifier, primaryScope: operation.resourcePrimaryScope, scope: 'application' } });\n }\n\n try {\n const tempExecutionContext = this._getTempExecutionContext(operation);\n const repository = this.repositoriesRegistry.getRepository(CoreResourceType.OAUTH_CLIENTS_APPLICATION);\n\n const presentedHash = hashOAuthClientSecret(secret);\n let client = await repository.read<OAuthClientApplication>(tempExecutionContext, {\n hashedSecret: presentedHash,\n });\n\n if (!client) {\n const rotated = await repository.read<OAuthClientApplication>(tempExecutionContext, {\n previousHashedSecret: presentedHash,\n });\n if (rotated && isRotationGraceWindowOpen(rotated.previousSecretInvalidationDate)) {\n client = rotated;\n }\n }\n\n if (!client || client.status !== OAuthClientStatus.ACTIVE || isCredentialExpired(client.expiresAt)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID,\n context: { scope: 'application', ...(client?.status ? { clientStatus: client.status } : {}) } });\n }\n\n const initiatorIds: ExecutionContext_InitiatorIds = {\n // Machine credential provenance: an OAuth client (the OAuthClient row `_id`).\n machineCredential: { authMethod: MachineAuthMethod.OAUTH_CLIENT, credentialId: client._id },\n ...this.extractInitiatorIds(initiatorCriticalParamsValue)\n };\n\n const executionContext = new ExecutionContext(\n operation,\n ExecutionContext_ExecutionType.APPLICATION_MACHINE,\n new Map(Object.entries(initiatorCriticalParamsValue)),\n initiatorIds,\n [ { roles: client.roles || [], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION, relatedResourceId: client.applicationId } ],\n relationshipContexts\n );\n\n await this.populateApplicationIdIfNeeded(executionContext, true);\n\n return executionContext;\n\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_API_KEY_FAILED,\n context: { scope: 'application', originalError: describeCaughtError(error) } });\n }\n }\n\n /**\n * Canonical audience (RFC 8707 resource indicator) of THIS app's generic API resource\n * server — the `aud` an exchanged machine access token MUST carry to be accepted at\n * the resource-operation choke point (D7). SINGLE SOURCE OF TRUTH: the (OIDC-branch)\n * client-credentials token endpoint MUST mint with this exact value, and this method MUST\n * be the only validator — centralising it makes minting and validation drift-impossible.\n * Returns `undefined` (→ fail-closed at the call site) when the app public base URL is not\n * yet resolvable.\n *\n * TENANCY note (external-access plan): derivation = app public base URL + API mount path.\n * MCP and A2A resource servers carry their OWN canonical audiences (their endpoint URIs),\n * validated inside their own transports — NOT here.\n */\n private resolveApiResourceAudience(): string | undefined {\n return this.appConfigService.resolveApiResourceAudience();\n }\n\n /**\n * Handle JWT bearer token authentication\n */\n private async handleJwtAuthentication<\n TCustomOperationEnum extends EnumLikeType | undefined = undefined,\n TCoreOperationEnum extends Partial<CoreResourceOperation> | undefined = undefined,\n TMainSchema extends z.ZodTypeAny = z.ZodTypeAny,\n>(\n token: string,\n req: Request,\n operation: ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>,\n initiatorInfo: ResourceConfiguration_Operation_UrlInitiatorInfo\n ): Promise<ExecutionContext<typeof operation>> {\n\n this.logDebug('Processing JWT authentication');\n\n try {\n\n // Route the verify by the token's (UNVERIFIED) `type`: a user access token is verified with\n // `issuer=appSlug`/`audience='AUTH_TOKEN'`, while a machine (client-credentials) token is\n // RFC-8707 audience-bound (`iss=aud=`the API resource URL) and MUST be verified with\n // `verifyMachineToken` — otherwise `jwt.verify` rejects every valid machine token on the\n // aud/issuer check before the machine arm below (incl. its `aud` guard) ever runs. The peek\n // only selects options; the signature is still fully verified by the chosen verify.\n const unverifiedType = this.jwtService.peekUnverifiedClaimType(token);\n const isMachineToken =\n unverifiedType === ExecutionContext_ExecutionType.ORGANIZATION_MACHINE ||\n unverifiedType === ExecutionContext_ExecutionType.APPLICATION_MACHINE;\n const rawDecodedToken = isMachineToken\n ? await this.jwtService.verifyMachineToken(token)\n : await this.jwtService.verifyWithoutBackendErrorActions(token);\n const decodedToken = JwtClaim_App_Auth_Schema.parse(rawDecodedToken);\n const tokenType = decodedToken.type;\n\n const initiatorCriticalParamsValue = this.validateParameterCoherence(req, initiatorInfo, {});\n\n // Build relationship contexts from URL parameters\n const relationshipContexts = this.buildRelationshipContexts(initiatorInfo, initiatorCriticalParamsValue);\n\n // Narrow on `decodedToken.type` directly (no `as` casts) so the discriminated union\n // is exhaustively checked at compile time — a future arm makes `decodedToken` fail to\n // reduce to `never` at the fallback below.\n if (decodedToken.type === ExecutionContext_ExecutionType.USER_REQUEST) {\n const userJwtToken = decodedToken;\n\n // F1 fix: Reject access tokens issued before a forced invalidation\n // (e.g., after password reset or refresh token rotation detection).\n // Without this check, stale access tokens would remain valid for resource\n // requests until natural expiry, even after invalidateAllTokensForUser().\n // This is the MAIN resource-API front — the widest surface the fence protects — and it is a\n // one-shot check: `iat` is fixed, so a token that passes here is never re-evaluated. Shared\n // fail-closed `<=` policy: see {@link evaluateUserTokenInvalidationFence} (GRACE-BOUNDARY).\n const { isRevoked } = await evaluateUserTokenInvalidationFence(\n this.redisService, userJwtToken.userId, userJwtToken.iat as number | undefined,\n );\n if (isRevoked) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n context: { reason: 'token_invalidated' },\n });\n }\n\n // revocation-C: PER-SESSION fence (companion to the user-wide fence above). This is the MAIN\n // resource-API front and the widest surface an OIDC end_session / per-device logout must reach:\n // the access claim carries `sessionId`, so terminating that one session evicts its access token\n // here within the token's own lifetime, leaving the user's other sessions live. See\n // {@link evaluateSessionInvalidationFence}.\n const { isRevoked: sessionRevoked } = await evaluateSessionInvalidationFence(\n this.redisService, userJwtToken.sessionId, userJwtToken.iat as number | undefined,\n );\n if (sessionRevoked) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n context: { reason: 'session_invalidated' },\n });\n }\n\n return await this.handleUserJwtAuthentication(\n userJwtToken.userId, initiatorCriticalParamsValue, operation, relationshipContexts,\n userJwtToken.lastAuthenticatedAt, userJwtToken.activeUserType,\n userJwtToken.authorizationVersion,\n );\n }\n\n if (\n decodedToken.type === ExecutionContext_ExecutionType.ORGANIZATION_MACHINE ||\n decodedToken.type === ExecutionContext_ExecutionType.APPLICATION_MACHINE\n ) {\n // Exchanged OAuth client-credentials token front (D2 \"front b\"). The client\n // exchanged its secret at the token endpoint for this short-lived audience-bound\n // token; it authenticates as an org/app MACHINE principal. The token `type` encodes\n // the scope — there is no separate `scopeType` claim.\n const machineToken = decodedToken;\n const machineScope = machineToken.type === ExecutionContext_ExecutionType.ORGANIZATION_MACHINE\n ? ResourcePrimaryScope.ORGANIZATIONS\n : ResourcePrimaryScope.APPLICATION;\n\n // RFC 8707 (D7): the token MUST be audience-bound to THIS resource server. Reject a\n // token minted for a different resource — confused-deputy / token-passthrough guard.\n const expectedAudience = this.resolveApiResourceAudience();\n if (!expectedAudience || machineToken.aud !== expectedAudience) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { reason: 'machine_aud_mismatch', tokenType } });\n }\n\n // A machine principal reaches ORG/APP-scoped resources only. The token's scope must\n // match the operation's primary scope — this also fail-closes USER_SELF/ANONYMOUS\n // resources (a machine has no userId; those scopes can never equal ORG/APP).\n if (operation.resourcePrimaryScope !== machineScope) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_ORG_KEY_WRONG_RESOURCE,\n context: { reason: 'machine_scope_wrong_resource', resourceIdentifier: operation.resourceIdentifier, tokenScope: machineScope, resourceScope: operation.resourcePrimaryScope } });\n }\n\n // COHERENCE GUARD (W3.6, machine arm) — symmetric with the USER_REQUEST userId-mismatch check\n // below. `machineToken.scopeId` is authoritative for `initiatorIds`, BUT the ExecutionContext's\n // CONTEXT MAP is built from `initiatorCriticalParamsValue` (URL-derived), and THAT map — not\n // `initiatorIds` — is what scopes every read filter (`buildContextualFilter`) and write enrichment\n // (`enrichDataWithContext`). So a token bound to one scope addressing a DIFFERENT scope in the URL\n // would have its COLLECTION ops (LIST/SEARCH/COUNT/CREATE) silently scoped to the URL tenant while\n // authorization only checks the token tenant — a cross-tenant read/write leak (by-id ops escape it\n // only because their post-fetch row-org check happens to compare against the token org). Reject the\n // contradiction at its source. (api-keys / `oc_` direct secrets cannot diverge: their credential\n // lookup is itself filtered by the URL scope, so scopeId always equals the URL scope; only the\n // exchanged Bearer front carries scope in a token claim instead of re-resolving it against the URL.)\n const urlScopeId = machineScope === ResourcePrimaryScope.ORGANIZATIONS\n ? initiatorCriticalParamsValue.organizationId\n : initiatorCriticalParamsValue.applicationId;\n if (urlScopeId && urlScopeId !== machineToken.scopeId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHORIZATION_MACHINE_SCOPE_MISMATCH,\n context: { reason: 'machine_scope_url_mismatch', tokenScope: machineScope } });\n }\n\n // Token scope is AUTHORITATIVE: spread URL-derived ids first, then overwrite with the\n // authenticated scopeId — a URL param cannot widen the token's scope. The OAuth client\n // that exchanged the token is recorded as the machine credential.\n const machineCredential = { authMethod: MachineAuthMethod.OAUTH_CLIENT, credentialId: machineToken.clientId };\n const initiatorIds: ExecutionContext_InitiatorIds = machineScope === ResourcePrimaryScope.ORGANIZATIONS\n ? { ...this.extractInitiatorIds(initiatorCriticalParamsValue), organizationId: machineToken.scopeId, machineCredential }\n : { ...this.extractInitiatorIds(initiatorCriticalParamsValue), applicationId: machineToken.scopeId, machineCredential };\n\n const executionContext = new ExecutionContext(\n operation,\n machineToken.type,\n new Map(Object.entries(initiatorCriticalParamsValue)),\n initiatorIds,\n [ { roles: machineToken.roles || [], relatedPrimaryScope: machineScope, relatedResourceId: machineToken.scopeId } ],\n relationshipContexts\n );\n\n if (machineScope === ResourcePrimaryScope.APPLICATION) {\n await this.populateApplicationIdIfNeeded(executionContext, true);\n }\n\n return executionContext;\n }\n\n // Exhaustive: after USER_REQUEST + both machine arms, `decodedToken` is `never`. A new\n // `JwtClaim_App_Auth` arm added later fails to compile HERE until it is handled above.\n const _exhaustiveToken: never = decodedToken;\n void _exhaustiveToken;\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { tokenType }} );\n\n } catch (error) {\n if (isExpiredJwtVerificationFailure(error)) {\n this.logger.debug('API request authentication rejected expired access token; client may refresh and retry', {\n customMessageReference: error.customMessageReference,\n statusCode: error.statusCode,\n path: req.originalUrl,\n operationIdentifier: operation.operationIdentifier,\n });\n throw error;\n }\n if (isJwtVerificationFailure(error)) {\n this.logger.warn('API request authentication failed', {\n error: error.customMessageReference,\n statusCode: error.statusCode,\n path: req.originalUrl,\n operationIdentifier: operation.operationIdentifier,\n });\n throw error;\n }\n // Handle JWT verification or validation errors\n if (isWildoBackendError(error)) {\n throw error;\n }\n\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n context: { originalError: describeCaughtError(error) } });\n }\n }\n\n // =====================================================\n // SHARED AUTH HELPERS (used by both HTTP and WebSocket)\n // =====================================================\n\n /**\n * Fetch user and build roles - SHARED between HTTP and WebSocket authentication.\n * This is the single source of truth for user authentication logic.\n *\n * @param userId - User ID to authenticate\n * @param tempContext - Temporary execution context for DB queries\n * @returns User object and built roles array\n */\n private async _fetchUserAndBuildRoles(\n userId: string,\n tempContext: ExecutionContext<any>,\n expectedAuthorizationVersion?: number,\n ): Promise<{ user: User; initiatorRoles: ExecutionContext_RoleInfo[]; applicationId: string }> {\n\n // 1. Fetch and validate user\n const userRepository = this.repositoriesRegistry.getRepository(CoreResourceType.USERS);\n const user =\n await userRepository.read<AuthorizationVersionedUser>(\n tempContext,\n userId,\n );\n\n if (!user) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_FOUND,\n context: { userId }\n });\n }\n\n if (expectedAuthorizationVersion !== undefined) {\n const currentAuthorizationVersion = getUserAuthorizationVersion(user);\n if (\n currentAuthorizationVersion === null\n || currentAuthorizationVersion !== expectedAuthorizationVersion\n ) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n context: {\n reason: 'user_authorization_version_changed',\n userId,\n },\n },\n );\n }\n }\n\n if (user.status !== UserStatus.ACTIVE) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_ACTIVE,\n context: { userId }\n });\n }\n\n // 2. Fetch organization memberships\n const orgMemberRepo = this.repositoriesRegistry.getRepository(CoreResourceType.ORGANIZATION_MEMBERS);\n const membershipsList = await orgMemberRepo.list<OrganizationMember>(tempContext, {\n userId: userId,\n status: OrganizationMemberStatus.ACTIVE\n });\n\n // Workaround: If organization members only have _id (due to projection issue),\n // fetch them individually using READ operations to get all fields\n const memberships = await Promise.all(\n membershipsList.map(async (member) => {\n if (member && member.roles && member.organizationId) {\n return member;\n }\n if (member && member._id) {\n try {\n const fullMember = await orgMemberRepo.read(tempContext, member._id) as OrganizationMember | null;\n return fullMember || member;\n } catch {\n return member;\n }\n }\n return member;\n })\n );\n\n // 2b. Drop memberships whose ORGANIZATION no longer confers authority.\n //\n // An ACTIVE membership row is necessary but not sufficient: the tenant granting it must itself\n // be operational. Without this filter a tenant marked for deletion keeps handing out\n // `ORG_ADMIN` for the whole retention window — the authority half of the teardown would be\n // purely cosmetic, since invalidating existing tokens does nothing about the next login.\n //\n // Applied to `memberships` itself rather than to the loop below, because the array feeds BOTH\n // the organization-wide roles built here AND `appendUnitScopedRoles`. Filtering only at the\n // loop would leave unit-scoped grants from a dead tenant flowing into `initiatorRoles` — a\n // narrower leak, but the same one.\n const authorityConferringMemberships =\n await this.filterMembershipsToAuthorityConferringOrganizations(memberships, tempContext);\n\n // 3. Build roles from memberships\n const initiatorRoles: ExecutionContext_RoleInfo[] = [];\n for (const membership of authorityConferringMemberships) {\n if (membership && membership.organizationId) {\n initiatorRoles.push({\n roles: membership.roles || [],\n relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n relatedResourceId: membership.organizationId\n });\n }\n }\n\n // 3b. Add UNIT-SCOPED roles (WS-C phase 2).\n //\n // These entries carry `organizationUnitId`, which marks them as narrowed: they confer authority\n // inside ONE organization unit, never across the organization. Every consumer that unions\n // `initiatorRoles` partitions on that field first (`isOrganizationWideRoleInfo`), which is why\n // emitting them here is safe — without that containment, a unit grant would read as tenant-wide\n // authority at four separate call sites. Do NOT relax the discriminator.\n //\n // Errors deliberately PROPAGATE rather than being swallowed into \"no unit roles\". A context\n // built with fewer grants than the principal actually holds is not a safe degradation once unit\n // narrowing lands: it silently empties list results for opted-in resources, which reads as data\n // loss rather than as the failure it is.\n await this.appendUnitScopedRoles(authorityConferringMemberships, initiatorRoles, tempContext);\n\n // 4. Add application-level roles if user has any\n const applicationId = await this.getApplicationId();\n if (user.appRoles && user.appRoles.length > 0) {\n initiatorRoles.push({\n roles: user.appRoles,\n relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n relatedResourceId: applicationId\n });\n }\n\n return { user, initiatorRoles, applicationId };\n }\n\n /**\n * Keep only the memberships whose ORGANIZATION is still in an authority-conferring state.\n *\n * ## Why an ACTIVE membership is not enough\n *\n * `membership.status` answers \"is this person still a member?\". It cannot answer \"is this tenant\n * still operational?\", and until 2026-08-01 nothing asked the second question at all —\n * `OrganizationStatus` had zero backend readers, so `SUSPENDED` was decorative and a tenant\n * marked for deletion would have kept conferring `ORG_ADMIN` for its entire retention window.\n *\n * This is the read-time half of tenant soft-delete, and it is deliberately a DERIVATION rather\n * than stored state. The alternative — rewriting every membership row at mark time and rewriting\n * it back on restore — would have to remember each row's prior status to be reversible, and\n * would make the restore path a data migration instead of a status flip. Computing authority\n * from the tenant's current status keeps the membership rows untouched, which is exactly what\n * makes the retention window restorable.\n *\n * ## Failure posture: FAIL CLOSED\n *\n * An organization that cannot be resolved confers nothing\n * ({@link isAuthorityConferringOrganizationStatus} returns `false` for `undefined`). A dangling\n * membership must never widen authority.\n *\n * The one nuance is a row that IS found but arrives without a usable `status`. `status` is a\n * declared summary field so a LIST projection carries it, but this same method's caller already\n * carries a workaround for a projection issue that returned `_id`-only membership rows — so the\n * same defect here would silently strip EVERY user's organization roles application-wide. Those\n * rows therefore get one targeted `read()` before being judged, mirroring the neighbouring\n * workaround. Genuinely absent rows still fail closed; a projection anomaly does not become an\n * outage.\n *\n * ## Cost\n *\n * One extra LIST per authenticated context build, batched over the distinct organizations the\n * caller belongs to (typically one). Not cached: authority must reflect a suspension or a\n * deletion mark on the next request, not after a TTL.\n *\n * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — access rights derive from the\n * current state of the granting scope.\n */\n private async filterMembershipsToAuthorityConferringOrganizations(\n memberships: OrganizationMember[],\n tempContext: ExecutionContext<any>,\n ): Promise<OrganizationMember[]> {\n const organizationIds = [\n ...new Set(\n memberships\n .filter((membership) => Boolean(membership?.organizationId))\n .map((membership) => membership.organizationId),\n ),\n ];\n if (organizationIds.length === 0) return [];\n\n const organizationRepository = this.repositoriesRegistry.getRepository(CoreResourceType.ORGANIZATIONS);\n const organizations = await organizationRepository.list<Organization>(tempContext, {\n _id: { $in: organizationIds },\n });\n\n const statusByOrganizationId = new Map<string, Organization['status'] | undefined>();\n for (const organization of organizations) {\n if (organization?._id) statusByOrganizationId.set(organization._id, organization.status);\n }\n\n // Projection-anomaly recovery — see the JSDoc. Only for rows that were FOUND without a status;\n // an organization absent from the result set stays absent and therefore stays fail-closed.\n for (const [organizationId, status] of statusByOrganizationId) {\n if (status !== undefined) continue;\n const refetched = await organizationRepository.read<Organization>(tempContext, organizationId);\n if (refetched?.status !== undefined) {\n statusByOrganizationId.set(organizationId, refetched.status);\n }\n }\n\n return memberships.filter((membership) =>\n Boolean(membership?.organizationId)\n && isAuthorityConferringOrganizationStatus(statusByOrganizationId.get(membership.organizationId)),\n );\n }\n\n /**\n * Resolve the caller's per-unit role grants and append them to `initiatorRoles` as NARROWED entries.\n *\n * ## Shape of what this emits\n *\n * One entry per assignment, carrying the same `relatedPrimaryScope`/`relatedResourceId` as the\n * organization-wide entry it sits beside, plus `organizationUnitId`. That discriminator is the ONLY\n * thing separating \"ORG_MANAGER of Sales\" from \"ORG_MANAGER of the tenant\", and every consumer that\n * unions `initiatorRoles` partitions on it (see `isOrganizationWideRoleInfo`). Emitting these\n * without that containment in place would have been a privilege escalation at four call sites,\n * which is why the consumers were hardened first.\n *\n * ## Why the membership id and not the user id\n *\n * The assignment's parent is the MEMBERSHIP, and the membership rows are already loaded here — so\n * this is an indexed lookup on data in hand, not a second identity resolution. It also means a\n * membership that was filtered out above (non-`ACTIVE`) contributes no unit roles for free: losing\n * organization membership must never leave a unit grant standing.\n *\n * ## Cost and failure posture\n *\n * One query per organization the caller belongs to (typically one). Errors PROPAGATE: a context\n * built with fewer grants than the principal holds is not a safe degradation once unit narrowing\n * lands — it silently empties list results for opted-in resources, presenting a failure as data.\n *\n * An UNREGISTERED repository is different from a failed read and is treated as such: an application\n * that never registered the resource cannot have assignments, so there are no unit roles to add.\n * That is an accurate answer, not a swallowed error.\n */\n private async appendUnitScopedRoles(\n memberships: (OrganizationMember | null | undefined)[],\n initiatorRoles: ExecutionContext_RoleInfo[],\n tempContext: ExecutionContext<any>,\n ): Promise<void> {\n const unitMemberRepository = this.repositoriesRegistry.getRepository(CoreResourceType.ORGANIZATION_UNIT_MEMBERS);\n if (!unitMemberRepository) return;\n\n for (const membership of memberships) {\n if (!membership?._id || !membership.organizationId) continue;\n\n const assignments = await unitMemberRepository.list<OrganizationUnitMember>(tempContext, {\n organizationMemberId: membership._id,\n });\n\n for (const assignment of assignments ?? []) {\n if (!assignment?.organizationUnitId || !assignment.role) continue;\n initiatorRoles.push({\n roles: [assignment.role],\n relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n relatedResourceId: membership.organizationId,\n organizationUnitId: assignment.organizationUnitId,\n });\n }\n }\n }\n\n // =====================================================\n // HTTP AUTHENTICATION METHODS\n // =====================================================\n\n /**\n * Handle user JWT authentication with user and role validation.\n * Uses _fetchUserAndBuildRoles() shared helper for DRY.\n */\n private async handleUserJwtAuthentication<\n TCustomOperationEnum extends EnumLikeType | undefined = undefined,\n TCoreOperationEnum extends Partial<CoreResourceOperation> | undefined = undefined,\n TMainSchema extends z.ZodTypeAny = z.ZodTypeAny,\n>(\n userId: string,\n initiatorCriticalParamsValue: Record<string, string>,\n operation: ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>,\n relationshipContexts: ExecutionContext_RelationshipContext[],\n lastAuthenticatedAt?: number,\n jwtActiveUserType?: string,\n jwtAuthorizationVersion?: number,\n ): Promise<ExecutionContext<typeof operation>> {\n\n this.logDebug('Processing user JWT authentication', { userId: userId.substring(0, 8) + '...' });\n\n // W3.6: Validate URL params don't contradict JWT-derived identity.\n //\n // The comparison applies ONLY to a `userId` segment that actually denotes the CALLER. On a\n // resource whose own primary key is `userId` but whose segment names the SUBJECT of an\n // administrative action (`USERS`), the two are different people BY DESIGN and this check was\n // refusing the entire admin surface — see `primaryKeyIdentifiesInitiator` for the full rationale\n // and why the distinction cannot be inferred from the field name.\n //\n // Relaxing it here cannot produce impersonation: `initiatorIds.userId` below is taken from the\n // JWT and spread LAST precisely so a URL can never override it, and authorization still decides\n // whether this caller may run this operation on this row.\n if (\n initiatorCriticalParamsValue.userId\n && initiatorCriticalParamsValue.userId !== userId\n && this.doesUserIdParamDenoteInitiator(operation)\n ) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATION_USER_ID_MISMATCH,\n });\n }\n\n try {\n const tempExecutionContext = this._getTempExecutionContext(operation);\n\n // Use shared helper for user fetch and role building\n const { initiatorRoles } = await this._fetchUserAndBuildRoles(\n userId,\n tempExecutionContext,\n jwtAuthorizationVersion,\n );\n\n // W3.6: JWT-derived values MUST take precedence over URL params to prevent identity spoofing.\n const initiatorIds: ExecutionContext_InitiatorIds = {\n ...this.extractInitiatorIds(initiatorCriticalParamsValue),\n userId,\n };\n\n const executionContext = new ExecutionContext(\n operation,\n ExecutionContext_ExecutionType.USER_REQUEST,\n new Map(Object.entries(initiatorCriticalParamsValue)),\n initiatorIds,\n initiatorRoles,\n relationshipContexts,\n undefined, // correlationId — auto-generated\n 0, // subCallDepth — top-level\n undefined, // visitedResources\n jwtActiveUserType ?? null,\n );\n\n if (lastAuthenticatedAt !== undefined) {\n executionContext.setLastAuthenticatedAt(lastAuthenticatedAt);\n }\n\n return executionContext;\n\n } catch (error) {\n if (isWildoBackendError(error)) {\n throw error;\n }\n\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n context: { originalError: describeCaughtError(error), userId } });\n }\n }\n\n // =====================================================\n // SOCKET AUTHENTICATION METHODS\n // =====================================================\n // These methods are factorized with HTTP authentication:\n // - Same JWT verification (jwtService.verify)\n // - Same token parsing (JwtClaim_App_Auth_Schema)\n // - Same user/role extraction (reuses _fetchUserAndBuildRoles)\n\n /**\n * Authenticate a socket connection from JWT token.\n *\n * FACTORIZATION: Reuses same JWT verification and user/role extraction as HTTP.\n *\n * @param token - JWT token from socket handshake\n * @returns SocketAuthResult with execution type, initiator IDs and roles\n */\n public async authenticateSocketConnection(token: string, requestedOrganizationId?: string): Promise<SocketAuthResult> {\n this.logDebug('Authenticating socket connection');\n\n const rawDecodedToken = await this.jwtService.verifyWithoutBackendErrorActions(token);\n const decodedToken = JwtClaim_App_Auth_Schema.parse(rawDecodedToken);\n const tokenType = decodedToken.type;\n\n // Sockets accept USER_REQUEST JWTs only; machine tokens are rejected via the fallback below.\n if (decodedToken.type === ExecutionContext_ExecutionType.USER_REQUEST) {\n const userJwtToken = decodedToken;\n\n // All-session revocation fence, evaluated ONCE at handshake. A socket then stays open for the\n // life of the connection with nothing re-checking `iat`, so a same-second token admitted here\n // outlives the revocation by the whole session — which makes the shared fail-closed `<=` matter\n // more here, not less. See {@link evaluateUserTokenInvalidationFence} (GRACE-BOUNDARY).\n const { isRevoked } = await evaluateUserTokenInvalidationFence(\n this.redisService, userJwtToken.userId, userJwtToken.iat as number | undefined,\n );\n if (isRevoked) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n context: { reason: 'token_invalidated' },\n });\n }\n\n // revocation-C: PER-SESSION fence (companion to the user-wide fence above), evaluated ONCE at\n // handshake like its sibling. A socket stays open for the connection's life with nothing\n // re-checking `iat`, so admitting a token whose session was terminated would outlive the\n // end_session by the whole connection — the same reason the `<=` boundary matters more here.\n // See {@link evaluateSessionInvalidationFence}.\n const { isRevoked: sessionRevoked } = await evaluateSessionInvalidationFence(\n this.redisService, userJwtToken.sessionId, userJwtToken.iat as number | undefined,\n );\n if (sessionRevoked) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n context: { reason: 'session_invalidated' },\n });\n }\n\n return await this._authenticateUserForSocket(\n userJwtToken.userId,\n requestedOrganizationId,\n // Handshake selector — advisory: a stale/non-member value degrades to membership inference.\n ActiveOrganizationSelectionSource.USER_REQUESTED,\n userJwtToken.authorizationVersion,\n );\n }\n\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { tokenType }\n });\n }\n\n /**\n * Get auth result for public (unauthenticated) socket connections.\n */\n public getPublicSocketAuth(): SocketAuthResult {\n return {\n executionType: ExecutionContext_ExecutionType.PUBLIC_EXECUTION,\n initiatorIds: null,\n initiatorRoles: []\n };\n }\n\n /**\n * Authenticate an EXTERNAL-caller token (A2A / MCP) into a principal-agnostic\n * {@link SocketAuthResult}. Accepts BOTH:\n * - **user-delegated** OIDC `authorization_code` tokens (`USER_REQUEST`) → the\n * session is owned by the delegating user;\n * - **machine** OAuth `client_credentials` tokens\n * (`ORGANIZATION_MACHINE` / `APPLICATION_MACHINE`) → the session is owned by\n * the org/app machine principal.\n *\n * The returned `SocketAuthResult` flows unchanged through\n * {@link buildContextFromSocketAuth} (principal-agnostic) so the caller's tools /\n * operations run under the caller's OWN roles + scope, authorized by\n * `authorizeInController` — no `systemAccessPolicy` bypass. This is the SAME\n * principal resolution as the HTTP request path (`handleJwtAuthentication`);\n * there is deliberately no auth-method-specific EC-builder (the machine principal\n * is the same shape as any other, per the machine-principal recentering).\n *\n * Audience binding (RFC 8707 / D7):\n * - USER_REQUEST — `aud` MUST equal `callerAudience` (the caller's own endpoint,\n * e.g. the A2A agent card `url`); a token minted for another agent is rejected.\n * - machine — REQUIRES this endpoint's own `callerAudience` (a per-endpoint aud-bound\n * token minted when the client named this surface's `resource` at the token endpoint,\n * RFC 8707). The generic API audience is NOT accepted here (2026-07-29 flip): API and\n * agent-surface tokens never cross. `iss` is always the app issuer. The main-API choke\n * point is the sole consumer of the API audience (it passes no per-endpoint override).\n *\n * @throws AUTHENTICATION on a bad signature, wrong/expired token, aud mismatch,\n * or an invalidated user token — the caller maps this to a transport-level reject.\n */\n public async authenticateExternalToken(token: string, callerAudience: string): Promise<SocketAuthResult> {\n const unverifiedType = this.jwtService.peekUnverifiedClaimType(token);\n const isMachineToken =\n unverifiedType === ExecutionContext_ExecutionType.ORGANIZATION_MACHINE ||\n unverifiedType === ExecutionContext_ExecutionType.APPLICATION_MACHINE;\n\n if (isMachineToken) {\n // Machine client-credentials token. This external resource server (A2A / MCP) REQUIRES a token\n // audience-bound to its OWN per-endpoint audience (`callerAudience` — the RFC 8707 `resource`\n // advertised in this endpoint's Protected-Resource-Metadata). The generic API audience is NOT\n // accepted here: a token minted for the API cannot be replayed at an agent surface, and a\n // per-endpoint agent token cannot be replayed at another surface (strict confused-deputy /\n // token-passthrough defense, per the 2026-07-29 flip). The client MUST request\n // `resource=<this endpoint's audience>` at the token endpoint. The main-API choke point is the\n // ONLY consumer of the generic API audience (it passes NO override to `verifyMachineToken`), so\n // the two audiences never cross. NOTE (multi-* ready): `callerAudience` is opaque here — a future\n // per-instance MCP-server / A2A-agent audience (`…/mcp/<ref>`) flows through unchanged.\n if (!callerAudience) {\n // Fail-closed: an unresolvable per-endpoint audience must never accept a machine token.\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { reason: 'external_machine_aud_unresolvable' },\n });\n }\n const rawMachine = await this.jwtService.verifyMachineToken(token, [callerAudience]);\n const machineToken = JwtClaim_App_Auth_Schema.parse(rawMachine);\n if (\n machineToken.type !== ExecutionContext_ExecutionType.ORGANIZATION_MACHINE &&\n machineToken.type !== ExecutionContext_ExecutionType.APPLICATION_MACHINE\n ) {\n // The unverified peek disagreed with the verified type (forged/malformed) → reject.\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { reason: 'external_machine_type_mismatch', tokenType: machineToken.type },\n });\n }\n // Defense-in-depth backstop: `verifyMachineToken` already bound `aud === callerAudience`, but\n // its degraded path (API audience unresolvable) can skip jwt.verify's audience check. Re-assert\n // explicitly — a token whose `aud` is not THIS endpoint's audience is rejected even if lenient.\n if (!this._audienceIncludes(machineToken.aud, callerAudience)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { reason: 'external_machine_aud_unbound' },\n });\n }\n const machineScope = machineToken.type === ExecutionContext_ExecutionType.ORGANIZATION_MACHINE\n ? ResourcePrimaryScope.ORGANIZATIONS\n : ResourcePrimaryScope.APPLICATION;\n const machineCredential = { authMethod: MachineAuthMethod.OAUTH_CLIENT, credentialId: machineToken.clientId };\n const initiatorIds: ExecutionContext_InitiatorIds = machineScope === ResourcePrimaryScope.ORGANIZATIONS\n ? { organizationId: machineToken.scopeId, machineCredential }\n : { applicationId: machineToken.scopeId, machineCredential };\n return {\n executionType: machineToken.type,\n initiatorIds,\n initiatorRoles: [{ roles: machineToken.roles || [], relatedPrimaryScope: machineScope, relatedResourceId: machineToken.scopeId }],\n };\n }\n\n // User-delegated token (A2A / MCP): verify signature / issuer / expiry AUD-AGNOSTICALLY. A\n // delegated token is `aud`-bound to THIS agent endpoint (RFC 8707), NOT the first-party\n // `aud='AUTH_TOKEN'` that the shared verify would otherwise enforce — which would reject every\n // delegated token (B-S1). The agent audience is then validated EXPLICITLY below, so a refresh\n // token (`aud='REFRESH_TOKEN'`) or any other-audience token is still rejected there (its `aud`\n // is not this agent endpoint). Same `APPLICATION_AUTH_TOKEN` signing key + issuer, so a forged\n // signature still fails. First-party paths NEVER pass `ignoreAudience` — their `aud='AUTH_TOKEN'`\n // gate is what confines this delegated token OUT of the main API (B-S2 / R4).\n const rawUser = await this.jwtService.verifyWithoutBackendErrorActions(token, JwtPrivateKeys.APPLICATION_AUTH_TOKEN, { ignoreAudience: true });\n const decodedToken = JwtClaim_App_Auth_Schema.parse(rawUser);\n if (decodedToken.type !== ExecutionContext_ExecutionType.USER_REQUEST) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { reason: 'external_unexpected_token_type', tokenType: decodedToken.type },\n });\n }\n if (!callerAudience || !this._audienceIncludes(decodedToken.aud, callerAudience)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { reason: 'external_user_aud_mismatch' },\n });\n }\n // Reject a user token issued at OR before a forced invalidation. This matters MOST here: a delegated\n // agent token has NO other server-side revocation handle (no refresh; `TOKEN_INVALID_BEFORE` is its\n // only post-issuance fence), so a same-second token admitted here survives its full ≤30-min TTL at\n // /a2a + /mcp. The shared fail-closed `<=` policy and its full rationale live in\n // {@link evaluateUserTokenInvalidationFence} (GRACE-BOUNDARY). (D9 — fix landed for refresh 2026-07-29.)\n const { isRevoked } = await evaluateUserTokenInvalidationFence(\n this.redisService, decodedToken.userId, decodedToken.iat as number | undefined,\n );\n if (isRevoked) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n context: { reason: 'token_invalidated' },\n });\n }\n // revocation-C: the PER-SESSION fence is DELIBERATELY ABSENT on this delegated (A2A / MCP) front,\n // and this is one of the six fronts the user-wide fence covers — recorded here so the omission reads\n // as a decision, not an oversight. Two independent reasons: (1) a delegated token is `aud`-bound to\n // THIS agent endpoint (verified `ignoreAudience` then re-checked at `_audienceIncludes` above), so a\n // first-party session-bound token (`aud='AUTH_TOKEN'`) is already rejected and cannot reach here —\n // the fence would be inert; (2) per OIDC RP-Initiated Logout 1.0, an `end_session` terminates the\n // End-User's OP session, and RP token revocation is explicitly OUT OF SCOPE (that is RFC 7009's job).\n // Wildo's delegated tokens are short-lived with no refresh, so they are left to expire rather than\n // revoked by end_session. Gating here would revoke RP tokens on logout, contrary to the spec.\n // spec-cite: OpenID Connect RP-Initiated Logout 1.0 §2 (the OP terminates the End-User's session at the\n // OP). That RP-held tokens are NOT revoked is a DESIGN INFERENCE, not a spec quote: the specification\n // addresses OP session termination and is silent on RP token revocation, which is RFC 7009's concern.\n // Seed the delegated turn's active organization from the DELEGATING CLIENT's own tenant (`azp` →\n // org-scoped client → `organizationId`). Before this, external tokens passed a hardcoded\n // `undefined` here, so a MULTI-ORG user's A2A / MCP turn carried no active organization at all —\n // which broke in opposite directions per surface: MCP denied every org-scoped tool call (a\n // multi-org member could not use org data at all), while A2A's token budget fell through to\n // USER_SELF, found no grant, and resolved to the unlimited default (uncapped spend). Both are the\n // same missing signal. `CLIENT_PINNED` is load-bearing: on a non-membership pin the resolver must\n // DECLINE rather than infer, or Acme's client would silently bill Globex — see\n // {@link ActiveOrganizationSelectionSource}.\n const delegatingClientOrganizationId = await this.resolveDelegatingClientOrganizationId(decodedToken.azp);\n return await this._authenticateUserForSocket(\n decodedToken.userId,\n delegatingClientOrganizationId,\n delegatingClientOrganizationId\n ? ActiveOrganizationSelectionSource.CLIENT_PINNED\n // No tenant pin exists (APPLICATION-scoped / unknown client) — inference is the correct\n // fallback for it, and is what the deferred `organization`-at-authorize work would replace.\n : ActiveOrganizationSelectionSource.USER_REQUESTED,\n decodedToken.authorizationVersion,\n );\n }\n\n /** RFC 7519 `aud` membership — `aud` may be a single string or an array. */\n private _audienceIncludes(aud: unknown, expected: string): boolean {\n if (typeof aud === 'string') return aud === expected;\n if (Array.isArray(aud)) return aud.includes(expected);\n return false;\n }\n\n /**\n * Normalize a raw `contextResourceIdentifiers` record (as produced by the\n * frontend and carried over websocket subscription / chart payloads) into the\n * field-identifier-keyed map that {@link ExecutionContext} requires.\n *\n * WHY THIS EXISTS — the scope map (`_contextResourcesFieldIdentifier`) is\n * contractually keyed by `ResourceFieldIdentifier` because\n * `RepositoryResourceBackendService.buildContextualFilter` resolves every key\n * as a Zod schema field path and **fail-closed throws a `configuration` (500)\n * error** on any key that is not a field on the target resource's schema. The\n * HTTP request path already satisfies this contract: `validateParameterCoherence`\n * keys the map by `initiatorInfo.parameters[].fieldIdentifier` (e.g.\n * `organizationId`). The frontend's `contextResourceIdentifiers`, however,\n * deliberately addresses a scope by EITHER its resource-type name\n * (`organizations`) OR its field identifier (`organizationId`) — see\n * `normalizeContextResourceIdentifiersForTransport` in `saas-frontend-lib`,\n * which for a plain-string scope id emits only the resource-type key. Copying\n * those keys verbatim into the scope map let a resource-type key such as\n * `organizations` reach `buildContextualFilter`, which then rejected it (no\n * `organizations` field exists on, say, `todoLists`). This surfaced as a\n * repeating FATAL 500 the first time any persisted org-scoped record was opened\n * in a single-resource READ view (which mounts the realtime WS subscription).\n *\n * Each resource-type key is mapped to its field identifier via the resources\n * registry (`organizations` → `organizationId`, `todoLists` → `todolistId`, …).\n * Keys that are already field identifiers (or any non-resource-type key) pass\n * through unchanged. When both forms of the same scope are present they collapse\n * onto a single field-identifier entry (same value, so order-independent). The\n * subscribed resource's own resource-type key collapses to its own field\n * identifier, which `buildContextualFilter` then skips via its self-reference\n * blacklist. Translating here — rather than blacklisting the offending key in\n * `buildContextualFilter` — keeps the fail-closed guard intact and fixes the\n * keying at the layer that owns the scope→field-identifier mapping.\n */\n /**\n * Collect the field identifiers of every declared URL scope parameter across\n * all route variants of an operation — the socket analogue of the HTTP\n * request path's `initiatorInfo.parameters`. The union spans every generated\n * route variant, so it includes the primary scope (`organizationId`), every\n * optional-context ancestor (`todoListId`), every disambiguating relationship\n * FK (`assignedToUserId`, `createdByUserId`), and the resource's own id\n * parameter. It deliberately does NOT include the ambient session identities\n * a client may send (`userId` / `applicationId`) unless they are a genuine\n * scope parameter of THIS resource, which is exactly what\n * `buildContextFromSocketAuth` uses to strip the ambient scope bundle before\n * it reaches the fail-closed contextual filter.\n *\n * Returns an empty set for operations without URL routes (`initiatorInfos`\n * absent/empty); callers treat that as \"do not filter\" so internal\n * route-less operations keep their explicit context untouched.\n */\n private collectDeclaredScopeFieldIdentifiers(operation: ResourceConfiguration_Operation<any, any, any>): Set<string> {\n const fieldIdentifiers = new Set<string>();\n if ('initiatorInfos' in operation && Array.isArray(operation.initiatorInfos)) {\n for (const initiatorInfo of operation.initiatorInfos as ResourceConfiguration_Operation_UrlInitiatorInfo[]) {\n for (const parameter of initiatorInfo.parameters) {\n fieldIdentifiers.add(parameter.fieldIdentifier);\n }\n }\n }\n return fieldIdentifiers;\n }\n\n private normalizeContextIdentifiersToFieldIdentifierMap(contextResourceIdentifiers: Record<string, string>): Map<ResourceFieldIdentifier, string | string[]> {\n const allResourceFieldIdentifiers = this.resourcesRegistryService.getAllResourceFieldIdentifiers();\n const contextMap = new Map<ResourceFieldIdentifier, string | string[]>();\n for (const [key, value] of Object.entries(contextResourceIdentifiers)) {\n const fieldIdentifier = allResourceFieldIdentifiers[key as ResourceType] ?? key;\n contextMap.set(fieldIdentifier, value);\n }\n return contextMap;\n }\n\n /**\n * Build an ExecutionContext from socket auth info for resource authorization.\n *\n * FACTORIZATION: Creates an ExecutionContext with same structure as HTTP requests.\n * Enables reuse of AuthorizationsBackendService.authorizeInController().\n *\n * @param auth - SocketAuthResult from authenticated socket\n * @param operation - Operation config (already looked up from ResourcesRegistryService)\n * @param contextResourceIdentifiers - Path context for authorization\n */\n public async buildContextFromSocketAuth<\n TResourceConfigOperation extends ResourceConfiguration_Operation<any, any, any>\n >(\n auth: SocketAuthResult,\n operation: TResourceConfigOperation,\n contextResourceIdentifiers: Record<string, string>\n ): Promise<ExecutionContext<TResourceConfigOperation>> {\n\n this.logDebug('Building execution context from socket auth', {\n executionType: auth.executionType,\n resourceType: operation.resourceIdentifier,\n operationIdentifier: operation.operationIdentifier,\n contextKeys: Object.keys(contextResourceIdentifiers)\n });\n\n // Convert contextResourceIdentifiers to Map for ExecutionContext, translating\n // resource-type keys (e.g. 'organizations') to their field identifier (e.g.\n // 'organizationId') so the scope map honors the same field-identifier contract\n // the HTTP request path produces. See normalizeContextIdentifiersToFieldIdentifierMap.\n const contextMap = this.normalizeContextIdentifiersToFieldIdentifierMap(contextResourceIdentifiers);\n\n // Reduce the frontend-sent scope bundle to the operation's DECLARED scope\n // parameters — the socket analogue of the HTTP request path's\n // `initiatorInfo.parameters` filtering.\n //\n // WHY THIS EXISTS — the frontend merges the AMBIENT session scope\n // (`organizations` + `users` + `application`, keyed by resource type by\n // `AppScopeContext.buildContextResourceIdentifiers`) into EVERY resource\n // operation context (see `useCompositeResourceOperationContextBuilder`), and\n // the socket subscription forwards that whole bundle as\n // `contextResourceIdentifiers`. On HTTP those ambient scopes never reach the\n // scope map: `createExecutionContextFromRequest` only maps the matched\n // route's declared `initiatorInfo.parameters` into it. The socket path had no\n // equivalent filter, so for an ORG-scoped resource (e.g. `todos`) the ambient\n // `users` scope normalized to `userId` — which is NOT a column on the\n // resource (its user links are the REFERENCE FKs `assignedToUserId` /\n // `createdByUserId`, never a bare `userId`). `buildContextualFilter` then\n // fail-closed threw a FATAL `configuration` (500) on EVERY single-resource\n // READ subscription (which mounts the realtime WS room), cascading to a 404\n // `authorizations_validation_failed`. Filtering here yields the exact scope\n // map HTTP produces (`organizationId`, `todoListId`, …) and drops the ambient\n // identity scopes, which are already carried authoritatively in\n // `initiatorIds` (server-verified, never client-trusted for authorization).\n //\n // Fail-closed contract preserved: the surviving keys are all declared route\n // parameters — i.e. real scope columns — so `buildContextualFilter` still\n // throws on a genuinely misconfigured scope. When the operation has no URL\n // routes (`initiatorInfos` empty — e.g. the internal APPLICATION READ used\n // for badge counts) the declared set is empty and filtering is skipped, so\n // no legitimate scope is dropped.\n const declaredScopeFieldIdentifiers = this.collectDeclaredScopeFieldIdentifiers(operation);\n if (declaredScopeFieldIdentifiers.size > 0) {\n for (const fieldIdentifier of [...contextMap.keys()]) {\n if (!declaredScopeFieldIdentifiers.has(fieldIdentifier)) {\n this.logDebug('Dropping non-declared ambient scope from socket context map', { fieldIdentifier });\n contextMap.delete(fieldIdentifier);\n }\n }\n }\n\n // USER_SELF socket scoping — the socket analogue of the HTTP URL's `userId` primary-scope segment.\n //\n // A USER_SELF resource scopes EVERY read (`buildContextualFilter`) by the `userId` field in the\n // CONTEXT MAP — not `initiatorIds` (see the W3.6 coherence guard). On HTTP that `userId` enters the\n // map from the URL (`/…/{userId}/…`). The socket path carries NO URL, so for a caller that sends no\n // ambient `userId` (e.g. the MCP delegated transport, which forwards only org/app), the map had no\n // `userId` and a USER_SELF COLLECTION read (LIST/SEARCH/COUNT) went UNSCOPED → every user's rows (a\n // cross-user leak). Seed the SERVER-VERIFIED `auth.initiatorIds.userId` (authoritative, never\n // client-trusted) under the declared user field so the read is scoped to the caller.\n //\n // Guards: only when the op's PRIMARY scope is USER_SELF AND it actually DECLARES the `userId` field\n // (so we never inject a non-column key and re-trip the WS-subscription FATAL the filter above\n // guards). `.set()` OVERRIDES any ambient `userId` a client sent — for USER_SELF the caller's OWN\n // identity is the only legitimate scope, so a client-supplied value must never widen it. WS\n // subscriptions already carry the same (own) `userId` via the ambient scope, so this is a no-op for\n // them; instance ops (READ/UPDATE/DELETE) are additionally protected by `authorizeUserSelf`.\n const userSelfFieldIdentifier = coreResourceShared_FieldIdentifier[CoreResourceType.USER_SELF];\n if (\n operation.resourcePrimaryScope === ResourcePrimaryScope.USER_SELF\n && auth.initiatorIds?.userId\n && declaredScopeFieldIdentifiers.has(userSelfFieldIdentifier)\n ) {\n contextMap.set(userSelfFieldIdentifier, auth.initiatorIds.userId);\n }\n\n // Build execution context with socket auth info AND context identifiers\n // SAME ExecutionContext structure as HTTP - enables reuse of:\n // - AuthorizationsBackendService.authorizeInController()\n // - All internal validation methods (validateOperationRoles, validateParentScopeAccess, etc.)\n const executionContext = new ExecutionContext<TResourceConfigOperation>(\n operation, // Same: operation config\n auth.executionType, // Same structure: USER_REQUEST, PUBLIC_EXECUTION\n contextMap, // Same structure: context resource identifiers\n auth.initiatorIds ?? {}, // Same structure: ExecutionContext_InitiatorIds\n auth.initiatorRoles, // Same structure: ExecutionContext_RoleInfo[]\n [] // relationshipContexts - not needed for socket authorization\n );\n\n if (auth.consumableTokenValue) {\n executionContext.setConsumableTokenValue(auth.consumableTokenValue);\n }\n\n // Reuse existing helper to populate applicationId\n await this.populateApplicationIdIfNeeded(executionContext, false);\n\n return executionContext;\n }\n\n /**\n * Authenticate user for socket.\n * Uses _fetchUserAndBuildRoles() shared helper - same logic as HTTP auth.\n */\n private async _authenticateUserForSocket(\n userId: string,\n requestedOrganizationId: string | undefined,\n organizationSelectionSource: ActiveOrganizationSelectionSource,\n expectedAuthorizationVersion?: number,\n ): Promise<SocketAuthResult> {\n this.logDebug('Authenticating user for socket', { userId: userId.substring(0, 8) + '...' });\n\n // Get temp context for DB queries\n const appReadOp = this.resourcesRegistryService.getOperationFromPath(\n this.resourcesRegistryService.getOperationPathDefault(CoreResourceType.APPLICATION, CoreResourceOperation.READ)\n );\n const tempContext = this._getTempExecutionContext(appReadOp);\n\n // Use shared helper - same logic as HTTP auth\n const { initiatorRoles, applicationId } =\n await this._fetchUserAndBuildRoles(\n userId,\n tempContext,\n expectedAuthorizationVersion,\n );\n\n // Seed the connection's active organization from server-verified membership so\n // org-scoped resource authorization works on sockets the same way as HTTP. The\n // HTTP path derives org from the URL scope (re-validated against memberships);\n // a socket has no URL, so we take the client's active-org selector from the\n // handshake and validate it against `initiatorRoles` (or infer it for single-org\n // users). Without this, `initiatorIds.organizationId` is always undefined and\n // `authorizeOrganizations` denies every org-scoped resource subscription. See\n // `resolveSocketActiveOrganizationId` for the (non-trusting) resolution policy, and\n // `ActiveOrganizationSelectionSource` for why a handshake selector and a delegating client's own\n // tenant pin must NOT share the same miss semantics.\n const organizationId = this.resolveSocketActiveOrganizationId(requestedOrganizationId, initiatorRoles, organizationSelectionSource);\n\n return {\n executionType: ExecutionContext_ExecutionType.USER_REQUEST,\n initiatorIds: { userId, applicationId, ...(organizationId ? { organizationId } : {}) },\n initiatorRoles\n };\n }\n\n /**\n * Resolve the resource field identifier from the operation.\n * This is the FK field name used when relating to this resource (e.g., 'todoId' for TODOS).\n * Used to map token.relatedId to the correct parameter name for coherence validation.\n */\n private resolveResourceFieldIdentifier(operation: ResourceConfiguration_Operation<any, any, any>): string | undefined {\n return operation.resourceFieldIdentifier as string | undefined;\n }\n\n}\n"]}
1
+ {"version":3,"file":"execution-context-creator.backend.service.js","sourceRoot":"","sources":["../../../../../src/runtime/services/execution-context-creator.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAqBA,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,cAAc,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,kBAAkB,EAAE,uCAAuC,EAAE,wBAAwB,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,oBAAoB,EAAE,sCAAsC,EAAE,mCAAmC,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEpa,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,SAAS,EAAE,8BAA8B,EAAiC,iBAAiB,EAAE,4BAA4B,EAAE,kCAAkC,EAAE,yBAAyB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEvV,wDAAwD;AACxD,uEAAuE;AACvE,wDAAwD;AAGxD,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,iCAAiC,EAAE,gBAAgB,EAAoD,MAAM,qEAAqE,CAAC;AAC5L,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAG3H,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAEzH;;;;;;;GAOG;AACH;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,kCAAkC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAE5F,MAAM,uCAAuC,GAAyD;IACpG,sCAAsC;IACtC,mCAAmC;CACpC,CAAC;AAEF,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,wBAAwB,EAAE,MAAM,oFAAoF,CAAC;AAC9H,OAAO,EAAE,cAAc,EAAE,MAAM,wEAAwE,CAAC;AACxG,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,EACL,+BAA+B,EAC/B,wBAAwB,GACzB,MAAM,2FAA2F,CAAC;AAEnG,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,UAAU,EAAE,MAAM,uEAAuE,CAAC;AACnG,OAAO,EAAE,qBAAqB,EAAE,MAAM,iFAAiF,CAAC;AACxH,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAE3H,OAAO,EAAE,qCAAqC,EAAE,MAAM,6CAA6C,CAAC;AAGpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AAExI,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAClG,OAAO,EAAE,kCAAkC,EAAE,wBAAwB,EAAE,MAAM,kGAAkG,CAAC;AAChL,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,qEAAqE,CAAC;AACrI,OAAO,EAAE,kCAAkC,EAAE,MAAM,oEAAoE,CAAC;AACxH,OAAO,EAAE,gCAAgC,EAAE,MAAM,sEAAsE,CAAC;AACxH,OAAO,EACL,2BAA2B,GAE5B,MAAM,6FAA6F,CAAC;AAI9F,IAAM,qCAAqC,GAA3C,MAAM,qCAAqC;IAKU;IACU;IACG;IACW;IACb;IACM;IACW;IACZ;IACV;IACH;IAIqB;IAhB/D,QAAQ,CAA+D;IAExF,YACwD,MAAqB,EACX,gBAAyC,EACtC,YAAwC,EAC7B,8BAAqE,EAClF,UAA6B,EACvB,wBAAyD,EAC9C,oBAA+D,EAC3E,sBAAqD,EAC/D,YAA0B,EAC7B,SAAoB,EAIC,uBAA8D;QAbtF,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QACtC,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,mCAA8B,GAA9B,8BAA8B,CAAuC;QAClF,eAAU,GAAV,UAAU,CAAmB;QACvB,6BAAwB,GAAxB,wBAAwB,CAAiC;QAC9C,yBAAoB,GAApB,oBAAoB,CAA2C;QAC3E,2BAAsB,GAAtB,sBAAsB,CAA+B;QAC/D,iBAAY,GAAZ,YAAY,CAAc;QAC7B,cAAS,GAAT,SAAS,CAAW;QAIC,4BAAuB,GAAvB,uBAAuB,CAAuC;QAE1I,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;IACtE,CAAC;IAED;;;OAGG;IACK,0BAA0B;QAChC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAiC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACxG,CAAC;IAEO,yBAAyB;QAC/B,OAAO;YACL;gBACE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;gBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;aACtD;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,6BAA6B,CAAC,gBAAuC,EAAE,gBAAyB,KAAK;QACjH,wCAAwC;QACxC,MAAM,4BAA4B,GAChC,gBAAgB,CAAC,YAAY,EAAE,aAAa,KAAK,SAAS;YAC1D,gBAAgB,CAAC,YAAY,EAAE,aAAa,KAAK,IAAI,CAAC;QAExD,qBAAqB;QACrB,MAAM,eAAe,GAAG,CACtB,gBAAgB,CAAC,SAAS,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,WAAW;YACpF,4BAA4B,CAC7B,IAAI,aAAa,CAAC;QAEnB,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,uHAAuH;iBACjI;aACF,CACF,CAAC;QACJ,CAAC;QAED,0FAA0F;QAC1F,YAAY;QACZ,EAAE;QACF,8FAA8F;QAC9F,8FAA8F;QAC9F,8FAA8F;QAC9F,kFAAkF;QAClF,+FAA+F;QAC/F,+EAA+E;QAC/E,EAAE;QACF,8FAA8F;QAC9F,+FAA+F;QAC/F,0FAA0F;QAC1F,+FAA+F;QAC/F,oCAAoC;QACpC,gBAAgB,CAAC,YAAY,CAAC,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;IAC9E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,KAAK,CAAC,gBAAgB;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,WAAW,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAClI,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAClC,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAC7D,8BAA8B,CAAC,4BAA4B,EAC3D,IAAI,GAAG,EAAE,EACT,EAAE,EACF,CAAE,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAE,EAC5G,EAAE,CACH,CAAC;QAEF,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC5F,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAAC,IAAI,CAAc,OAAO,EAAE,EAAG,CAAC,CAAC;QAE/E,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,2HAA2H;iBACrI;aACF,CACF,CAAC;QACJ,CAAC;QAED,OAAO,kBAAkB,CAAC,GAAG,CAAC;IAChC,CAAC;IAEM,KAAK,CAAC,sBAAsB,CACjC,MAAsC;QAGtC,IAAI,CAAC,QAAQ,CAAC,2BAA2B,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAC,mBAAmB,EAAE,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAC,kBAAkB,EAAE,MAAM,CAAC,SAAS,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAEtM,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAA6B,CAAC;QAEnH,MAAM,IAAI,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAEvE,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,+BAA+B,EACtC,MAAM,CAAC,YAAY,IAAI,EAAE,EAAE,2DAA2D;QACtF,MAAM,CAAC,cAAc,IAAI,EAAE,EAC3B,MAAM,CAAC,oBAAoB,IAAI,EAAE;QACjC,6FAA6F;QAC7F,gGAAgG;QAChG,6FAA6F;QAC7F,mEAAmE;QACnE,SAAS,EACT,CAAC,EACD,SAAS,EACT,IAAI,EACJ,MAAM,CAAC,gBAAgB,CACxB,CAAC;QAEF,IAAG,SAAS,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,WAAW,EAAE,CAAC;YACvE,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE,EAAE,aAAa,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,gBAAgB,CAAC,qBAAqB,EAAE,CAAC,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC,gBAAgB,CAAC,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QAEhT,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,qBAAqB;QACrB,IAAI,CAAC,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;QAEjD,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACK,yBAAyB,CAAC,gBAAuC;QACvE,IAAI,CAAC;YACH,0EAA0E;YAC1E,2EAA2E;YAC3E,0EAA0E;YAC1E,6EAA6E;YAC7E,oCAAoC;YACpC,IAAI,gBAAgB,CAAC,aAAa,KAAK,8BAA8B,CAAC,4BAA4B,EAAE,CAAC;gBACnG,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,MAAM,UAAU,GAA2B,EAAE,CAAC;YAC9C,IAAI,gBAAgB,CAAC,aAAa,EAAE,CAAC;gBACnC,UAAU,CAAC,qBAAqB,CAAC,GAAG,gBAAgB,CAAC,aAAa,CAAC;YACrE,CAAC;YACD,IAAI,gBAAgB,CAAC,cAAc,EAAE,CAAC;gBACpC,UAAU,CAAC,sBAAsB,CAAC,GAAG,gBAAgB,CAAC,cAAc,CAAC;YACvE,CAAC;YACD,IAAI,gBAAgB,CAAC,MAAM,EAAE,CAAC;gBAC5B,UAAU,CAAC,cAAc,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC;YACvD,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;QAC/E,CAAC;IACH,CAAC;IAGI,KAAK,CAAC,0BAA0B,CACrC,MAA6D;QAG7D,OAAO,IAAI,CAAC,sBAAsB,CAAC;YACjC,GAAG,MAAM;YACT,aAAa,EAAE,8BAA8B,CAAC,4BAA4B;SAC3E,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,KAAK,CAAC,iCAAiC,CAG5C,MAAsC;QAEtC,OAAO,IAAI,CAAC,sBAAsB,CAA2B,MAAM,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACI,KAAK,CAAC,oCAAoC,CAC/C,MAGC;QAED,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC;QACvE,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,yCAAyC,CAC3F,YAAY,EACZ,mBAAmB,CACpB,CAAC;QACF,OAAO,IAAI,CAAC,0BAA0B,CAA2B;YAC/D,GAAG,aAAa;YAChB,SAAS,EAAE,aAAa;SACzB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACI,KAAK,CAAC,iCAAiC,CAC5C,MAGC;QAED,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC;QACvE,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,8BAA8B,CAChF,YAAY,EACZ,mBAAmB,CACpB,CAAC;QACF,OAAO,IAAI,CAAC,0BAA0B,CAA2B;YAC/D,GAAG,aAAa;YAChB,SAAS,EAAE,aAAa;SACzB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACI,KAAK,CAAC,4BAA4B,CACvC,MAIC;QAED,MAAM,EAAE,qBAAqB,EAAE,+BAA+B,EAAE,oBAAoB,EAAE,GAAG,MAAM,CAAC;QAEhG,IAAI,qBAAqB,CAAC,IAAI,KAAK,uBAAuB,CAAC,cAAc,EAAE,CAAC;YAC1E,OAAO,IAAI,CAAC,yCAAyC,CAAC;gBACpD,qBAAqB;gBACrB,+BAA+B;gBAC/B,oBAAoB;aACrB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB;aACjD,oBAAoB,EAAE;aACtB,sBAAsB,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;QAEpE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,iBAAiB,qBAAqB,CAAC,mBAAmB,+BAA+B,qBAAqB,CAAC,kBAAkB,GAAG;oBAC7I,kBAAkB,EAAE,qBAAqB,CAAC,kBAAkB;oBAC5D,mBAAmB,EAAE,qBAAqB,CAAC,mBAAmB;iBAC/D;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,iBAAiB;YACjE,CAAC,CAAC,4BAA4B,CAAC,QAAQ;YACvC,CAAC,CAAC,4BAA4B,CAAC,SAAS,CAAC;QAE3C,MAAM,mBAAmB,GAAG,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACzE,SAAS,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,mBAAmB;eACxE,SAAS,CAAC,WAAW,KAAK,mBAAmB,CACjD,CAAC;QAEF,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,uDAAuD,qBAAqB,CAAC,kBAAkB,IAAI,qBAAqB,CAAC,mBAAmB,GAAG;oBACxJ,kBAAkB,EAAE,qBAAqB,CAAC,kBAAkB;oBAC5D,mBAAmB,EAAE,qBAAqB,CAAC,mBAAmB;oBAC9D,mBAAmB;oBACnB,YAAY,EAAE,mBAAmB,CAAC,MAAM;iBACzC;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,CAAC,CAAC;eAC5C,IAAI,CAAC,uCAAuC,CAAC,cAAc,EAAE,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;QAE7G,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC;YAC7D,SAAS,EAAE,kCAAkC,CAAC,oBAAoB,CAAC,kBAAkB,CAAC;YACtF,+BAA+B;YAC/B,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,IAAI,CAAC,yBAAyB,EAAE;YAChD,oBAAoB;SACrB,CAAC,CAAC;QAEH,MAAM,uBAAuB,GAAmD,mBAAmB,KAAK,4BAA4B,CAAC,QAAQ;YAC3I,CAAC,CAAC;gBACE,GAAG,kBAAkB;gBACrB,mBAAmB,EAAE,qBAAqB,CAAC,mBAAmB;gBAC9D,WAAW,EAAE,4BAA4B,CAAC,QAAQ;gBAClD,cAAc,EAAE,qBAAqB,CAAC,iBAAiB,IAAI,EAAE;gBAC7D,kBAAkB,EAAE,KAAK;gBACzB,KAAK,EAAE,EAAE;aACwC;YACrD,CAAC,CAAC;gBACE,GAAG,kBAAkB;gBACrB,mBAAmB,EAAE,qBAAqB,CAAC,mBAAmB;gBAC9D,WAAW,EAAE,4BAA4B,CAAC,SAAS;gBACnD,kBAAkB,EAAE,KAAK;gBACzB,KAAK,EAAE,EAAE;aACwC,CAAC;QAExD,OAAO,gBAAgB,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACK,KAAK,CAAC,yCAAyC,CACrD,MAOC;QAED,MAAM,EAAE,qBAAqB,EAAE,+BAA+B,EAAE,oBAAoB,EAAE,GAAG,MAAM,CAAC;QAEhG,MAAM,sBAAsB,GAAG,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CAClF,gBAAgB,CAAC,WAAW,EAC5B,qBAAqB,CAAC,IAAI,CAC3B,CAAC;QACF,MAAM,kBAAkB,GAAG,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,CAAC;QAEtG,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC;YAC7D,SAAS,EAAE,kCAAkC,CAAC,oBAAoB,CAAC,kBAAkB,CAAC;YACtF,+BAA+B;YAC/B,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,IAAI,CAAC,yBAAyB,EAAE;YAChD,oBAAoB;SACrB,CAAC,CAAC;QAEH,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,iBAAiB;YACjE,CAAC,CAAC,4BAA4B,CAAC,QAAQ;YACvC,CAAC,CAAC,4BAA4B,CAAC,SAAS,CAAC;QAE3C,MAAM,uBAAuB,GAAmD,mBAAmB,KAAK,4BAA4B,CAAC,QAAQ;YAC3I,CAAC,CAAC;gBACE,GAAG,kBAAkB;gBACrB,mBAAmB,EAAE,qBAAqB,CAAC,mBAAmB;gBAC9D,WAAW,EAAE,4BAA4B,CAAC,QAAQ;gBAClD,cAAc,EAAE,qBAAqB,CAAC,iBAAiB,IAAI,EAAE;gBAC7D,oBAAoB,EAAE,qBAAqB,CAAC,YAAY;gBACxD,kBAAkB,EAAE,KAAK;gBACzB,KAAK,EAAE,EAAE;aACwC;YACrD,CAAC,CAAC;gBACE,GAAG,kBAAkB;gBACrB,mBAAmB,EAAE,qBAAqB,CAAC,mBAAmB;gBAC9D,WAAW,EAAE,4BAA4B,CAAC,SAAS;gBACnD,oBAAoB,EAAE,qBAAqB,CAAC,YAAY;gBACxD,kBAAkB,EAAE,KAAK;gBACzB,KAAK,EAAE,EAAE;aACwC,CAAC;QAExD,OAAO,gBAAgB,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC;IACjE,CAAC;IAGD,KAAK,CAAC,wBAAwB,CAC5B,MAA6D;QAG7D,OAAO,IAAI,CAAC,sBAAsB,CAAC;YACjC,GAAG,MAAM;YACT,aAAa,EAAE,8BAA8B,CAAC,gBAAgB;SAC/D,CAAC,CAAC;IACL,CAAC;IAID;;;;;;OAMG;IACI,KAAK,CAAC,gCAAgC;QAC3C,2DAA2D;QAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CACzE,gBAAgB,CAAC,WAAW,EAC5B,qBAAqB,CAAC,IAAI,CAC3B,CAAC;QACF,MAAM,eAAe,GAAG,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;QAE1F,OAAO,IAAI,CAAC,0BAA0B,CAAC;YACrC,SAAS,EAAE,eAAe;YAC1B,+BAA+B,EAAE,IAAI,GAAG,EAAE;YAC1C,YAAY,EAAE,IAAI,EAAE,+BAA+B;YACnD,cAAc,EAAE,IAAI,CAAC,yBAAyB,EAAE;YAChD,oBAAoB,EAAE,EAAE;SACzB,CAAC,CAAC;IACL,CAAC;IAEO,uCAAuC,CAC7C,cAAwC,EACxC,mBAA2B;QAE3B,MAAM,wBAAwB,GAAG,cAAc,CAAC,UAAU,CAAC,MAAM,CAC/D,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,mBAAmB,KAAK,mBAAmB,CACrE,CAAC;QAEF,+FAA+F;QAC/F,6FAA6F;QAC7F,0FAA0F;QAC1F,sCAAsC;QACtC,EAAE;QACF,wFAAwF;QACxF,gGAAgG;QAChG,4FAA4F;QAC5F,kGAAkG;QAClG,4FAA4F;QAC5F,kGAAkG;QAClG,EAAE;QACF,yFAAyF;QACzF,iGAAiG;QACjG,iGAAiG;QACjG,0EAA0E;QAC1E,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,MAAM,CACvD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,kBAAkB,KAAK,IAAI,CACrD,CAAC;YACF,MAAM,gBAAgB,GAAG,uCAAuC;iBAC7D,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;iBAC5G,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAChD,IAAI,gBAAgB,EAAE,CAAC;gBACrB,OAAO,gBAAgB,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,kHAAkH;oBAC3H,kBAAkB,EAAE,cAAc,CAAC,kBAAkB;oBACrD,mBAAmB;oBACnB,iBAAiB,EAAE,wBAAwB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;wBAC9D,WAAW,EAAE,SAAS,CAAC,WAAW;wBAClC,UAAU,EAAE,SAAS,CAAC,UAAU;wBAChC,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;qBACjD,CAAC,CAAC;iBACJ;aACF,CACF,CAAC;QACJ,CAAC;QACD,MAAM,uBAAuB,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;QAE5D,IAAI,uBAAuB,EAAE,CAAC;YAC5B,OAAO,uBAAuB,CAAC;QACjC,CAAC;QAED,MAAM,qBAAqB,GAAG,cAAc,CAAC,UAAU,CAAC,MAAM,CAC5D,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI;eACtE,SAAS,CAAC,kBAAkB,KAAK,IAAI,CAC3C,CAAC;QACF,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,4FAA4F;oBACrG,kBAAkB,EAAE,cAAc,CAAC,kBAAkB;oBACrD,mBAAmB;oBACnB,iBAAiB,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;wBAC3D,WAAW,EAAE,SAAS,CAAC,WAAW;wBAClC,UAAU,EAAE,SAAS,CAAC,UAAU;qBACjC,CAAC,CAAC;iBACJ;aACF,CACF,CAAC;QACJ,CAAC;QACD,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAEtD,IAAI,oBAAoB,EAAE,CAAC;YACzB,OAAO,oBAAoB,CAAC;QAC9B,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;YACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACP,OAAO,EAAE,iBAAiB,mBAAmB,6DAA6D,cAAc,CAAC,kBAAkB,gEAAgE;gBAC3M,kBAAkB,EAAE,cAAc,CAAC,kBAAkB;gBACrD,mBAAmB;aACpB;SACF,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,wBAAwB,CACnC,aAKC,EACD,WAKC;QAED,8DAA8D;QAC9D,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CACzE,gBAAgB,CAAC,WAAW,EAC5B,qBAAqB,CAAC,IAAI,CAC3B,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;QAEpF,gDAAgD;QAChD,MAAM,YAAY,GAAkC;YAClD,aAAa,EAAE,aAAa,CAAC,aAAa;YAC1C,cAAc,EAAE,aAAa,CAAC,cAAc;YAC5C,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,iBAAiB,EAAE,WAAW,CAAC,WAAW;SAC3C,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,8BAA8B,CAAC,gBAAgB,EAC/C,IAAI,GAAG,EAAE,EACT,YAAY,EACZ,EAAE,EAAE,+DAA+D;QACnE,EAAE,CACH,CAAC;QAEF,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,CAAC,CAAC;QAE3D,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,6BAA6B,CACxC,oBAAwC,EACxC,iBAAqC;QAErC,oDAAoD;QACpD,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAE7E,wDAAwD;QACxD,IAAI,CAAC,oBAAoB,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAChD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE,EAAE,OAAO,EAAE,oEAAoE,EAAE;aAC3F,CACF,CAAC;QACJ,CAAC;QAED,uBAAuB;QACvB,MAAM,OAAO,GAAG,0BAA0B,CAAC,+BAA+B,CAAC,oBAAoB,CAAC,CAAC;QACjG,MAAM,aAAa,GAAG,0BAA0B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,CAAC;QAE7F,uCAAuC;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;QAEpF,mEAAmE;QACnE,oIAAoI;QACpI,+EAA+E;QAC/E,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC;QACtD,IAAI,OAAO,CAAC,+BAA+B,EAAE,CAAC;YAC5C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBAC/E,wFAAwF;gBACxF,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBAClE,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;QACL,CAAC;QAED,+BAA+B;QAC/B,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;QAEhE,gEAAgE;QAChE,IAAI,OAAO,CAAC,aAAa,KAAK,8BAA8B,CAAC,4BAA4B,EAAE,CAAC;YAC1F,OAAO,IAAI,CAAC,0BAA0B,CAAC;gBACrC,SAAS;gBACT,+BAA+B,EAAE,mBAAmB;gBACpD,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,oBAAoB;aACrB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,CAAC,aAAa,KAAK,8BAA8B,CAAC,gBAAgB,EAAE,CAAC;YACrF,OAAO,IAAI,CAAC,wBAAwB,CAAC;gBACnC,SAAS;gBACT,+BAA+B,EAAE,mBAAmB;gBACpD,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,oBAAoB;aACrB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,CAAC,aAAa,KAAK,8BAA8B,CAAC,iBAAiB,EAAE,CAAC;YACtF,iGAAiG;YACjG,OAAO,IAAI,CAAC,sBAAsB,CAAC;gBACjC,aAAa,EAAE,8BAA8B,CAAC,iBAAiB;gBAC/D,SAAS;gBACT,+BAA+B,EAAE,mBAAmB;gBACpD,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;gBAC5I,oBAAoB;aACrB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,CAAC,aAAa,KAAK,8BAA8B,CAAC,gBAAgB,EAAE,CAAC;YACrF,2EAA2E;YAC3E,OAAO,IAAI,CAAC,wBAAwB,CAClC;gBACE,aAAa,EAAE,OAAO,CAAC,YAAY,EAAE,aAAa;gBAClD,cAAc,EAAE,OAAO,CAAC,YAAY,EAAE,cAAc;gBACpD,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,MAAM;aACrC,EACD;gBACE,WAAW,EAAE,OAAO,CAAC,YAAY,EAAE,iBAAiB,IAAI,SAAS;gBACjE,WAAW,EAAE,eAAe;gBAC5B,OAAO,EAAE,eAAe;gBACxB,SAAS,EAAE,eAAe;aAC3B,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,2DAA2D;YAC3D,OAAO,IAAI,CAAC,sBAAsB,CAAC;gBACjC,aAAa,EAAE,OAAO,CAAC,aAA+C;gBACtE,SAAS;gBACT,+BAA+B,EAAE,mBAAmB;gBACpD,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,oBAAoB;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,kCAAkC,CACxC,SAA0D,EAC1D,YAA0B;QAE1B,+FAA+F;QAC/F,gGAAgG;QAChG,kGAAkG;QAClG,uFAAuF;QACvF,MAAM,mBAAmB,GAAG,IAAI,CAAC,wBAAwB,CAAC,2BAA2B,EAAE,CAAC,YAAY,CAAC,CAAC;QACtG,IAAI,CAAC,mBAAmB,EAAE,UAAU,IAAI,CAAC,IAAI,CAAC,uBAAuB;YAAE,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAEjG,MAAM,2BAA2B,GAAG,mBAAmB,CAAC,oBAAoB;YAC1E,CAAC,CAAC,iCAAiC,CAAC,mBAAmB,CAAC,oBAAoB,CAAC;YAC7E,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8C,CAAC;QACvE,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,IAAI,CAAC,uBAAuB;iBAC5C,iCAAiC,CAAC,mBAAmB,CAAC,UAAU,EAAE,eAAe,CAAC;iBAClF,MAAM,GAAG,CAAC,CAAC;YACd,IAAI,UAAU,IAAI,eAAe,KAAK,2BAA2B,EAAE,CAAC;gBAClE,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,QAAQ,CAAC,mFAAmF,EAAE;gBACjG,YAAY;gBACZ,OAAO;gBACP,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,gBAAgB,CACpB,aAAoC,EACpC,YAA0B,EAC1B,mBAA0C,EAC1C,OAAwB,EACxB,UAAmB,EACnB,mBAA0D;QAG1D,oCAAoC;QACpC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,6GAA6G;iBACvH;aACF,CACF,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,MAAM,YAAY,GAAG,aAAa,CAAC,eAAe,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,EAAE,CAAC;QACrB,IAAI,YAAY,IAAI,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,aAAa,EACb;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,uBAAuB,SAAS,2CAA2C;oBACpF,YAAY;oBACZ,mBAAmB;oBACnB,YAAY;iBACb;aACF,CACF,CAAC;QACJ,CAAC;QAED,mGAAmG;QACnG,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,GAAG,YAAY,IAAI,UAAU,EAAE,CAAC;YACjD,IAAI,aAAa,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,aAAa,EACb;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACP,OAAO,EAAE,iCAAiC,QAAQ,iCAAiC;wBACnF,QAAQ;wBACR,YAAY;wBACZ,mBAAmB;qBACpB;iBACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,oDAAoD;QACpD,0EAA0E;QAC1E,6EAA6E;QAC7E,iEAAiE;QACjE,2FAA2F;QAC3F,kEAAkE;QAClE,EAAE;QACF,kFAAkF;QAClF,IAAI,mBAAmB,KAAK,qBAAqB,CAAC,MAAM,IAAI,mBAAmB,EAAE,CAAC;YAChF,MAAM,qBAAqB,GAAG,aAAa,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;YAC5F,IAAI,qBAAqB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBACjD,MAAM,gBAAgB,GAAG,CAAC,GAAG,qBAAqB,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC9E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,QAAQ,EAClB,aAAa,EACb;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACP,OAAO,EAAE,wDAAwD,YAAY,sEAAsE,gBAAgB,EAAE;wBACrK,YAAY;wBACZ,mBAAmB;wBACnB,gBAAgB;qBACjB;iBACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,2EAA2E;QAC3E,+CAA+C;QAC/C,EAAE;QACF,4EAA4E;QAC5E,sEAAsE;QACtE,6EAA6E;QAC7E,yEAAyE;QACzE,yEAAyE;QACzE,6EAA6E;QAC7E,+DAA+D;QAC/D,IAAI,aAA4D,CAAC;QACjE,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;YACxB,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,YAAY,EAAE,mBAAmB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/H,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;QAClH,CAAC;QAED,qCAAqC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;QAEpF,qGAAqG;QACrG,EAAE;QACF,iGAAiG;QACjG,kGAAkG;QAClG,gGAAgG;QAChG,wFAAwF;QACxF,EAAE;QACF,8FAA8F;QAC9F,oGAAoG;QACpG,gGAAgG;QAChG,kDAAkD;QAClD,EAAE;QACF,8FAA8F;QAC9F,gGAAgG;QAChG,uFAAuF;QACvF,gGAAgG;QAChG,+FAA+F;QAC/F,kEAAkE;QAClE,MAAM,+BAA+B,GAAG,IAAI,CAAC,kCAAkC,CAC7E,aAAa,CAAC,qBAAqB,EAAqD,EACxF,YAAY,CACb,CAAC;QACF,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,IAAI,CAAC,wBAAwB,CAAC,8BAA8B,EAAE,CAAC;YACnF,MAAM,eAAe,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;YAClD,IAAI,eAAe,EAAE,CAAC;gBACpB,+BAA+B,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,yFAAyF;QACzF,EAAE;QACF,iGAAiG;QACjG,+FAA+F;QAC/F,+FAA+F;QAC/F,+FAA+F;QAC/F,8EAA8E;QAC9E,EAAE;QACF,wFAAwF;QACxF,sGAAsG;QACtG,kDAAkD;QAClD,MAAM,oBAAoB,GAAG,CAAC,GAAG,aAAa,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE;YACxF,IAAI,CAAC,SAAS,CAAC,iBAAiB;gBAAE,OAAO,IAAI,CAAC;YAC9C,OAAO,IAAI,CAAC,kCAAkC,CAC5C,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,iBAA4C,EAAE,EAAE,CAAC,CAAC,CAAC,EACvE,YAAY,CACb,CAAC,IAAI,GAAG,CAAC,CAAC;QACb,CAAC,CAAC,CAAC;QACH,IAAI,mBAAmB,EAAE,CAAC;YACxB,oBAAoB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACjD,CAAC;QAED,oEAAoE;QACpE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAS,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC;QAC9E,IAAI,UAAU,EAAE,CAAC;YACf,gBAAgB,CAAC,GAAG,CAAC,GAAG,YAAY,IAAI,UAAU,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,+CAA+C;QAC/C,sEAAsE;QACtE,MAAM,cAAc,GAAG,IAAI,gBAAgB,CACzC,SAAS,EACT,aAAa,CAAC,aAAa,EAAY,wBAAwB;QAC/D,+BAA+B,EAAQ,2BAA2B;QAClE,aAAa,CAAC,YAAY,EAAa,0CAA0C;QACjF,CAAC,GAAG,aAAa,CAAC,cAAc,CAAC,EAAM,gCAAgC;QACvE,oBAAoB,EAAmB,wCAAwC;QAC/E,aAAa,CAAC,aAAa,EAAc,+BAA+B;QACxE,YAAY,GAAG,CAAC,EAAuB,iCAAiC;QACxE,gBAAgB,EAAuB,oCAAoC;QAC3E,aAAa,CAAC,cAAc,EAAW,mCAAmC;QAC1E,iGAAiG;QACjG,gGAAgG;QAChG,gGAAgG;QAChG,wFAAwF;QACxF,aAAa,CAAC,gBAAgB,CAC/B,CAAC;QACF,kGAAkG;QAClG,gGAAgG;QAChG,oGAAoG;QACpG,kGAAkG;QAClG,+FAA+F;QAC/F,IAAI,aAAa,CAAC,eAAe,EAAE,CAAC;YAClC,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QACD,4FAA4F;QAC5F,kGAAkG;QAClG,0FAA0F;QAC1F,6FAA6F;QAC7F,8FAA8F;QAC9F,cAAc,CAAC,sCAAsC,CAAC,aAAa,CAAC,CAAC;QACrE,OAAO,cAAc,CAAC;IACxB,CAAC;IAEM,KAAK,CAAC,iCAAiC,CAK5C,GAAY,EACZ,SAAiG,EACjG,aAA+D;QAG/D,IAAI,CAAC,QAAQ,CAAC,yCAAyC,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,mBAAmB,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAEzI,yCAAyC;QACzC,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,EAAE,gBAAsC,CAAC;QACrE,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,gBAAgB,CAAuB,CAAC;QACxF,MAAM,eAAe,GAAG,qBAAqB,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,MAAM,MAAM,GAAG,eAAe,EAAE,MAAM,CAAC;QAEvC,iGAAiG;QACjG,iGAAiG;QACjG,gGAAgG;QAChG,qGAAqG;QACrG,uGAAuG;QACvG,kGAAkG;QAClG,MAAM,gBAAgB,GAAG,UAAU,IAAI,CAAC,MAAM,KAAK,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAEpH,4DAA4D;QAC5D,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,wDAAwD;gBACxD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2CAA2C;oBAC/F,OAAO,EAAE,EAAE,mBAAmB,EAAE,SAAS,CAAC,mBAAmB,EAAE;iBAChE,CAAC,CAAC;YACL,CAAC;YAED,IAAI,MAAM,KAAK,yBAAyB,CAAC,WAAW,EAAE,CAAC;gBACrD,IAAI,CAAC,QAAQ,CAAC,wEAAwE,CAAC,CAAC;gBAExF,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,IAAI,EAAE,CAAC;gBAClD,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAC3E,gBAAgB,EAChB,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CACrD,CAAC;gBAEF,0EAA0E;gBAC1E,MAAM,YAAY,GAA2B,EAAE,CAAC;gBAChD,IAAI,qBAAqB,CAAC,cAAc,EAAE,CAAC;oBACzC,YAAY,CAAC,cAAc,GAAG,qBAAqB,CAAC,cAAc,CAAC;gBACrE,CAAC;gBACD,IAAI,qBAAqB,CAAC,SAAS,EAAE,CAAC;oBACpC,MAAM,uBAAuB,GAAG,IAAI,CAAC,8BAA8B,CAAC,SAAS,CAAC,CAAC;oBAC/E,IAAI,uBAAuB,EAAE,CAAC;wBAC5B,YAAY,CAAC,uBAAuB,CAAC,GAAG,qBAAqB,CAAC,SAAS,CAAC;oBAC1E,CAAC;gBACH,CAAC;gBACD,IAAI,qBAAqB,CAAC,MAAM,EAAE,CAAC;oBACjC,YAAY,CAAC,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC;gBACrD,CAAC;gBAED,MAAM,4BAA4B,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;gBACvG,MAAM,oBAAoB,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC;gBAEzG,MAAM,YAAY,GAAG;oBACnB,iBAAiB,EAAE,qBAAqB,CAAC,GAAG;oBAC5C,cAAc,EAAE,qBAAqB,CAAC,cAAc;oBACpD,MAAM,EAAE,qBAAqB,CAAC,MAAM;oBACpC,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC;iBAC1D,CAAC;gBAEF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,8BAA8B,CAAC,gBAAgB,EAC/C,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,EACrD,YAAY,EACZ,qBAAqB,CAAC,KAAK,IAAI,EAAE,EACjC,oBAAoB,CACrB,CAAC;gBAEF,gBAAgB,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;gBAE3D,IAAI,SAAS,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,WAAW,EAAE,CAAC;oBACxE,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,CAAC,CAAC;gBAC7D,CAAC;gBAED,OAAO,gBAAgB,CAAC;YAC1B,CAAC;YAED,yEAAyE;QAC3E,CAAC;QAED,6CAA6C;QAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAuB,CAAC;QAEpF,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,gBAAoD,CAAC;YAEzD,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnC,gBAAgB,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YACtG,CAAC;iBAAM,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChF,0EAA0E;gBAC1E,8EAA8E;gBAC9E,+GAA+G;gBAC/G,kFAAkF;gBAClF,kFAAkF;gBAClF,+EAA+E;gBAC/E,gBAAgB,GAAG,MAAM,IAAI,CAAC,qCAAqC,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YACjH,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;gBAChD,gBAAgB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;gBAE5F,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAuB,CAAC;gBACpF,IAAI,WAAW,EAAE,CAAC;oBAChB,gBAAgB,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;YAED,kEAAkE;YAClE,IAAI,MAAM,KAAK,yBAAyB,CAAC,QAAQ,EAAE,CAAC;gBAClD,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uBAAuB;wBAC3E,OAAO,EAAE,EAAE,mBAAmB,EAAE,SAAS,CAAC,mBAAmB,EAAE;qBAChE,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,aAAa,GAAG,eAAgB,CAAC,KAAK,IAAI,EAAE,CAAC;gBACnD,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAC3E,WAAW,EACX,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CACrD,CAAC;gBAEF,IAAI,qBAAqB,CAAC,MAAM,IAAI,gBAAgB,CAAC,YAAY,EAAE,MAAM;uBACpE,qBAAqB,CAAC,MAAM,KAAK,gBAAgB,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;oBAC3E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;wBACrF,OAAO,EAAE,EAAE,mBAAmB,EAAE,SAAS,CAAC,mBAAmB,EAAE;qBAChE,CAAC,CAAC;gBACL,CAAC;gBAED,gBAAgB,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC;YACxD,CAAC;YAED,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,mFAAmF;QACnF,IAAI,MAAM,KAAK,yBAAyB,CAAC,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uBAAuB;gBAC3E,OAAO,EAAE,EAAE,mBAAmB,EAAE,SAAS,CAAC,mBAAmB,EAAE;aAChE,CAAC,CAAC;QACL,CAAC;QAED,kFAAkF;QAClF,MAAM,qBAAqB,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAuB,CAAC;QACnG,IAAI,qBAAqB,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,oCAAoC,CAAC,qBAAqB,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QACzG,CAAC;QAED,kFAAkF;QAClF,MAAM,sBAAsB,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,sBAAsB,CAAuB,CAAC;QACzG,IAAI,sBAAsB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,0BAA0B,CAAC,sBAAsB,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAChG,CAAC;QAED,wFAAwF;QACxF,IAAI,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,mCAAmC,CAAC,SAAS,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QACjF,CAAC;QAED,uEAAuE;QACvE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC,EAAE,CAAC,CAAC;IACvG,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACI,KAAK,CAAC,yCAAyC,CAAC,GAAY;QACjE,IAAI,CAAC,QAAQ,CAAC,kDAAkD,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAExG,kCAAkC;QAClC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAW,CAAC;QACxE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC,EAAE,CAClG,CAAC;QACJ,CAAC;QAED,kGAAkG;QAClG,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CACzE,gBAAgB,CAAC,WAAW,EAC5B,qBAAqB,CAAC,IAAI,CAC3B,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;QACpF,MAAM,WAAW,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAE7D,mCAAmC;QACnC,MAAM,WAAW,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,0FAA0F;YAC1F,4FAA4F;YAC5F,yCAAyC;YACzC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;YAC7C,MAAM,kCAAkC,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;YAE5I,IAAI,CAAC;gBACH,kEAAkE;gBAClE,8EAA8E;gBAC9E,IAAI,WAAW,KAAK,WAAW,CAAC,YAAY,EAAE,CAAC;oBAC7C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;qBAC/E,CACF,CAAC;gBACJ,CAAC;gBACD,iDAAiD;gBACjD,MAAM,mBAAmB,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;gBAC3G,8EAA8E;gBAC9E,2EAA2E;gBAC3E,mDAAmD;gBACnD,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAoB,WAAW,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;gBAExH,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;oBACvG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,CAC1H,CAAC;gBACJ,CAAC;gBAED,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,8BAA8B,CAAC,mBAAmB,EAClD,IAAI,GAAG,EAAE,EACT,EAAE,iBAAiB,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,GAAG,EAAE,EAAE,EAC7F,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,iBAAiB,EAAE,SAAS,CAAC,aAAa,EAAE,CAAC,EACrI,EAAE,CACH,CAAC;gBACF,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;gBACjE,OAAO,gBAAgB,CAAC;YAC1B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,mCAAmC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAChE,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAEhD,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,gCAAgC,CAAC,KAAK,CAAC,CAAC;YACtF,MAAM,YAAY,GAAG,wBAAwB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YACrE,4FAA4F;YAC5F,4FAA4F;YAC5F,oFAAoF;YACpF,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC;YAEpC,IAAI,YAAY,CAAC,IAAI,KAAK,8BAA8B,CAAC,YAAY,EAAE,CAAC;gBACtE,MAAM,YAAY,GAAG,YAAY,CAAC;gBAClC,qEAAqE;gBACrE,+DAA+D;gBAC/D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,kCAAkC,CAC5D,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,GAAyB,CAC/E,CAAC;gBACF,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;wBACnF,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;qBACzC,CAAC,CAAC;gBACL,CAAC;gBACD,iGAAiG;gBACjG,iGAAiG;gBACjG,2EAA2E;gBAC3E,4CAA4C;gBAC5C,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,MAAM,gCAAgC,CAC1E,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,GAAyB,CAClF,CAAC;gBACF,IAAI,cAAc,EAAE,CAAC;oBACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;wBACnF,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE;qBAC3C,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAC3D,YAAY,CAAC,MAAM,EACnB,WAAW,EACX,YAAY,CAAC,oBAAoB,CAClC,CAAC;gBACF,MAAM,cAAc,GAAG,IAAI,CAAC,qCAAqC,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;gBAEvF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,8BAA8B,CAAC,YAAY,EAC3C,IAAI,GAAG,EAAE,EACT;oBACE,MAAM,EAAE,YAAY,CAAC,MAAM;oBAC3B,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9C,EACD,cAAc,EACd,EAAE,EACF,SAAS,EAAE,gBAAgB;gBAC3B,CAAC,EAAU,eAAe;gBAC1B,SAAS,EAAE,mBAAmB;gBAC9B,YAAY,CAAC,cAAc,IAAI,IAAI,CACpC,CAAC;gBACF,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,CAAC,CAAC;gBAC3D,OAAO,gBAAgB,CAAC;YAC1B,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,CAC7G,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,+BAA+B,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kGAAkG,EAAE;oBACpH,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;oBACpD,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,IAAI,EAAE,GAAG,CAAC,WAAW;iBACtB,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE;oBAC9D,KAAK,EAAE,KAAK,CAAC,sBAAsB;oBACnC,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,IAAI,EAAE,GAAG,CAAC,WAAW;iBACtB,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,KAAK,CAAC,CAAC,yBAAyB;YACxC,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,CAChJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,qCAAqC,CAC3C,GAAY,EACZ,cAA2C;QAE3C,MAAM,wBAAwB,GAAG;YAC/B,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAA4B,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;SAC7G,CAAC;QAEF,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,UAAU,EACpB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;gBAC7F,OAAO,EAAE;oBACP,eAAe,EAAE,gBAAgB;oBACjC,MAAM,EAAE,wBAAwB;oBAChC,OAAO,EAAE;wBACP,SAAS,EAAE,CAAC,WAAW,CAAC;wBACxB,WAAW,EAAE,wBAAwB;wBACrC,UAAU,EAAE,CAAC,WAAW,CAAC;wBACzB,WAAW,EAAE,CAAC,WAAW,CAAC;qBAC3B;iBACF;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,yBAAyB,GAAG;YAChC,GAAG,IAAI,GAAG,CACR,cAAc,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,aAAa,IAAI,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;iBACrI,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,iBAA2B,CAAC,CAC3D;SACF,CAAC;QAEF,MAAM,uBAAuB,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,uBAAuB,EAAE,CAAC;YAC5B,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;oBAChF,OAAO,EAAE;wBACP,wBAAwB;wBACxB,cAAc,EAAE,uBAAuB;qBACxC;iBACF,CACF,CAAC;YACJ,CAAC;YACD,OAAO,uBAAuB,CAAC;QACjC,CAAC;QAED,OAAO,yBAAyB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACK,KAAK,CAAC,qCAAqC,CAAC,QAA4B;QAC9E,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,oCAAoC,CAAC;gBACjE,YAAY,EAAE,gBAAgB,CAAC,0BAA0B;gBACzD,mBAAmB,EAAE,qBAAqB,CAAC,IAAI;aAChD,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB;iBAC3C,aAAa,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;iBAC1D,IAAI,CAA0B,UAAU,EAAE,QAAQ,CAAC,CAAC;YACvD,oFAAoF;YACpF,OAAO,MAAM,EAAE,cAAc,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qGAAqG,EAAE;gBACtH,QAAQ;gBACR,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE,EAAE,MAAM,EAAE,uCAAuC,EAAE;aAC7D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,iCAAiC,CACvC,uBAA2C,EAC3C,cAA2C,EAC3C,2BAA8D;QAE9D,MAAM,yBAAyB,GAAG;YAChC,GAAG,IAAI,GAAG,CACR,cAAc,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,aAAa,IAAI,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;iBACrI,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,iBAA2B,CAAC,CAC3D;SACF,CAAC;QAEF,IAAI,uBAAuB,IAAI,yBAAyB,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC3F,OAAO,uBAAuB,CAAC;QACjC,CAAC;QAED,iGAAiG;QACjG,uFAAuF;QACvF,IAAI,uBAAuB,IAAI,2BAA2B,KAAK,iCAAiC,CAAC,aAAa,EAAE,CAAC;YAC/G,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,yBAAyB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,CAAC;IAEO,wBAAwB,CAK9B,SAAiG;QAEjG,OAAO,IAAI,gBAAgB,CAAE,SAAS,EAAE,8BAA8B,CAAC,4BAA4B,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAChI,CAAC;IAED;;;;;;;;;;OAUG;IACK,yBAAyB,CAC/B,aAA+D,EAC/D,eAAuC;QAEvC,MAAM,oBAAoB,GAA2C,EAAE,CAAC;QAExE,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;YAC9B,OAAO,oBAAoB,CAAC;QAC9B,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YACrD,IAAI,KAAK,EAAE,CAAC;gBACV,oBAAoB,CAAC,IAAI,CAAC;oBACxB,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;oBAC1C,UAAU,EAAE,KAAK;oBACjB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;iBACzC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED;;;;;;;;OAQG;IACK,qBAAqB,CAAC,MAA0C,EAAE,eAAuB;QAC/F,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,kEAAkE;QAClE,MAAM,WAAW,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;OAWG;IACK,uBAAuB,CAAC,KAA0B,EAAE,eAAuB;QACjF,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,yBAAyB;QACzB,MAAM,WAAW,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/B,8EAA8E;gBAC9E,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,2DAA2D;gBAC3D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YAChE,IAAI,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/B,2DAA2D;oBAC3D,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7E,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;OAQG;IACK,sBAAsB,CAAC,IAAS,EAAE,eAAuB;QAC/D,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,yBAAyB;QACzB,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAC/D,IAAI,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7E,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;OAUG;IACK,uBAAuB,CAAC,YAAiC,EAAE,eAAuB;QACxF,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,yBAAyB;QACzB,MAAM,WAAW,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;YACvE,IAAI,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7E,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,GAAQ,EAAE,IAAY;QAC3C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,OAAO,GAAG,GAAG,CAAC;QAElB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC7E,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,qBAAqB,CAAC,KAAU;QACtC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;IAC/D,CAAC;IAED;;;OAGG;IACK,aAAa,CAAC,KAAU;QAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,gFAAgF;QAChF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAEO,0BAA0B,CAChC,GAAY,EACZ,aAA+D,EAC/D,YAAoC;QAGpC,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE,EAAE,UAAU,EAAE,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAE7H,MAAM,4BAA4B,GAA2B,EAAE,CAAC;QAEhE,IAAI,CAAC,aAAa,CAAC,UAAU,IAAI,aAAa,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvE,OAAO,4BAA4B,CAAC;QACtC,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;YACjD,MAAM,eAAe,GAAG,SAAS,CAAC,eAAe,CAAC;YAElD,0DAA0D;YAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAA4C,EAAE,eAAe,CAAC,CAAC;YAChH,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAC1E,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;YAEhF,MAAM,OAAO,GAAG;gBACd,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;gBACvD,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;gBAC7D,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;gBAC1D,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;aAC9D,CAAC;YAEF,gDAAgD;YAChD,MAAM,SAAS,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,WAAW,EAAE,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC;iBAC5E,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAE1D,gDAAgD;YAChD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,UAAU,EAAE,SAAS,EACjE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;oBACxF,OAAO,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,CAAE,CAAC;YAChD,CAAC;YAED,mCAAmC;YACnC,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;YAC7C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAE,yCAAyC;gBACvE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,UAAU,EAAE,SAAS,EACjE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;oBAC7F,OAAO,EAAE,EAAG,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,CAAE,CAAC;YACvE,CAAC;YAED,qEAAqE;YACrE,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,uBAAuB,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAChE,CAAC;YAED,6BAA6B;YAC7B,IAAI,KAAK,EAAE,CAAC;gBACV,4BAA4B,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC;YACxD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,2CAA2C,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAG,CAAC,CAAC;QAE5H,OAAO,4BAA4B,CAAC;IACtC,CAAC;IAID;;OAEG;IACK,uBAAuB,CAAC,eAAuB,EAAE,KAAa,EAAE,OAAa;QACnF,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAC,CAAC;YAClF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,UAAU,EAAE,SAAS,EACjE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;gBACxF,OAAO,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAE,CAAC;QACvD,CAAC;QAED,0EAA0E;QAC1E,IAAI,eAAe,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,UAAU,EAAE,SAAS,EACjE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,wCAAwC;oBAC5F,OAAO,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,EAAE,CAAE,CAAC;YACnG,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,UAAU,EAAE,SAAS,EACjE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,wCAAwC;gBAC5F,OAAO,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAE,CAAC;QACvE,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,UAAkB;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;QAElC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,CAAE,CAAC;QACpH,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,0BAA0B;QAErE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,CAAE,CAAC;QACpH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,oCAAoC,CAChD,YAAoB,EACpB,GAAY,EACZ,SAAyD,EACzD,aAA+D;QAG/D,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,mBAAmB,EAAE,CAAC,CAAC;QAE7G,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,EAAE,CAAC;YACpD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;aAC9F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAa,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;gBAC7F,OAAO,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,mBAAmB,EAAE,EAAE,wBAAwB;aAClF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,uBAAuB,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAClE,MAAM,EAAE,eAAe,EAAE,GAAG,uBAAuB,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACrF,wGAAwG;QACxG,uGAAuG;QACvG,yGAAyG;QACzG,sGAAsG;QACtG,yGAAyG;QACzG,2EAA2E;QAC3E,MAAM,uBAAuB,CAAC,+BAA+B,CAAC,eAAe,CAAC,CAAC;QAE/E,MAAM,YAAY,GAA2B,EAAE,eAAe,EAAE,CAAC;QACjE,MAAM,4BAA4B,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;QAEvG,MAAM,oBAAoB,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC;QAEzG,iFAAiF;QACjF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAEpD,MAAM,YAAY,GAAkC;YAClD,eAAe;YACf,aAAa;YACb,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC;SAC1D,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,8BAA8B,CAAC,iBAAiB,EAChD,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,EACrD,YAAY,EACZ,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC,EAClG,oBAAoB,CACrB,CAAC;QAEF,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,0BAA0B,CACtC,eAAuB,EACvB,GAAY,EACZ,SAAyD,EACzD,aAA+D;QAG/D,IAAI,CAAC,QAAQ,CAAC,mCAAmC,EAAE,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,CAAC,mBAAmB,EAAE,CAAC,CAAC;QAEpH,IAAI,CAAC,uBAAuB,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;QAEjE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,EAAE,CAAC;YACpD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;aAC9F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAa,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;gBAC7F,OAAO,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,mBAAmB,EAAE,EAAE,wBAAwB;aAClF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAA2B,EAAE,eAAe,EAAE,CAAC;QACjE,MAAM,4BAA4B,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;QAEvG,MAAM,oBAAoB,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC;QAEzG,iFAAiF;QACjF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAEpD,MAAM,YAAY,GAAkC;YAClD,eAAe;YACf,aAAa;YACb,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC;SAC1D,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,8BAA8B,CAAC,iBAAiB,EAChD,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,EACrD,YAAY,EACZ,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC,EAClG,oBAAoB,CACrB,CAAC;QAEF,gBAAgB,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAE/C,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACK,2BAA2B,CAAC,SAAyD;QAC3F,OAAO,gCAAgC,CAAE,SAAkC,CAAC,KAAK,CAAC,CAAC;IACrF,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,mCAAmC,CAC/C,SAAmC,EACnC,GAAY,EACZ,aAA+D;QAE/D,MAAM,4BAA4B,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAC7F,MAAM,oBAAoB,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC;QACzG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAEpD,OAAO,IAAI,CAAC,wBAAwB,CAA2B;YAC7D,SAAS;YACT,+BAA+B,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;YACtF,YAAY,EAAE,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,EAAE;YAC1F,cAAc,EAAE;gBACd,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE;aAC9F;YACD,oBAAoB;SACZ,CAAC,CAAC;IACd,CAAC;IAED;;OAEG;IACH;;;;;;;;;;;;;;;;;;OAkBG;IACK,8BAA8B,CAAC,SAA2C;QAChF,MAAM,kBAAkB,GAAG,SAAS,EAAE,kBAAkB,CAAC;QACzD,IAAI,OAAO,kBAAkB,KAAK,QAAQ,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAE3F,IAAI,CAAC;YACH,MAAM,mBAAmB,GAAG,IAAI,CAAC,wBAAwB,CAAC,8BAA8B,EAAE,CAAC;YAC3F,+FAA+F;YAC/F,yFAAyF;YACzF,IAAI,mBAAmB,EAAE,CAAC,kBAAkB,CAAC,KAAK,wBAAwB;gBAAE,OAAO,IAAI,CAAC;YAExF,4FAA4F;YAC5F,MAAM,qBAAqB,GAAG,IAAI,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,kBAAkC,CAAC,CAAC;YACzH,OAAO,qBAAqB,EAAE,6BAA6B,KAAK,KAAK,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,mBAAmB,CAAC,cAAsC;QAChE,MAAM,YAAY,GAA2C,EAAE,CAAC;QAEhE,0DAA0D;QAC1D,IAAI,cAAc,CAAC,cAAc,EAAE,CAAC;YAClC,YAAY,CAAC,cAAc,GAAG,cAAc,CAAC,cAAc,CAAC;QAC9D,CAAC;QACD,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;YAC1B,YAAY,CAAC,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC;QAC9C,CAAC;QACD,IAAI,cAAc,CAAC,aAAa,EAAE,CAAC;YACjC,YAAY,CAAC,aAAa,GAAG,cAAc,CAAC,aAAa,CAAC;QAC5D,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,0BAA0B,CAKtC,MAAc,EACd,GAAY,EACZ,SAAiG,EACjG,aAA+D;QAG/D,MAAM,WAAW,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,WAAW,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QACpH,IAAI,CAAC,QAAQ,CAAC,mCAAmC,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QAE7E,iFAAiF;QACjF,mFAAmF;QACnF,sFAAsF;QACtF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,kCAAkC,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAE5I,MAAM,4BAA4B,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAE7F,kDAAkD;QAClD,MAAM,oBAAoB,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC;QAEzG,IAAI,CAAC;YACH,OAAO,CAAC,WAAW,KAAK,WAAW,CAAC,YAAY,CAAC;gBAC/C,CAAC,CAAC,MAAM,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,oBAAoB,CAAC;gBAC5G,CAAC,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;QAChH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,mCAAmC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAChE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,mCAAmC,CAAC,KAAc,EAAE,QAAgB;QAChF,IAAI,mBAAmB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,cAAc,EAAE,CAAC;YAC1E,MAAM,wBAAwB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,wBAAwB,CAKpC,MAAc,EACd,4BAAoD,EACpD,SAAiG,EACjG,oBAA4D;QAG5D,IAAI,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAAC;QAEjD,IAAG,SAAS,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,aAAa,EAAE,CAAC;YACzE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE,YAAY,EAAE,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QACrH,CAAC;QAED,IAAI,CAAC,4BAA4B,CAAC,cAAc,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE,EAAG,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,CAAC;YACH,6DAA6D;YAC7D,MAAM,oBAAoB,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAEtE,MAAM,mBAAmB,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAEnG,wCAAwC;YACxC,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,yDAAyD;YACnG,IAAI,SAAS,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAqB,oBAAoB,EAAE;gBACvF,SAAS,EAAE,aAAa;gBACxB,cAAc,EAAE,4BAA4B,CAAC,cAAc;aAC5D,CAAC,CAAC;YAEH,0EAA0E;YAC1E,6EAA6E;YAC7E,gFAAgF;YAChF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,gBAAgB,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAqB,oBAAoB,EAAE;oBAChG,iBAAiB,EAAE,aAAa;oBAChC,cAAc,EAAE,4BAA4B,CAAC,cAAc;iBAC5D,CAAC,CAAC;gBACH,IAAI,gBAAgB,IAAI,yBAAyB,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,EAAE,CAAC;oBAChG,SAAS,GAAG,gBAAgB,CAAC;gBAC/B,CAAC;YACH,CAAC;YAED,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;oBAClF,OAAO,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,4BAA4B,CAAC,cAAc,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACtK,CAAC;YACJ,CAAC;YAED,6CAA6C;YAC7C,MAAM,YAAY,GAAkC;gBAClD,cAAc,EAAE,4BAA4B,CAAC,cAAc;gBAC3D,2FAA2F;gBAC3F,iBAAiB,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,GAAG,EAAE;gBACzF,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC;aAC1D,CAAC;YAEF,6FAA6F;YAC7F,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,8BAA8B,CAAC,oBAAoB,EACnD,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,EACrD,YAAY,EACZ,CAAE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,aAAa,EAAE,iBAAiB,EAAE,SAAS,CAAC,cAAc,EAAE,CAAE,EAAE,qCAAqC;YACjL,oBAAoB,CACrB,CAAC;YAGF,OAAO,gBAAgB,CAAC;QAE1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,KAAK,CAAC,CAAC,yDAAyD;YACxE,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE;oBACP,cAAc,EAAE,4BAA4B,CAAC,cAAc;oBAC3D,KAAK,EAAG,cAAc;oBACtB,aAAa,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBAC1C,EAAE,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,uBAAuB,CAKnC,MAAc,EACd,4BAAoD,EACpD,SAAiG,EACjG,oBAA4D;QAG5D,IAAI,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;QAEhD,kFAAkF;QAClF,uFAAuF;QACvF,sFAAsF;QACtF,mEAAmE;QACnE,IAAI,SAAS,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,WAAW,EAAE,CAAC;YACxE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE,YAAY,EAAE,SAAS,CAAC,oBAAoB,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAC3I,CAAC;QAED,IAAI,CAAC;YACH,6DAA6D;YAC7D,MAAM,oBAAoB,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAEtE,wCAAwC;YACxC,MAAM,mBAAmB,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;YAC3G,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,yDAAyD;YACnG,IAAI,SAAS,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAoB,oBAAoB,EAAE;gBACtF,SAAS,EAAE,aAAa;aACzB,CAAC,CAAC;YAEH,qEAAqE;YACrE,wDAAwD;YACxD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,gBAAgB,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAoB,oBAAoB,EAAE;oBAC/F,iBAAiB,EAAE,aAAa;iBACjC,CAAC,CAAC;gBACH,IAAI,gBAAgB,IAAI,yBAAyB,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,EAAE,CAAC;oBAChG,SAAS,GAAG,gBAAgB,CAAC;gBAC/B,CAAC;YACH,CAAC;YAED,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EACpE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;oBAClF,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAE,CAAC;YAC9G,CAAC;YAED,MAAM,YAAY,GAAkC;gBAClD,2FAA2F;gBAC3F,iBAAiB,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,GAAG,EAAE;gBACzF,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC;aAC1D,CAAC;YAEF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,8BAA8B,CAAC,mBAAmB,EAClD,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,EACrD,YAAY,EACZ,CAAE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,iBAAiB,EAAE,SAAS,CAAC,aAAa,EAAE,CAAE,EAAE,qCAAqC;YAC9K,oBAAoB,CACrB,CAAC;YAEF,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAGjE,OAAO,gBAAgB,CAAC;QAE1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE;oBACP,KAAK,EAAE,aAAa;oBACpB,aAAa,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBAC1C,EAAE,CAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,qCAAqC,CAKjD,MAAc,EACd,GAAY,EACZ,SAAiG,EACjG,aAA+D;QAG/D,IAAI,CAAC,QAAQ,CAAC,+CAA+C,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;QAEzI,6FAA6F;QAC7F,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,kCAAkC,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAE5I,MAAM,4BAA4B,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAC7F,MAAM,oBAAoB,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC;QAEzG,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;gBACnC,CAAC,CAAC,MAAM,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,oBAAoB,CAAC;gBACjH,CAAC,CAAC,MAAM,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;QACrH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,mCAAmC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAChE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,6BAA6B,CAKzC,MAAc,EACd,4BAAoD,EACpD,SAAiG,EACjG,oBAA4D;QAG5D,IAAI,SAAS,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,aAAa,EAAE,CAAC;YAC1E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EACpE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE,YAAY,EAAE,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QACrH,CAAC;QAED,IAAI,CAAC,4BAA4B,CAAC,cAAc,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EACpE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,oBAAoB,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACtE,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;YAExG,MAAM,aAAa,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAA0B,oBAAoB,EAAE;gBAChF,YAAY,EAAE,aAAa;gBAC3B,cAAc,EAAE,4BAA4B,CAAC,cAAc;aAC5D,CAAC,CAAC;YAEH,0EAA0E;YAC1E,kGAAkG;YAClG,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAA0B,oBAAoB,EAAE;oBACnF,oBAAoB,EAAE,aAAa;oBACnC,cAAc,EAAE,4BAA4B,CAAC,cAAc;iBAC5D,CAAC,CAAC;gBACH,IAAI,OAAO,IAAI,yBAAyB,CAAC,OAAO,CAAC,8BAA8B,CAAC,EAAE,CAAC;oBACjF,MAAM,GAAG,OAAO,CAAC;gBACnB,CAAC;YACH,CAAC;YAED,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EACpE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;oBAClF,OAAO,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,4BAA4B,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACrK,CAAC;YAED,MAAM,YAAY,GAAkC;gBAClD,cAAc,EAAE,4BAA4B,CAAC,cAAc;gBAC3D,8EAA8E;gBAC9E,iBAAiB,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,MAAM,CAAC,GAAG,EAAE;gBAC3F,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC;aAC1D,CAAC;YAEF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,8BAA8B,CAAC,oBAAoB,EACnD,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,EACrD,YAAY,EACZ,CAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,aAAa,EAAE,iBAAiB,EAAE,MAAM,CAAC,cAAc,EAAE,CAAE,EACpI,oBAAoB,CACrB,CAAC;YAEF,OAAO,gBAAgB,CAAC;QAE1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EACpE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE,EAAE,cAAc,EAAE,4BAA4B,CAAC,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACpJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,4BAA4B,CAKxC,MAAc,EACd,4BAAoD,EACpD,SAAiG,EACjG,oBAA4D;QAG5D,qFAAqF;QACrF,gFAAgF;QAChF,IAAI,SAAS,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,WAAW,EAAE,CAAC;YACxE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EACpE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE,YAAY,EAAE,SAAS,CAAC,oBAAoB,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAC3I,CAAC;QAED,IAAI,CAAC;YACH,MAAM,oBAAoB,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACtE,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;YAEvG,MAAM,aAAa,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAyB,oBAAoB,EAAE;gBAC/E,YAAY,EAAE,aAAa;aAC5B,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAyB,oBAAoB,EAAE;oBAClF,oBAAoB,EAAE,aAAa;iBACpC,CAAC,CAAC;gBACH,IAAI,OAAO,IAAI,yBAAyB,CAAC,OAAO,CAAC,8BAA8B,CAAC,EAAE,CAAC;oBACjF,MAAM,GAAG,OAAO,CAAC;gBACnB,CAAC;YACH,CAAC;YAED,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EACpE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;oBAClF,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACvG,CAAC;YAED,MAAM,YAAY,GAAkC;gBAClD,8EAA8E;gBAC9E,iBAAiB,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,MAAM,CAAC,GAAG,EAAE;gBAC3F,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC;aAC1D,CAAC;YAEF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,8BAA8B,CAAC,mBAAmB,EAClD,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,EACrD,YAAY,EACZ,CAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,iBAAiB,EAAE,MAAM,CAAC,aAAa,EAAE,CAAE,EACjI,oBAAoB,CACrB,CAAC;YAEF,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAEjE,OAAO,gBAAgB,CAAC;QAE1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EACpE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,0BAA0B;QAChC,OAAO,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,CAAC;IAC5D,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,uBAAuB,CAKnC,KAAa,EACb,GAAY,EACZ,SAAiG,EACjG,aAA+D;QAG/D,IAAI,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAC;QAE/C,IAAI,CAAC;YAEH,4FAA4F;YAC5F,0FAA0F;YAC1F,qFAAqF;YACrF,yFAAyF;YACzF,4FAA4F;YAC5F,oFAAoF;YACpF,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,cAAc,GAClB,cAAc,KAAK,8BAA8B,CAAC,oBAAoB;gBACtE,cAAc,KAAK,8BAA8B,CAAC,mBAAmB,CAAC;YACxE,MAAM,eAAe,GAAG,cAAc;gBACpC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC;gBACjD,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,gCAAgC,CAAC,KAAK,CAAC,CAAC;YAClE,MAAM,YAAY,GAAG,wBAAwB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YACrE,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC;YAEpC,MAAM,4BAA4B,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;YAE7F,kDAAkD;YAClD,MAAM,oBAAoB,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC;YAEzG,oFAAoF;YACpF,sFAAsF;YACtF,2CAA2C;YAC3C,IAAI,YAAY,CAAC,IAAI,KAAK,8BAA8B,CAAC,YAAY,EAAE,CAAC;gBACtE,MAAM,YAAY,GAAG,YAAY,CAAC;gBAElC,mEAAmE;gBACnE,oEAAoE;gBACpE,0EAA0E;gBAC1E,0EAA0E;gBAC1E,4FAA4F;gBAC5F,4FAA4F;gBAC5F,4FAA4F;gBAC5F,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,kCAAkC,CAC5D,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,GAAyB,CAC/E,CAAC;gBACF,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;wBACnF,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;qBACzC,CAAC,CAAC;gBACL,CAAC;gBAED,6FAA6F;gBAC7F,gGAAgG;gBAChG,gGAAgG;gBAChG,oFAAoF;gBACpF,4CAA4C;gBAC5C,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,MAAM,gCAAgC,CAC1E,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,GAAyB,CAClF,CAAC;gBACF,IAAI,cAAc,EAAE,CAAC;oBACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;wBACnF,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE;qBAC3C,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO,MAAM,IAAI,CAAC,2BAA2B,CAC3C,YAAY,CAAC,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,oBAAoB,EAClF,YAAY,CAAC,mBAAmB,EAAE,YAAY,CAAC,cAAc,EAC7D,YAAY,CAAC,oBAAoB,CAClC,CAAC;YACJ,CAAC;YAED,IACE,YAAY,CAAC,IAAI,KAAK,8BAA8B,CAAC,oBAAoB;gBACzE,YAAY,CAAC,IAAI,KAAK,8BAA8B,CAAC,mBAAmB,EACxE,CAAC;gBACD,4EAA4E;gBAC5E,iFAAiF;gBACjF,oFAAoF;gBACpF,sDAAsD;gBACtD,MAAM,YAAY,GAAG,YAAY,CAAC;gBAClC,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,KAAK,8BAA8B,CAAC,oBAAoB;oBAC5F,CAAC,CAAC,oBAAoB,CAAC,aAAa;oBACpC,CAAC,CAAC,oBAAoB,CAAC,WAAW,CAAC;gBAErC,oFAAoF;gBACpF,qFAAqF;gBACrF,MAAM,gBAAgB,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;gBAC3D,IAAI,CAAC,gBAAgB,IAAI,YAAY,CAAC,GAAG,KAAK,gBAAgB,EAAE,CAAC;oBAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EACpE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;wBAChF,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;gBAChE,CAAC;gBAED,oFAAoF;gBACpF,kFAAkF;gBAClF,6EAA6E;gBAC7E,IAAI,SAAS,CAAC,oBAAoB,KAAK,YAAY,EAAE,CAAC;oBACpD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EACpE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;wBAC9E,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;gBACxL,CAAC;gBAED,8FAA8F;gBAC9F,gGAAgG;gBAChG,6FAA6F;gBAC7F,mGAAmG;gBACnG,mGAAmG;gBACnG,mGAAmG;gBACnG,mGAAmG;gBACnG,oGAAoG;gBACpG,iGAAiG;gBACjG,+FAA+F;gBAC/F,qGAAqG;gBACrG,MAAM,UAAU,GAAG,YAAY,KAAK,oBAAoB,CAAC,aAAa;oBACpE,CAAC,CAAC,4BAA4B,CAAC,cAAc;oBAC7C,CAAC,CAAC,4BAA4B,CAAC,aAAa,CAAC;gBAC/C,IAAI,UAAU,IAAI,UAAU,KAAK,YAAY,CAAC,OAAO,EAAE,CAAC;oBACtD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EACnE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;wBACxF,OAAO,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,UAAU,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;gBACrF,CAAC;gBAED,sFAAsF;gBACtF,uFAAuF;gBACvF,kEAAkE;gBAClE,MAAM,iBAAiB,GAAG,EAAE,UAAU,EAAE,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC;gBAC9G,MAAM,YAAY,GAAkC,YAAY,KAAK,oBAAoB,CAAC,aAAa;oBACrG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,EAAE,cAAc,EAAE,YAAY,CAAC,OAAO,EAAE,iBAAiB,EAAE;oBACxH,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,EAAE,aAAa,EAAE,YAAY,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;gBAE1H,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,YAAY,CAAC,IAAI,EACjB,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,EACrD,YAAY,EACZ,CAAE,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,IAAI,EAAE,EAAE,mBAAmB,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,CAAC,OAAO,EAAE,CAAE,EACnH,oBAAoB,CACrB,CAAC;gBAEF,IAAI,YAAY,KAAK,oBAAoB,CAAC,WAAW,EAAE,CAAC;oBACtD,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;gBACnE,CAAC;gBAED,OAAO,gBAAgB,CAAC;YAC1B,CAAC;YAED,uFAAuF;YACvF,uFAAuF;YACvF,MAAM,gBAAgB,GAAU,YAAY,CAAC;YAC7C,KAAK,gBAAgB,CAAC;YACtB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE,EAAE,SAAS,EAAE,EAAC,CAAE,CAAC;QAEhC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,+BAA+B,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wFAAwF,EAAE;oBAC1G,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;oBACpD,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,IAAI,EAAE,GAAG,CAAC,WAAW;oBACrB,mBAAmB,EAAE,SAAS,CAAC,mBAAmB;iBACnD,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;oBACpD,KAAK,EAAE,KAAK,CAAC,sBAAsB;oBACnC,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,IAAI,EAAE,GAAG,CAAC,WAAW;oBACrB,mBAAmB,EAAE,SAAS,CAAC,mBAAmB;iBACnD,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;YACD,+CAA+C;YAC/C,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;gBACnF,OAAO,EAAE,EAAE,aAAa,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,wDAAwD;IACxD,wDAAwD;IAExD;;;;;;;OAOG;IACK,KAAK,CAAC,uBAAuB,CACnC,MAAc,EACd,WAAkC,EAClC,4BAAqC;QAGrC,6BAA6B;QAC7B,MAAM,cAAc,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACvF,MAAM,IAAI,GACR,MAAM,cAAc,CAAC,IAAI,CACvB,WAAW,EACX,MAAM,CACP,CAAC;QAEJ,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE,EAAE,MAAM,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,4BAA4B,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,2BAA2B,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;YACtE,IACE,2BAA2B,KAAK,IAAI;mBACjC,2BAA2B,KAAK,4BAA4B,EAC/D,CAAC;gBACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;oBACE,sBAAsB,EACpB,2BAA2B,CAAC,+BAA+B;oBAC7D,OAAO,EAAE;wBACP,MAAM,EAAE,oCAAoC;wBAC5C,MAAM;qBACP;iBACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;gBAClF,OAAO,EAAE,EAAE,MAAM,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QAED,oCAAoC;QACpC,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;QACrG,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,IAAI,CAAqB,WAAW,EAAE;YAChF,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,wBAAwB,CAAC,MAAM;SACxC,CAAC,CAAC;QAEH,+EAA+E;QAC/E,kEAAkE;QAClE,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CACnC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBACpD,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,CAA8B,CAAC;oBAClG,OAAO,UAAU,IAAI,MAAM,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,MAAM,CAAC;gBAChB,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CACH,CAAC;QAEF,uEAAuE;QACvE,EAAE;QACF,+FAA+F;QAC/F,qFAAqF;QACrF,2FAA2F;QAC3F,yFAAyF;QACzF,EAAE;QACF,8FAA8F;QAC9F,4FAA4F;QAC5F,2FAA2F;QAC3F,mCAAmC;QACnC,MAAM,8BAA8B,GAClC,MAAM,IAAI,CAAC,mDAAmD,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAE3F,kCAAkC;QAClC,MAAM,cAAc,GAAgC,EAAE,CAAC;QACvD,KAAK,MAAM,UAAU,IAAI,8BAA8B,EAAE,CAAC;YACxD,IAAI,UAAU,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;gBAC5C,cAAc,CAAC,IAAI,CAAC;oBAClB,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,EAAE;oBAC7B,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;oBACvD,iBAAiB,EAAE,UAAU,CAAC,cAAc;iBAC7C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,EAAE;QACF,gGAAgG;QAChG,0FAA0F;QAC1F,+FAA+F;QAC/F,gGAAgG;QAChG,yEAAyE;QACzE,EAAE;QACF,4FAA4F;QAC5F,gGAAgG;QAChG,gGAAgG;QAChG,yCAAyC;QACzC,MAAM,IAAI,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;QAE9F,iDAAiD;QACjD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,cAAc,CAAC,IAAI,CAAC;gBAClB,KAAK,EAAE,IAAI,CAAC,QAAQ;gBACpB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;gBACrD,iBAAiB,EAAE,aAAa;aACjC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;IACjD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACK,KAAK,CAAC,mDAAmD,CAC/D,WAAiC,EACjC,WAAkC;QAElC,MAAM,eAAe,GAAG;YACtB,GAAG,IAAI,GAAG,CACR,WAAW;iBACR,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;iBAC3D,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,CAClD;SACF,CAAC;QACF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAE5C,MAAM,sBAAsB,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;QACvG,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAe,WAAW,EAAE;YACjF,GAAG,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE;SAC9B,CAAC,CAAC;QAEH,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAA8C,CAAC;QACrF,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YACzC,IAAI,YAAY,EAAE,GAAG;gBAAE,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QAC3F,CAAC;QAED,+FAA+F;QAC/F,2FAA2F;QAC3F,KAAK,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,sBAAsB,EAAE,CAAC;YAC9D,IAAI,MAAM,KAAK,SAAS;gBAAE,SAAS;YACnC,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAe,WAAW,EAAE,cAAc,CAAC,CAAC;YAC/F,IAAI,SAAS,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;gBACpC,sBAAsB,CAAC,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QAED,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CACvC,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC;eAChC,uCAAuC,CAAC,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAClG,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACK,KAAK,CAAC,qBAAqB,CACjC,WAAsD,EACtD,cAA2C,EAC3C,WAAkC;QAElC,MAAM,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;QACjH,IAAI,CAAC,oBAAoB;YAAE,OAAO;QAElC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc;gBAAE,SAAS;YAE7D,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAyB,WAAW,EAAE;gBACvF,oBAAoB,EAAE,UAAU,CAAC,GAAG;aACrC,CAAC,CAAC;YAEH,KAAK,MAAM,UAAU,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;gBAC3C,IAAI,CAAC,UAAU,EAAE,kBAAkB,IAAI,CAAC,UAAU,CAAC,IAAI;oBAAE,SAAS;gBAClE,cAAc,CAAC,IAAI,CAAC;oBAClB,KAAK,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;oBACxB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;oBACvD,iBAAiB,EAAE,UAAU,CAAC,cAAc;oBAC5C,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;iBAClD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,8BAA8B;IAC9B,wDAAwD;IAExD;;;OAGG;IACK,KAAK,CAAC,2BAA2B,CAKvC,MAAc,EACd,4BAAoD,EACpD,SAAiG,EACjG,oBAA4D,EAC5D,mBAA4B,EAC5B,iBAA0B,EAC1B,uBAAgC;QAGhC,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;QAEhG,mEAAmE;QACnE,EAAE;QACF,2FAA2F;QAC3F,uFAAuF;QACvF,6FAA6F;QAC7F,iGAAiG;QACjG,kEAAkE;QAClE,EAAE;QACF,+FAA+F;QAC/F,gGAAgG;QAChG,0DAA0D;QAC1D,IACE,4BAA4B,CAAC,MAAM;eAChC,4BAA4B,CAAC,MAAM,KAAK,MAAM;eAC9C,IAAI,CAAC,8BAA8B,CAAC,SAAS,CAAC,EACjD,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;aACnF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,MAAM,oBAAoB,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAEtE,qDAAqD;YACrD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAC3D,MAAM,EACN,oBAAoB,EACpB,uBAAuB,CACxB,CAAC;YAEF,8FAA8F;YAC9F,MAAM,YAAY,GAAkC;gBAClD,GAAG,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC;gBACzD,MAAM;aACP,CAAC;YAEF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EACT,8BAA8B,CAAC,YAAY,EAC3C,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,EACrD,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,SAAS,EAAE,iCAAiC;YAC5C,CAAC,EAAU,2BAA2B;YACtC,SAAS,EAAE,mBAAmB;YAC9B,iBAAiB,IAAI,IAAI,CAC1B,CAAC;YAEF,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;gBACtC,gBAAgB,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;YAC/D,CAAC;YAED,OAAO,gBAAgB,CAAC;QAE1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAE,SAAS,CAAC,cAAc,EAAE,SAAS,EACrE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;gBACnF,OAAO,EAAE,EAAE,aAAa,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,gCAAgC;IAChC,wDAAwD;IACxD,yDAAyD;IACzD,8CAA8C;IAC9C,kDAAkD;IAClD,+DAA+D;IAE/D;;;;;;;OAOG;IACI,KAAK,CAAC,4BAA4B,CAAC,KAAa,EAAE,uBAAgC;QACvF,IAAI,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAC;QAElD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,gCAAgC,CAAC,KAAK,CAAC,CAAC;QACtF,MAAM,YAAY,GAAG,wBAAwB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC;QAEpC,6FAA6F;QAC7F,IAAI,YAAY,CAAC,IAAI,KAAK,8BAA8B,CAAC,YAAY,EAAE,CAAC;YACtE,MAAM,YAAY,GAAG,YAAY,CAAC;YAElC,8FAA8F;YAC9F,8FAA8F;YAC9F,gGAAgG;YAChG,wFAAwF;YACxF,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,kCAAkC,CAC5D,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,GAAyB,CAC/E,CAAC;YACF,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;oBACnF,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;iBACzC,CAAC,CAAC;YACL,CAAC;YAED,8FAA8F;YAC9F,yFAAyF;YACzF,yFAAyF;YACzF,6FAA6F;YAC7F,gDAAgD;YAChD,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,MAAM,gCAAgC,CAC1E,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,GAAyB,CAClF,CAAC;YACF,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;oBACnF,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE;iBAC3C,CAAC,CAAC;YACL,CAAC;YAED,OAAO,MAAM,IAAI,CAAC,0BAA0B,CAC1C,YAAY,CAAC,MAAM,EACnB,uBAAuB;YACvB,4FAA4F;YAC5F,iCAAiC,CAAC,cAAc,EAChD,YAAY,CAAC,oBAAoB,CAClC,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;YACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;YAChF,OAAO,EAAE,EAAE,SAAS,EAAE;SACvB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,mBAAmB;QACxB,OAAO;YACL,aAAa,EAAE,8BAA8B,CAAC,gBAAgB;YAC9D,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,EAAE;SACnB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACI,KAAK,CAAC,yBAAyB,CAAC,KAAa,EAAE,cAAsB;QAC1E,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,cAAc,GAClB,cAAc,KAAK,8BAA8B,CAAC,oBAAoB;YACtE,cAAc,KAAK,8BAA8B,CAAC,mBAAmB,CAAC;QAExE,IAAI,cAAc,EAAE,CAAC;YACnB,+FAA+F;YAC/F,8FAA8F;YAC9F,8FAA8F;YAC9F,0FAA0F;YAC1F,2FAA2F;YAC3F,+EAA+E;YAC/E,+FAA+F;YAC/F,gGAAgG;YAChG,kGAAkG;YAClG,wFAAwF;YACxF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,wFAAwF;gBACxF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;oBAChF,OAAO,EAAE,EAAE,MAAM,EAAE,mCAAmC,EAAE;iBACzD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;YACrF,MAAM,YAAY,GAAG,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAChE,IACE,YAAY,CAAC,IAAI,KAAK,8BAA8B,CAAC,oBAAoB;gBACzE,YAAY,CAAC,IAAI,KAAK,8BAA8B,CAAC,mBAAmB,EACxE,CAAC;gBACD,oFAAoF;gBACpF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;oBAChF,OAAO,EAAE,EAAE,MAAM,EAAE,gCAAgC,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,EAAE;iBACpF,CAAC,CAAC;YACL,CAAC;YACD,8FAA8F;YAC9F,gGAAgG;YAChG,gGAAgG;YAChG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;oBAChF,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE;iBACpD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,KAAK,8BAA8B,CAAC,oBAAoB;gBAC5F,CAAC,CAAC,oBAAoB,CAAC,aAAa;gBACpC,CAAC,CAAC,oBAAoB,CAAC,WAAW,CAAC;YACrC,MAAM,iBAAiB,GAAG,EAAE,UAAU,EAAE,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC9G,MAAM,YAAY,GAAkC,YAAY,KAAK,oBAAoB,CAAC,aAAa;gBACrG,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,CAAC,OAAO,EAAE,iBAAiB,EAAE;gBAC7D,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;YAC/D,OAAO;gBACL,aAAa,EAAE,YAAY,CAAC,IAAI;gBAChC,YAAY;gBACZ,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,IAAI,EAAE,EAAE,mBAAmB,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC;aAClI,CAAC;QACJ,CAAC;QAED,2FAA2F;QAC3F,wFAAwF;QACxF,+FAA+F;QAC/F,8FAA8F;QAC9F,+FAA+F;QAC/F,+FAA+F;QAC/F,kGAAkG;QAClG,8EAA8E;QAC9E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,gCAAgC,CAAC,KAAK,EAAE,cAAc,CAAC,sBAAsB,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/I,MAAM,YAAY,GAAG,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,YAAY,CAAC,IAAI,KAAK,8BAA8B,CAAC,YAAY,EAAE,CAAC;YACtE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE,EAAE,MAAM,EAAE,gCAAgC,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,EAAE;aACpF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;QACD,qGAAqG;QACrG,oGAAoG;QACpG,mGAAmG;QACnG,iFAAiF;QACjF,yGAAyG;QACzG,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,kCAAkC,CAC5D,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,GAAyB,CAC/E,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;gBACnF,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;aACzC,CAAC,CAAC;QACL,CAAC;QACD,kGAAkG;QAClG,qGAAqG;QACrG,oGAAoG;QACpG,qGAAqG;QACrG,mGAAmG;QACnG,kGAAkG;QAClG,sGAAsG;QACtG,mGAAmG;QACnG,8FAA8F;QAC9F,wGAAwG;QACxG,sGAAsG;QACtG,sGAAsG;QACtG,iGAAiG;QACjG,yFAAyF;QACzF,iGAAiG;QACjG,2FAA2F;QAC3F,4FAA4F;QAC5F,kGAAkG;QAClG,kGAAkG;QAClG,+EAA+E;QAC/E,6CAA6C;QAC7C,MAAM,8BAA8B,GAAG,MAAM,IAAI,CAAC,qCAAqC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC1G,OAAO,MAAM,IAAI,CAAC,0BAA0B,CAC1C,YAAY,CAAC,MAAM,EACnB,8BAA8B,EAC9B,8BAA8B;YAC5B,CAAC,CAAC,iCAAiC,CAAC,aAAa;YACjD,wFAAwF;YACxF,4FAA4F;YAC5F,CAAC,CAAC,iCAAiC,CAAC,cAAc,EACpD,YAAY,CAAC,oBAAoB,CAClC,CAAC;IACJ,CAAC;IAED,4EAA4E;IACpE,iBAAiB,CAAC,GAAY,EAAE,QAAgB;QACtD,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,GAAG,KAAK,QAAQ,CAAC;QACrD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH;;;;;;;;;;;;;;;;OAgBG;IACK,oCAAoC,CAAC,SAAyD;QACpG,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC3C,IAAI,gBAAgB,IAAI,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7E,KAAK,MAAM,aAAa,IAAI,SAAS,CAAC,cAAoE,EAAE,CAAC;gBAC3G,KAAK,MAAM,SAAS,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;oBACjD,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAEO,+CAA+C,CAAC,0BAAkD;QACxG,MAAM,2BAA2B,GAAG,IAAI,CAAC,wBAAwB,CAAC,8BAA8B,EAAE,CAAC;QACnG,MAAM,UAAU,GAAG,IAAI,GAAG,EAA8C,CAAC;QACzE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,CAAC;YACtE,MAAM,eAAe,GAAG,2BAA2B,CAAC,GAAmB,CAAC,IAAI,GAAG,CAAC;YAChF,UAAU,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,0BAA0B,CAGrC,IAAsB,EACtB,SAAmC,EACnC,0BAAkD;QAGlD,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE;YAC3D,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,YAAY,EAAE,SAAS,CAAC,kBAAkB;YAC1C,mBAAmB,EAAE,SAAS,CAAC,mBAAmB;YAClD,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC;SACrD,CAAC,CAAC;QAEH,8EAA8E;QAC9E,4EAA4E;QAC5E,+EAA+E;QAC/E,uFAAuF;QACvF,MAAM,UAAU,GAAG,IAAI,CAAC,+CAA+C,CAAC,0BAA0B,CAAC,CAAC;QAEpG,0EAA0E;QAC1E,8DAA8D;QAC9D,wCAAwC;QACxC,EAAE;QACF,kEAAkE;QAClE,wEAAwE;QACxE,yEAAyE;QACzE,6EAA6E;QAC7E,wDAAwD;QACxD,6EAA6E;QAC7E,uEAAuE;QACvE,8EAA8E;QAC9E,8EAA8E;QAC9E,sEAAsE;QACtE,sEAAsE;QACtE,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,4EAA4E;QAC5E,8EAA8E;QAC9E,gEAAgE;QAChE,4EAA4E;QAC5E,EAAE;QACF,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,kCAAkC;QAClC,MAAM,6BAA6B,GAAG,IAAI,CAAC,oCAAoC,CAAC,SAAS,CAAC,CAAC;QAC3F,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC3C,KAAK,MAAM,eAAe,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACrD,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;oBACxD,IAAI,CAAC,QAAQ,CAAC,6DAA6D,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;oBAClG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;QAED,mGAAmG;QACnG,EAAE;QACF,gGAAgG;QAChG,oGAAoG;QACpG,oGAAoG;QACpG,mGAAmG;QACnG,oGAAoG;QACpG,8FAA8F;QAC9F,qFAAqF;QACrF,EAAE;QACF,oGAAoG;QACpG,8FAA8F;QAC9F,kGAAkG;QAClG,4FAA4F;QAC5F,oGAAoG;QACpG,6FAA6F;QAC7F,MAAM,uBAAuB,GAAG,kCAAkC,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC/F,IACE,SAAS,CAAC,oBAAoB,KAAK,oBAAoB,CAAC,SAAS;eAC9D,IAAI,CAAC,YAAY,EAAE,MAAM;eACzB,6BAA6B,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAC7D,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;QAED,wEAAwE;QACxE,8DAA8D;QAC9D,yDAAyD;QACzD,8FAA8F;QAC9F,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,SAAS,EAAgB,yBAAyB;QAClD,IAAI,CAAC,aAAa,EAAO,iDAAiD;QAC1E,UAAU,EAAe,+CAA+C;QACxE,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,gDAAgD;QACzE,IAAI,CAAC,cAAc,EAAM,8CAA8C;QACvE,EAAE,CAAuB,6DAA6D;SACvF,CAAC;QAEF,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9B,gBAAgB,CAAC,uBAAuB,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACtE,CAAC;QAED,kDAAkD;QAClD,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;QAElE,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,0BAA0B,CACtC,MAAc,EACd,uBAA2C,EAC3C,2BAA8D,EAC9D,4BAAqC;QAErC,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;QAE5F,kCAAkC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAClE,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,WAAW,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAChH,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAE7D,8CAA8C;QAC9C,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,GACrC,MAAM,IAAI,CAAC,uBAAuB,CAChC,MAAM,EACN,WAAW,EACX,4BAA4B,CAC7B,CAAC;QAEJ,+EAA+E;QAC/E,+EAA+E;QAC/E,+EAA+E;QAC/E,4EAA4E;QAC5E,iFAAiF;QACjF,8EAA8E;QAC9E,8EAA8E;QAC9E,oFAAoF;QACpF,iGAAiG;QACjG,qDAAqD;QACrD,MAAM,cAAc,GAAG,IAAI,CAAC,iCAAiC,CAAC,uBAAuB,EAAE,cAAc,EAAE,2BAA2B,CAAC,CAAC;QAEpI,OAAO;YACL,aAAa,EAAE,8BAA8B,CAAC,YAAY;YAC1D,YAAY,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACtF,cAAc;SACf,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,8BAA8B,CAAC,SAAyD;QAC9F,OAAO,SAAS,CAAC,uBAA6C,CAAC;IACjE,CAAC;CAEF,CAAA;AAxtHY,qCAAqC;IADjD,UAAU,EAAE;IAMJ,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAC5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAClD,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAC7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,WAAA,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAA;IAIpC,YAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;qCAbE,aAAa;QACO,uBAAuB;QACxB,0BAA0B;QACG,qCAAqC;QACtE,iBAAiB;QACG,+BAA+B;QACxB,yCAAyC;QACnD,6BAA6B;QACjD,YAAY;QAClB,SAAS;GAdtE,qCAAqC,CAwtHjD","sourcesContent":["import type {\n ApiKeyApplication,\n ApiKeyOrganization,\n OAuthClientApplication,\n OAuthClientOrganization,\n Application,\n AnyResourceConfiguration,\n ExecutionContext_RoleInfo,\n Organization,\n OrganizationMember,\n OrganizationUnitMember,\n ResourceConfiguration_Operation,\n ResourceConfiguration_Operation_UrlInitiatorInfo,\n User,\n ExecutionContext_RelationshipContext,\n ResourceFieldIdentifier,\n ResourceType,\n ResourceConfiguration_OperationPath\n} from '@wildo-ai/saas-models';\nimport { EnumLikeType } from '@wildo-ai/zod-decorators';\nimport { Request } from 'express';\nimport { Container, inject, injectable } from 'inversify';\nimport 'reflect-metadata';\nimport { z } from 'zod';\nimport { trace } from '@opentelemetry/api';\n\nimport { ApiKeyScope, apiKeyScopeForCredential, CORE_APP_ROLES, CoreResourceType, coreResourceShared_FieldIdentifier, isApiKeyCredential, isAuthorityConferringOrganizationStatus, OrganizationMemberStatus, PRIMARY_SCOPE_TO_FIELD_IDENTIFIER, requiredRolesDeclarePublicAccess, ResourcePrimaryScope, SERVICE_NATIVE_OPERATION_VARIANT_TYPES, URL_BEARING_OPERATION_VARIANT_TYPES, WildoHeaderKeys } from '@wildo-ai/saas-models';\n\nimport { ApiKeyStatus, OAuthClientStatus, CoreResourceOperation, ErrorCustomMessageReference, ErrorType, ExecutionContext_ExecutionType, ExecutionContext_InitiatorIds, MachineAuthMethod, ResourceOperationVariantType, ResourcesConfig_OperationPathUtils, TokenAuthenticationPolicy, UserStatus, isWildoBackendError } from '@wildo-ai/saas-models';\n\n// =====================================================\n// Socket Authentication Types (reuses existing ExecutionContext types)\n// =====================================================\n\n\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ActiveOrganizationSelectionSource, ExecutionContext, ExecutionContext_FactoryParams, SocketAuthResult } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { ServiceOptions } from '~wildo-backend-lib/base-classes/models/repositories.backend.schemas';\nimport type { BatchesCronjobsCustomExecution_Context } from '~wildo-backend-lib/base-classes/services/batches/batches-cronjobs-custom-execution.service';\nimport { CustomBatchManifestKind } from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\n\n/**\n * Transport preference used to disambiguate a multi-variant custom-batch anchor operation.\n *\n * Ordered, and deliberately identical to `getServiceOperationPathDefault`'s own preference — the\n * service layer's native transport first, URL-bearing second — so a batch bootstraps on exactly the\n * operation its `servicesRegistry.<verb>()` call will later resolve to. Two rules that could drift\n * apart would reintroduce the class of bug this ordering exists to prevent.\n */\n/**\n * The URL segment that carries a person's identity — derived from the canonical field-identifier map\n * rather than re-typed, so a rename moves this with it instead of silently disabling the\n * identity-coherence guard.\n */\nconst USER_ID_FIELD_IDENTIFIER = coreResourceShared_FieldIdentifier[CoreResourceType.USERS];\n\nconst SERVICE_RESOLVABLE_TRANSPORT_PREFERENCE: readonly (readonly ResourceOperationVariantType[])[] = [\n SERVICE_NATIVE_OPERATION_VARIANT_TYPES,\n URL_BEARING_OPERATION_VARIANT_TYPES,\n];\n\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { JwtClaim_App_Auth_Schema } from '~wildo-backend-lib/security/authentications/models/authentications.backend.schemas';\nimport { JwtPrivateKeys } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport {\n isExpiredJwtVerificationFailure,\n isJwtVerificationFailure,\n} from '~wildo-backend-lib/security/jwt/utils/jwt-verification-error-classification.backend.utils';\nimport { AuthorizationsBackendService } from '~wildo-backend-lib/security/authorizations/services/authorizations.backend.service';\nimport { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { hashApiKey } from '~wildo-backend-lib/security/api-keys/api-key-generation.backend.utils';\nimport { hashOAuthClientSecret } from '~wildo-backend-lib/security/oauth-clients/oauth-client-generation.backend.utils';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ErrorHandlerService } from '~wildo-backend-lib/errors/services/error-handler.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ResourceOperationHelperBackendService } from '~wildo-backend-lib/base-classes/services/resource-operations-helper.backend.service';\nimport { ExecutionContextHandlerBackendService } from './execution-context-handler.backend.service';\nimport { BackendResourceType } from '~wildo-backend-lib/resources/models/resources-types.backend.schemas';\nimport { ConsumableToken } from '~wildo-backend-lib/security/consumable-tokens/models/consumable-tokens.shared.schemas';\nimport { ConsumableTokenBackendService } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport { AnonymousSessionBackendService } from '~wildo-backend-lib/security/authentications/services/anonymous-session.backend.service';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { getClientIpFromRequest } from '~wildo-backend-lib/runtime/utils/request-client-ip.utils';\nimport { assertMachineAuthAttemptWithinRate, recordMachineAuthFailure } from '~wildo-backend-lib/security/authentications/services/utils/machine-auth-rate-limit.backend.utils';\nimport { isRotationGraceWindowOpen, isCredentialExpired } from '~wildo-backend-lib/security/credential-rotation-grace.backend.utils';\nimport { evaluateUserTokenInvalidationFence } from '~wildo-backend-lib/security/token-invalidation-fence.backend.utils';\nimport { evaluateSessionInvalidationFence } from '~wildo-backend-lib/security/session-invalidation-fence.backend.utils';\nimport {\n getUserAuthorizationVersion,\n type AuthorizationVersionedUser,\n} from '~wildo-backend-lib/security/authentications/models/user-authorization-version.backend.utils';\n\n\n@injectable()\nexport class ExecutionContextCreatorBackendService {\n\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ExecutionContextHandlerService) private readonly executionContextHandlerService: ExecutionContextHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.JwtBackendService) private readonly jwtService: JwtBackendService,\n @inject(SAAS_SERVICE_TYPES.ResourceRegistryService) private readonly resourcesRegistryService: ResourcesRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) private readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.ConsumableTokenService) private readonly consumableTokenService: ConsumableTokenBackendService,\n @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,\n @inject(SAAS_SERVICE_TYPES.Container) private readonly container: Container,\n // Appended LAST on purpose: several tests construct this service positionally, so a new\n // dependency must not shift the existing parameter order. Used only by\n // `retainContextFieldsKnownToResource`.\n @inject(SAAS_SERVICE_TYPES.ResourceOperationHelperService) private readonly resourceOperationHelper: ResourceOperationHelperBackendService,\n ) {\n this.logDebug = this.logger.debugByType('ExecutionContextCreator');\n this.logger.setDebugTypeLogging('ExecutionContextCreator', false);\n }\n\n /**\n * Anonymous session handling eventually calls back into the services registry,\n * so we resolve it lazily to avoid a hard DI cycle during backend startup.\n */\n private getAnonymousSessionService(): AnonymousSessionBackendService {\n return this.container.get<AnonymousSessionBackendService>(SAAS_SERVICE_TYPES.AnonymousSessionService);\n }\n\n private createInternalSystemRoles(): ExecutionContext_RoleInfo[] {\n return [\n {\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n }\n ];\n }\n\n private async populateApplicationIdIfNeeded(executionContext: ExecutionContext<any>, forcePopulate: boolean = false) {\n // Check if applicationId is already set\n const applicationIdUndefinedOrNull =\n executionContext.initiatorIds?.applicationId === undefined ||\n executionContext.initiatorIds?.applicationId === null;\n\n // Populate if needed\n const needsPopulation = (\n executionContext.operation.resourcePrimaryScope === ResourcePrimaryScope.APPLICATION &&\n applicationIdUndefinedOrNull\n ) || forcePopulate;\n\n if (!needsPopulation) {\n return;\n }\n\n // initiatorIds should always exist (validated in ExecutionContext constructor)\n if (!executionContext.initiatorIds) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n executionContext,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'ExecutionContext.initiatorIds is null - this should not happen after validation. Check ExecutionContext construction.'\n }\n }\n );\n }\n\n // Resolve through the canonical resolver, NOT by reading APPLICATION on the context being\n // enriched.\n //\n // That read used to pass `executionContext` — the very context this method is populating — so\n // the repository's contextual filter applied whatever that context carried to `applications`.\n // The filter is fail-closed: a field the application schema does not model (`organizationId`,\n // for one) throws CONFIGURATION / `context_filter` rather than being ignored. Any\n // APPLICATION-scoped operation whose context carried a tenant therefore failed here, and it is\n // how giving the audit write context a tenant briefly broke EVERY audit write.\n //\n // There is one APPLICATION row, so no caller context can usefully narrow this lookup — it can\n // only break it. `getApplicationId` owns the context-free read; delegating leaves ONE resolver\n // rather than two copies that drift. Safe to call only because that method now builds its\n // context DIRECTLY: routing it through `createForInternalOperation` would re-enter this method\n // and recurse until the stack blew.\n executionContext.initiatorIds.applicationId = await this.getApplicationId();\n }\n\n /**\n * Resolve the singleton APPLICATION row's id — the ONE way to do it in this class.\n *\n * ## Why the read context is constructed DIRECTLY here\n *\n * This used to build its context through `createForInternalOperation`, which is the ordinary\n * path — but that path calls {@link populateApplicationIdIfNeeded} for any APPLICATION-scoped\n * operation, and this operation is APPLICATION-scoped by definition. Two consequences followed:\n *\n * - the APPLICATION row was read TWICE per call (once by the nested populate, once below);\n * - and `populateApplicationIdIfNeeded` could not delegate here, because doing so recursed\n * until the stack blew — which surfaces as a vitest \"worker exited unexpectedly\" and reads\n * like load flakiness rather than a stack overflow.\n *\n * Constructing the context directly breaks that re-entry. It is the idiomatic move in this class\n * (which builds `ExecutionContext` directly in a dozen places), and it lets the enrichment path\n * delegate here so there is exactly one resolver instead of two divergent copies.\n *\n * The context is deliberately EMPTY of context resources: there is one APPLICATION row, so\n * nothing can usefully narrow this read — while a borrowed caller context CAN break it, because\n * the repository's contextual filter is fail-closed on any field `applications` does not model.\n * `validateOperation` is skipped along with the generic path; this is a fixed, framework-owned\n * bootstrap read of a single known operation, not caller-authored input.\n */\n private async getApplicationId(): Promise<string> {\n const appReadOp = this.resourcesRegistryService.getOperationPathDefault(CoreResourceType.APPLICATION, CoreResourceOperation.READ);\n const execCtx = new ExecutionContext(\n this.resourcesRegistryService.getOperationFromPath(appReadOp),\n ExecutionContext_ExecutionType.INTERNALLY_INITIATED_REQUEST,\n new Map(),\n {},\n [ { roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION } ],\n [],\n );\n\n const appRepository = this.repositoriesRegistry.getRepository(CoreResourceType.APPLICATION);\n const currentApplication = await appRepository.read<Application>(execCtx, { });\n\n if (!currentApplication) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'No APPLICATION record found in database. The application must be seeded with an APPLICATION record during initialization.'\n }\n }\n );\n }\n\n return currentApplication._id;\n }\n\n public async createExecutionContext<TResourceConfigOperation extends ResourceConfiguration_Operation<any, any, any> >(\n params: ExecutionContext_FactoryParams\n ): Promise<ExecutionContext<TResourceConfigOperation>> {\n\n this.logDebug('Creating ExecutionContext', { executionType: params.executionType,operationIdentifier: params.operation.operationIdentifier,resourceIdentifier: params.operation.resourceIdentifier });\n\n const operation = this.resourcesRegistryService.getOperationFromPath(params.operation) as TResourceConfigOperation;\n\n await this.executionContextHandlerService.validateOperation(operation);\n\n const executionContext = new ExecutionContext<TResourceConfigOperation>(\n operation,\n params.executionType,\n params.contextResourcesFieldIdentifier,\n params.initiatorIds ?? {}, // Use nullish coalescing - handles both null and undefined\n params.initiatorRoles ?? [],\n params.relationshipContexts ?? [],\n // The four positional slots between `relationshipContexts` and the audit actor are passed as\n // their own defaults verbatim (mint a correlationId, depth 0, fresh visited set, no active user\n // type) — they exist only so the on-behalf-of principal, which is the last parameter, can be\n // supplied at all. Behaviour here is unchanged from omitting them.\n undefined,\n 0,\n undefined,\n null,\n params.auditActorUserId\n );\n\n if(operation.resourcePrimaryScope === ResourcePrimaryScope.APPLICATION) {\n await this.populateApplicationIdIfNeeded(executionContext);\n }\n\n this.logDebug('ExecutionContext created successfully', { executionType: executionContext.executionType, contextResourcesCount: executionContext.getContextResourceIds().size, hasExecutionContext_InitiatorIds: !!executionContext.initiatorIds, initiatorRolesCount: executionContext.initiatorRoles.length });\n\n // Slice 2 Phase 3 — enrich the active OTel span with the resolved tenant\n // identity so exported traces are filterable per-organization / per-user.\n // No-op when no span is active (internal/worker contexts) or telemetry is\n // off; never throws.\n this.enrichActiveSpanWithScope(executionContext);\n\n return executionContext;\n }\n\n /**\n * Attach the resolved tenant identity (organization / user) to the active\n * OpenTelemetry span as `saas.*` attributes, so exported traces are\n * filterable per-organization / per-user in the telemetry backend.\n *\n * The span is created by the HTTP auto-instrumentation in the OTLP preload\n * (`otel-preload.ts`); this method only ENRICHES it — it never creates a\n * span. `trace.getActiveSpan()` returns the in-flight request span from\n * anywhere in the handler (the auto-instrumentation runs the request inside\n * the span's context), so enriching at this single central funnel covers\n * every authenticated operation — the HTTP server has no global auth\n * middleware (scope resolves here), so a per-route Express middleware could\n * not see org/user at all.\n *\n * Enriches INBOUND-REQUEST contexts only. `createExecutionContext` is also the\n * funnel for `INTERNALLY_INITIATED_REQUEST` sub-operations, which a request\n * handler can spawn while the request's span is still active; enriching from one\n * of those would let a nested op's scope CLOBBER the request principal on the\n * span. So internal contexts are skipped here — inbound-request types\n * (USER_REQUEST / ANONYMOUS_SESSION / WEBHOOK_CALLBACK / PUBLIC_EXECUTION) stamp\n * the identity exactly once. Webhooks ARE enriched (inbound HTTP with a span and\n * a resolved tenant scope).\n *\n * Root-span invariant: an inbound-request context is resolved in the controller\n * layer BEFORE the service/repository layer runs, so no auto-instrumentation child\n * span (DB / redis / outbound-http) has started yet when this fires —\n * `getActiveSpan()` is therefore the root HTTP server span, which is exactly the\n * span we want stamped (not a nested child). Skipping internal sub-ops (above)\n * upholds this: those are the only contexts created mid-execution, when a child\n * span could be the active one.\n *\n * Pure side-effect, fail-open: when no preload is active, or the context is built\n * outside an HTTP request (internal / worker / cron), `getActiveSpan()` is\n * undefined and this is a no-op anyway. Wrapped so a telemetry error can never\n * affect request handling.\n *\n * Also stamps `saas.correlation_id` (Phase 6). The span's own `trace_id` identifies\n * ONE trace, but the Wildo correlationId is the join key that survives the seams\n * OTel does not automatically cross here — the queue hop (carried as\n * `originCorrelationId` and re-adopted on the worker) and every structured log line\n * (which carries correlationId, not trace_id). Bridging it onto the span lets an\n * operator pivot from a log line's correlationId to the trace and back. It is NOT\n * derived from `trace_id` (they are independent ids) — it is the EC's own\n * correlationId, the same value the logs and audit rows carry.\n */\n private enrichActiveSpanWithScope(executionContext: ExecutionContext<any>): void {\n try {\n // Skip nested internal sub-operations — see the \"INBOUND-REQUEST contexts\n // only\" rationale above. A non-HTTP internal context is also caught by the\n // `!span` guard below, but an internal op nested INSIDE a request has the\n // parent request's span active, so this type check is the real guard against\n // clobbering the request principal.\n if (executionContext.executionType === ExecutionContext_ExecutionType.INTERNALLY_INITIATED_REQUEST) {\n return;\n }\n const span = trace.getActiveSpan();\n if (!span) {\n return;\n }\n const attributes: Record<string, string> = {};\n if (executionContext.correlationId) {\n attributes['saas.correlation_id'] = executionContext.correlationId;\n }\n if (executionContext.organizationId) {\n attributes['saas.organization_id'] = executionContext.organizationId;\n }\n if (executionContext.userId) {\n attributes['saas.user_id'] = executionContext.userId;\n }\n if (Object.keys(attributes).length > 0) {\n span.setAttributes(attributes);\n }\n } catch {\n // best-effort enrichment — never let a telemetry failure affect the request.\n }\n }\n\n\n public async createForInternalOperation<TResourceConfigOperation extends ResourceConfiguration_Operation<any, any, any> >(\n params: Omit<ExecutionContext_FactoryParams, 'executionType'>\n ): Promise<ExecutionContext<TResourceConfigOperation>> {\n\n return this.createExecutionContext({\n ...params,\n executionType: ExecutionContext_ExecutionType.INTERNALLY_INITIATED_REQUEST,\n });\n }\n\n /**\n * Reconstruct the attribution and scope of an operation that already\n * committed, solely to finish one of its persisted post-commit effects.\n *\n * This is intentionally distinct from {@link createForInternalOperation}.\n * A deferred effect is executed by a worker, but it still belongs to the\n * original authenticated principal. Relabelling that principal as INTERNAL\n * either violates `ExecutionContext` identity invariants or tempts workers to\n * fabricate elevated roles. The durable record must therefore persist the\n * original execution type, initiator IDs, roles, relationship paths, and\n * scope; this seam reconstructs them through the normal constructor so every\n * principal-category validation remains active.\n *\n * SECURITY: callers must source these parameters from immutable framework\n * state written atomically with the completed operation. This is not an\n * authentication entry point and must never accept client-authored data.\n */\n public async createForDeferredAuthorizedEffect<\n TResourceConfigOperation extends ResourceConfiguration_Operation<any, any, any>\n >(\n params: ExecutionContext_FactoryParams,\n ): Promise<ExecutionContext<TResourceConfigOperation>> {\n return this.createExecutionContext<TResourceConfigOperation>(params);\n }\n\n /**\n * Bootstrap an INTERNAL execution context for a repository operation on the\n * given resource, resolving the operation path `REPOSITORY_ONLY`-preferred with\n * a URL-bearing fallback (see\n * {@link ResourcesRegistryBackendService.getInternalRepositoryOperationPathDefault}).\n *\n * This is the single seam REPOSITORY-DIRECT internal-context builders should\n * use (`FilesBackendService`, the queue services, `ResourceContextBackendService`,\n * `NotificationBadgeBackendService`, the data-seed ledger). It replaces the hand-rolled\n * `getOperationPathDefault(...) → createForInternalOperation(...)` pattern that\n * repeatedly drifted to the URL-only resolver and threw\n * `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` on `REPOSITORY_ONLY`-only\n * resources (FILES, JOB_*). Variant-correct path resolution and context\n * construction live together here so a new builder cannot reintroduce that\n * bug by reaching for the wrong sibling resolver.\n *\n * Use this ONLY for resources whose internal CRUD is repository-direct and\n * bypasses the service pipeline (the `FilesBackendService` pattern). For\n * resources whose internal CRUD runs THROUGH the service pipeline (ACL, hooks,\n * lifecycle) but has no HTTP surface — the billing back-office — use\n * {@link createForInternalServiceOperation} instead, which resolves the\n * `INTERNAL_CALL` default.\n *\n * Identity (`initiatorIds`, `initiatorRoles`) and scope\n * (`contextResourcesFieldIdentifier`, `relationshipContexts`) are forwarded\n * verbatim to {@link createForInternalOperation}; omit them for an unattributed\n * system context.\n */\n public async createForInternalRepositoryOperation<TResourceConfigOperation extends ResourceConfiguration_Operation<any, any, any> >(\n params: Omit<ExecutionContext_FactoryParams, 'executionType' | 'operation'> & {\n resourceType: ResourceType;\n operationIdentifier: string;\n }\n ): Promise<ExecutionContext<TResourceConfigOperation>> {\n const { resourceType, operationIdentifier, ...contextParams } = params;\n const operationPath = this.resourcesRegistryService.getInternalRepositoryOperationPathDefault(\n resourceType,\n operationIdentifier,\n );\n return this.createForInternalOperation<TResourceConfigOperation>({\n ...contextParams,\n operation: operationPath,\n });\n }\n\n /**\n * Bootstrap an INTERNAL execution context for a SERVICE-pipeline operation on\n * the given resource, resolving the operation path `INTERNAL_CALL`-preferred\n * with a URL-bearing fallback (see\n * {@link ResourcesRegistryBackendService.getServiceOperationPathDefault}).\n *\n * This is the seam for internal SERVICE-pipeline operations (`INTERNAL_CALL`):\n * resources whose internal CRUD runs through `doOperation` (ACL, hooks,\n * lifecycle) via `ServicesRegistryHandlerBackendService.list/create/read/update`\n * but has NO HTTP surface — the billing back-office\n * (`AbstractBillingBackendService` subclasses such as\n * `ProductCatalogSyncBackendService`, and billing-account auto-create). Their\n * catalog + internal-write operations are declared `INTERNAL_CALL`, so the\n * service dispatcher accepts them and this resolver returns their path.\n *\n * Contrast with {@link createForInternalRepositoryOperation}\n * (`REPOSITORY_ONLY`, repository-direct, bypasses the service pipeline — the\n * `FilesBackendService` pattern). Reaching for the repository seam on a\n * service-pipeline resource resolves to NOTHING (no `REPOSITORY_ONLY` default)\n * and vice-versa; pick the seam that matches the resource's declared transport.\n *\n * Identity (`initiatorIds`, `initiatorRoles`) and scope\n * (`contextResourcesFieldIdentifier`, `relationshipContexts`) are forwarded\n * verbatim to {@link createForInternalOperation}; omit them for an unattributed\n * system context.\n */\n public async createForInternalServiceOperation<TResourceConfigOperation extends ResourceConfiguration_Operation<any, any, any> >(\n params: Omit<ExecutionContext_FactoryParams, 'executionType' | 'operation'> & {\n resourceType: ResourceType;\n operationIdentifier: string;\n }\n ): Promise<ExecutionContext<TResourceConfigOperation>> {\n const { resourceType, operationIdentifier, ...contextParams } = params;\n const operationPath = this.resourcesRegistryService.getServiceOperationPathDefault(\n resourceType,\n operationIdentifier,\n );\n return this.createForInternalOperation<TResourceConfigOperation>({\n ...contextParams,\n operation: operationPath,\n });\n }\n\n /**\n * Create an internal execution context for a custom batch definition.\n *\n * Custom batches are authored outside the resource-operation registry, so\n * some of them either:\n *\n * 1. point at semantic operation identifiers that do not exist as concrete\n * `CRON_JOB` / `BATCH_JOB` registry variants on a real resource\n * (`kind: CustomBatchManifestKind.RESOURCE_ANCHORED`), or\n * 2. are event-triggered cross-resource workers with no honest target\n * resource at all (`kind: CustomBatchManifestKind.SCOPE_ANCHORED` — e.g. `email.batch-send`,\n * `m2m-webhook-delivery`).\n *\n * In both cases we bootstrap through a real registered operation so that\n * `populateApplicationIdIfNeeded` and the rest of the EC creator wiring run\n * unmodified, then swap the operation for the custom batch's synthetic\n * identity via {@link ExecutionContext.withOperation}, which preserves\n * `_initiatorIds` (including the freshly populated `applicationId`),\n * `_subCallDepth`, `_visitedResources`, and the request UUID — i.e. the\n * audit-relevant identity carried by the bootstrap context survives the\n * swap, only the operation slot changes.\n *\n * Resource-anchored batches resolve the bootstrap on their declared\n * `(resourceIdentifier, operationIdentifier)` pair (matching the existing\n * registry-backed behavior). Scope-anchored batches deliberately bootstrap\n * on `APPLICATION.READ` instead of pretending to be operations on an\n * unrelated resource — the synthetic operation then carries the declared\n * `primaryScope` so downstream authorization and audit logs see the honest\n * scope rather than the bootstrap one.\n */\n public async createForInternalCustomBatch(\n params: {\n batchOperationContext: BatchesCronjobsCustomExecution_Context;\n contextResourcesFieldIdentifier: Map<ResourceFieldIdentifier, string>;\n relationshipContexts?: ExecutionContext_RelationshipContext[];\n }\n ): Promise<ExecutionContext<any>> {\n const { batchOperationContext, contextResourcesFieldIdentifier, relationshipContexts } = params;\n\n if (batchOperationContext.kind === CustomBatchManifestKind.SCOPE_ANCHORED) {\n return this.createForInternalScopeAnchoredCustomBatch({\n batchOperationContext,\n contextResourcesFieldIdentifier,\n relationshipContexts,\n });\n }\n\n const resourceConfig = this.resourcesRegistryService\n .getResourcesRegistry()\n .resourceConfigurations[batchOperationContext.resourceIdentifier];\n\n if (!resourceConfig) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: `Custom batch '${batchOperationContext.operationIdentifier}' targets unknown resource '${batchOperationContext.resourceIdentifier}'`,\n resourceIdentifier: batchOperationContext.resourceIdentifier,\n operationIdentifier: batchOperationContext.operationIdentifier,\n }\n }\n );\n }\n\n const expectedVariantType = batchOperationContext.cronJobExpression\n ? ResourceOperationVariantType.CRON_JOB\n : ResourceOperationVariantType.BATCH_JOB;\n\n const exactVariantMatches = resourceConfig.operations.filter((operation) =>\n operation.operationIdentifier === batchOperationContext.operationIdentifier\n && operation.variantType === expectedVariantType\n );\n\n if (exactVariantMatches.length > 1) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: `Custom batch operation resolution is ambiguous for '${batchOperationContext.resourceIdentifier}.${batchOperationContext.operationIdentifier}'`,\n resourceIdentifier: batchOperationContext.resourceIdentifier,\n operationIdentifier: batchOperationContext.operationIdentifier,\n expectedVariantType,\n matchedCount: exactVariantMatches.length,\n }\n }\n );\n }\n\n const bootstrapOperation = exactVariantMatches[0]\n ?? this.resolveBootstrapOperationForCustomBatch(resourceConfig, batchOperationContext.operationIdentifier);\n\n const bootstrapContext = await this.createForInternalOperation({\n operation: ResourcesConfig_OperationPathUtils.extractOperationPath(bootstrapOperation),\n contextResourcesFieldIdentifier,\n initiatorIds: null,\n initiatorRoles: this.createInternalSystemRoles(),\n relationshipContexts,\n });\n\n const syntheticBatchOperation: ResourceConfiguration_Operation<any, any, any> = expectedVariantType === ResourceOperationVariantType.CRON_JOB\n ? {\n ...bootstrapOperation,\n operationIdentifier: batchOperationContext.operationIdentifier,\n variantType: ResourceOperationVariantType.CRON_JOB,\n cronExpression: batchOperationContext.cronJobExpression ?? '',\n isOperationDefault: false,\n roles: [],\n } as ResourceConfiguration_Operation<any, any, any>\n : {\n ...bootstrapOperation,\n operationIdentifier: batchOperationContext.operationIdentifier,\n variantType: ResourceOperationVariantType.BATCH_JOB,\n isOperationDefault: false,\n roles: [],\n } as ResourceConfiguration_Operation<any, any, any>;\n\n return bootstrapContext.withOperation(syntheticBatchOperation);\n }\n\n /**\n * Bootstrap an `ExecutionContext` for a `scope_anchored` custom batch.\n *\n * Strategy (OD-2.c \"spread-and-override\"):\n *\n * 1. Resolve the canonical `APPLICATION.READ` operation as the bootstrap\n * anchor. APPLICATION.READ is always registered and always\n * APPLICATION-scoped, which is exactly what we need to make\n * `populateApplicationIdIfNeeded` fire during\n * `createForInternalOperation` so the bootstrap context carries a\n * populated `applicationId` before the operation swap.\n * 2. Spread the bootstrap operation and override the identity-carrying\n * fields with the batch's synthetic shape: the declared\n * `operationIdentifier`, `BATCH_JOB`/`CRON_JOB` variant type, the\n * optional cron expression, `isOperationDefault: false`, an empty\n * `roles` list, and — crucially — `resourcePrimaryScope` from the\n * batch context so downstream authorization sees the honest scope\n * rather than the bootstrap APPLICATION scope.\n * 3. Swap the operation via {@link ExecutionContext.withOperation}, which\n * preserves `_initiatorIds` (and therefore the `applicationId` populated\n * in step 1), `_subCallDepth`, `_visitedResources`, and the request\n * UUID. Only the `operation` slot changes; the audit-relevant identity\n * of the bootstrap context survives.\n *\n * This is the engine-level seam that lets event-triggered batches stop\n * pretending to be operations on an unrelated resource. The synthetic\n * `roles: []` is intentional: the bootstrap context already carries the\n * `APP_ADMIN_SUPER_ADMIN` system role via `createInternalSystemRoles()`,\n * and the synthetic operation must not advertise additional public roles.\n */\n private async createForInternalScopeAnchoredCustomBatch(\n params: {\n batchOperationContext: Extract<\n BatchesCronjobsCustomExecution_Context,\n { kind: CustomBatchManifestKind.SCOPE_ANCHORED }\n >;\n contextResourcesFieldIdentifier: Map<ResourceFieldIdentifier, string>;\n relationshipContexts?: ExecutionContext_RelationshipContext[];\n }\n ): Promise<ExecutionContext<any>> {\n const { batchOperationContext, contextResourcesFieldIdentifier, relationshipContexts } = params;\n\n const bootstrapOperationPath = this.resourcesRegistryService.getOperationPathDefault(\n CoreResourceType.APPLICATION,\n CoreResourceOperation.READ,\n );\n const bootstrapOperation = this.resourcesRegistryService.getOperationFromPath(bootstrapOperationPath);\n\n const bootstrapContext = await this.createForInternalOperation({\n operation: ResourcesConfig_OperationPathUtils.extractOperationPath(bootstrapOperation),\n contextResourcesFieldIdentifier,\n initiatorIds: null,\n initiatorRoles: this.createInternalSystemRoles(),\n relationshipContexts,\n });\n\n const expectedVariantType = batchOperationContext.cronJobExpression\n ? ResourceOperationVariantType.CRON_JOB\n : ResourceOperationVariantType.BATCH_JOB;\n\n const syntheticBatchOperation: ResourceConfiguration_Operation<any, any, any> = expectedVariantType === ResourceOperationVariantType.CRON_JOB\n ? {\n ...bootstrapOperation,\n operationIdentifier: batchOperationContext.operationIdentifier,\n variantType: ResourceOperationVariantType.CRON_JOB,\n cronExpression: batchOperationContext.cronJobExpression ?? '',\n resourcePrimaryScope: batchOperationContext.primaryScope,\n isOperationDefault: false,\n roles: [],\n } as ResourceConfiguration_Operation<any, any, any>\n : {\n ...bootstrapOperation,\n operationIdentifier: batchOperationContext.operationIdentifier,\n variantType: ResourceOperationVariantType.BATCH_JOB,\n resourcePrimaryScope: batchOperationContext.primaryScope,\n isOperationDefault: false,\n roles: [],\n } as ResourceConfiguration_Operation<any, any, any>;\n\n return bootstrapContext.withOperation(syntheticBatchOperation);\n }\n\n\n async createForPublicOperation<TResourceConfigOperation extends ResourceConfiguration_Operation<any, any, any>>(\n params: Omit<ExecutionContext_FactoryParams, 'executionType'>\n ): Promise<ExecutionContext<TResourceConfigOperation>> {\n\n return this.createExecutionContext({\n ...params,\n executionType: ExecutionContext_ExecutionType.PUBLIC_EXECUTION,\n });\n }\n\n\n\n /**\n * Create internal execution context for system operations (no specific operation context needed).\n * Convenience method for queue services, tracking, and other internal operations.\n *\n * Uses a generic \"system\" operation that grants full access within the application scope.\n * This is used by queue services for internal DB operations that don't have a specific user context.\n */\n public async createForInternalSystemOperation(): Promise<ExecutionContext<any>> {\n // Use a generic internal operation for system-level access\n const operationPath = this.resourcesRegistryService.getOperationPathDefault(\n CoreResourceType.APPLICATION,\n CoreResourceOperation.READ\n );\n const systemOperation = this.resourcesRegistryService.getOperationFromPath(operationPath);\n\n return this.createForInternalOperation({\n operation: systemOperation,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null, // Null for internal operations\n initiatorRoles: this.createInternalSystemRoles(),\n relationshipContexts: [],\n });\n }\n\n private resolveBootstrapOperationForCustomBatch(\n resourceConfig: AnyResourceConfiguration,\n operationIdentifier: string,\n ): AnyResourceConfiguration['operations'][number] {\n const sameIdentifierOperations = resourceConfig.operations.filter(\n (operation) => operation.operationIdentifier === operationIdentifier\n );\n\n // A multi-variant anchor is NOT ambiguous when the configuration declares which variant is the\n // default: that is the one the batch's own `servicesRegistry.<verb>()` will dispatch through\n // (`getServiceOperationPathDefault`), so bootstrapping on anything else would describe an\n // operation the batch never performs.\n //\n // Without this, ANY resource whose anchor verb declares more than one variant makes its\n // resource-anchored batch unrunnable — it throws CONFIGURATION on every invocation. That is not\n // hypothetical: `organization-purge` anchors on `ORGANIZATIONS | DELETE`, which declares an\n // INTERNAL_CALL default (the purge door) plus an `admin` API_CALL variant, so the tenant-teardown\n // batch failed on every run and marked tenants were never destroyed — the exact failure the\n // retention window exists to prevent, and silent because a batch failure is logged, not surfaced.\n //\n // Defaults are variant-type-LOCAL, so several transport groups can each declare one. The\n // tie-break mirrors the service resolver's own transport preference (native INTERNAL first, then\n // URL-bearing) rather than inventing a second, divergent rule. Genuine ambiguity — no default at\n // all, or two within the same preference tier — still fails closed below.\n if (sameIdentifierOperations.length > 1) {\n const defaultOperations = sameIdentifierOperations.filter(\n (operation) => operation.isOperationDefault === true\n );\n const preferredDefault = SERVICE_RESOLVABLE_TRANSPORT_PREFERENCE\n .map((variantTypes) => defaultOperations.filter((operation) => variantTypes.includes(operation.variantType)))\n .find((matches) => matches.length === 1)?.[0];\n if (preferredDefault) {\n return preferredDefault;\n }\n }\n\n if (sameIdentifierOperations.length > 1) {\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'Custom batch bootstrap operation is ambiguous because multiple variants share the requested operation identifier',\n resourceIdentifier: resourceConfig.resourceIdentifier,\n operationIdentifier,\n candidateVariants: sameIdentifierOperations.map((operation) => ({\n variantType: operation.variantType,\n variantKey: operation.variantKey,\n isOperationDefault: operation.isOperationDefault,\n })),\n }\n }\n );\n }\n const sameIdentifierOperation = sameIdentifierOperations[0];\n\n if (sameIdentifierOperation) {\n return sameIdentifierOperation;\n }\n\n const defaultReadOperations = resourceConfig.operations.filter(\n (operation) => operation.operationIdentifier === CoreResourceOperation.READ\n && operation.isOperationDefault === true\n );\n if (defaultReadOperations.length > 1) {\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'Custom batch bootstrap READ operation is ambiguous because multiple default variants exist',\n resourceIdentifier: resourceConfig.resourceIdentifier,\n operationIdentifier,\n candidateVariants: defaultReadOperations.map((operation) => ({\n variantType: operation.variantType,\n variantKey: operation.variantKey,\n })),\n }\n }\n );\n }\n const defaultReadOperation = defaultReadOperations[0];\n\n if (defaultReadOperation) {\n return defaultReadOperation;\n }\n\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: `Custom batch '${operationIdentifier}' cannot bootstrap an execution context because resource '${resourceConfig.resourceIdentifier}' exposes no requested operation and no default READ operation`,\n resourceIdentifier: resourceConfig.resourceIdentifier,\n operationIdentifier,\n }\n }\n );\n }\n\n /**\n * Create an ExecutionContext for a webhook callback.\n *\n * Webhook events are not tied to a single resource operation — a single event\n * (e.g., invoice.paid) may trigger multiple operations (update subscription, create invoice record, adjust credits).\n * Uses APPLICATION.READ as a generic \"entry\" operation for the pipeline.\n * Capability handlers create per-resource sub-contexts via createForSubCall() for specific operations.\n *\n * @param resolvedScope - Scope identifiers resolved from the webhook event payload\n * @param parsedEvent - The parsed webhook event (for providerRef metadata)\n */\n public async createForWebhookCallback(\n resolvedScope: {\n applicationId?: string;\n organizationId?: string;\n userId?: string;\n providerScopeIds?: Record<string, string>;\n },\n parsedEvent: {\n providerRef: string;\n endpointKey: string;\n eventId: string;\n eventType: string;\n }\n ): Promise<ExecutionContext<any>> {\n // Use a generic APPLICATION.READ operation as the entry point\n const operationPath = this.resourcesRegistryService.getOperationPathDefault(\n CoreResourceType.APPLICATION,\n CoreResourceOperation.READ,\n );\n const operation = this.resourcesRegistryService.getOperationFromPath(operationPath);\n\n // Map all resolved scope fields to initiatorIds\n const initiatorIds: ExecutionContext_InitiatorIds = {\n applicationId: resolvedScope.applicationId,\n organizationId: resolvedScope.organizationId,\n userId: resolvedScope.userId,\n webhookProviderId: parsedEvent.providerRef,\n };\n\n const executionContext = new ExecutionContext(\n operation,\n ExecutionContext_ExecutionType.WEBHOOK_CALLBACK,\n new Map(),\n initiatorIds,\n [], // No roles — webhooks are trusted after signature verification\n []\n );\n\n await this.populateApplicationIdIfNeeded(executionContext);\n\n return executionContext;\n }\n\n /**\n * Reconstruct ExecutionContext from serialized data (for queue workers).\n *\n * This method:\n * 1. Deserializes the operationPathJson to get the OperationPath\n * 2. Gets the full Operation from the registry\n * 3. Reconstructs ExecutionContext with the original execution type, initiator IDs, and roles\n *\n * @param executionContextJson - Serialized execution context data (optional for CUSTOM_BATCH/SCHEDULED_CRON)\n * @param operationPathJson - Serialized operation path from JobPayload (optional for CUSTOM_BATCH)\n * @returns Reconstructed ExecutionContext ready for execution\n */\n public async reconstructFromSerializedData(\n executionContextJson: string | undefined,\n operationPathJson: string | undefined\n ): Promise<ExecutionContext<any>> {\n // Import dynamically to avoid circular dependencies\n const { ResourceSerializationUtils } = await import('@wildo-ai/saas-models');\n\n // If no serialized data, return internal system context\n if (!executionContextJson || !operationPathJson) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.JOB_EXECUTION_CONTEXT_INVALID,\n context: { message: 'Cannot reconstruct ExecutionContext from undefined serialized data' },\n }\n );\n }\n\n // Deserialize the data\n const ctxData = ResourceSerializationUtils.deserializeExecutionContextData(executionContextJson);\n const operationPath = ResourceSerializationUtils.deserializeOperationPath(operationPathJson);\n\n // Get the full operation from registry\n const operation = this.resourcesRegistryService.getOperationFromPath(operationPath);\n\n // Convert contextResourcesFieldIdentifier from plain object to Map\n // Note: The schema accepts Map<string, string> but the actual ExecutionContext uses Map<ResourceFieldIdentifier, string | string[]>\n // We convert arrays to comma-separated strings for factory param compatibility\n const contextResourcesMap = new Map<string, string>();\n if (ctxData.contextResourcesFieldIdentifier) {\n Object.entries(ctxData.contextResourcesFieldIdentifier).forEach(([key, value]) => {\n // Convert arrays to first value (most common case) or comma-separated for compatibility\n const stringValue = Array.isArray(value) ? value[0] ?? '' : value;\n contextResourcesMap.set(key, stringValue);\n });\n }\n\n // Convert relationshipContexts\n const relationshipContexts = ctxData.relationshipContexts || [];\n\n // Reconstruct ExecutionContext based on original execution type\n if (ctxData.executionType === ExecutionContext_ExecutionType.INTERNALLY_INITIATED_REQUEST) {\n return this.createForInternalOperation({\n operation,\n contextResourcesFieldIdentifier: contextResourcesMap,\n initiatorIds: ctxData.initiatorIds,\n initiatorRoles: ctxData.initiatorRoles,\n relationshipContexts,\n });\n } else if (ctxData.executionType === ExecutionContext_ExecutionType.PUBLIC_EXECUTION) {\n return this.createForPublicOperation({\n operation,\n contextResourcesFieldIdentifier: contextResourcesMap,\n initiatorIds: ctxData.initiatorIds,\n initiatorRoles: ctxData.initiatorRoles,\n relationshipContexts,\n });\n } else if (ctxData.executionType === ExecutionContext_ExecutionType.ANONYMOUS_SESSION) {\n // W7.3a: Reconstruct anonymous session context with anonymousUserId from serialized initiatorIds\n return this.createExecutionContext({\n executionType: ExecutionContext_ExecutionType.ANONYMOUS_SESSION,\n operation,\n contextResourcesFieldIdentifier: contextResourcesMap,\n initiatorIds: ctxData.initiatorIds,\n initiatorRoles: ctxData.initiatorRoles ?? [{ roles: [CORE_APP_ROLES.APP_ANONYMOUS], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n relationshipContexts,\n });\n } else if (ctxData.executionType === ExecutionContext_ExecutionType.WEBHOOK_CALLBACK) {\n // Webhook callback — reconstruct with the resolved scope from initiatorIds\n return this.createForWebhookCallback(\n {\n applicationId: ctxData.initiatorIds?.applicationId,\n organizationId: ctxData.initiatorIds?.organizationId,\n userId: ctxData.initiatorIds?.userId,\n },\n {\n providerRef: ctxData.initiatorIds?.webhookProviderId ?? 'unknown',\n endpointKey: 'reconstructed',\n eventId: 'reconstructed',\n eventType: 'reconstructed',\n }\n );\n } else {\n // USER_REQUEST, API_KEY, etc. - use createExecutionContext\n return this.createExecutionContext({\n executionType: ctxData.executionType as ExecutionContext_ExecutionType,\n operation,\n contextResourcesFieldIdentifier: contextResourcesMap,\n initiatorIds: ctxData.initiatorIds,\n initiatorRoles: ctxData.initiatorRoles,\n relationshipContexts,\n });\n }\n }\n\n /**\n * Keep only the context fields the TARGET resource can actually be filtered by.\n *\n * The predicate deliberately mirrors the repository's own contextual-filter rule, so this never\n * drops a field the repository would have honoured:\n *\n * - the field resolves to a path in the target's `mainSchema` (the NON-throwing lookup, the same\n * one the write path uses to decide where to inject); or\n * - it is the target's own primary-scope field identifier, which a scoped resource carries as a\n * top-level column even when the Zod schema does not model it (`auditLogs.applicationId`, the\n * shared `ScopeFeaturesWithOverridesSchema` resources, …).\n *\n * Anything else would make the repository throw `context_filter`. An unresolvable target\n * configuration returns the map untouched: this is a defensive narrowing, not an authority, and it\n * must never be the reason a context silently loses its scope.\n */\n private retainContextFieldsKnownToResource(\n inherited: Map<ResourceFieldIdentifier, string | string[]>,\n resourceType: ResourceType,\n ): Map<ResourceFieldIdentifier, string | string[]> {\n // Optional calls, deliberately. This narrowing is a REPAIR, never a gate: when the registry or\n // the helper cannot answer (a minimal test container, a partially-wired bootstrap), the correct\n // fallback is to inherit unchanged — i.e. the pre-existing behaviour, which is fail-CLOSED at the\n // repository. Declining an optional repair is not the same as relaxing an enforcement.\n const targetConfiguration = this.resourcesRegistryService.tryGetResourceConfiguration?.(resourceType);\n if (!targetConfiguration?.mainSchema || !this.resourceOperationHelper) return new Map(inherited);\n\n const primaryScopeFieldIdentifier = targetConfiguration.resourcePrimaryScope\n ? PRIMARY_SCOPE_TO_FIELD_IDENTIFIER[targetConfiguration.resourcePrimaryScope]\n : undefined;\n\n const retained = new Map<ResourceFieldIdentifier, string | string[]>();\n const dropped: string[] = [];\n for (const [fieldIdentifier, value] of inherited) {\n const isModelled = this.resourceOperationHelper\n .findNestedFieldPathsFromZodSchema(targetConfiguration.mainSchema, fieldIdentifier)\n .length > 0;\n if (isModelled || fieldIdentifier === primaryScopeFieldIdentifier) {\n retained.set(fieldIdentifier, value);\n } else {\n dropped.push(fieldIdentifier);\n }\n }\n\n if (dropped.length > 0) {\n this.logDebug('Sub-call context dropped parent context fields the target resource does not model', {\n resourceType,\n dropped,\n retained: [...retained.keys()],\n });\n }\n return retained;\n }\n\n /**\n * Create a new ExecutionContext for an internal sub-call.\n * Inherits security context from parent but uses the correct operation for the sub-resource.\n *\n * @param parentContext - The parent execution context to inherit from\n * @param resourceType - The resource type for the sub-call\n * @param operationIdentifier - The operation (READ, LIST, etc.)\n * @param options - ServiceOptions with variantKey, dataMode\n * @param resourceId - Optional resource ID for single-resource operations (undefined for LIST)\n * @param relationshipContext - Optional relationship context tracking how we got to this sub-resource.\n * Should be provided when there's an FK relationship between parent and sub-resource.\n * Example: { resourceType: 'USER_SELF', relationshipField: 'userId', resourceId: '...' }\n */\n async createForSubCall(\n parentContext: ExecutionContext<any>,\n resourceType: ResourceType,\n operationIdentifier: CoreResourceOperation,\n options?: ServiceOptions,\n resourceId?: string,\n relationshipContext?: ExecutionContext_RelationshipContext\n ): Promise<ExecutionContext<any>> {\n\n // 0. Validate parent context exists\n if (!parentContext) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'Parent context is required for sub-calls. Use createForInternalOperation for top-level internal operations.'\n }\n }\n );\n }\n\n // 1. Cycle detection and depth check\n const currentDepth = parentContext.getSubCallDepth();\n const MAX_DEPTH = 15;\n if (currentDepth >= MAX_DEPTH) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n parentContext,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: `Max sub-call depth (${MAX_DEPTH}) exceeded. Possible circular dependency.`,\n resourceType,\n operationIdentifier,\n currentDepth\n }\n }\n );\n }\n\n // 2a. Instance-level cycle detection (UPDATE/DELETE — same resourceType:resourceId visited before)\n if (resourceId) {\n const visitKey = `${resourceType}:${resourceId}`;\n if (parentContext.hasVisitedResource(visitKey)) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n parentContext,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: `Circular dependency detected: ${visitKey} already visited in call chain.`,\n visitKey,\n resourceType,\n operationIdentifier\n }\n }\n );\n }\n }\n\n // 2b. Type-level cycle detection for nested CREATE.\n // CREATE has no resourceId, so the instance-level check above is skipped.\n // Instead, detect schema-level cycles by checking if the child resource type\n // already appears as a parent in the relationship context chain.\n // Example: A→B→A cycle would have relationshipContexts=[{resourceType:A},{resourceType:B}]\n // and we're about to create another A — the chain proves a cycle.\n //\n // Performance: O(n) where n = relationship chain depth, typically <5. Negligible.\n if (operationIdentifier === CoreResourceOperation.CREATE && relationshipContext) {\n const ancestorResourceTypes = parentContext.relationshipContexts.map(rc => rc.resourceType);\n if (ancestorResourceTypes.includes(resourceType)) {\n const chainDescription = [...ancestorResourceTypes, resourceType].join(' → ');\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n parentContext,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: `Circular dependency in nested CREATE: resource type \"${resourceType}\" already appears as an ancestor in the relationship chain. Chain: ${chainDescription}`,\n resourceType,\n operationIdentifier,\n chainDescription,\n }\n }\n );\n }\n }\n\n // 3. Get the correct operation path. A provided variant key is part of the\n // caller's intended DTO/policy surface, so missing variants must fail loud\n // instead of silently falling back to default.\n //\n // SERVICE-dispatch resolver (not the URL-only `getOperationPath*`): this is\n // the generic internal-operation context builder and `resourceType` /\n // `operationIdentifier` are arbitrary — including resources whose operations\n // are declared `INTERNAL_CALL` (e.g. nested child creates). The URL-only\n // resolver would throw `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` for\n // those. (The hardcoded `APPLICATION.READ` bootstrap sites elsewhere in this\n // file stay on the URL resolver — that op is always API_CALL.)\n let operationPath: ResourceConfiguration_OperationPath<any, any>;\n if (options?.variantKey) {\n operationPath = this.resourcesRegistryService.getServiceOperationPath(resourceType, operationIdentifier, options.variantKey);\n } else {\n operationPath = this.resourcesRegistryService.getServiceOperationPathDefault(resourceType, operationIdentifier);\n }\n\n // 4. Get the operation configuration\n const operation = this.resourcesRegistryService.getOperationFromPath(operationPath);\n\n // 5. Build contextual FK fields: INHERIT the parent's fields THAT THE TARGET ACTUALLY HAS + add new.\n //\n // Inheriting the parent's map WHOLESALE was a defect. A sub-call changes resource by definition,\n // and the parent's context is keyed to the PARENT's resource — so it routinely carries fields the\n // target has no column for. The repository's contextual filter is (correctly) fail-closed on an\n // unknown context field, so those foreign fields did not degrade the query, they THREW.\n //\n // Concretely (2026-08-05): assigning a member to an organization unit 500'd for every caller.\n // `ORGANIZATION_UNIT_MEMBERS | CREATE` carries `organizationMemberId`; its cross-tenant guard reads\n // ORGANIZATION_UNITS, which has no such field → CONFIGURATION / `context_filter`, and the whole\n // unit-assignment feature was unusable over HTTP.\n //\n // WHY DROPPING IS SAFE — it cannot widen a query. A field removed here is exactly a field the\n // repository would have REFUSED to filter on; there is no case where it would have been applied\n // as a scope and now silently is not. Fields the target does model — including its own\n // primary-scope FK, which scoped resources carry as a top-level column even when the Zod schema\n // does not model it — are all retained, so tenant scoping is untouched. That mirrors the write\n // path's own non-throwing lookup (`enrichDataWithContextFields`).\n const contextResourcesFieldIdentifier = this.retainContextFieldsKnownToResource(\n parentContext.getContextResourceIds() as Map<ResourceFieldIdentifier, string | string[]>,\n resourceType,\n );\n if (resourceId) {\n const allFieldIds = this.resourcesRegistryService.getAllResourceFieldIdentifiers();\n const fieldIdentifier = allFieldIds[resourceType];\n if (fieldIdentifier) {\n contextResourcesFieldIdentifier.set(fieldIdentifier, resourceId);\n }\n }\n\n // 6. Build relationship contexts: inherit the parent's THAT THE TARGET MODELS + add new.\n //\n // The SECOND inheritance channel, and it needs the same narrowing as the context map in step 5 —\n // for the same reason and with the same safety argument. A relationship context drives FK-PATH\n // filtering (`fk_filter`), which is equally fail-closed: a `relationshipField` the target does\n // not model throws rather than degrading the query. Narrowing step 5 alone just moved the unit\n // assignment 500 from `context_filter` to `fk_filter` on the very same field.\n //\n // Entries WITHOUT a `relationshipField` are always kept: they carry no filter, only the\n // ancestry the CREATE cycle-detector above reads (`relationshipContexts.map(rc => rc.resourceType)`),\n // so dropping them could mask a real A→B→A cycle.\n const relationshipContexts = [...parentContext.relationshipContexts].filter((candidate) => {\n if (!candidate.relationshipField) return true;\n return this.retainContextFieldsKnownToResource(\n new Map([[candidate.relationshipField as ResourceFieldIdentifier, '']]),\n resourceType,\n ).size > 0;\n });\n if (relationshipContext) {\n relationshipContexts.push(relationshipContext);\n }\n\n // 7. Build visited resources set: inherit from parent + add current\n const visitedResources = new Set<string>(parentContext.getVisitedResources());\n if (resourceId) {\n visitedResources.add(`${resourceType}:${resourceId}`);\n }\n\n // 8. Create new context inheriting from parent\n // Note: ExecutionType and correlationId inherited (same request flow)\n const subCallContext = new ExecutionContext(\n operation,\n parentContext.executionType, // Inherit - same origin\n contextResourcesFieldIdentifier, // Inherit parent + add new\n parentContext.initiatorIds, // Inherit (readonly, passed as reference)\n [...parentContext.initiatorRoles], // Inherit (spread to new array)\n relationshipContexts, // Inherit parent + add new relationship\n parentContext.correlationId, // INHERIT - same request trace\n currentDepth + 1, // Increment depth for next level\n visitedResources, // Track visited for cycle detection\n parentContext.activeUserType, // Inherit - same user type context\n // Inherit: a nested operation performed as part of an on-behalf-of act is still on behalf of the\n // same principal. Unlike the request-entry setter flags below, this is identity-shaped (it sits\n // with `initiatorIds`, which is also inherited) and confers NO authority, so propagating it can\n // never widen what a sub-call may do — only what the trail can say about who caused it.\n parentContext.auditActorUserId,\n );\n // M5b: propagate the retention see-through flag DOWN the sub-call chain. Unlike the request-entry\n // setter flags (consumable-token / anonymous-session), which are intentionally NOT inherited by\n // sub-calls, a see-through read that traverses relations must keep revealing retained rows at every\n // hop — otherwise a populated / context-embedded retained record silently re-hides mid-traversal.\n // Fail-closed: only propagates when the parent already carries it (default false stays false).\n if (parentContext.seeRetainedData) {\n subCallContext.setSeeRetainedData(true);\n }\n // WS-C: carry the parent's organization-unit narrowing decisions down the sub-call chain. A\n // sub-call does not re-run the request gate, so without this a nested read of a narrowed resource\n // would find no stamp and fail closed to zero rows mid-traversal. The stamps are keyed by\n // resource, so inheriting them can never answer for a resource the gate did not evaluate — a\n // sub-call reaching a DIFFERENT narrowed resource still finds nothing and still fails closed.\n subCallContext.inheritOrganizationUnitNarrowingStamps(parentContext);\n return subCallContext;\n }\n\n public async createExecutionContextFromRequest<\n TCustomOperationEnum extends EnumLikeType | undefined = undefined,\n TCoreOperationEnum extends Partial<CoreResourceOperation> | undefined = undefined,\n TMainSchema extends z.ZodTypeAny = z.ZodTypeAny\n >(\n req: Request,\n operation: ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>,\n initiatorInfo: ResourceConfiguration_Operation_UrlInitiatorInfo\n ): Promise<ExecutionContext<typeof operation>> {\n\n this.logDebug('Creating execution context from request', { operation: operation.operationIdentifier, url: req.url, method: req.method });\n\n // ── Token and authentication sources ──\n const queryToken = req.query?.consumable_token as string | undefined;\n const headerToken = req.headers[WildoHeaderKeys.CONSUMABLE_TOKEN] as string | undefined;\n const tokenAuthConfig = 'tokenAuthentication' in operation ? operation.tokenAuthentication : undefined;\n const policy = tokenAuthConfig?.policy;\n\n // An ALTERNATIVE token may arrive in the `x-consumable-token` HEADER as well as the query string\n // (issue #312, D5). Paths are recorded by every proxy and access log between the client and this\n // process; headers are not — so a credential that travels through an LLM transcript and a shell\n // history is handed to `curl` as a header, and the query form stays for links a browser must follow.\n // Narrow on purpose: the header counts as a credential ONLY when the operation declares an ALTERNATIVE\n // policy. An operation with no token config, or an ADDITIVE one, sees exactly what it saw before.\n const alternativeToken = queryToken ?? (policy === TokenAuthenticationPolicy.ALTERNATIVE ? headerToken : undefined);\n\n // ── GATE 1: Alternative token present — route by policy ──\n if (alternativeToken) {\n if (!tokenAuthConfig) {\n // Trap 6: operation doesn't accept token authentication\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_NOT_ACCEPTED_FOR_OPERATION,\n context: { operationIdentifier: operation.operationIdentifier },\n });\n }\n\n if (policy === TokenAuthenticationPolicy.ALTERNATIVE) {\n this.logDebug('Consumable token provided, processing ALTERNATIVE token authentication');\n\n const expectedTypes = tokenAuthConfig.types || [];\n const consumableTokenObject = await this.consumableTokenService.validateToken(\n alternativeToken,\n expectedTypes.length > 0 ? expectedTypes : undefined,\n );\n\n // Build context from typed token fields (Trap 3: no untyped metadata bag)\n const tokenContext: Record<string, string> = {};\n if (consumableTokenObject.organizationId) {\n tokenContext.organizationId = consumableTokenObject.organizationId;\n }\n if (consumableTokenObject.relatedId) {\n const resourceFieldIdentifier = this.resolveResourceFieldIdentifier(operation);\n if (resourceFieldIdentifier) {\n tokenContext[resourceFieldIdentifier] = consumableTokenObject.relatedId;\n }\n }\n if (consumableTokenObject.userId) {\n tokenContext.userId = consumableTokenObject.userId;\n }\n\n const initiatorCriticalParamsValue = this.validateParameterCoherence(req, initiatorInfo, tokenContext);\n const relationshipContexts = this.buildRelationshipContexts(initiatorInfo, initiatorCriticalParamsValue);\n\n const initiatorIds = {\n consumableTokenId: consumableTokenObject._id,\n organizationId: consumableTokenObject.organizationId,\n userId: consumableTokenObject.userId,\n ...this.extractInitiatorIds(initiatorCriticalParamsValue),\n };\n\n const executionContext = new ExecutionContext(\n operation,\n ExecutionContext_ExecutionType.CONSUMABLE_TOKEN,\n new Map(Object.entries(initiatorCriticalParamsValue)),\n initiatorIds,\n consumableTokenObject.roles || [],\n relationshipContexts\n );\n\n executionContext.setConsumableTokenValue(alternativeToken);\n\n if (operation.resourcePrimaryScope === ResourcePrimaryScope.APPLICATION) {\n await this.populateApplicationIdIfNeeded(executionContext);\n }\n\n return executionContext;\n }\n\n // ADDITIVE: query token is irrelevant — fall through to JWT/API-key auth\n }\n\n // ── GATE 2: JWT / API-key authentication ──\n const authHeader = req.headers[WildoHeaderKeys.AUTHORIZATION] as string | undefined;\n\n if (authHeader) {\n let executionContext: ExecutionContext<typeof operation>;\n\n if (isApiKeyCredential(authHeader)) {\n executionContext = await this.handleApiKeyAuthentication(authHeader, req, operation, initiatorInfo);\n } else if (authHeader.startsWith('oc_org_') || authHeader.startsWith('oc_app_')) {\n // Direct OAuth-client secret front (D2): a registered client presents its\n // long-lived `oc_*` secret per-request (api-key style) and authenticates as a\n // machine principal (ORGANIZATION_MACHINE / APPLICATION_MACHINE). The exchanged short-lived-token front is the\n // Bearer-JWT path below (handleJwtAuthentication), which routes machine tokens to\n // `verifyMachineToken` (iss=aud=the API resource) and enforces the RFC 8707 `aud`\n // gate in its machine arm — both fronts resolve to the same machine principal.\n executionContext = await this.handleOAuthClientSecretAuthentication(authHeader, req, operation, initiatorInfo);\n } else {\n const token = this.parseBearerToken(authHeader);\n executionContext = await this.handleJwtAuthentication(token, req, operation, initiatorInfo);\n\n const reAuthToken = req.headers[WildoHeaderKeys.REAUTH_TOKEN] as string | undefined;\n if (reAuthToken) {\n executionContext.setReAuthTokenValue(reAuthToken);\n }\n }\n\n // ── GATE 3: ADDITIVE check (after JWT/API-key auth succeeded) ──\n if (policy === TokenAuthenticationPolicy.ADDITIVE) {\n if (!headerToken) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.ADDITIVE_TOKEN_REQUIRED,\n context: { operationIdentifier: operation.operationIdentifier },\n });\n }\n const expectedTypes = tokenAuthConfig!.types || [];\n const consumableTokenObject = await this.consumableTokenService.validateToken(\n headerToken,\n expectedTypes.length > 0 ? expectedTypes : undefined,\n );\n\n if (consumableTokenObject.userId && executionContext.initiatorIds?.userId\n && consumableTokenObject.userId !== executionContext.initiatorIds.userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_CONTEXT_MISMATCH,\n context: { operationIdentifier: operation.operationIdentifier },\n });\n }\n\n executionContext.setConsumableTokenValue(headerToken);\n }\n\n return executionContext;\n }\n\n // ADDITIVE operations require JWT/API-key — anonymous sessions cannot satisfy them\n if (policy === TokenAuthenticationPolicy.ADDITIVE) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.ADDITIVE_TOKEN_REQUIRED,\n context: { operationIdentifier: operation.operationIdentifier },\n });\n }\n\n // Step 3: x-anonymous-session header — existing anonymous session with signed JWT\n const anonymousSessionToken = req.headers[WildoHeaderKeys.ANONYMOUS_SESSION] as string | undefined;\n if (anonymousSessionToken) {\n return this.handleAnonymousSessionAuthentication(anonymousSessionToken, req, operation, initiatorInfo);\n }\n\n // Step 4: x-anonymous-session-init header — new session initialization (raw UUID)\n const anonymousSessionInitId = req.headers[WildoHeaderKeys.ANONYMOUS_SESSION_INIT] as string | undefined;\n if (anonymousSessionInitId) {\n return this.handleAnonymousSessionInit(anonymousSessionInitId, req, operation, initiatorInfo);\n }\n\n // Step 5: the operation may be declared PUBLIC — accessible to everyone, no credential.\n if (this.operationAdmitsPublicAccess(operation)) {\n return this.createPublicRequestExecutionContext(operation, req, initiatorInfo);\n }\n\n // Step 6: No authentication provided, and the operation requires some.\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_NO_AUTHENTICATION_PROVIDED });\n }\n\n /**\n * Create an ExecutionContext for manual controller requests (charts, billing, etc.).\n *\n * Manual controllers are NOT resource controllers — they don't have a\n * ResourceConfiguration_Operation or URL initiatorInfo. This method provides a\n * lightweight alternative to createExecutionContextFromRequest that:\n *\n * 1. Extracts the Authorization header (Bearer JWT or API key)\n * 2. Verifies the token and fetches user from the database\n * 3. Builds initiator roles from org memberships\n * 4. Returns an ExecutionContext bound to APPLICATION.READ as a generic operation\n *\n * The returned context carries full identity (userId, roles, orgMemberships)\n * which is sufficient for:\n * - AggregationAuthorizationService (chart queries)\n * - Role-based guards (billing endpoints)\n * - Any service that needs initiatorIds / initiatorRoles\n *\n * @param req - Express Request object with Authorization header\n * @returns ExecutionContext<any> with the caller's identity and roles\n * @throws AUTHENTICATION error if no token, invalid token, or user not found/active\n */\n public async createExecutionContextForManualController(req: Request): Promise<ExecutionContext<any>> {\n this.logDebug('Creating execution context for manual controller', { url: req.url, method: req.method });\n\n // 1. Extract authorization header\n const authHeader = req.headers[WildoHeaderKeys.AUTHORIZATION] as string;\n if (!authHeader) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_NO_AUTHENTICATION_PROVIDED },\n );\n }\n\n // 2. Get a generic operation for the context (APPLICATION.READ — lightweight, application-scoped)\n const operationPath = this.resourcesRegistryService.getOperationPathDefault(\n CoreResourceType.APPLICATION,\n CoreResourceOperation.READ,\n );\n const operation = this.resourcesRegistryService.getOperationFromPath(operationPath);\n const tempContext = this._getTempExecutionContext(operation);\n\n // 3. Handle API key authentication\n const apiKeyScope = apiKeyScopeForCredential(authHeader);\n if (apiKeyScope !== null) {\n // Brute-force / DB-read-exhaustion guard on the presented-secret lookup (identical to the\n // api-key / oauth-client request-auth handlers): reject a saturated source before the read,\n // record a failure after a rejected one.\n const clientIp = getClientIpFromRequest(req);\n await assertMachineAuthAttemptWithinRate(this.redisService, this.errorBuilder, this.logger, clientIp, this.appConfigService.applicationEnv);\n\n try {\n // API keys for manual controllers: only app-level keys make sense\n // (org keys require ORGANIZATIONS-scoped operations which we don't have here)\n if (apiKeyScope === ApiKeyScope.ORGANIZATION) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.API_ORG_KEY_WRONG_RESOURCE,\n },\n );\n }\n // App-level API key — validate and build context\n const appApiKeyRepository = this.repositoriesRegistry.getRepository(CoreResourceType.APPLICATION_API_KEYS);\n // Resolve by the deterministic sha256 of the presented key — only `hashedKey`\n // is persisted (the plaintext never is). MUST stay in sync with the create\n // generation (`api-key-generation.backend.utils`).\n const appApiKey = await appApiKeyRepository.read<ApiKeyApplication>(tempContext, { hashedKey: hashApiKey(authHeader) });\n\n if (!appApiKey || appApiKey.status !== ApiKeyStatus.ACTIVE || isCredentialExpired(appApiKey.expiresAt)) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID, context: { scope: 'application' } },\n );\n }\n\n const executionContext = new ExecutionContext(\n operation,\n ExecutionContext_ExecutionType.APPLICATION_MACHINE,\n new Map(),\n { machineCredential: { authMethod: MachineAuthMethod.API_KEY, credentialId: appApiKey._id } },\n [{ roles: appApiKey.roles || [], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION, relatedResourceId: appApiKey.applicationId }],\n [],\n );\n await this.populateApplicationIdIfNeeded(executionContext, true);\n return executionContext;\n } catch (error) {\n await this.recordMachineAuthFailureIfAuthError(error, clientIp);\n throw error;\n }\n }\n\n // 4. Handle JWT Bearer token\n const token = this.parseBearerToken(authHeader);\n\n try {\n const rawDecodedToken = await this.jwtService.verifyWithoutBackendErrorActions(token);\n const decodedToken = JwtClaim_App_Auth_Schema.parse(rawDecodedToken);\n // Manual controllers accept USER_REQUEST JWTs only — machine tokens (ORGANIZATION_MACHINE /\n // APPLICATION_MACHINE) are intentionally rejected via the fallback throw below. `tokenType`\n // is captured for that error context; the USER arm narrows `decodedToken` directly.\n const tokenType = decodedToken.type;\n\n if (decodedToken.type === ExecutionContext_ExecutionType.USER_REQUEST) {\n const userJwtToken = decodedToken;\n // All-session revocation fence — shared fail-closed `<=` policy, see\n // {@link evaluateUserTokenInvalidationFence} (GRACE-BOUNDARY).\n const { isRevoked } = await evaluateUserTokenInvalidationFence(\n this.redisService, userJwtToken.userId, userJwtToken.iat as number | undefined,\n );\n if (isRevoked) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n context: { reason: 'token_invalidated' },\n });\n }\n // revocation-C: PER-SESSION fence (companion to the user-wide fence above). A first-party access\n // token carries `sessionId`, so an OIDC end_session / per-device logout terminating THAT session\n // reaches this manual-controller front too, not only the resource API. See\n // {@link evaluateSessionInvalidationFence}.\n const { isRevoked: sessionRevoked } = await evaluateSessionInvalidationFence(\n this.redisService, userJwtToken.sessionId, userJwtToken.iat as number | undefined,\n );\n if (sessionRevoked) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n context: { reason: 'session_invalidated' },\n });\n }\n const { initiatorRoles } = await this._fetchUserAndBuildRoles(\n userJwtToken.userId,\n tempContext,\n userJwtToken.authorizationVersion,\n );\n const organizationId = this.resolveManualControllerOrganizationId(req, initiatorRoles);\n\n const executionContext = new ExecutionContext(\n operation,\n ExecutionContext_ExecutionType.USER_REQUEST,\n new Map(),\n {\n userId: userJwtToken.userId,\n ...(organizationId ? { organizationId } : {}),\n },\n initiatorRoles,\n [],\n undefined, // correlationId\n 0, // subCallDepth\n undefined, // visitedResources\n userJwtToken.activeUserType ?? null,\n );\n await this.populateApplicationIdIfNeeded(executionContext);\n return executionContext;\n }\n\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN, context: { tokenType } },\n );\n } catch (error) {\n if (isExpiredJwtVerificationFailure(error)) {\n this.logger.debug('API manual-controller authentication rejected expired access token; client may refresh and retry', {\n customMessageReference: error.customMessageReference,\n statusCode: error.statusCode,\n path: req.originalUrl,\n });\n throw error;\n }\n if (isJwtVerificationFailure(error)) {\n this.logger.warn('API manual-controller authentication failed', {\n error: error.customMessageReference,\n statusCode: error.statusCode,\n path: req.originalUrl,\n });\n throw error;\n }\n if (isWildoBackendError(error)) {\n throw error; // Re-throw engine errors\n }\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED, context: { originalError: describeCaughtError(error) } },\n );\n }\n }\n\n /**\n * Manual endpoints like chart execution are not mounted on resource URLs, so\n * they do not get organization scope from initiatorInfo / URL-param validation.\n *\n * Resolution policy:\n * - If the request explicitly provides `organizationId`, validate it against\n * the caller's active organization memberships and use it.\n * - Otherwise, if the caller belongs to exactly one active organization,\n * infer that org to preserve the common single-tenant case.\n * - Otherwise, leave the org undefined and let downstream org-scoped\n * authorization fail closed instead of widening scope silently.\n */\n private resolveManualControllerOrganizationId(\n req: Request,\n initiatorRoles: ExecutionContext_RoleInfo[],\n ): string | undefined {\n const requestedOrganizationIds = [\n ...new Set(this.getQueryParameterValues(req.query as Record<string, any>, 'organizationId').filter(Boolean)),\n ];\n\n if (requestedOrganizationIds.length > 1) {\n throw this.errorBuilder.buildError(\n ErrorType.VALIDATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.API_CALL_INITIATOR_PARAMETER_INCONSISTENT,\n context: {\n fieldIdentifier: 'organizationId',\n values: requestedOrganizationIds,\n sources: {\n urlValues: ['undefined'],\n queryValues: requestedOrganizationIds,\n bodyValues: ['undefined'],\n tokenValues: ['undefined'],\n },\n },\n },\n );\n }\n\n const membershipOrganizationIds = [\n ...new Set(\n initiatorRoles.filter((roleInfo) => roleInfo.relatedPrimaryScope === ResourcePrimaryScope.ORGANIZATIONS && !!roleInfo.relatedResourceId)\n .map((roleInfo) => roleInfo.relatedResourceId as string),\n ),\n ];\n\n const requestedOrganizationId = requestedOrganizationIds[0];\n if (requestedOrganizationId) {\n if (!membershipOrganizationIds.includes(requestedOrganizationId)) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHORIZATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED,\n context: {\n // diagnostic (log-only)\n organizationId: requestedOrganizationId,\n },\n },\n );\n }\n return requestedOrganizationId;\n }\n\n return membershipOrganizationIds.length === 1 ? membershipOrganizationIds[0] : undefined;\n }\n\n /**\n * Resolve the active organization for a socket connection from server-verified\n * state. Mirrors the membership authority of `resolveManualControllerOrganizationId`\n * (the HTTP no-URL-scope path) but is **non-throwing**: a stale or non-member\n * client-supplied `requestedOrganizationId` is ignored (not trusted, not fatal)\n * rather than failing the whole websocket connection. The result is only ever an\n * org the caller is a verified member of, so it is safe to seed\n * `initiatorIds.organizationId` — which the org-scope authorization gate\n * (`authorizeOrganizations`) compares against the requested resource.\n *\n * - requested + member → the requested org (either source)\n * - `CLIENT_PINNED` + non-member → **undefined — decline, never substitute** (see below)\n * - `USER_REQUESTED` + non-member, OR absent, with 1 membership → infer the sole membership\n * - otherwise (multi-org, no valid selector) → undefined (org-scoped resource\n * subscribes then fail closed until the client pins one via ORGANIZATION_SWITCH)\n *\n * SECURITY: never returns a value not present in `initiatorRoles` under EITHER source, so neither a\n * handshake selector nor a delegating OAuth client can widen the caller's org scope.\n *\n * ## Why the source matters on a MISS (the attribution bug this branch exists to prevent)\n *\n * Membership gating protects AUTHORIZATION, but silent substitution corrupts ATTRIBUTION. A\n * consultant who is a member of Globex only may legitimately consent to ACME's agent client — the\n * consent gate deliberately FORCES the consent screen for a non-member rather than rejecting them\n * (see `OidcAuthorizationCodeBackendService.resolveAuthorizationClientConsent`), so such a token is\n * valid by design. Falling through to single-membership inference would then resolve Acme's pin to\n * **Globex**, and Acme's registered client would operate in — and spend against — Globex's budget,\n * for a client Globex never registered. No data crosses, but the tenant attribution is wrong and\n * silent. A `CLIENT_PINNED` miss therefore declines to self scope instead of inferring.\n */\n /**\n * Resolve the ORGANIZATION that a user-delegated token's issuing OAuth client belongs to, from the\n * token's `azp` (authorized-party) claim. This is what gives a delegated A2A / MCP turn an active\n * organization at all — without it every such turn resolves to no-org.\n *\n * ## Why `azp` is a sufficient and safe tenant signal\n *\n * `azp` is MANDATORY on every delegated user token (hard-enforced at mint in\n * `JwtBackendService.createJwtForDelegatedUserToken`), and it is a SERVER-verified claim on a\n * signature-checked token — not a caller-supplied header. Org-scoped OAuth clients live in their own\n * resource type (`OAUTH_CLIENTS_ORGANIZATION`), each carrying a required `organizationId`, so a hit\n * here means \"the user consented to a client that BELONGS to this organization\" — the same model as\n * an installation-scoped token. The value is still re-validated against live membership downstream\n * by {@link resolveSocketActiveOrganizationId}, so a stale or tampered record cannot widen scope.\n *\n * Returns `undefined` when the client is not org-scoped (an APPLICATION-scoped client has no tenant\n * to pin; the caller then falls back to `USER_REQUESTED` inference, which is correct for it).\n *\n * ## Failure posture: THROW rather than degrade (deliberate)\n *\n * A read failure means we cannot determine tenancy. Silently proceeding would fall through to\n * single-membership inference and risk attributing the turn — and its SPEND — to an organization\n * that never registered this client, which is a silent, persistent, cross-tenant error. A thrown\n * auth error is loud, transient and retryable. Loud-and-transient beats silent-and-persistent, so\n * this fails closed. The exposure window is narrow: `_fetchUserAndBuildRoles` reads the user and\n * roles moments later, so a broad datastore outage already fails the request regardless.\n *\n * NOTE (out of scope, tracked separately): client `status` is deliberately NOT gated here. Whether a\n * REVOKED client's already-minted delegated tokens should still authenticate is a distinct question\n * from which tenant that client belongs to — revoking a client must not retroactively re-attribute\n * its in-flight turns to a different organization.\n */\n private async resolveDelegatingClientOrganizationId(clientId: string | undefined): Promise<string | undefined> {\n if (!clientId) return undefined;\n try {\n const internalEc = await this.createForInternalRepositoryOperation({\n resourceType: CoreResourceType.OAUTH_CLIENTS_ORGANIZATION,\n operationIdentifier: CoreResourceOperation.READ,\n });\n const client = await this.repositoriesRegistry\n .getRepository(CoreResourceType.OAUTH_CLIENTS_ORGANIZATION)\n .read<OAuthClientOrganization>(internalEc, clientId);\n // A miss is the APPLICATION-scoped (or unknown) client case — no tenant pin exists.\n return client?.organizationId;\n } catch (error) {\n this.logger.warn('Delegating OAuth client tenant lookup failed — failing closed rather than inferring an organization', {\n clientId,\n ...projectCaughtErrorLogFields(error),\n });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { reason: 'delegating_client_tenant_unresolvable' },\n });\n }\n }\n\n private resolveSocketActiveOrganizationId(\n requestedOrganizationId: string | undefined,\n initiatorRoles: ExecutionContext_RoleInfo[],\n organizationSelectionSource: ActiveOrganizationSelectionSource,\n ): string | undefined {\n const membershipOrganizationIds = [\n ...new Set(\n initiatorRoles.filter((roleInfo) => roleInfo.relatedPrimaryScope === ResourcePrimaryScope.ORGANIZATIONS && !!roleInfo.relatedResourceId)\n .map((roleInfo) => roleInfo.relatedResourceId as string),\n ),\n ];\n\n if (requestedOrganizationId && membershipOrganizationIds.includes(requestedOrganizationId)) {\n return requestedOrganizationId;\n }\n\n // A client-pinned org that is NOT a membership positively contradicts inference — decline rather\n // than silently substituting a different tenant (see the attribution rationale above).\n if (requestedOrganizationId && organizationSelectionSource === ActiveOrganizationSelectionSource.CLIENT_PINNED) {\n return undefined;\n }\n\n return membershipOrganizationIds.length === 1 ? membershipOrganizationIds[0] : undefined;\n }\n\n private _getTempExecutionContext<\n TCustomOperationEnum extends EnumLikeType | undefined = undefined,\n TCoreOperationEnum extends Partial<CoreResourceOperation> | undefined = undefined,\n TMainSchema extends z.ZodTypeAny = z.ZodTypeAny\n >(\n operation: ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>\n ){\n return new ExecutionContext( operation, ExecutionContext_ExecutionType.INTERNALLY_INITIATED_REQUEST, new Map(), null, [], []);\n }\n\n /**\n * Build relationship contexts from initiator info parameters and extracted values.\n *\n * This extracts FK relationship information from URL parameters to enable:\n * 1. Authorization checks that understand which FK path was used (e.g., assignedToUserId vs createdByUserId)\n * 2. Repository filtering based on the FK relationship\n *\n * @param initiatorInfo The URL initiator info containing parameter definitions\n * @param extractedValues The extracted parameter values from the request\n * @returns Array of relationship contexts for the ExecutionContext\n */\n private buildRelationshipContexts(\n initiatorInfo: ResourceConfiguration_Operation_UrlInitiatorInfo,\n extractedValues: Record<string, string>\n ): ExecutionContext_RelationshipContext[] {\n const relationshipContexts: ExecutionContext_RelationshipContext[] = [];\n\n if (!initiatorInfo.parameters) {\n return relationshipContexts;\n }\n\n for (const param of initiatorInfo.parameters) {\n const value = extractedValues[param.fieldIdentifier];\n if (value) {\n relationshipContexts.push({\n resourceType: param.resourceType,\n relationshipField: param.relationshipField,\n resourceId: value,\n scopeViaJunction: param.scopeViaJunction,\n });\n }\n }\n\n return relationshipContexts;\n }\n\n /**\n * Extract all potential values from URL parameters (req.params)\n * According to Express.js specification, URL params are always flat key-value pairs\n * automatically URL-decoded from route parameters like /users/:userId\n *\n * Examples:\n * - Route: /users/:userId → req.params = { userId: '123' }\n * - Route: /users/:userId/posts/:postId → req.params = { userId: '123', postId: '456' }\n */\n private getUrlParameterValues(params: Record<string, string | undefined>, fieldIdentifier: string): string[] {\n const values: string[] = [];\n\n // Direct access to field (URL params are always flat, no nesting)\n const directValue = params[fieldIdentifier];\n if (this.isValidParameterValue(directValue)) {\n values.push(this.safeStringify(directValue));\n }\n\n return values;\n }\n\n /**\n * Extract all potential values from query parameters (req.query)\n * Handles Express.js query serialization via the `qs` library:\n *\n * Examples of how Express/qs parses query strings:\n * - ?name=John → { name: 'John' }\n * - ?tags=red&tags=blue → { tags: ['red', 'blue'] } (repeated keys = array)\n * - ?tags=red,blue → { tags: 'red,blue' } (comma-separated = single string)\n * - ?user[name]=John&user[age]=25 → { user: { name: 'John', age: '25' } }\n * - ?user[tags]=red&user[tags]=blue → { user: { tags: ['red', 'blue'] } }\n * - ?items[0]=apple&items[1]=banana → { items: ['apple', 'banana'] }\n */\n private getQueryParameterValues(query: Record<string, any>, fieldIdentifier: string): string[] {\n const values: string[] = [];\n\n // Direct access to field\n const directValue = query[fieldIdentifier];\n if (this.isValidParameterValue(directValue)) {\n if (Array.isArray(directValue)) {\n // Handle arrays created by qs from repeated query params (?key=val1&key=val2)\n values.push(...directValue.map(v => this.safeStringify(v)).filter(v => v));\n } else {\n // Handle single values (including comma-separated strings)\n values.push(this.safeStringify(directValue));\n }\n }\n\n // Nested object access (e.g., user.id -> query.user?.id)\n if (fieldIdentifier.includes('.')) {\n const nestedValue = this.getNestedValue(query, fieldIdentifier);\n if (this.isValidParameterValue(nestedValue)) {\n if (Array.isArray(nestedValue)) {\n // Handle nested arrays like user[tags]=red&user[tags]=blue\n values.push(...nestedValue.map(v => this.safeStringify(v)).filter(v => v));\n } else {\n values.push(this.safeStringify(nestedValue));\n }\n }\n }\n\n return values;\n }\n\n /**\n * Extract all potential values from body parameters (req.body)\n * Handles deep object access and arrays according to body parser specifications\n *\n * Examples based on body parser type:\n * - JSON: { \"user\": { \"id\": \"123\", \"tags\": [\"red\", \"blue\"] } }\n * - URL-encoded: user[id]=123&user[tags]=red&user[tags]=blue (parsed to nested object)\n * - Form-data: Can include files and nested structures\n */\n private getBodyParameterValues(body: any, fieldIdentifier: string): string[] {\n const values: string[] = [];\n\n if (!body || typeof body !== 'object') {\n return values;\n }\n\n // Direct access to field\n const directValue = body[fieldIdentifier];\n if (this.isValidParameterValue(directValue)) {\n if (Array.isArray(directValue)) {\n values.push(...directValue.map(v => this.safeStringify(v)).filter(v => v));\n } else {\n values.push(this.safeStringify(directValue));\n }\n }\n\n // Nested object access (e.g., user.id -> body.user?.id)\n if (fieldIdentifier.includes('.')) {\n const nestedValue = this.getNestedValue(body, fieldIdentifier);\n if (this.isValidParameterValue(nestedValue)) {\n if (Array.isArray(nestedValue)) {\n values.push(...nestedValue.map(v => this.safeStringify(v)).filter(v => v));\n } else {\n values.push(this.safeStringify(nestedValue));\n }\n }\n }\n\n return values;\n }\n\n /**\n * Extract all potential values from token context\n * Handles deep object access if token context contains nested objects\n *\n * Token context is application-specific and can contain any structure\n * depending on how the token was parsed and what data it contains.\n *\n * Examples:\n * - JWT claims: { \"userId\": \"123\", \"organizationId\": \"org456\" }\n * - Consumable token data: { \"permissions\": [\"read\", \"write\"], \"scope\": \"user.profile\" }\n */\n private getTokenParameterValues(tokenContext: Record<string, any>, fieldIdentifier: string): string[] {\n const values: string[] = [];\n\n if (!tokenContext || typeof tokenContext !== 'object') {\n return values;\n }\n\n // Direct access to field\n const directValue = tokenContext[fieldIdentifier];\n if (this.isValidParameterValue(directValue)) {\n if (Array.isArray(directValue)) {\n values.push(...directValue.map(v => this.safeStringify(v)).filter(v => v));\n } else {\n values.push(this.safeStringify(directValue));\n }\n }\n\n // Nested object access (e.g., user.id -> tokenContext.user?.id)\n if (fieldIdentifier.includes('.')) {\n const nestedValue = this.getNestedValue(tokenContext, fieldIdentifier);\n if (this.isValidParameterValue(nestedValue)) {\n if (Array.isArray(nestedValue)) {\n values.push(...nestedValue.map(v => this.safeStringify(v)).filter(v => v));\n } else {\n values.push(this.safeStringify(nestedValue));\n }\n }\n }\n\n return values;\n }\n\n /**\n * Get nested value from object using dot notation (e.g., 'user.profile.name')\n */\n private getNestedValue(obj: any, path: string): any {\n if (!obj || typeof obj !== 'object') {\n return undefined;\n }\n\n const keys = path.split('.');\n let current = obj;\n\n for (const key of keys) {\n if (current === null || current === undefined || typeof current !== 'object') {\n return undefined;\n }\n current = current[key];\n }\n\n return current;\n }\n\n /**\n * Check if a parameter value is valid (not null, undefined, or empty string)\n * According to Express.js specification, these values should be ignored\n */\n private isValidParameterValue(value: any): boolean {\n return value !== undefined && value !== null && value !== '';\n }\n\n /**\n * Safely convert a value to string, handling edge cases\n * According to Express.js specification, all parameter values are strings or arrays of strings\n */\n private safeStringify(value: any): string {\n if (value === null || value === undefined) {\n return '';\n }\n if (typeof value === 'string') {\n return value;\n }\n if (typeof value === 'number' || typeof value === 'boolean') {\n return String(value);\n }\n // For objects, convert to string (though this should be rare in Express params)\n return String(value);\n }\n\n private validateParameterCoherence(\n req: Request,\n initiatorInfo: ResourceConfiguration_Operation_UrlInitiatorInfo,\n tokenContext: Record<string, string>\n ): Record<string, string> {\n\n this.logDebug('Validating parameter coherence', { parameters: initiatorInfo.parameters?.map(p => p.fieldIdentifier) || [] });\n\n const initiatorCriticalParamsValue: Record<string, string> = {};\n\n if (!initiatorInfo.parameters || initiatorInfo.parameters.length === 0) {\n return initiatorCriticalParamsValue;\n }\n\n for (const paramInfo of initiatorInfo.parameters) {\n const fieldIdentifier = paramInfo.fieldIdentifier;\n\n // Extract ALL potential values from each source as arrays\n const urlValues = this.getUrlParameterValues(req.params as Record<string, string | undefined>, fieldIdentifier);\n const queryValues = this.getQueryParameterValues(req.query, fieldIdentifier);\n const bodyValues = this.getBodyParameterValues(req.body, fieldIdentifier);\n const tokenValues = this.getTokenParameterValues(tokenContext, fieldIdentifier);\n\n const sources = {\n urlValues: urlValues.length ? urlValues : ['undefined'],\n queryValues: queryValues.length ? queryValues : ['undefined'],\n bodyValues: bodyValues.length ? bodyValues : ['undefined'],\n tokenValues: tokenValues.length ? tokenValues : ['undefined']\n };\n\n // Combine all non-empty values from all sources\n const allValues = [...urlValues, ...queryValues, ...bodyValues, ...tokenValues]\n .filter(v => v !== null && v !== undefined && v !== '');\n\n // check if all mandatory parameters are present\n if (allValues.length === 0) {\n throw this.errorBuilder.buildError( ErrorType.VALIDATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_CALL_INITIATOR_PARAMETER_MISSING,\n context: { fieldIdentifier, sources } } );\n }\n\n // Check if all values are the same\n const uniqueValues = [...new Set(allValues)];\n if (uniqueValues.length > 1) { // Values are inconsistent across sources\n throw this.errorBuilder.buildError( ErrorType.VALIDATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_CALL_INITIATOR_PARAMETER_INCONSISTENT,\n context: { fieldIdentifier, values: uniqueValues, sources } } );\n }\n\n // 🔒 SECURE: Validate parameter format for security-sensitive fields\n const value = uniqueValues[0];\n if (value) {\n this.validateParameterFormat(fieldIdentifier, value, sources);\n }\n\n // Store the consistent value\n if (value) {\n initiatorCriticalParamsValue[fieldIdentifier] = value;\n }\n }\n\n this.logDebug('Parameter coherence validation successful', { extractedParams: Object.keys(initiatorCriticalParamsValue) });\n\n return initiatorCriticalParamsValue;\n }\n\n\n\n /**\n * 🔒 SECURE: Validate parameter format for security-sensitive fields\n */\n private validateParameterFormat(fieldIdentifier: string, value: string, sources?: any): void {\n if (value === 'undefined' || value === null || value === undefined || value === ''){\n throw this.errorBuilder.buildError( ErrorType.VALIDATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_CALL_INITIATOR_PARAMETER_MISSING,\n context: { fieldIdentifier, value, sources } } );\n }\n\n // Validate ID formats (should be alphanumeric, hyphens, underscores only)\n if (fieldIdentifier.toLowerCase().endsWith('id')) {\n if (!/^[a-zA-Z0-9_-]+$/.test(value)) {\n throw this.errorBuilder.buildError( ErrorType.VALIDATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_CALL_INITIATOR_PARAMETER_UNSUPPORTED,\n context: { fieldIdentifier, value, sources, regexStringForIdFormat: '^[a-zA-Z0-9_-]+$' } } );\n }\n }\n\n if (value.length > 255) {\n throw this.errorBuilder.buildError( ErrorType.VALIDATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_CALL_INITIATOR_PARAMETER_UNSUPPORTED,\n context: { fieldIdentifier, value, sources, maxLength: 255 } } );\n }\n }\n\n private parseBearerToken(authHeader: string): string {\n const trimmed = authHeader.trim();\n\n if (!trimmed.toLowerCase().startsWith('bearer ')) {\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN, context: { authHeader } } );\n }\n\n const token = trimmed.substring(7).trim(); // Remove 'Bearer ' prefix\n\n if (!token) {\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN, context: { authHeader } } );\n }\n\n return token;\n }\n\n /**\n * W7.3a: Handle x-anonymous-session header — verify existing session JWT,\n * validate parameter coherence, and create ANONYMOUS_SESSION execution context.\n */\n private async handleAnonymousSessionAuthentication(\n sessionToken: string,\n req: Request,\n operation: ResourceConfiguration_Operation<any, any, any>,\n initiatorInfo: ResourceConfiguration_Operation_UrlInitiatorInfo\n ): Promise<ExecutionContext<any>> {\n\n this.logDebug('Processing anonymous session authentication', { operationId: operation.operationIdentifier });\n\n if (!this.appConfigService.anonymousSessionsEnabled) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_NO_AUTHENTICATION_PROVIDED,\n });\n }\n\n const operationRoles: string[] = operation.roles ?? [];\n if (!operationRoles.includes(CORE_APP_ROLES.APP_ANONYMOUS)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_NO_AUTHENTICATION_PROVIDED,\n context: { operationId: operation.operationIdentifier }, // diagnostic (log-only)\n });\n }\n\n const anonymousSessionService = this.getAnonymousSessionService();\n const { anonymousUserId } = anonymousSessionService.verifySessionToken(sessionToken);\n // Liveness: the anon JWT is stateless — no `TOKEN_INVALID_BEFORE` fence (it carries no `userId`) and no\n // refresh — so a cryptographically-valid token says NOTHING about whether the SUBJECT is still a live,\n // un-converted anonymous identity. Re-read the row and reject a converted / erased / swept subject, so a\n // retained token cannot keep acting — and, post-conversion, cannot mint fresh anon rows under the old\n // `uuidRef`, re-establishing the linkage conversion severs. This is the anon-plane analogue of the USERS\n // front's row re-read + version/status checks (`_fetchUserAndBuildRoles`).\n await anonymousSessionService.assertAnonymousSubjectStillLive(anonymousUserId);\n\n const tokenContext: Record<string, string> = { anonymousUserId };\n const initiatorCriticalParamsValue = this.validateParameterCoherence(req, initiatorInfo, tokenContext);\n\n const relationshipContexts = this.buildRelationshipContexts(initiatorInfo, initiatorCriticalParamsValue);\n\n // Pre-fetch applicationId — the EC constructor requires it for ANONYMOUS_SESSION\n const applicationId = await this.getApplicationId();\n\n const initiatorIds: ExecutionContext_InitiatorIds = {\n anonymousUserId,\n applicationId,\n ...this.extractInitiatorIds(initiatorCriticalParamsValue),\n };\n\n const executionContext = new ExecutionContext(\n operation,\n ExecutionContext_ExecutionType.ANONYMOUS_SESSION,\n new Map(Object.entries(initiatorCriticalParamsValue)),\n initiatorIds,\n [{ roles: [CORE_APP_ROLES.APP_ANONYMOUS], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n relationshipContexts\n );\n\n return executionContext;\n }\n\n /**\n * W7.3a: Handle x-anonymous-session-init header — validate UUID, check feature\n * flag and operation roles, create ANONYMOUS_SESSION execution context with\n * anonymousUserCreated flag for the controller to create the AnonymousUser record.\n */\n private async handleAnonymousSessionInit(\n anonymousUserId: string,\n req: Request,\n operation: ResourceConfiguration_Operation<any, any, any>,\n initiatorInfo: ResourceConfiguration_Operation_UrlInitiatorInfo\n ): Promise<ExecutionContext<any>> {\n\n this.logDebug('Processing anonymous session init', { anonymousUserId, operationId: operation.operationIdentifier });\n\n this.validateParameterFormat('anonymousUserId', anonymousUserId);\n\n if (!this.appConfigService.anonymousSessionsEnabled) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_NO_AUTHENTICATION_PROVIDED,\n });\n }\n\n const operationRoles: string[] = operation.roles ?? [];\n if (!operationRoles.includes(CORE_APP_ROLES.APP_ANONYMOUS)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_NO_AUTHENTICATION_PROVIDED,\n context: { operationId: operation.operationIdentifier }, // diagnostic (log-only)\n });\n }\n\n const tokenContext: Record<string, string> = { anonymousUserId };\n const initiatorCriticalParamsValue = this.validateParameterCoherence(req, initiatorInfo, tokenContext);\n\n const relationshipContexts = this.buildRelationshipContexts(initiatorInfo, initiatorCriticalParamsValue);\n\n // Pre-fetch applicationId — the EC constructor requires it for ANONYMOUS_SESSION\n const applicationId = await this.getApplicationId();\n\n const initiatorIds: ExecutionContext_InitiatorIds = {\n anonymousUserId,\n applicationId,\n ...this.extractInitiatorIds(initiatorCriticalParamsValue),\n };\n\n const executionContext = new ExecutionContext(\n operation,\n ExecutionContext_ExecutionType.ANONYMOUS_SESSION,\n new Map(Object.entries(initiatorCriticalParamsValue)),\n initiatorIds,\n [{ roles: [CORE_APP_ROLES.APP_ANONYMOUS], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n relationshipContexts\n );\n\n executionContext.setAnonymousUserCreated(true);\n\n return executionContext;\n }\n\n /**\n * Does this operation declare `APP_PUBLIC` — accessible to everyone, without access control?\n *\n * ## Why this check exists\n *\n * `CORE_APP_ROLES.APP_PUBLIC` is documented on the enum as \"Unauthenticated access. Operations\n * with APP_PUBLIC are accessible without auth\", and the OpenAPI generator has always PUBLISHED it\n * that way — `roles` containing `APP_PUBLIC` emits an empty `security` array, which the spec\n * defines as no authentication required. The runtime did not implement it: authentication ran to\n * the end of its chain and threw `AUTHENTICATION_NO_AUTHENTICATION_PROVIDED` without ever\n * consulting the operation's roles.\n *\n * So the published API contract and the runtime disagreed. The contract is the one that is right:\n * a public price list, a frontend application configuration, an i18n bundle are genuinely\n * readable by anyone, and today each is reachable only by escaping the resource system into a\n * manual controller. That is a workaround for this gap, not a design.\n *\n * ## Blast radius, measured before writing this\n *\n * ZERO resource configurations in the repository declare `APP_PUBLIC` on an operation — 39\n * declare `APP_ADMIN_SUPER_ADMIN` and 3 declare `APP_ANONYMOUS`, by the same search. So no\n * existing operation changes behaviour: this makes a declaration that nobody could use mean what\n * it says, rather than altering what any shipped route does.\n *\n * ## Read against the DEFAULT variant only\n *\n * The operation reaching this point is already the resolved one for the request. Consulting its\n * declared roles is the same question the authorizer asks later — this is not a second authority,\n * it is the authentication tier declining to demand a credential the operation never required.\n */\n private operationAdmitsPublicAccess(operation: ResourceConfiguration_Operation<any, any, any>): boolean {\n return requiredRolesDeclarePublicAccess((operation as { roles?: string[] }).roles);\n }\n\n /**\n * Build the execution context for a public request — no caller identity, minimal privilege.\n *\n * Mirrors `AuthExecutionContextFactory.createForPreAuthOperation`, which has always produced\n * exactly this pair (`PUBLIC_EXECUTION` + `APP_PUBLIC` at APPLICATION scope) for flows whose\n * caller is unknown. Nothing new is invented here; the shape is reused so a public resource read\n * and a pre-auth flow are the same kind of principal.\n *\n * `initiatorIds` carries only the application: there is no user, no organization and no anonymous\n * subject to attribute, and inventing one would make an unattributable request look attributed.\n */\n private async createPublicRequestExecutionContext<TResourceConfigOperation extends ResourceConfiguration_Operation<any, any, any>>(\n operation: TResourceConfigOperation,\n req: Request,\n initiatorInfo: ResourceConfiguration_Operation_UrlInitiatorInfo,\n ): Promise<ExecutionContext<TResourceConfigOperation>> {\n const initiatorCriticalParamsValue = this.validateParameterCoherence(req, initiatorInfo, {});\n const relationshipContexts = this.buildRelationshipContexts(initiatorInfo, initiatorCriticalParamsValue);\n const applicationId = await this.getApplicationId();\n\n return this.createForPublicOperation<TResourceConfigOperation>({\n operation,\n contextResourcesFieldIdentifier: new Map(Object.entries(initiatorCriticalParamsValue)),\n initiatorIds: { applicationId, ...this.extractInitiatorIds(initiatorCriticalParamsValue) },\n initiatorRoles: [\n { roles: [CORE_APP_ROLES.APP_PUBLIC], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION },\n ],\n relationshipContexts,\n } as never);\n }\n\n /**\n * Extract initiator IDs from critical parameters\n */\n /**\n * Does a `userId` URL segment on THIS operation denote the CALLER (so a value differing from the\n * JWT is a contradiction), or the SUBJECT (so it legitimately differs)?\n *\n * Three cases, and the middle one is the reason this is a predicate rather than a lookup:\n *\n * 1. **`userId` is a PARENT segment** — `/users/{userId}/draft-notes`. The operation's resource is\n * `DRAFT_NOTES`, whose own identifier is `draftNoteId`, so `userId` is scoping the request to\n * whose rows these are. It DOES denote the caller. Guard applies. This case is decided by the\n * field-identifier comparison below and never reaches the declaration.\n * 2. **`userId` is the operation's OWN primary key** — `/users/{userId}` and\n * `/user-self/{userId}`. Structurally identical, semantically opposite, so the owning resource's\n * `primaryKeyIdentifiesInitiator` decides. `USER_SELF` says caller; `USERS` says subject.\n * 3. **The resource cannot be resolved** — a mock, a hand-built config, an unregistered type.\n * Returns `true` (guard applies). Fail-closed: an unknown resource keeps the refusal.\n *\n * The default is `true` at every layer — the factory materialises it, and this reads\n * `!== false` — so a resource can only lose the guard by declaring so deliberately.\n */\n private doesUserIdParamDenoteInitiator(operation: { resourceIdentifier?: unknown }): boolean {\n const resourceIdentifier = operation?.resourceIdentifier;\n if (typeof resourceIdentifier !== 'string' || resourceIdentifier.length === 0) return true;\n\n try {\n const allFieldIdentifiers = this.resourcesRegistryService.getAllResourceFieldIdentifiers();\n // Case 1: the segment belongs to a PARENT, not to this operation's own resource. It scopes the\n // request to a user's rows and must stay guarded, whatever the parent resource declares.\n if (allFieldIdentifiers?.[resourceIdentifier] !== USER_ID_FIELD_IDENTIFIER) return true;\n\n // Case 2: it IS this resource's own primary key — only a deliberate declaration relaxes it.\n const resourceConfiguration = this.resourcesRegistryService.getResourceConfiguration(resourceIdentifier as ResourceType);\n return resourceConfiguration?.primaryKeyIdentifiesInitiator !== false;\n } catch {\n // Case 3: unresolvable resource — fail closed.\n return true;\n }\n }\n\n private extractInitiatorIds(criticalParams: Record<string, string>): Partial<ExecutionContext_InitiatorIds> {\n const initiatorIds: Partial<ExecutionContext_InitiatorIds> = {};\n\n // Map common field identifiers to initiator ID properties\n if (criticalParams.organizationId) {\n initiatorIds.organizationId = criticalParams.organizationId;\n }\n if (criticalParams.userId) {\n initiatorIds.userId = criticalParams.userId;\n }\n if (criticalParams.applicationId) {\n initiatorIds.applicationId = criticalParams.applicationId;\n }\n return initiatorIds;\n }\n\n /**\n * Handle API key authentication (org and app keys)\n */\n private async handleApiKeyAuthentication<\n TCustomOperationEnum extends EnumLikeType | undefined = undefined,\n TCoreOperationEnum extends Partial<CoreResourceOperation> | undefined = undefined,\n TMainSchema extends z.ZodTypeAny = z.ZodTypeAny\n >(\n apiKey: string,\n req: Request,\n operation: ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>,\n initiatorInfo: ResourceConfiguration_Operation_UrlInitiatorInfo\n ): Promise<ExecutionContext<typeof operation>> {\n\n const apiKeyScope = apiKeyScopeForCredential(apiKey);\n if (apiKeyScope === null) throw new Error('API-key authentication requires a recognized API-key credential prefix');\n this.logDebug('Processing API key authentication', { keyType: apiKeyScope });\n\n // Brute-force / DB-read-exhaustion guard on the presented-secret lookup (see the\n // machine-auth-rate-limit utils): reject before the lookup once this source IP has\n // saturated its failed-presentation window; record a failure after a rejected lookup.\n const clientIp = getClientIpFromRequest(req);\n await assertMachineAuthAttemptWithinRate(this.redisService, this.errorBuilder, this.logger, clientIp, this.appConfigService.applicationEnv);\n\n const initiatorCriticalParamsValue = this.validateParameterCoherence(req, initiatorInfo, {});\n\n // Build relationship contexts from URL parameters\n const relationshipContexts = this.buildRelationshipContexts(initiatorInfo, initiatorCriticalParamsValue);\n\n try {\n return (apiKeyScope === ApiKeyScope.ORGANIZATION)\n ? await this.handleOrganizationApiKey(apiKey, initiatorCriticalParamsValue, operation, relationshipContexts)\n : await this.handleApplicationApiKey(apiKey, initiatorCriticalParamsValue, operation, relationshipContexts);\n } catch (error) {\n await this.recordMachineAuthFailureIfAuthError(error, clientIp);\n throw error;\n }\n }\n\n /**\n * Feed the per-source-IP machine-auth failure lockout (see the machine-auth-rate-limit utils)\n * ONLY when the thrown error is an authentication failure. Non-auth errors are not counted so a\n * transient backend fault cannot lock out an honest source.\n */\n private async recordMachineAuthFailureIfAuthError(error: unknown, clientIp: string): Promise<void> {\n if (isWildoBackendError(error) && error.type === ErrorType.AUTHENTICATION) {\n await recordMachineAuthFailure(this.redisService, this.logger, clientIp);\n }\n }\n\n /**\n * Handle organization API key authentication with repository validation\n */\n private async handleOrganizationApiKey<\n TCustomOperationEnum extends EnumLikeType | undefined = undefined,\n TCoreOperationEnum extends Partial<CoreResourceOperation> | undefined = undefined,\n TMainSchema extends z.ZodTypeAny = z.ZodTypeAny\n >(\n apiKey: string,\n initiatorCriticalParamsValue: Record<string, string>,\n operation: ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>,\n relationshipContexts: ExecutionContext_RelationshipContext[]\n ): Promise<ExecutionContext<typeof operation>> {\n\n this.logDebug('Processing organization API key');\n\n if(operation.resourcePrimaryScope !== ResourcePrimaryScope.ORGANIZATIONS) {\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_ORG_KEY_WRONG_RESOURCE,\n context: { resourceIdentifier: operation.resourceIdentifier, primaryScope: operation.resourcePrimaryScope } });\n }\n\n if (!initiatorCriticalParamsValue.organizationId) {\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_ORG_KEY_WITHOUT_ORG_ID,\n context: { providedParams: Object.keys(initiatorCriticalParamsValue) } });\n }\n\n try {\n // Create a temporary execution context for repository access\n const tempExecutionContext = this._getTempExecutionContext(operation);\n\n const orgApiKeyRepository = this.repositoriesRegistry.getRepository(CoreResourceType.ORG_API_KEYS);\n\n // Validate API key exists and is active\n const presentedHash = hashApiKey(apiKey); // Resolve by the persisted sha256, not the raw plaintext\n let orgApiKey = await orgApiKeyRepository.read<ApiKeyOrganization>(tempExecutionContext, {\n hashedKey: presentedHash,\n organizationId: initiatorCriticalParamsValue.organizationId\n });\n\n // Rotation grace window: a rotated-out secret still authenticates against\n // `previousHashedKey` until `previousKeyInvalidationDate` (null = open-ended\n // REGENERATE overlap). The ACTIVE gate below still applies to the resolved key.\n if (!orgApiKey) {\n const rotatedOrgApiKey = await orgApiKeyRepository.read<ApiKeyOrganization>(tempExecutionContext, {\n previousHashedKey: presentedHash,\n organizationId: initiatorCriticalParamsValue.organizationId\n });\n if (rotatedOrgApiKey && isRotationGraceWindowOpen(rotatedOrgApiKey.previousKeyInvalidationDate)) {\n orgApiKey = rotatedOrgApiKey;\n }\n }\n\n if (!orgApiKey || orgApiKey.status !== ApiKeyStatus.ACTIVE || isCredentialExpired(orgApiKey.expiresAt)) {\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID,\n context: { scope: \"organization\", organizationId: initiatorCriticalParamsValue.organizationId, ...(orgApiKey?.status ? { apiKeyStatus: orgApiKey.status } : {}) } }\n );\n }\n\n // Create execution context with API key info\n const initiatorIds: ExecutionContext_InitiatorIds = {\n organizationId: initiatorCriticalParamsValue.organizationId,\n // Machine credential provenance: a static API key (the ApiKey row `_id`, not the raw key).\n machineCredential: { authMethod: MachineAuthMethod.API_KEY, credentialId: orgApiKey._id },\n ...this.extractInitiatorIds(initiatorCriticalParamsValue)\n };\n\n // Create initial execution context (roles will be validated by AuthorizationsBackendService)\n const executionContext = new ExecutionContext(\n operation,\n ExecutionContext_ExecutionType.ORGANIZATION_MACHINE,\n new Map(Object.entries(initiatorCriticalParamsValue)),\n initiatorIds,\n [ { roles: orgApiKey.roles || [], relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS, relatedResourceId: orgApiKey.organizationId } ], // Use API key roles as initial roles\n relationshipContexts\n );\n\n\n return executionContext;\n\n } catch (error) {\n if (isWildoBackendError(error)) {\n throw error; // Re-throw our own errors (including WildoError_Backend)\n }\n\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_API_KEY_FAILED,\n context: {\n organizationId: initiatorCriticalParamsValue.organizationId,\n scope : \"organization\",\n originalError: describeCaughtError(error)\n } });\n }\n }\n\n /**\n * Handle application API key authentication with repository validation\n */\n private async handleApplicationApiKey<\n TCustomOperationEnum extends EnumLikeType | undefined = undefined,\n TCoreOperationEnum extends Partial<CoreResourceOperation> | undefined = undefined,\n TMainSchema extends z.ZodTypeAny = z.ZodTypeAny\n >(\n apiKey: string,\n initiatorCriticalParamsValue: Record<string, string>,\n operation: ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>,\n relationshipContexts: ExecutionContext_RelationshipContext[]\n ): Promise<ExecutionContext<typeof operation>> {\n\n this.logDebug('Processing application API key');\n\n // Fail-closed scope guard (symmetric with the organization handler above): an app\n // machine credential may only authenticate APPLICATION-scoped operations. Without this\n // the app path deferred scope enforcement entirely to downstream role authorization —\n // a defense-in-depth gap the machine-principal unification closes.\n if (operation.resourcePrimaryScope !== ResourcePrimaryScope.APPLICATION) {\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_ORG_KEY_WRONG_RESOURCE,\n context: { resourceIdentifier: operation.resourceIdentifier, primaryScope: operation.resourcePrimaryScope, scope: 'application' } });\n }\n\n try {\n // Create a temporary execution context for repository access\n const tempExecutionContext = this._getTempExecutionContext(operation);\n\n // Validate API key exists and is active\n const appApiKeyRepository = this.repositoriesRegistry.getRepository(CoreResourceType.APPLICATION_API_KEYS);\n const presentedHash = hashApiKey(apiKey); // Resolve by the persisted sha256, not the raw plaintext\n let appApiKey = await appApiKeyRepository.read<ApiKeyApplication>(tempExecutionContext, {\n hashedKey: presentedHash,\n });\n\n // Rotation grace window (see the organization handler): fall back to\n // `previousHashedKey` while the overlap window is open.\n if (!appApiKey) {\n const rotatedAppApiKey = await appApiKeyRepository.read<ApiKeyApplication>(tempExecutionContext, {\n previousHashedKey: presentedHash,\n });\n if (rotatedAppApiKey && isRotationGraceWindowOpen(rotatedAppApiKey.previousKeyInvalidationDate)) {\n appApiKey = rotatedAppApiKey;\n }\n }\n\n if (!appApiKey || appApiKey.status !== ApiKeyStatus.ACTIVE || isCredentialExpired(appApiKey.expiresAt)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID,\n context: { scope: \"application\", ...(appApiKey?.status ? { apiKeyStatus: appApiKey.status } : {}) } } );\n }\n\n const initiatorIds: ExecutionContext_InitiatorIds = {\n // Machine credential provenance: a static API key (the ApiKey row `_id`, not the raw key).\n machineCredential: { authMethod: MachineAuthMethod.API_KEY, credentialId: appApiKey._id },\n ...this.extractInitiatorIds(initiatorCriticalParamsValue)\n };\n\n const executionContext = new ExecutionContext(\n operation,\n ExecutionContext_ExecutionType.APPLICATION_MACHINE,\n new Map(Object.entries(initiatorCriticalParamsValue)),\n initiatorIds,\n [ { roles: appApiKey.roles || [], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION, relatedResourceId: appApiKey.applicationId } ], // Use API key roles as initial roles\n relationshipContexts\n );\n\n await this.populateApplicationIdIfNeeded(executionContext, true);\n\n\n return executionContext;\n\n } catch (error) {\n if (isWildoBackendError(error)) {\n throw error;\n }\n\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_API_KEY_FAILED,\n context: {\n scope: \"application\",\n originalError: describeCaughtError(error)\n } } );\n }\n }\n\n /**\n * Direct OAuth-client secret authentication (D2 \"front a\"). A registered OAuth client\n * presents its long-lived `oc_org_`/`oc_app_` secret per-request; it authenticates as\n * a machine principal via an OAuth client (a distinct credential from an api-key, same principal). Faithful\n * mirror of `handleApiKeyAuthentication` — same hash-lookup + rotation-grace + ACTIVE\n * gate — differing only in the resource (OAUTH_CLIENTS_*), the execution type, and the\n * granted-scopes projection.\n */\n private async handleOAuthClientSecretAuthentication<\n TCustomOperationEnum extends EnumLikeType | undefined = undefined,\n TCoreOperationEnum extends Partial<CoreResourceOperation> | undefined = undefined,\n TMainSchema extends z.ZodTypeAny = z.ZodTypeAny\n >(\n secret: string,\n req: Request,\n operation: ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>,\n initiatorInfo: ResourceConfiguration_Operation_UrlInitiatorInfo\n ): Promise<ExecutionContext<typeof operation>> {\n\n this.logDebug('Processing OAuth client secret authentication', { scope: secret.startsWith('oc_org_') ? 'organization' : 'application' });\n\n // Same brute-force / DB-read-exhaustion guard as the api-key path — the `oc_*` direct-secret\n // front re-hashes and looks up the presented secret exactly like an api-key.\n const clientIp = getClientIpFromRequest(req);\n await assertMachineAuthAttemptWithinRate(this.redisService, this.errorBuilder, this.logger, clientIp, this.appConfigService.applicationEnv);\n\n const initiatorCriticalParamsValue = this.validateParameterCoherence(req, initiatorInfo, {});\n const relationshipContexts = this.buildRelationshipContexts(initiatorInfo, initiatorCriticalParamsValue);\n\n try {\n return (secret.startsWith('oc_org_'))\n ? await this.handleOrganizationOAuthClient(secret, initiatorCriticalParamsValue, operation, relationshipContexts)\n : await this.handleApplicationOAuthClient(secret, initiatorCriticalParamsValue, operation, relationshipContexts);\n } catch (error) {\n await this.recordMachineAuthFailureIfAuthError(error, clientIp);\n throw error;\n }\n }\n\n private async handleOrganizationOAuthClient<\n TCustomOperationEnum extends EnumLikeType | undefined = undefined,\n TCoreOperationEnum extends Partial<CoreResourceOperation> | undefined = undefined,\n TMainSchema extends z.ZodTypeAny = z.ZodTypeAny\n >(\n secret: string,\n initiatorCriticalParamsValue: Record<string, string>,\n operation: ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>,\n relationshipContexts: ExecutionContext_RelationshipContext[]\n ): Promise<ExecutionContext<typeof operation>> {\n\n if (operation.resourcePrimaryScope !== ResourcePrimaryScope.ORGANIZATIONS) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_ORG_KEY_WRONG_RESOURCE,\n context: { resourceIdentifier: operation.resourceIdentifier, primaryScope: operation.resourcePrimaryScope } });\n }\n\n if (!initiatorCriticalParamsValue.organizationId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_ORG_KEY_WITHOUT_ORG_ID,\n context: { providedParams: Object.keys(initiatorCriticalParamsValue) } });\n }\n\n try {\n const tempExecutionContext = this._getTempExecutionContext(operation);\n const repository = this.repositoriesRegistry.getRepository(CoreResourceType.OAUTH_CLIENTS_ORGANIZATION);\n\n const presentedHash = hashOAuthClientSecret(secret);\n let client = await repository.read<OAuthClientOrganization>(tempExecutionContext, {\n hashedSecret: presentedHash,\n organizationId: initiatorCriticalParamsValue.organizationId,\n });\n\n // Rotation grace window: a rotated-out secret still authenticates against\n // `previousHashedSecret` until `previousSecretInvalidationDate`. ACTIVE gate below still applies.\n if (!client) {\n const rotated = await repository.read<OAuthClientOrganization>(tempExecutionContext, {\n previousHashedSecret: presentedHash,\n organizationId: initiatorCriticalParamsValue.organizationId,\n });\n if (rotated && isRotationGraceWindowOpen(rotated.previousSecretInvalidationDate)) {\n client = rotated;\n }\n }\n\n if (!client || client.status !== OAuthClientStatus.ACTIVE || isCredentialExpired(client.expiresAt)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID,\n context: { scope: 'organization', organizationId: initiatorCriticalParamsValue.organizationId, ...(client?.status ? { clientStatus: client.status } : {}) } });\n }\n\n const initiatorIds: ExecutionContext_InitiatorIds = {\n organizationId: initiatorCriticalParamsValue.organizationId,\n // Machine credential provenance: an OAuth client (the OAuthClient row `_id`).\n machineCredential: { authMethod: MachineAuthMethod.OAUTH_CLIENT, credentialId: client._id },\n ...this.extractInitiatorIds(initiatorCriticalParamsValue)\n };\n\n const executionContext = new ExecutionContext(\n operation,\n ExecutionContext_ExecutionType.ORGANIZATION_MACHINE,\n new Map(Object.entries(initiatorCriticalParamsValue)),\n initiatorIds,\n [ { roles: client.roles || [], relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS, relatedResourceId: client.organizationId } ],\n relationshipContexts\n );\n\n return executionContext;\n\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_API_KEY_FAILED,\n context: { organizationId: initiatorCriticalParamsValue.organizationId, scope: 'organization', originalError: describeCaughtError(error) } });\n }\n }\n\n private async handleApplicationOAuthClient<\n TCustomOperationEnum extends EnumLikeType | undefined = undefined,\n TCoreOperationEnum extends Partial<CoreResourceOperation> | undefined = undefined,\n TMainSchema extends z.ZodTypeAny = z.ZodTypeAny\n >(\n secret: string,\n initiatorCriticalParamsValue: Record<string, string>,\n operation: ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>,\n relationshipContexts: ExecutionContext_RelationshipContext[]\n ): Promise<ExecutionContext<typeof operation>> {\n\n // Fail-closed scope guard (symmetric with the organization OAuth-client handler): an\n // application OAuth client may only authenticate APPLICATION-scoped operations.\n if (operation.resourcePrimaryScope !== ResourcePrimaryScope.APPLICATION) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_ORG_KEY_WRONG_RESOURCE,\n context: { resourceIdentifier: operation.resourceIdentifier, primaryScope: operation.resourcePrimaryScope, scope: 'application' } });\n }\n\n try {\n const tempExecutionContext = this._getTempExecutionContext(operation);\n const repository = this.repositoriesRegistry.getRepository(CoreResourceType.OAUTH_CLIENTS_APPLICATION);\n\n const presentedHash = hashOAuthClientSecret(secret);\n let client = await repository.read<OAuthClientApplication>(tempExecutionContext, {\n hashedSecret: presentedHash,\n });\n\n if (!client) {\n const rotated = await repository.read<OAuthClientApplication>(tempExecutionContext, {\n previousHashedSecret: presentedHash,\n });\n if (rotated && isRotationGraceWindowOpen(rotated.previousSecretInvalidationDate)) {\n client = rotated;\n }\n }\n\n if (!client || client.status !== OAuthClientStatus.ACTIVE || isCredentialExpired(client.expiresAt)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID,\n context: { scope: 'application', ...(client?.status ? { clientStatus: client.status } : {}) } });\n }\n\n const initiatorIds: ExecutionContext_InitiatorIds = {\n // Machine credential provenance: an OAuth client (the OAuthClient row `_id`).\n machineCredential: { authMethod: MachineAuthMethod.OAUTH_CLIENT, credentialId: client._id },\n ...this.extractInitiatorIds(initiatorCriticalParamsValue)\n };\n\n const executionContext = new ExecutionContext(\n operation,\n ExecutionContext_ExecutionType.APPLICATION_MACHINE,\n new Map(Object.entries(initiatorCriticalParamsValue)),\n initiatorIds,\n [ { roles: client.roles || [], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION, relatedResourceId: client.applicationId } ],\n relationshipContexts\n );\n\n await this.populateApplicationIdIfNeeded(executionContext, true);\n\n return executionContext;\n\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_API_KEY_FAILED,\n context: { scope: 'application', originalError: describeCaughtError(error) } });\n }\n }\n\n /**\n * Canonical audience (RFC 8707 resource indicator) of THIS app's generic API resource\n * server — the `aud` an exchanged machine access token MUST carry to be accepted at\n * the resource-operation choke point (D7). SINGLE SOURCE OF TRUTH: the (OIDC-branch)\n * client-credentials token endpoint MUST mint with this exact value, and this method MUST\n * be the only validator — centralising it makes minting and validation drift-impossible.\n * Returns `undefined` (→ fail-closed at the call site) when the app public base URL is not\n * yet resolvable.\n *\n * TENANCY note (external-access plan): derivation = app public base URL + API mount path.\n * MCP and A2A resource servers carry their OWN canonical audiences (their endpoint URIs),\n * validated inside their own transports — NOT here.\n */\n private resolveApiResourceAudience(): string | undefined {\n return this.appConfigService.resolveApiResourceAudience();\n }\n\n /**\n * Handle JWT bearer token authentication\n */\n private async handleJwtAuthentication<\n TCustomOperationEnum extends EnumLikeType | undefined = undefined,\n TCoreOperationEnum extends Partial<CoreResourceOperation> | undefined = undefined,\n TMainSchema extends z.ZodTypeAny = z.ZodTypeAny,\n>(\n token: string,\n req: Request,\n operation: ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>,\n initiatorInfo: ResourceConfiguration_Operation_UrlInitiatorInfo\n ): Promise<ExecutionContext<typeof operation>> {\n\n this.logDebug('Processing JWT authentication');\n\n try {\n\n // Route the verify by the token's (UNVERIFIED) `type`: a user access token is verified with\n // `issuer=appSlug`/`audience='AUTH_TOKEN'`, while a machine (client-credentials) token is\n // RFC-8707 audience-bound (`iss=aud=`the API resource URL) and MUST be verified with\n // `verifyMachineToken` — otherwise `jwt.verify` rejects every valid machine token on the\n // aud/issuer check before the machine arm below (incl. its `aud` guard) ever runs. The peek\n // only selects options; the signature is still fully verified by the chosen verify.\n const unverifiedType = this.jwtService.peekUnverifiedClaimType(token);\n const isMachineToken =\n unverifiedType === ExecutionContext_ExecutionType.ORGANIZATION_MACHINE ||\n unverifiedType === ExecutionContext_ExecutionType.APPLICATION_MACHINE;\n const rawDecodedToken = isMachineToken\n ? await this.jwtService.verifyMachineToken(token)\n : await this.jwtService.verifyWithoutBackendErrorActions(token);\n const decodedToken = JwtClaim_App_Auth_Schema.parse(rawDecodedToken);\n const tokenType = decodedToken.type;\n\n const initiatorCriticalParamsValue = this.validateParameterCoherence(req, initiatorInfo, {});\n\n // Build relationship contexts from URL parameters\n const relationshipContexts = this.buildRelationshipContexts(initiatorInfo, initiatorCriticalParamsValue);\n\n // Narrow on `decodedToken.type` directly (no `as` casts) so the discriminated union\n // is exhaustively checked at compile time — a future arm makes `decodedToken` fail to\n // reduce to `never` at the fallback below.\n if (decodedToken.type === ExecutionContext_ExecutionType.USER_REQUEST) {\n const userJwtToken = decodedToken;\n\n // F1 fix: Reject access tokens issued before a forced invalidation\n // (e.g., after password reset or refresh token rotation detection).\n // Without this check, stale access tokens would remain valid for resource\n // requests until natural expiry, even after invalidateAllTokensForUser().\n // This is the MAIN resource-API front — the widest surface the fence protects — and it is a\n // one-shot check: `iat` is fixed, so a token that passes here is never re-evaluated. Shared\n // fail-closed `<=` policy: see {@link evaluateUserTokenInvalidationFence} (GRACE-BOUNDARY).\n const { isRevoked } = await evaluateUserTokenInvalidationFence(\n this.redisService, userJwtToken.userId, userJwtToken.iat as number | undefined,\n );\n if (isRevoked) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n context: { reason: 'token_invalidated' },\n });\n }\n\n // revocation-C: PER-SESSION fence (companion to the user-wide fence above). This is the MAIN\n // resource-API front and the widest surface an OIDC end_session / per-device logout must reach:\n // the access claim carries `sessionId`, so terminating that one session evicts its access token\n // here within the token's own lifetime, leaving the user's other sessions live. See\n // {@link evaluateSessionInvalidationFence}.\n const { isRevoked: sessionRevoked } = await evaluateSessionInvalidationFence(\n this.redisService, userJwtToken.sessionId, userJwtToken.iat as number | undefined,\n );\n if (sessionRevoked) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n context: { reason: 'session_invalidated' },\n });\n }\n\n return await this.handleUserJwtAuthentication(\n userJwtToken.userId, initiatorCriticalParamsValue, operation, relationshipContexts,\n userJwtToken.lastAuthenticatedAt, userJwtToken.activeUserType,\n userJwtToken.authorizationVersion,\n );\n }\n\n if (\n decodedToken.type === ExecutionContext_ExecutionType.ORGANIZATION_MACHINE ||\n decodedToken.type === ExecutionContext_ExecutionType.APPLICATION_MACHINE\n ) {\n // Exchanged OAuth client-credentials token front (D2 \"front b\"). The client\n // exchanged its secret at the token endpoint for this short-lived audience-bound\n // token; it authenticates as an org/app MACHINE principal. The token `type` encodes\n // the scope — there is no separate `scopeType` claim.\n const machineToken = decodedToken;\n const machineScope = machineToken.type === ExecutionContext_ExecutionType.ORGANIZATION_MACHINE\n ? ResourcePrimaryScope.ORGANIZATIONS\n : ResourcePrimaryScope.APPLICATION;\n\n // RFC 8707 (D7): the token MUST be audience-bound to THIS resource server. Reject a\n // token minted for a different resource — confused-deputy / token-passthrough guard.\n const expectedAudience = this.resolveApiResourceAudience();\n if (!expectedAudience || machineToken.aud !== expectedAudience) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { reason: 'machine_aud_mismatch', tokenType } });\n }\n\n // A machine principal reaches ORG/APP-scoped resources only. The token's scope must\n // match the operation's primary scope — this also fail-closes USER_SELF/ANONYMOUS\n // resources (a machine has no userId; those scopes can never equal ORG/APP).\n if (operation.resourcePrimaryScope !== machineScope) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.API_ORG_KEY_WRONG_RESOURCE,\n context: { reason: 'machine_scope_wrong_resource', resourceIdentifier: operation.resourceIdentifier, tokenScope: machineScope, resourceScope: operation.resourcePrimaryScope } });\n }\n\n // COHERENCE GUARD (W3.6, machine arm) — symmetric with the USER_REQUEST userId-mismatch check\n // below. `machineToken.scopeId` is authoritative for `initiatorIds`, BUT the ExecutionContext's\n // CONTEXT MAP is built from `initiatorCriticalParamsValue` (URL-derived), and THAT map — not\n // `initiatorIds` — is what scopes every read filter (`buildContextualFilter`) and write enrichment\n // (`enrichDataWithContext`). So a token bound to one scope addressing a DIFFERENT scope in the URL\n // would have its COLLECTION ops (LIST/SEARCH/COUNT/CREATE) silently scoped to the URL tenant while\n // authorization only checks the token tenant — a cross-tenant read/write leak (by-id ops escape it\n // only because their post-fetch row-org check happens to compare against the token org). Reject the\n // contradiction at its source. (api-keys / `oc_` direct secrets cannot diverge: their credential\n // lookup is itself filtered by the URL scope, so scopeId always equals the URL scope; only the\n // exchanged Bearer front carries scope in a token claim instead of re-resolving it against the URL.)\n const urlScopeId = machineScope === ResourcePrimaryScope.ORGANIZATIONS\n ? initiatorCriticalParamsValue.organizationId\n : initiatorCriticalParamsValue.applicationId;\n if (urlScopeId && urlScopeId !== machineToken.scopeId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHORIZATION_MACHINE_SCOPE_MISMATCH,\n context: { reason: 'machine_scope_url_mismatch', tokenScope: machineScope } });\n }\n\n // Token scope is AUTHORITATIVE: spread URL-derived ids first, then overwrite with the\n // authenticated scopeId — a URL param cannot widen the token's scope. The OAuth client\n // that exchanged the token is recorded as the machine credential.\n const machineCredential = { authMethod: MachineAuthMethod.OAUTH_CLIENT, credentialId: machineToken.clientId };\n const initiatorIds: ExecutionContext_InitiatorIds = machineScope === ResourcePrimaryScope.ORGANIZATIONS\n ? { ...this.extractInitiatorIds(initiatorCriticalParamsValue), organizationId: machineToken.scopeId, machineCredential }\n : { ...this.extractInitiatorIds(initiatorCriticalParamsValue), applicationId: machineToken.scopeId, machineCredential };\n\n const executionContext = new ExecutionContext(\n operation,\n machineToken.type,\n new Map(Object.entries(initiatorCriticalParamsValue)),\n initiatorIds,\n [ { roles: machineToken.roles || [], relatedPrimaryScope: machineScope, relatedResourceId: machineToken.scopeId } ],\n relationshipContexts\n );\n\n if (machineScope === ResourcePrimaryScope.APPLICATION) {\n await this.populateApplicationIdIfNeeded(executionContext, true);\n }\n\n return executionContext;\n }\n\n // Exhaustive: after USER_REQUEST + both machine arms, `decodedToken` is `never`. A new\n // `JwtClaim_App_Auth` arm added later fails to compile HERE until it is handled above.\n const _exhaustiveToken: never = decodedToken;\n void _exhaustiveToken;\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { tokenType }} );\n\n } catch (error) {\n if (isExpiredJwtVerificationFailure(error)) {\n this.logger.debug('API request authentication rejected expired access token; client may refresh and retry', {\n customMessageReference: error.customMessageReference,\n statusCode: error.statusCode,\n path: req.originalUrl,\n operationIdentifier: operation.operationIdentifier,\n });\n throw error;\n }\n if (isJwtVerificationFailure(error)) {\n this.logger.warn('API request authentication failed', {\n error: error.customMessageReference,\n statusCode: error.statusCode,\n path: req.originalUrl,\n operationIdentifier: operation.operationIdentifier,\n });\n throw error;\n }\n // Handle JWT verification or validation errors\n if (isWildoBackendError(error)) {\n throw error;\n }\n\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n context: { originalError: describeCaughtError(error) } });\n }\n }\n\n // =====================================================\n // SHARED AUTH HELPERS (used by both HTTP and WebSocket)\n // =====================================================\n\n /**\n * Fetch user and build roles - SHARED between HTTP and WebSocket authentication.\n * This is the single source of truth for user authentication logic.\n *\n * @param userId - User ID to authenticate\n * @param tempContext - Temporary execution context for DB queries\n * @returns User object and built roles array\n */\n private async _fetchUserAndBuildRoles(\n userId: string,\n tempContext: ExecutionContext<any>,\n expectedAuthorizationVersion?: number,\n ): Promise<{ user: User; initiatorRoles: ExecutionContext_RoleInfo[]; applicationId: string }> {\n\n // 1. Fetch and validate user\n const userRepository = this.repositoriesRegistry.getRepository(CoreResourceType.USERS);\n const user =\n await userRepository.read<AuthorizationVersionedUser>(\n tempContext,\n userId,\n );\n\n if (!user) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_FOUND,\n context: { userId }\n });\n }\n\n if (expectedAuthorizationVersion !== undefined) {\n const currentAuthorizationVersion = getUserAuthorizationVersion(user);\n if (\n currentAuthorizationVersion === null\n || currentAuthorizationVersion !== expectedAuthorizationVersion\n ) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n context: {\n reason: 'user_authorization_version_changed',\n userId,\n },\n },\n );\n }\n }\n\n if (user.status !== UserStatus.ACTIVE) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_ACTIVE,\n context: { userId }\n });\n }\n\n // 2. Fetch organization memberships\n const orgMemberRepo = this.repositoriesRegistry.getRepository(CoreResourceType.ORGANIZATION_MEMBERS);\n const membershipsList = await orgMemberRepo.list<OrganizationMember>(tempContext, {\n userId: userId,\n status: OrganizationMemberStatus.ACTIVE\n });\n\n // Workaround: If organization members only have _id (due to projection issue),\n // fetch them individually using READ operations to get all fields\n const memberships = await Promise.all(\n membershipsList.map(async (member) => {\n if (member && member.roles && member.organizationId) {\n return member;\n }\n if (member && member._id) {\n try {\n const fullMember = await orgMemberRepo.read(tempContext, member._id) as OrganizationMember | null;\n return fullMember || member;\n } catch {\n return member;\n }\n }\n return member;\n })\n );\n\n // 2b. Drop memberships whose ORGANIZATION no longer confers authority.\n //\n // An ACTIVE membership row is necessary but not sufficient: the tenant granting it must itself\n // be operational. Without this filter a tenant marked for deletion keeps handing out\n // `ORG_ADMIN` for the whole retention window — the authority half of the teardown would be\n // purely cosmetic, since invalidating existing tokens does nothing about the next login.\n //\n // Applied to `memberships` itself rather than to the loop below, because the array feeds BOTH\n // the organization-wide roles built here AND `appendUnitScopedRoles`. Filtering only at the\n // loop would leave unit-scoped grants from a dead tenant flowing into `initiatorRoles` — a\n // narrower leak, but the same one.\n const authorityConferringMemberships =\n await this.filterMembershipsToAuthorityConferringOrganizations(memberships, tempContext);\n\n // 3. Build roles from memberships\n const initiatorRoles: ExecutionContext_RoleInfo[] = [];\n for (const membership of authorityConferringMemberships) {\n if (membership && membership.organizationId) {\n initiatorRoles.push({\n roles: membership.roles || [],\n relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n relatedResourceId: membership.organizationId\n });\n }\n }\n\n // 3b. Add UNIT-SCOPED roles (WS-C phase 2).\n //\n // These entries carry `organizationUnitId`, which marks them as narrowed: they confer authority\n // inside ONE organization unit, never across the organization. Every consumer that unions\n // `initiatorRoles` partitions on that field first (`isOrganizationWideRoleInfo`), which is why\n // emitting them here is safe — without that containment, a unit grant would read as tenant-wide\n // authority at four separate call sites. Do NOT relax the discriminator.\n //\n // Errors deliberately PROPAGATE rather than being swallowed into \"no unit roles\". A context\n // built with fewer grants than the principal actually holds is not a safe degradation once unit\n // narrowing lands: it silently empties list results for opted-in resources, which reads as data\n // loss rather than as the failure it is.\n await this.appendUnitScopedRoles(authorityConferringMemberships, initiatorRoles, tempContext);\n\n // 4. Add application-level roles if user has any\n const applicationId = await this.getApplicationId();\n if (user.appRoles && user.appRoles.length > 0) {\n initiatorRoles.push({\n roles: user.appRoles,\n relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n relatedResourceId: applicationId\n });\n }\n\n return { user, initiatorRoles, applicationId };\n }\n\n /**\n * Keep only the memberships whose ORGANIZATION is still in an authority-conferring state.\n *\n * ## Why an ACTIVE membership is not enough\n *\n * `membership.status` answers \"is this person still a member?\". It cannot answer \"is this tenant\n * still operational?\", and until 2026-08-01 nothing asked the second question at all —\n * `OrganizationStatus` had zero backend readers, so `SUSPENDED` was decorative and a tenant\n * marked for deletion would have kept conferring `ORG_ADMIN` for its entire retention window.\n *\n * This is the read-time half of tenant soft-delete, and it is deliberately a DERIVATION rather\n * than stored state. The alternative — rewriting every membership row at mark time and rewriting\n * it back on restore — would have to remember each row's prior status to be reversible, and\n * would make the restore path a data migration instead of a status flip. Computing authority\n * from the tenant's current status keeps the membership rows untouched, which is exactly what\n * makes the retention window restorable.\n *\n * ## Failure posture: FAIL CLOSED\n *\n * An organization that cannot be resolved confers nothing\n * ({@link isAuthorityConferringOrganizationStatus} returns `false` for `undefined`). A dangling\n * membership must never widen authority.\n *\n * The one nuance is a row that IS found but arrives without a usable `status`. `status` is a\n * declared summary field so a LIST projection carries it, but this same method's caller already\n * carries a workaround for a projection issue that returned `_id`-only membership rows — so the\n * same defect here would silently strip EVERY user's organization roles application-wide. Those\n * rows therefore get one targeted `read()` before being judged, mirroring the neighbouring\n * workaround. Genuinely absent rows still fail closed; a projection anomaly does not become an\n * outage.\n *\n * ## Cost\n *\n * One extra LIST per authenticated context build, batched over the distinct organizations the\n * caller belongs to (typically one). Not cached: authority must reflect a suspension or a\n * deletion mark on the next request, not after a TTL.\n *\n * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — access rights derive from the\n * current state of the granting scope.\n */\n private async filterMembershipsToAuthorityConferringOrganizations(\n memberships: OrganizationMember[],\n tempContext: ExecutionContext<any>,\n ): Promise<OrganizationMember[]> {\n const organizationIds = [\n ...new Set(\n memberships\n .filter((membership) => Boolean(membership?.organizationId))\n .map((membership) => membership.organizationId),\n ),\n ];\n if (organizationIds.length === 0) return [];\n\n const organizationRepository = this.repositoriesRegistry.getRepository(CoreResourceType.ORGANIZATIONS);\n const organizations = await organizationRepository.list<Organization>(tempContext, {\n _id: { $in: organizationIds },\n });\n\n const statusByOrganizationId = new Map<string, Organization['status'] | undefined>();\n for (const organization of organizations) {\n if (organization?._id) statusByOrganizationId.set(organization._id, organization.status);\n }\n\n // Projection-anomaly recovery — see the JSDoc. Only for rows that were FOUND without a status;\n // an organization absent from the result set stays absent and therefore stays fail-closed.\n for (const [organizationId, status] of statusByOrganizationId) {\n if (status !== undefined) continue;\n const refetched = await organizationRepository.read<Organization>(tempContext, organizationId);\n if (refetched?.status !== undefined) {\n statusByOrganizationId.set(organizationId, refetched.status);\n }\n }\n\n return memberships.filter((membership) =>\n Boolean(membership?.organizationId)\n && isAuthorityConferringOrganizationStatus(statusByOrganizationId.get(membership.organizationId)),\n );\n }\n\n /**\n * Resolve the caller's per-unit role grants and append them to `initiatorRoles` as NARROWED entries.\n *\n * ## Shape of what this emits\n *\n * One entry per assignment, carrying the same `relatedPrimaryScope`/`relatedResourceId` as the\n * organization-wide entry it sits beside, plus `organizationUnitId`. That discriminator is the ONLY\n * thing separating \"ORG_MANAGER of Sales\" from \"ORG_MANAGER of the tenant\", and every consumer that\n * unions `initiatorRoles` partitions on it (see `isOrganizationWideRoleInfo`). Emitting these\n * without that containment in place would have been a privilege escalation at four call sites,\n * which is why the consumers were hardened first.\n *\n * ## Why the membership id and not the user id\n *\n * The assignment's parent is the MEMBERSHIP, and the membership rows are already loaded here — so\n * this is an indexed lookup on data in hand, not a second identity resolution. It also means a\n * membership that was filtered out above (non-`ACTIVE`) contributes no unit roles for free: losing\n * organization membership must never leave a unit grant standing.\n *\n * ## Cost and failure posture\n *\n * One query per organization the caller belongs to (typically one). Errors PROPAGATE: a context\n * built with fewer grants than the principal holds is not a safe degradation once unit narrowing\n * lands — it silently empties list results for opted-in resources, presenting a failure as data.\n *\n * An UNREGISTERED repository is different from a failed read and is treated as such: an application\n * that never registered the resource cannot have assignments, so there are no unit roles to add.\n * That is an accurate answer, not a swallowed error.\n */\n private async appendUnitScopedRoles(\n memberships: (OrganizationMember | null | undefined)[],\n initiatorRoles: ExecutionContext_RoleInfo[],\n tempContext: ExecutionContext<any>,\n ): Promise<void> {\n const unitMemberRepository = this.repositoriesRegistry.getRepository(CoreResourceType.ORGANIZATION_UNIT_MEMBERS);\n if (!unitMemberRepository) return;\n\n for (const membership of memberships) {\n if (!membership?._id || !membership.organizationId) continue;\n\n const assignments = await unitMemberRepository.list<OrganizationUnitMember>(tempContext, {\n organizationMemberId: membership._id,\n });\n\n for (const assignment of assignments ?? []) {\n if (!assignment?.organizationUnitId || !assignment.role) continue;\n initiatorRoles.push({\n roles: [assignment.role],\n relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n relatedResourceId: membership.organizationId,\n organizationUnitId: assignment.organizationUnitId,\n });\n }\n }\n }\n\n // =====================================================\n // HTTP AUTHENTICATION METHODS\n // =====================================================\n\n /**\n * Handle user JWT authentication with user and role validation.\n * Uses _fetchUserAndBuildRoles() shared helper for DRY.\n */\n private async handleUserJwtAuthentication<\n TCustomOperationEnum extends EnumLikeType | undefined = undefined,\n TCoreOperationEnum extends Partial<CoreResourceOperation> | undefined = undefined,\n TMainSchema extends z.ZodTypeAny = z.ZodTypeAny,\n>(\n userId: string,\n initiatorCriticalParamsValue: Record<string, string>,\n operation: ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>,\n relationshipContexts: ExecutionContext_RelationshipContext[],\n lastAuthenticatedAt?: number,\n jwtActiveUserType?: string,\n jwtAuthorizationVersion?: number,\n ): Promise<ExecutionContext<typeof operation>> {\n\n this.logDebug('Processing user JWT authentication', { userId: userId.substring(0, 8) + '...' });\n\n // W3.6: Validate URL params don't contradict JWT-derived identity.\n //\n // The comparison applies ONLY to a `userId` segment that actually denotes the CALLER. On a\n // resource whose own primary key is `userId` but whose segment names the SUBJECT of an\n // administrative action (`USERS`), the two are different people BY DESIGN and this check was\n // refusing the entire admin surface — see `primaryKeyIdentifiesInitiator` for the full rationale\n // and why the distinction cannot be inferred from the field name.\n //\n // Relaxing it here cannot produce impersonation: `initiatorIds.userId` below is taken from the\n // JWT and spread LAST precisely so a URL can never override it, and authorization still decides\n // whether this caller may run this operation on this row.\n if (\n initiatorCriticalParamsValue.userId\n && initiatorCriticalParamsValue.userId !== userId\n && this.doesUserIdParamDenoteInitiator(operation)\n ) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATION_USER_ID_MISMATCH,\n });\n }\n\n try {\n const tempExecutionContext = this._getTempExecutionContext(operation);\n\n // Use shared helper for user fetch and role building\n const { initiatorRoles } = await this._fetchUserAndBuildRoles(\n userId,\n tempExecutionContext,\n jwtAuthorizationVersion,\n );\n\n // W3.6: JWT-derived values MUST take precedence over URL params to prevent identity spoofing.\n const initiatorIds: ExecutionContext_InitiatorIds = {\n ...this.extractInitiatorIds(initiatorCriticalParamsValue),\n userId,\n };\n\n const executionContext = new ExecutionContext(\n operation,\n ExecutionContext_ExecutionType.USER_REQUEST,\n new Map(Object.entries(initiatorCriticalParamsValue)),\n initiatorIds,\n initiatorRoles,\n relationshipContexts,\n undefined, // correlationId — auto-generated\n 0, // subCallDepth — top-level\n undefined, // visitedResources\n jwtActiveUserType ?? null,\n );\n\n if (lastAuthenticatedAt !== undefined) {\n executionContext.setLastAuthenticatedAt(lastAuthenticatedAt);\n }\n\n return executionContext;\n\n } catch (error) {\n if (isWildoBackendError(error)) {\n throw error;\n }\n\n throw this.errorBuilder.buildError( ErrorType.AUTHENTICATION, undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n context: { originalError: describeCaughtError(error), userId } });\n }\n }\n\n // =====================================================\n // SOCKET AUTHENTICATION METHODS\n // =====================================================\n // These methods are factorized with HTTP authentication:\n // - Same JWT verification (jwtService.verify)\n // - Same token parsing (JwtClaim_App_Auth_Schema)\n // - Same user/role extraction (reuses _fetchUserAndBuildRoles)\n\n /**\n * Authenticate a socket connection from JWT token.\n *\n * FACTORIZATION: Reuses same JWT verification and user/role extraction as HTTP.\n *\n * @param token - JWT token from socket handshake\n * @returns SocketAuthResult with execution type, initiator IDs and roles\n */\n public async authenticateSocketConnection(token: string, requestedOrganizationId?: string): Promise<SocketAuthResult> {\n this.logDebug('Authenticating socket connection');\n\n const rawDecodedToken = await this.jwtService.verifyWithoutBackendErrorActions(token);\n const decodedToken = JwtClaim_App_Auth_Schema.parse(rawDecodedToken);\n const tokenType = decodedToken.type;\n\n // Sockets accept USER_REQUEST JWTs only; machine tokens are rejected via the fallback below.\n if (decodedToken.type === ExecutionContext_ExecutionType.USER_REQUEST) {\n const userJwtToken = decodedToken;\n\n // All-session revocation fence, evaluated ONCE at handshake. A socket then stays open for the\n // life of the connection with nothing re-checking `iat`, so a same-second token admitted here\n // outlives the revocation by the whole session — which makes the shared fail-closed `<=` matter\n // more here, not less. See {@link evaluateUserTokenInvalidationFence} (GRACE-BOUNDARY).\n const { isRevoked } = await evaluateUserTokenInvalidationFence(\n this.redisService, userJwtToken.userId, userJwtToken.iat as number | undefined,\n );\n if (isRevoked) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n context: { reason: 'token_invalidated' },\n });\n }\n\n // revocation-C: PER-SESSION fence (companion to the user-wide fence above), evaluated ONCE at\n // handshake like its sibling. A socket stays open for the connection's life with nothing\n // re-checking `iat`, so admitting a token whose session was terminated would outlive the\n // end_session by the whole connection — the same reason the `<=` boundary matters more here.\n // See {@link evaluateSessionInvalidationFence}.\n const { isRevoked: sessionRevoked } = await evaluateSessionInvalidationFence(\n this.redisService, userJwtToken.sessionId, userJwtToken.iat as number | undefined,\n );\n if (sessionRevoked) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n context: { reason: 'session_invalidated' },\n });\n }\n\n return await this._authenticateUserForSocket(\n userJwtToken.userId,\n requestedOrganizationId,\n // Handshake selector — advisory: a stale/non-member value degrades to membership inference.\n ActiveOrganizationSelectionSource.USER_REQUESTED,\n userJwtToken.authorizationVersion,\n );\n }\n\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { tokenType }\n });\n }\n\n /**\n * Get auth result for public (unauthenticated) socket connections.\n */\n public getPublicSocketAuth(): SocketAuthResult {\n return {\n executionType: ExecutionContext_ExecutionType.PUBLIC_EXECUTION,\n initiatorIds: null,\n initiatorRoles: []\n };\n }\n\n /**\n * Authenticate an EXTERNAL-caller token (A2A / MCP) into a principal-agnostic\n * {@link SocketAuthResult}. Accepts BOTH:\n * - **user-delegated** OIDC `authorization_code` tokens (`USER_REQUEST`) → the\n * session is owned by the delegating user;\n * - **machine** OAuth `client_credentials` tokens\n * (`ORGANIZATION_MACHINE` / `APPLICATION_MACHINE`) → the session is owned by\n * the org/app machine principal.\n *\n * The returned `SocketAuthResult` flows unchanged through\n * {@link buildContextFromSocketAuth} (principal-agnostic) so the caller's tools /\n * operations run under the caller's OWN roles + scope, authorized by\n * `authorizeInController` — no `systemAccessPolicy` bypass. This is the SAME\n * principal resolution as the HTTP request path (`handleJwtAuthentication`);\n * there is deliberately no auth-method-specific EC-builder (the machine principal\n * is the same shape as any other, per the machine-principal recentering).\n *\n * Audience binding (RFC 8707 / D7):\n * - USER_REQUEST — `aud` MUST equal `callerAudience` (the caller's own endpoint,\n * e.g. the A2A agent card `url`); a token minted for another agent is rejected.\n * - machine — REQUIRES this endpoint's own `callerAudience` (a per-endpoint aud-bound\n * token minted when the client named this surface's `resource` at the token endpoint,\n * RFC 8707). The generic API audience is NOT accepted here (2026-07-29 flip): API and\n * agent-surface tokens never cross. `iss` is always the app issuer. The main-API choke\n * point is the sole consumer of the API audience (it passes no per-endpoint override).\n *\n * @throws AUTHENTICATION on a bad signature, wrong/expired token, aud mismatch,\n * or an invalidated user token — the caller maps this to a transport-level reject.\n */\n public async authenticateExternalToken(token: string, callerAudience: string): Promise<SocketAuthResult> {\n const unverifiedType = this.jwtService.peekUnverifiedClaimType(token);\n const isMachineToken =\n unverifiedType === ExecutionContext_ExecutionType.ORGANIZATION_MACHINE ||\n unverifiedType === ExecutionContext_ExecutionType.APPLICATION_MACHINE;\n\n if (isMachineToken) {\n // Machine client-credentials token. This external resource server (A2A / MCP) REQUIRES a token\n // audience-bound to its OWN per-endpoint audience (`callerAudience` — the RFC 8707 `resource`\n // advertised in this endpoint's Protected-Resource-Metadata). The generic API audience is NOT\n // accepted here: a token minted for the API cannot be replayed at an agent surface, and a\n // per-endpoint agent token cannot be replayed at another surface (strict confused-deputy /\n // token-passthrough defense, per the 2026-07-29 flip). The client MUST request\n // `resource=<this endpoint's audience>` at the token endpoint. The main-API choke point is the\n // ONLY consumer of the generic API audience (it passes NO override to `verifyMachineToken`), so\n // the two audiences never cross. NOTE (multi-* ready): `callerAudience` is opaque here — a future\n // per-instance MCP-server / A2A-agent audience (`…/mcp/<ref>`) flows through unchanged.\n if (!callerAudience) {\n // Fail-closed: an unresolvable per-endpoint audience must never accept a machine token.\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { reason: 'external_machine_aud_unresolvable' },\n });\n }\n const rawMachine = await this.jwtService.verifyMachineToken(token, [callerAudience]);\n const machineToken = JwtClaim_App_Auth_Schema.parse(rawMachine);\n if (\n machineToken.type !== ExecutionContext_ExecutionType.ORGANIZATION_MACHINE &&\n machineToken.type !== ExecutionContext_ExecutionType.APPLICATION_MACHINE\n ) {\n // The unverified peek disagreed with the verified type (forged/malformed) → reject.\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { reason: 'external_machine_type_mismatch', tokenType: machineToken.type },\n });\n }\n // Defense-in-depth backstop: `verifyMachineToken` already bound `aud === callerAudience`, but\n // its degraded path (API audience unresolvable) can skip jwt.verify's audience check. Re-assert\n // explicitly — a token whose `aud` is not THIS endpoint's audience is rejected even if lenient.\n if (!this._audienceIncludes(machineToken.aud, callerAudience)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { reason: 'external_machine_aud_unbound' },\n });\n }\n const machineScope = machineToken.type === ExecutionContext_ExecutionType.ORGANIZATION_MACHINE\n ? ResourcePrimaryScope.ORGANIZATIONS\n : ResourcePrimaryScope.APPLICATION;\n const machineCredential = { authMethod: MachineAuthMethod.OAUTH_CLIENT, credentialId: machineToken.clientId };\n const initiatorIds: ExecutionContext_InitiatorIds = machineScope === ResourcePrimaryScope.ORGANIZATIONS\n ? { organizationId: machineToken.scopeId, machineCredential }\n : { applicationId: machineToken.scopeId, machineCredential };\n return {\n executionType: machineToken.type,\n initiatorIds,\n initiatorRoles: [{ roles: machineToken.roles || [], relatedPrimaryScope: machineScope, relatedResourceId: machineToken.scopeId }],\n };\n }\n\n // User-delegated token (A2A / MCP): verify signature / issuer / expiry AUD-AGNOSTICALLY. A\n // delegated token is `aud`-bound to THIS agent endpoint (RFC 8707), NOT the first-party\n // `aud='AUTH_TOKEN'` that the shared verify would otherwise enforce — which would reject every\n // delegated token (B-S1). The agent audience is then validated EXPLICITLY below, so a refresh\n // token (`aud='REFRESH_TOKEN'`) or any other-audience token is still rejected there (its `aud`\n // is not this agent endpoint). Same `APPLICATION_AUTH_TOKEN` signing key + issuer, so a forged\n // signature still fails. First-party paths NEVER pass `ignoreAudience` — their `aud='AUTH_TOKEN'`\n // gate is what confines this delegated token OUT of the main API (B-S2 / R4).\n const rawUser = await this.jwtService.verifyWithoutBackendErrorActions(token, JwtPrivateKeys.APPLICATION_AUTH_TOKEN, { ignoreAudience: true });\n const decodedToken = JwtClaim_App_Auth_Schema.parse(rawUser);\n if (decodedToken.type !== ExecutionContext_ExecutionType.USER_REQUEST) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { reason: 'external_unexpected_token_type', tokenType: decodedToken.type },\n });\n }\n if (!callerAudience || !this._audienceIncludes(decodedToken.aud, callerAudience)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { reason: 'external_user_aud_mismatch' },\n });\n }\n // Reject a user token issued at OR before a forced invalidation. This matters MOST here: a delegated\n // agent token has NO other server-side revocation handle (no refresh; `TOKEN_INVALID_BEFORE` is its\n // only post-issuance fence), so a same-second token admitted here survives its full ≤30-min TTL at\n // /a2a + /mcp. The shared fail-closed `<=` policy and its full rationale live in\n // {@link evaluateUserTokenInvalidationFence} (GRACE-BOUNDARY). (D9 — fix landed for refresh 2026-07-29.)\n const { isRevoked } = await evaluateUserTokenInvalidationFence(\n this.redisService, decodedToken.userId, decodedToken.iat as number | undefined,\n );\n if (isRevoked) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n context: { reason: 'token_invalidated' },\n });\n }\n // revocation-C: the PER-SESSION fence is DELIBERATELY ABSENT on this delegated (A2A / MCP) front,\n // and this is one of the six fronts the user-wide fence covers — recorded here so the omission reads\n // as a decision, not an oversight. Two independent reasons: (1) a delegated token is `aud`-bound to\n // THIS agent endpoint (verified `ignoreAudience` then re-checked at `_audienceIncludes` above), so a\n // first-party session-bound token (`aud='AUTH_TOKEN'`) is already rejected and cannot reach here —\n // the fence would be inert; (2) per OIDC RP-Initiated Logout 1.0, an `end_session` terminates the\n // End-User's OP session, and RP token revocation is explicitly OUT OF SCOPE (that is RFC 7009's job).\n // Wildo's delegated tokens are short-lived with no refresh, so they are left to expire rather than\n // revoked by end_session. Gating here would revoke RP tokens on logout, contrary to the spec.\n // spec-cite: OpenID Connect RP-Initiated Logout 1.0 §2 (the OP terminates the End-User's session at the\n // OP). That RP-held tokens are NOT revoked is a DESIGN INFERENCE, not a spec quote: the specification\n // addresses OP session termination and is silent on RP token revocation, which is RFC 7009's concern.\n // Seed the delegated turn's active organization from the DELEGATING CLIENT's own tenant (`azp` →\n // org-scoped client → `organizationId`). Before this, external tokens passed a hardcoded\n // `undefined` here, so a MULTI-ORG user's A2A / MCP turn carried no active organization at all —\n // which broke in opposite directions per surface: MCP denied every org-scoped tool call (a\n // multi-org member could not use org data at all), while A2A's token budget fell through to\n // USER_SELF, found no grant, and resolved to the unlimited default (uncapped spend). Both are the\n // same missing signal. `CLIENT_PINNED` is load-bearing: on a non-membership pin the resolver must\n // DECLINE rather than infer, or Acme's client would silently bill Globex — see\n // {@link ActiveOrganizationSelectionSource}.\n const delegatingClientOrganizationId = await this.resolveDelegatingClientOrganizationId(decodedToken.azp);\n return await this._authenticateUserForSocket(\n decodedToken.userId,\n delegatingClientOrganizationId,\n delegatingClientOrganizationId\n ? ActiveOrganizationSelectionSource.CLIENT_PINNED\n // No tenant pin exists (APPLICATION-scoped / unknown client) — inference is the correct\n // fallback for it, and is what the deferred `organization`-at-authorize work would replace.\n : ActiveOrganizationSelectionSource.USER_REQUESTED,\n decodedToken.authorizationVersion,\n );\n }\n\n /** RFC 7519 `aud` membership — `aud` may be a single string or an array. */\n private _audienceIncludes(aud: unknown, expected: string): boolean {\n if (typeof aud === 'string') return aud === expected;\n if (Array.isArray(aud)) return aud.includes(expected);\n return false;\n }\n\n /**\n * Normalize a raw `contextResourceIdentifiers` record (as produced by the\n * frontend and carried over websocket subscription / chart payloads) into the\n * field-identifier-keyed map that {@link ExecutionContext} requires.\n *\n * WHY THIS EXISTS — the scope map (`_contextResourcesFieldIdentifier`) is\n * contractually keyed by `ResourceFieldIdentifier` because\n * `RepositoryResourceBackendService.buildContextualFilter` resolves every key\n * as a Zod schema field path and **fail-closed throws a `configuration` (500)\n * error** on any key that is not a field on the target resource's schema. The\n * HTTP request path already satisfies this contract: `validateParameterCoherence`\n * keys the map by `initiatorInfo.parameters[].fieldIdentifier` (e.g.\n * `organizationId`). The frontend's `contextResourceIdentifiers`, however,\n * deliberately addresses a scope by EITHER its resource-type name\n * (`organizations`) OR its field identifier (`organizationId`) — see\n * `normalizeContextResourceIdentifiersForTransport` in `saas-frontend-lib`,\n * which for a plain-string scope id emits only the resource-type key. Copying\n * those keys verbatim into the scope map let a resource-type key such as\n * `organizations` reach `buildContextualFilter`, which then rejected it (no\n * `organizations` field exists on, say, `todoLists`). This surfaced as a\n * repeating FATAL 500 the first time any persisted org-scoped record was opened\n * in a single-resource READ view (which mounts the realtime WS subscription).\n *\n * Each resource-type key is mapped to its field identifier via the resources\n * registry (`organizations` → `organizationId`, `todoLists` → `todolistId`, …).\n * Keys that are already field identifiers (or any non-resource-type key) pass\n * through unchanged. When both forms of the same scope are present they collapse\n * onto a single field-identifier entry (same value, so order-independent). The\n * subscribed resource's own resource-type key collapses to its own field\n * identifier, which `buildContextualFilter` then skips via its self-reference\n * blacklist. Translating here — rather than blacklisting the offending key in\n * `buildContextualFilter` — keeps the fail-closed guard intact and fixes the\n * keying at the layer that owns the scope→field-identifier mapping.\n */\n /**\n * Collect the field identifiers of every declared URL scope parameter across\n * all route variants of an operation — the socket analogue of the HTTP\n * request path's `initiatorInfo.parameters`. The union spans every generated\n * route variant, so it includes the primary scope (`organizationId`), every\n * optional-context ancestor (`todoListId`), every disambiguating relationship\n * FK (`assignedToUserId`, `createdByUserId`), and the resource's own id\n * parameter. It deliberately does NOT include the ambient session identities\n * a client may send (`userId` / `applicationId`) unless they are a genuine\n * scope parameter of THIS resource, which is exactly what\n * `buildContextFromSocketAuth` uses to strip the ambient scope bundle before\n * it reaches the fail-closed contextual filter.\n *\n * Returns an empty set for operations without URL routes (`initiatorInfos`\n * absent/empty); callers treat that as \"do not filter\" so internal\n * route-less operations keep their explicit context untouched.\n */\n private collectDeclaredScopeFieldIdentifiers(operation: ResourceConfiguration_Operation<any, any, any>): Set<string> {\n const fieldIdentifiers = new Set<string>();\n if ('initiatorInfos' in operation && Array.isArray(operation.initiatorInfos)) {\n for (const initiatorInfo of operation.initiatorInfos as ResourceConfiguration_Operation_UrlInitiatorInfo[]) {\n for (const parameter of initiatorInfo.parameters) {\n fieldIdentifiers.add(parameter.fieldIdentifier);\n }\n }\n }\n return fieldIdentifiers;\n }\n\n private normalizeContextIdentifiersToFieldIdentifierMap(contextResourceIdentifiers: Record<string, string>): Map<ResourceFieldIdentifier, string | string[]> {\n const allResourceFieldIdentifiers = this.resourcesRegistryService.getAllResourceFieldIdentifiers();\n const contextMap = new Map<ResourceFieldIdentifier, string | string[]>();\n for (const [key, value] of Object.entries(contextResourceIdentifiers)) {\n const fieldIdentifier = allResourceFieldIdentifiers[key as ResourceType] ?? key;\n contextMap.set(fieldIdentifier, value);\n }\n return contextMap;\n }\n\n /**\n * Build an ExecutionContext from socket auth info for resource authorization.\n *\n * FACTORIZATION: Creates an ExecutionContext with same structure as HTTP requests.\n * Enables reuse of AuthorizationsBackendService.authorizeInController().\n *\n * @param auth - SocketAuthResult from authenticated socket\n * @param operation - Operation config (already looked up from ResourcesRegistryService)\n * @param contextResourceIdentifiers - Path context for authorization\n */\n public async buildContextFromSocketAuth<\n TResourceConfigOperation extends ResourceConfiguration_Operation<any, any, any>\n >(\n auth: SocketAuthResult,\n operation: TResourceConfigOperation,\n contextResourceIdentifiers: Record<string, string>\n ): Promise<ExecutionContext<TResourceConfigOperation>> {\n\n this.logDebug('Building execution context from socket auth', {\n executionType: auth.executionType,\n resourceType: operation.resourceIdentifier,\n operationIdentifier: operation.operationIdentifier,\n contextKeys: Object.keys(contextResourceIdentifiers)\n });\n\n // Convert contextResourceIdentifiers to Map for ExecutionContext, translating\n // resource-type keys (e.g. 'organizations') to their field identifier (e.g.\n // 'organizationId') so the scope map honors the same field-identifier contract\n // the HTTP request path produces. See normalizeContextIdentifiersToFieldIdentifierMap.\n const contextMap = this.normalizeContextIdentifiersToFieldIdentifierMap(contextResourceIdentifiers);\n\n // Reduce the frontend-sent scope bundle to the operation's DECLARED scope\n // parameters — the socket analogue of the HTTP request path's\n // `initiatorInfo.parameters` filtering.\n //\n // WHY THIS EXISTS — the frontend merges the AMBIENT session scope\n // (`organizations` + `users` + `application`, keyed by resource type by\n // `AppScopeContext.buildContextResourceIdentifiers`) into EVERY resource\n // operation context (see `useCompositeResourceOperationContextBuilder`), and\n // the socket subscription forwards that whole bundle as\n // `contextResourceIdentifiers`. On HTTP those ambient scopes never reach the\n // scope map: `createExecutionContextFromRequest` only maps the matched\n // route's declared `initiatorInfo.parameters` into it. The socket path had no\n // equivalent filter, so for an ORG-scoped resource (e.g. `todos`) the ambient\n // `users` scope normalized to `userId` — which is NOT a column on the\n // resource (its user links are the REFERENCE FKs `assignedToUserId` /\n // `createdByUserId`, never a bare `userId`). `buildContextualFilter` then\n // fail-closed threw a FATAL `configuration` (500) on EVERY single-resource\n // READ subscription (which mounts the realtime WS room), cascading to a 404\n // `authorizations_validation_failed`. Filtering here yields the exact scope\n // map HTTP produces (`organizationId`, `todoListId`, …) and drops the ambient\n // identity scopes, which are already carried authoritatively in\n // `initiatorIds` (server-verified, never client-trusted for authorization).\n //\n // Fail-closed contract preserved: the surviving keys are all declared route\n // parameters — i.e. real scope columns — so `buildContextualFilter` still\n // throws on a genuinely misconfigured scope. When the operation has no URL\n // routes (`initiatorInfos` empty — e.g. the internal APPLICATION READ used\n // for badge counts) the declared set is empty and filtering is skipped, so\n // no legitimate scope is dropped.\n const declaredScopeFieldIdentifiers = this.collectDeclaredScopeFieldIdentifiers(operation);\n if (declaredScopeFieldIdentifiers.size > 0) {\n for (const fieldIdentifier of [...contextMap.keys()]) {\n if (!declaredScopeFieldIdentifiers.has(fieldIdentifier)) {\n this.logDebug('Dropping non-declared ambient scope from socket context map', { fieldIdentifier });\n contextMap.delete(fieldIdentifier);\n }\n }\n }\n\n // USER_SELF socket scoping — the socket analogue of the HTTP URL's `userId` primary-scope segment.\n //\n // A USER_SELF resource scopes EVERY read (`buildContextualFilter`) by the `userId` field in the\n // CONTEXT MAP — not `initiatorIds` (see the W3.6 coherence guard). On HTTP that `userId` enters the\n // map from the URL (`/…/{userId}/…`). The socket path carries NO URL, so for a caller that sends no\n // ambient `userId` (e.g. the MCP delegated transport, which forwards only org/app), the map had no\n // `userId` and a USER_SELF COLLECTION read (LIST/SEARCH/COUNT) went UNSCOPED → every user's rows (a\n // cross-user leak). Seed the SERVER-VERIFIED `auth.initiatorIds.userId` (authoritative, never\n // client-trusted) under the declared user field so the read is scoped to the caller.\n //\n // Guards: only when the op's PRIMARY scope is USER_SELF AND it actually DECLARES the `userId` field\n // (so we never inject a non-column key and re-trip the WS-subscription FATAL the filter above\n // guards). `.set()` OVERRIDES any ambient `userId` a client sent — for USER_SELF the caller's OWN\n // identity is the only legitimate scope, so a client-supplied value must never widen it. WS\n // subscriptions already carry the same (own) `userId` via the ambient scope, so this is a no-op for\n // them; instance ops (READ/UPDATE/DELETE) are additionally protected by `authorizeUserSelf`.\n const userSelfFieldIdentifier = coreResourceShared_FieldIdentifier[CoreResourceType.USER_SELF];\n if (\n operation.resourcePrimaryScope === ResourcePrimaryScope.USER_SELF\n && auth.initiatorIds?.userId\n && declaredScopeFieldIdentifiers.has(userSelfFieldIdentifier)\n ) {\n contextMap.set(userSelfFieldIdentifier, auth.initiatorIds.userId);\n }\n\n // Build execution context with socket auth info AND context identifiers\n // SAME ExecutionContext structure as HTTP - enables reuse of:\n // - AuthorizationsBackendService.authorizeInController()\n // - All internal validation methods (validateOperationRoles, validateParentScopeAccess, etc.)\n const executionContext = new ExecutionContext<TResourceConfigOperation>(\n operation, // Same: operation config\n auth.executionType, // Same structure: USER_REQUEST, PUBLIC_EXECUTION\n contextMap, // Same structure: context resource identifiers\n auth.initiatorIds ?? {}, // Same structure: ExecutionContext_InitiatorIds\n auth.initiatorRoles, // Same structure: ExecutionContext_RoleInfo[]\n [] // relationshipContexts - not needed for socket authorization\n );\n\n if (auth.consumableTokenValue) {\n executionContext.setConsumableTokenValue(auth.consumableTokenValue);\n }\n\n // Reuse existing helper to populate applicationId\n await this.populateApplicationIdIfNeeded(executionContext, false);\n\n return executionContext;\n }\n\n /**\n * Authenticate user for socket.\n * Uses _fetchUserAndBuildRoles() shared helper - same logic as HTTP auth.\n */\n private async _authenticateUserForSocket(\n userId: string,\n requestedOrganizationId: string | undefined,\n organizationSelectionSource: ActiveOrganizationSelectionSource,\n expectedAuthorizationVersion?: number,\n ): Promise<SocketAuthResult> {\n this.logDebug('Authenticating user for socket', { userId: userId.substring(0, 8) + '...' });\n\n // Get temp context for DB queries\n const appReadOp = this.resourcesRegistryService.getOperationFromPath(\n this.resourcesRegistryService.getOperationPathDefault(CoreResourceType.APPLICATION, CoreResourceOperation.READ)\n );\n const tempContext = this._getTempExecutionContext(appReadOp);\n\n // Use shared helper - same logic as HTTP auth\n const { initiatorRoles, applicationId } =\n await this._fetchUserAndBuildRoles(\n userId,\n tempContext,\n expectedAuthorizationVersion,\n );\n\n // Seed the connection's active organization from server-verified membership so\n // org-scoped resource authorization works on sockets the same way as HTTP. The\n // HTTP path derives org from the URL scope (re-validated against memberships);\n // a socket has no URL, so we take the client's active-org selector from the\n // handshake and validate it against `initiatorRoles` (or infer it for single-org\n // users). Without this, `initiatorIds.organizationId` is always undefined and\n // `authorizeOrganizations` denies every org-scoped resource subscription. See\n // `resolveSocketActiveOrganizationId` for the (non-trusting) resolution policy, and\n // `ActiveOrganizationSelectionSource` for why a handshake selector and a delegating client's own\n // tenant pin must NOT share the same miss semantics.\n const organizationId = this.resolveSocketActiveOrganizationId(requestedOrganizationId, initiatorRoles, organizationSelectionSource);\n\n return {\n executionType: ExecutionContext_ExecutionType.USER_REQUEST,\n initiatorIds: { userId, applicationId, ...(organizationId ? { organizationId } : {}) },\n initiatorRoles\n };\n }\n\n /**\n * Resolve the resource field identifier from the operation.\n * This is the FK field name used when relating to this resource (e.g., 'todoId' for TODOS).\n * Used to map token.relatedId to the correct parameter name for coherence validation.\n */\n private resolveResourceFieldIdentifier(operation: ResourceConfiguration_Operation<any, any, any>): string | undefined {\n return operation.resourceFieldIdentifier as string | undefined;\n }\n\n}\n"]}