@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (972) hide show
  1. package/dist/esm/applications/services/worker-remote-client-factory.backend.service.d.ts.map +1 -1
  2. package/dist/esm/applications/services/worker-remote-client-factory.backend.service.js +19 -1
  3. package/dist/esm/applications/services/worker-remote-client-factory.backend.service.js.map +1 -1
  4. package/dist/esm/base-classes/models/manual-controllers.backend.definition.d.ts.map +1 -1
  5. package/dist/esm/base-classes/models/manual-controllers.backend.definition.js +4 -0
  6. package/dist/esm/base-classes/models/manual-controllers.backend.definition.js.map +1 -1
  7. package/dist/esm/base-classes/services/batches/child-lifecycle-teardown.batch.backend.service.d.ts +35 -0
  8. package/dist/esm/base-classes/services/batches/child-lifecycle-teardown.batch.backend.service.d.ts.map +1 -0
  9. package/dist/esm/base-classes/services/batches/child-lifecycle-teardown.batch.backend.service.js +111 -0
  10. package/dist/esm/base-classes/services/batches/child-lifecycle-teardown.batch.backend.service.js.map +1 -0
  11. package/dist/esm/base-classes/services/batches/credential-expiry-sweep.batch.backend.service.d.ts +50 -0
  12. package/dist/esm/base-classes/services/batches/credential-expiry-sweep.batch.backend.service.d.ts.map +1 -0
  13. package/dist/esm/base-classes/services/batches/credential-expiry-sweep.batch.backend.service.js +199 -0
  14. package/dist/esm/base-classes/services/batches/credential-expiry-sweep.batch.backend.service.js.map +1 -0
  15. package/dist/esm/base-classes/services/batches/engine-custom-batch-manifests.d.ts +111 -0
  16. package/dist/esm/base-classes/services/batches/engine-custom-batch-manifests.d.ts.map +1 -1
  17. package/dist/esm/base-classes/services/batches/engine-custom-batch-manifests.js +140 -0
  18. package/dist/esm/base-classes/services/batches/engine-custom-batch-manifests.js.map +1 -1
  19. package/dist/esm/base-classes/services/controllers/controller-resource.backend.service.d.ts +14 -3
  20. package/dist/esm/base-classes/services/controllers/controller-resource.backend.service.d.ts.map +1 -1
  21. package/dist/esm/base-classes/services/controllers/controller-resource.backend.service.js +138 -24
  22. package/dist/esm/base-classes/services/controllers/controller-resource.backend.service.js.map +1 -1
  23. package/dist/esm/base-classes/services/controllers/controllers-registry-handler.backend.service.d.ts +3 -1
  24. package/dist/esm/base-classes/services/controllers/controllers-registry-handler.backend.service.d.ts.map +1 -1
  25. package/dist/esm/base-classes/services/controllers/controllers-registry-handler.backend.service.js +8 -3
  26. package/dist/esm/base-classes/services/controllers/controllers-registry-handler.backend.service.js.map +1 -1
  27. package/dist/esm/base-classes/services/repositories/field-clearing-partition.backend.d.ts +11 -0
  28. package/dist/esm/base-classes/services/repositories/field-clearing-partition.backend.d.ts.map +1 -1
  29. package/dist/esm/base-classes/services/repositories/field-clearing-partition.backend.js +11 -2
  30. package/dist/esm/base-classes/services/repositories/field-clearing-partition.backend.js.map +1 -1
  31. package/dist/esm/base-classes/services/repositories/http-api/http-api-provider-access.backend.d.ts +124 -13
  32. package/dist/esm/base-classes/services/repositories/http-api/http-api-provider-access.backend.d.ts.map +1 -1
  33. package/dist/esm/base-classes/services/repositories/http-api/http-api-provider-access.backend.js +207 -21
  34. package/dist/esm/base-classes/services/repositories/http-api/http-api-provider-access.backend.js.map +1 -1
  35. package/dist/esm/base-classes/services/repositories/http-api/http-api-read-client.backend.d.ts +60 -8
  36. package/dist/esm/base-classes/services/repositories/http-api/http-api-read-client.backend.d.ts.map +1 -1
  37. package/dist/esm/base-classes/services/repositories/http-api/http-api-read-client.backend.js +174 -26
  38. package/dist/esm/base-classes/services/repositories/http-api/http-api-read-client.backend.js.map +1 -1
  39. package/dist/esm/base-classes/services/repositories/http-api/http-api-resource-repository.backend.service.d.ts +48 -4
  40. package/dist/esm/base-classes/services/repositories/http-api/http-api-resource-repository.backend.service.d.ts.map +1 -1
  41. package/dist/esm/base-classes/services/repositories/http-api/http-api-resource-repository.backend.service.js +102 -30
  42. package/dist/esm/base-classes/services/repositories/http-api/http-api-resource-repository.backend.service.js.map +1 -1
  43. package/dist/esm/base-classes/services/repositories/http-api/http-api-rest-operation-reference.backend.d.ts +55 -0
  44. package/dist/esm/base-classes/services/repositories/http-api/http-api-rest-operation-reference.backend.d.ts.map +1 -0
  45. package/dist/esm/base-classes/services/repositories/http-api/http-api-rest-operation-reference.backend.js +114 -0
  46. package/dist/esm/base-classes/services/repositories/http-api/http-api-rest-operation-reference.backend.js.map +1 -0
  47. package/dist/esm/base-classes/services/repositories/http-api/http-api-transport.backend.d.ts +89 -14
  48. package/dist/esm/base-classes/services/repositories/http-api/http-api-transport.backend.d.ts.map +1 -1
  49. package/dist/esm/base-classes/services/repositories/http-api/http-api-transport.backend.js +84 -11
  50. package/dist/esm/base-classes/services/repositories/http-api/http-api-transport.backend.js.map +1 -1
  51. package/dist/esm/base-classes/services/repositories/http-api/odata-query-compiler.backend.d.ts.map +1 -1
  52. package/dist/esm/base-classes/services/repositories/http-api/odata-query-compiler.backend.js +16 -0
  53. package/dist/esm/base-classes/services/repositories/http-api/odata-query-compiler.backend.js.map +1 -1
  54. package/dist/esm/base-classes/services/repositories/infrastructure-tier-contract.backend.d.ts +20 -6
  55. package/dist/esm/base-classes/services/repositories/infrastructure-tier-contract.backend.d.ts.map +1 -1
  56. package/dist/esm/base-classes/services/repositories/infrastructure-tier-contract.backend.js +96 -32
  57. package/dist/esm/base-classes/services/repositories/infrastructure-tier-contract.backend.js.map +1 -1
  58. package/dist/esm/base-classes/services/repositories/introspection/introspection-resource-repository.backend.service.d.ts +3 -1
  59. package/dist/esm/base-classes/services/repositories/introspection/introspection-resource-repository.backend.service.d.ts.map +1 -1
  60. package/dist/esm/base-classes/services/repositories/introspection/introspection-resource-repository.backend.service.js +32 -7
  61. package/dist/esm/base-classes/services/repositories/introspection/introspection-resource-repository.backend.service.js.map +1 -1
  62. package/dist/esm/base-classes/services/repositories/introspection/introspection-resource-source.backend.port.d.ts +8 -5
  63. package/dist/esm/base-classes/services/repositories/introspection/introspection-resource-source.backend.port.d.ts.map +1 -1
  64. package/dist/esm/base-classes/services/repositories/introspection/introspection-resource-source.backend.port.js.map +1 -1
  65. package/dist/esm/base-classes/services/repositories/postgresql-resource-repository.backend.service.d.ts +80 -0
  66. package/dist/esm/base-classes/services/repositories/postgresql-resource-repository.backend.service.d.ts.map +1 -1
  67. package/dist/esm/base-classes/services/repositories/postgresql-resource-repository.backend.service.js +298 -23
  68. package/dist/esm/base-classes/services/repositories/postgresql-resource-repository.backend.service.js.map +1 -1
  69. package/dist/esm/base-classes/services/repositories/repositories-registry-handler.backend.service.d.ts +71 -1
  70. package/dist/esm/base-classes/services/repositories/repositories-registry-handler.backend.service.d.ts.map +1 -1
  71. package/dist/esm/base-classes/services/repositories/repositories-registry-handler.backend.service.js +85 -5
  72. package/dist/esm/base-classes/services/repositories/repositories-registry-handler.backend.service.js.map +1 -1
  73. package/dist/esm/base-classes/services/repositories/repository-resource.backend.service.d.ts +21 -0
  74. package/dist/esm/base-classes/services/repositories/repository-resource.backend.service.d.ts.map +1 -1
  75. package/dist/esm/base-classes/services/repositories/repository-resource.backend.service.js +146 -4
  76. package/dist/esm/base-classes/services/repositories/repository-resource.backend.service.js.map +1 -1
  77. package/dist/esm/base-classes/services/services/resource-operation-custom-implementation-base.backend.service.d.ts +22 -0
  78. package/dist/esm/base-classes/services/services/resource-operation-custom-implementation-base.backend.service.d.ts.map +1 -1
  79. package/dist/esm/base-classes/services/services/resource-operation-custom-implementation-base.backend.service.js.map +1 -1
  80. package/dist/esm/base-classes/services/services/resource-operation-implementation-coverage.backend.utils.d.ts +3 -26
  81. package/dist/esm/base-classes/services/services/resource-operation-implementation-coverage.backend.utils.d.ts.map +1 -1
  82. package/dist/esm/base-classes/services/services/resource-operation-implementation-coverage.backend.utils.js +3 -68
  83. package/dist/esm/base-classes/services/services/resource-operation-implementation-coverage.backend.utils.js.map +1 -1
  84. package/dist/esm/base-classes/services/services/resource-status-transition.custom-impl.backend.service.d.ts.map +1 -1
  85. package/dist/esm/base-classes/services/services/resource-status-transition.custom-impl.backend.service.js +4 -1
  86. package/dist/esm/base-classes/services/services/resource-status-transition.custom-impl.backend.service.js.map +1 -1
  87. package/dist/esm/base-classes/services/services/resource-status-transition.definitions.backend.d.ts +11 -0
  88. package/dist/esm/base-classes/services/services/resource-status-transition.definitions.backend.d.ts.map +1 -1
  89. package/dist/esm/base-classes/services/services/resource-status-transition.definitions.backend.js +39 -5
  90. package/dist/esm/base-classes/services/services/resource-status-transition.definitions.backend.js.map +1 -1
  91. package/dist/esm/base-classes/services/services/services-registry-handler.backend.service.d.ts +181 -2
  92. package/dist/esm/base-classes/services/services/services-registry-handler.backend.service.d.ts.map +1 -1
  93. package/dist/esm/base-classes/services/services/services-registry-handler.backend.service.js +533 -43
  94. package/dist/esm/base-classes/services/services/services-registry-handler.backend.service.js.map +1 -1
  95. package/dist/esm/base-classes/services/services/system-access.backend.service.d.ts +36 -3
  96. package/dist/esm/base-classes/services/services/system-access.backend.service.d.ts.map +1 -1
  97. package/dist/esm/base-classes/services/services/system-access.backend.service.js +70 -8
  98. package/dist/esm/base-classes/services/services/system-access.backend.service.js.map +1 -1
  99. package/dist/esm/billing/batches/billing-reconciliation.batch.backend.service.d.ts +28 -0
  100. package/dist/esm/billing/batches/billing-reconciliation.batch.backend.service.d.ts.map +1 -0
  101. package/dist/esm/billing/batches/billing-reconciliation.batch.backend.service.js +90 -0
  102. package/dist/esm/billing/batches/billing-reconciliation.batch.backend.service.js.map +1 -0
  103. package/dist/esm/billing/batches/usage-flush.batch.backend.service.d.ts +44 -0
  104. package/dist/esm/billing/batches/usage-flush.batch.backend.service.d.ts.map +1 -0
  105. package/dist/esm/billing/batches/usage-flush.batch.backend.service.js +99 -0
  106. package/dist/esm/billing/batches/usage-flush.batch.backend.service.js.map +1 -0
  107. package/dist/esm/billing/models/billing-provider-event-settlement.backend.schemas.d.ts +91 -0
  108. package/dist/esm/billing/models/billing-provider-event-settlement.backend.schemas.d.ts.map +1 -0
  109. package/dist/esm/billing/models/billing-provider-event-settlement.backend.schemas.js +152 -0
  110. package/dist/esm/billing/models/billing-provider-event-settlement.backend.schemas.js.map +1 -0
  111. package/dist/esm/billing/services/back-office/billing-reconciliation.backend.service.d.ts +186 -0
  112. package/dist/esm/billing/services/back-office/billing-reconciliation.backend.service.d.ts.map +1 -0
  113. package/dist/esm/billing/services/back-office/billing-reconciliation.backend.service.js +474 -0
  114. package/dist/esm/billing/services/back-office/billing-reconciliation.backend.service.js.map +1 -0
  115. package/dist/esm/billing/services/back-office/product-catalog-sync.backend.service.d.ts +100 -0
  116. package/dist/esm/billing/services/back-office/product-catalog-sync.backend.service.d.ts.map +1 -1
  117. package/dist/esm/billing/services/back-office/product-catalog-sync.backend.service.js +209 -6
  118. package/dist/esm/billing/services/back-office/product-catalog-sync.backend.service.js.map +1 -1
  119. package/dist/esm/billing/services/back-office/usage-metering.backend.service.d.ts +200 -4
  120. package/dist/esm/billing/services/back-office/usage-metering.backend.service.d.ts.map +1 -1
  121. package/dist/esm/billing/services/back-office/usage-metering.backend.service.js +593 -64
  122. package/dist/esm/billing/services/back-office/usage-metering.backend.service.js.map +1 -1
  123. package/dist/esm/billing/services/billing-adapter-registry.backend.d.ts +36 -0
  124. package/dist/esm/billing/services/billing-adapter-registry.backend.d.ts.map +1 -0
  125. package/dist/esm/billing/services/billing-adapter-registry.backend.js +83 -0
  126. package/dist/esm/billing/services/billing-adapter-registry.backend.js.map +1 -0
  127. package/dist/esm/billing/services/billing-checkout-metadata.backend.utils.d.ts +9 -0
  128. package/dist/esm/billing/services/billing-checkout-metadata.backend.utils.d.ts.map +1 -1
  129. package/dist/esm/billing/services/billing-checkout-metadata.backend.utils.js +11 -1
  130. package/dist/esm/billing/services/billing-checkout-metadata.backend.utils.js.map +1 -1
  131. package/dist/esm/billing/services/custom-impl/billing-account.mutations.custom-impl.backend.service.d.ts.map +1 -1
  132. package/dist/esm/billing/services/custom-impl/billing-account.mutations.custom-impl.backend.service.js +54 -13
  133. package/dist/esm/billing/services/custom-impl/billing-account.mutations.custom-impl.backend.service.js.map +1 -1
  134. package/dist/esm/billing/services/custom-impl/billing-custom-impl-utils.backend.d.ts +38 -1
  135. package/dist/esm/billing/services/custom-impl/billing-custom-impl-utils.backend.d.ts.map +1 -1
  136. package/dist/esm/billing/services/custom-impl/billing-custom-impl-utils.backend.js +67 -2
  137. package/dist/esm/billing/services/custom-impl/billing-custom-impl-utils.backend.js.map +1 -1
  138. package/dist/esm/billing/services/custom-impl/billing-custom-implementations.backend.d.ts +30 -1
  139. package/dist/esm/billing/services/custom-impl/billing-custom-implementations.backend.d.ts.map +1 -1
  140. package/dist/esm/billing/services/custom-impl/billing-custom-implementations.backend.js +43 -1
  141. package/dist/esm/billing/services/custom-impl/billing-custom-implementations.backend.js.map +1 -1
  142. package/dist/esm/billing/services/custom-impl/promotion.custom-ops.custom-impl.backend.service.d.ts +11 -3
  143. package/dist/esm/billing/services/custom-impl/promotion.custom-ops.custom-impl.backend.service.d.ts.map +1 -1
  144. package/dist/esm/billing/services/custom-impl/promotion.custom-ops.custom-impl.backend.service.js +30 -16
  145. package/dist/esm/billing/services/custom-impl/promotion.custom-ops.custom-impl.backend.service.js.map +1 -1
  146. package/dist/esm/billing/services/custom-impl/subscription.mutations.custom-impl.backend.service.d.ts.map +1 -1
  147. package/dist/esm/billing/services/custom-impl/subscription.mutations.custom-impl.backend.service.js +104 -25
  148. package/dist/esm/billing/services/custom-impl/subscription.mutations.custom-impl.backend.service.js.map +1 -1
  149. package/dist/esm/billing/services/stripe-standard-billing-provider.backend.service.d.ts +18 -1
  150. package/dist/esm/billing/services/stripe-standard-billing-provider.backend.service.d.ts.map +1 -1
  151. package/dist/esm/billing/services/stripe-standard-billing-provider.backend.service.js +106 -2
  152. package/dist/esm/billing/services/stripe-standard-billing-provider.backend.service.js.map +1 -1
  153. package/dist/esm/billing/services/webhooks/__tests__/settlement-ledger.test-double.d.ts +52 -0
  154. package/dist/esm/billing/services/webhooks/__tests__/settlement-ledger.test-double.d.ts.map +1 -0
  155. package/dist/esm/billing/services/webhooks/__tests__/settlement-ledger.test-double.js +74 -0
  156. package/dist/esm/billing/services/webhooks/__tests__/settlement-ledger.test-double.js.map +1 -0
  157. package/dist/esm/billing/services/webhooks/billing-webhook-event-router.backend.service.d.ts +104 -11
  158. package/dist/esm/billing/services/webhooks/billing-webhook-event-router.backend.service.d.ts.map +1 -1
  159. package/dist/esm/billing/services/webhooks/billing-webhook-event-router.backend.service.js +260 -26
  160. package/dist/esm/billing/services/webhooks/billing-webhook-event-router.backend.service.js.map +1 -1
  161. package/dist/esm/billing/testing/mock-billing-provider.d.ts +30 -1
  162. package/dist/esm/billing/testing/mock-billing-provider.d.ts.map +1 -1
  163. package/dist/esm/billing/testing/mock-billing-provider.js +25 -0
  164. package/dist/esm/billing/testing/mock-billing-provider.js.map +1 -1
  165. package/dist/esm/compliance/audit-trails/batches/audit-logs-archive.batch.backend.service.js +11 -4
  166. package/dist/esm/compliance/audit-trails/batches/audit-logs-archive.batch.backend.service.js.map +1 -1
  167. package/dist/esm/compliance/audit-trails/services/audit-event-dispatcher.backend.service.d.ts +263 -13
  168. package/dist/esm/compliance/audit-trails/services/audit-event-dispatcher.backend.service.d.ts.map +1 -1
  169. package/dist/esm/compliance/audit-trails/services/audit-event-dispatcher.backend.service.js +376 -58
  170. package/dist/esm/compliance/audit-trails/services/audit-event-dispatcher.backend.service.js.map +1 -1
  171. package/dist/esm/compliance/audit-trails/services/audit-logs.backend.service.d.ts +264 -7
  172. package/dist/esm/compliance/audit-trails/services/audit-logs.backend.service.d.ts.map +1 -1
  173. package/dist/esm/compliance/audit-trails/services/audit-logs.backend.service.js +414 -5
  174. package/dist/esm/compliance/audit-trails/services/audit-logs.backend.service.js.map +1 -1
  175. package/dist/esm/compliance/audit-trails/services/composite-audit-log-sink.backend.d.ts.map +1 -1
  176. package/dist/esm/compliance/audit-trails/services/composite-audit-log-sink.backend.js +7 -1
  177. package/dist/esm/compliance/audit-trails/services/composite-audit-log-sink.backend.js.map +1 -1
  178. package/dist/esm/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.d.ts +16 -0
  179. package/dist/esm/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.d.ts.map +1 -0
  180. package/dist/esm/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.js +140 -0
  181. package/dist/esm/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.js.map +1 -0
  182. package/dist/esm/compliance/audit-trails/services/siem-webhook-delivery.backend.service.d.ts +42 -0
  183. package/dist/esm/compliance/audit-trails/services/siem-webhook-delivery.backend.service.d.ts.map +1 -1
  184. package/dist/esm/compliance/audit-trails/services/siem-webhook-delivery.backend.service.js +65 -6
  185. package/dist/esm/compliance/audit-trails/services/siem-webhook-delivery.backend.service.js.map +1 -1
  186. package/dist/esm/compliance/audit-trails/services/utils/leased-value-cache.backend.utils.d.ts +110 -0
  187. package/dist/esm/compliance/audit-trails/services/utils/leased-value-cache.backend.utils.d.ts.map +1 -0
  188. package/dist/esm/compliance/audit-trails/services/utils/leased-value-cache.backend.utils.js +192 -0
  189. package/dist/esm/compliance/audit-trails/services/utils/leased-value-cache.backend.utils.js.map +1 -0
  190. package/dist/esm/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.d.ts.map +1 -1
  191. package/dist/esm/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.js +45 -0
  192. package/dist/esm/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.js.map +1 -1
  193. package/dist/esm/config/bootstrap/application-runtime-profile.backend.d.ts +5 -0
  194. package/dist/esm/config/bootstrap/application-runtime-profile.backend.d.ts.map +1 -1
  195. package/dist/esm/config/bootstrap/application-runtime-profile.backend.js +6 -0
  196. package/dist/esm/config/bootstrap/application-runtime-profile.backend.js.map +1 -1
  197. package/dist/esm/config/custom/application-config-controller.backend.service.d.ts.map +1 -1
  198. package/dist/esm/config/custom/application-config-controller.backend.service.js +7 -1
  199. package/dist/esm/config/custom/application-config-controller.backend.service.js.map +1 -1
  200. package/dist/esm/config/models/app-config.backend.schemas.d.ts +146 -46
  201. package/dist/esm/config/models/app-config.backend.schemas.d.ts.map +1 -1
  202. package/dist/esm/config/models/app-config.backend.schemas.js +121 -12
  203. package/dist/esm/config/models/app-config.backend.schemas.js.map +1 -1
  204. package/dist/esm/config/models/provider-runtime-artifact.backend.schemas.d.ts +38 -15
  205. package/dist/esm/config/models/provider-runtime-artifact.backend.schemas.d.ts.map +1 -1
  206. package/dist/esm/config/models/provider-runtime-artifact.backend.schemas.js +17 -2
  207. package/dist/esm/config/models/provider-runtime-artifact.backend.schemas.js.map +1 -1
  208. package/dist/esm/config/services/app-configuration-loader.backend.service.d.ts +0 -1
  209. package/dist/esm/config/services/app-configuration-loader.backend.service.d.ts.map +1 -1
  210. package/dist/esm/config/services/app-configuration-loader.backend.service.js +68 -76
  211. package/dist/esm/config/services/app-configuration-loader.backend.service.js.map +1 -1
  212. package/dist/esm/config/services/app-configuration.backend.service.d.ts.map +1 -1
  213. package/dist/esm/config/services/app-configuration.backend.service.js +23 -1
  214. package/dist/esm/config/services/app-configuration.backend.service.js.map +1 -1
  215. package/dist/esm/config/services/app-configuration.backend.utils.d.ts +43 -1
  216. package/dist/esm/config/services/app-configuration.backend.utils.d.ts.map +1 -1
  217. package/dist/esm/config/services/app-configuration.backend.utils.js +52 -3
  218. package/dist/esm/config/services/app-configuration.backend.utils.js.map +1 -1
  219. package/dist/esm/config/services/application-startup-config-validator.backend.service.d.ts +25 -0
  220. package/dist/esm/config/services/application-startup-config-validator.backend.service.d.ts.map +1 -1
  221. package/dist/esm/config/services/application-startup-config-validator.backend.service.js +41 -1
  222. package/dist/esm/config/services/application-startup-config-validator.backend.service.js.map +1 -1
  223. package/dist/esm/data-seeding/services/shared/data-seed-scope-iteration.shared.utils.d.ts +2 -2
  224. package/dist/esm/data-seeding/services/shared/data-seed-scope-iteration.shared.utils.js +2 -2
  225. package/dist/esm/data-seeding/services/shared/data-seed-scope-iteration.shared.utils.js.map +1 -1
  226. package/dist/esm/databases/models/filter.backend.schemas.js +2 -2
  227. package/dist/esm/databases/models/filter.backend.schemas.js.map +1 -1
  228. package/dist/esm/databases/services/aggregation/aggregation-authorization.backend.service.d.ts.map +1 -1
  229. package/dist/esm/databases/services/aggregation/aggregation-authorization.backend.service.js +20 -1
  230. package/dist/esm/databases/services/aggregation/aggregation-authorization.backend.service.js.map +1 -1
  231. package/dist/esm/databases/services/postgresql-schema-plan-diff.backend.d.ts.map +1 -1
  232. package/dist/esm/databases/services/postgresql-schema-plan-diff.backend.js +48 -0
  233. package/dist/esm/databases/services/postgresql-schema-plan-diff.backend.js.map +1 -1
  234. package/dist/esm/databases/services/redis.service.d.ts +27 -0
  235. package/dist/esm/databases/services/redis.service.d.ts.map +1 -1
  236. package/dist/esm/databases/services/redis.service.js +29 -0
  237. package/dist/esm/databases/services/redis.service.js.map +1 -1
  238. package/dist/esm/errors/services/error-builder.backend.service.d.ts +13 -1
  239. package/dist/esm/errors/services/error-builder.backend.service.d.ts.map +1 -1
  240. package/dist/esm/errors/services/error-builder.backend.service.js +13 -1
  241. package/dist/esm/errors/services/error-builder.backend.service.js.map +1 -1
  242. package/dist/esm/errors/services/error-handler.backend.service.d.ts +70 -7
  243. package/dist/esm/errors/services/error-handler.backend.service.d.ts.map +1 -1
  244. package/dist/esm/errors/services/error-handler.backend.service.js +134 -8
  245. package/dist/esm/errors/services/error-handler.backend.service.js.map +1 -1
  246. package/dist/esm/errors/services/rate-limit.backend.service.d.ts +66 -0
  247. package/dist/esm/errors/services/rate-limit.backend.service.d.ts.map +1 -1
  248. package/dist/esm/errors/services/rate-limit.backend.service.js +102 -25
  249. package/dist/esm/errors/services/rate-limit.backend.service.js.map +1 -1
  250. package/dist/esm/errors/utils/error-log-level-classification.backend.utils.d.ts +5 -0
  251. package/dist/esm/errors/utils/error-log-level-classification.backend.utils.d.ts.map +1 -1
  252. package/dist/esm/errors/utils/error-log-level-classification.backend.utils.js +25 -0
  253. package/dist/esm/errors/utils/error-log-level-classification.backend.utils.js.map +1 -1
  254. package/dist/esm/errors/utils/rate-limit-environment-relaxation.backend.utils.d.ts +33 -0
  255. package/dist/esm/errors/utils/rate-limit-environment-relaxation.backend.utils.d.ts.map +1 -1
  256. package/dist/esm/errors/utils/rate-limit-environment-relaxation.backend.utils.js +40 -0
  257. package/dist/esm/errors/utils/rate-limit-environment-relaxation.backend.utils.js.map +1 -1
  258. package/dist/esm/external-data/controllers/external-data-admin.backend.contracts.d.ts +41 -0
  259. package/dist/esm/external-data/controllers/external-data-admin.backend.contracts.d.ts.map +1 -0
  260. package/dist/esm/external-data/controllers/external-data-admin.backend.contracts.js +40 -0
  261. package/dist/esm/external-data/controllers/external-data-admin.backend.contracts.js.map +1 -0
  262. package/dist/esm/external-data/controllers/external-data-admin.backend.controller.d.ts +64 -0
  263. package/dist/esm/external-data/controllers/external-data-admin.backend.controller.d.ts.map +1 -0
  264. package/dist/esm/external-data/controllers/external-data-admin.backend.controller.js +193 -0
  265. package/dist/esm/external-data/controllers/external-data-admin.backend.controller.js.map +1 -0
  266. package/dist/esm/external-data/external-data-pipeline-run.backend.service.d.ts +72 -4
  267. package/dist/esm/external-data/external-data-pipeline-run.backend.service.d.ts.map +1 -1
  268. package/dist/esm/external-data/external-data-pipeline-run.backend.service.js +60 -19
  269. package/dist/esm/external-data/external-data-pipeline-run.backend.service.js.map +1 -1
  270. package/dist/esm/external-data/external-data-transform.backend.d.ts.map +1 -1
  271. package/dist/esm/external-data/external-data-transform.backend.js +7 -1
  272. package/dist/esm/external-data/external-data-transform.backend.js.map +1 -1
  273. package/dist/esm/external-data/models/external-data-pipeline-state.backend.schemas.d.ts +2 -0
  274. package/dist/esm/external-data/models/external-data-pipeline-state.backend.schemas.d.ts.map +1 -1
  275. package/dist/esm/external-data/models/external-data-pipeline-state.backend.schemas.js +13 -0
  276. package/dist/esm/external-data/models/external-data-pipeline-state.backend.schemas.js.map +1 -1
  277. package/dist/esm/external-providers/models/provider-selection-resolution-evidence.backend.definitions.d.ts +4 -2
  278. package/dist/esm/external-providers/models/provider-selection-resolution-evidence.backend.definitions.d.ts.map +1 -1
  279. package/dist/esm/external-providers/models/provider-selection-resolution-evidence.backend.definitions.js.map +1 -1
  280. package/dist/esm/external-providers/operations/provider-operation-executor.backend.service.d.ts +256 -0
  281. package/dist/esm/external-providers/operations/provider-operation-executor.backend.service.d.ts.map +1 -0
  282. package/dist/esm/external-providers/operations/provider-operation-executor.backend.service.js +333 -0
  283. package/dist/esm/external-providers/operations/provider-operation-executor.backend.service.js.map +1 -0
  284. package/dist/esm/external-providers/operations/provider-operation-request.backend.d.ts +56 -0
  285. package/dist/esm/external-providers/operations/provider-operation-request.backend.d.ts.map +1 -0
  286. package/dist/esm/external-providers/operations/provider-operation-request.backend.js +211 -0
  287. package/dist/esm/external-providers/operations/provider-operation-request.backend.js.map +1 -0
  288. package/dist/esm/external-providers/operations/provider-request-signing.backend.d.ts +45 -0
  289. package/dist/esm/external-providers/operations/provider-request-signing.backend.d.ts.map +1 -0
  290. package/dist/esm/external-providers/operations/provider-request-signing.backend.js +216 -0
  291. package/dist/esm/external-providers/operations/provider-request-signing.backend.js.map +1 -0
  292. package/dist/esm/external-providers/operations/provider-rest-call-client.backend.d.ts +56 -0
  293. package/dist/esm/external-providers/operations/provider-rest-call-client.backend.d.ts.map +1 -0
  294. package/dist/esm/external-providers/operations/provider-rest-call-client.backend.js +78 -0
  295. package/dist/esm/external-providers/operations/provider-rest-call-client.backend.js.map +1 -0
  296. package/dist/esm/external-providers/services/__tests__/mock-external-providers-registry.service.d.ts +1 -1
  297. package/dist/esm/external-providers/services/__tests__/mock-external-providers-registry.service.d.ts.map +1 -1
  298. package/dist/esm/external-providers/services/__tests__/mock-external-providers-registry.service.js +2 -2
  299. package/dist/esm/external-providers/services/__tests__/mock-external-providers-registry.service.js.map +1 -1
  300. package/dist/esm/external-providers/services/backend-provider-loader.backend.service.d.ts +89 -0
  301. package/dist/esm/external-providers/services/backend-provider-loader.backend.service.d.ts.map +1 -0
  302. package/dist/esm/external-providers/services/backend-provider-loader.backend.service.js +164 -0
  303. package/dist/esm/external-providers/services/backend-provider-loader.backend.service.js.map +1 -0
  304. package/dist/esm/external-providers/services/backend-provider-registry.backend.service.d.ts +26 -27
  305. package/dist/esm/external-providers/services/backend-provider-registry.backend.service.d.ts.map +1 -1
  306. package/dist/esm/external-providers/services/backend-provider-registry.backend.service.js +50 -64
  307. package/dist/esm/external-providers/services/backend-provider-registry.backend.service.js.map +1 -1
  308. package/dist/esm/external-providers/services/document-extraction.backend.service.d.ts.map +1 -1
  309. package/dist/esm/external-providers/services/document-extraction.backend.service.js +3 -3
  310. package/dist/esm/external-providers/services/document-extraction.backend.service.js.map +1 -1
  311. package/dist/esm/external-providers/services/embeddings.backend.service.d.ts.map +1 -1
  312. package/dist/esm/external-providers/services/embeddings.backend.service.js +4 -4
  313. package/dist/esm/external-providers/services/embeddings.backend.service.js.map +1 -1
  314. package/dist/esm/external-providers/services/external-providers-registry.backend.service.d.ts +306 -7
  315. package/dist/esm/external-providers/services/external-providers-registry.backend.service.d.ts.map +1 -1
  316. package/dist/esm/external-providers/services/external-providers-registry.backend.service.js +539 -45
  317. package/dist/esm/external-providers/services/external-providers-registry.backend.service.js.map +1 -1
  318. package/dist/esm/external-providers/services/frontend-bootstrap.backend.service.d.ts.map +1 -1
  319. package/dist/esm/external-providers/services/frontend-bootstrap.backend.service.js +25 -2
  320. package/dist/esm/external-providers/services/frontend-bootstrap.backend.service.js.map +1 -1
  321. package/dist/esm/files/controllers/file.controller.d.ts +24 -1
  322. package/dist/esm/files/controllers/file.controller.d.ts.map +1 -1
  323. package/dist/esm/files/controllers/file.controller.js +83 -11
  324. package/dist/esm/files/controllers/file.controller.js.map +1 -1
  325. package/dist/esm/files/handlers/file-upload-route-locals.backend.types.d.ts +17 -0
  326. package/dist/esm/files/handlers/file-upload-route-locals.backend.types.d.ts.map +1 -0
  327. package/dist/esm/files/handlers/file-upload-route-locals.backend.types.js +1 -0
  328. package/dist/esm/files/handlers/file-upload-route-locals.backend.types.js.map +1 -0
  329. package/dist/esm/files/handlers/resource-file-upload-handler.backend.service.d.ts +5 -1
  330. package/dist/esm/files/handlers/resource-file-upload-handler.backend.service.d.ts.map +1 -1
  331. package/dist/esm/files/handlers/resource-file-upload-handler.backend.service.js +76 -13
  332. package/dist/esm/files/handlers/resource-file-upload-handler.backend.service.js.map +1 -1
  333. package/dist/esm/files/services/file-operation-handler.backend.service.d.ts +18 -0
  334. package/dist/esm/files/services/file-operation-handler.backend.service.d.ts.map +1 -1
  335. package/dist/esm/files/services/file-operation-handler.backend.service.js +36 -28
  336. package/dist/esm/files/services/file-operation-handler.backend.service.js.map +1 -1
  337. package/dist/esm/files/services/file-scanning.backend.service.d.ts +94 -9
  338. package/dist/esm/files/services/file-scanning.backend.service.d.ts.map +1 -1
  339. package/dist/esm/files/services/file-scanning.backend.service.js +197 -17
  340. package/dist/esm/files/services/file-scanning.backend.service.js.map +1 -1
  341. package/dist/esm/files/services/file-text-extraction.backend.service.d.ts +60 -1
  342. package/dist/esm/files/services/file-text-extraction.backend.service.d.ts.map +1 -1
  343. package/dist/esm/files/services/file-text-extraction.backend.service.js +167 -8
  344. package/dist/esm/files/services/file-text-extraction.backend.service.js.map +1 -1
  345. package/dist/esm/files/services/file-upload-grant.backend.service.d.ts +214 -0
  346. package/dist/esm/files/services/file-upload-grant.backend.service.d.ts.map +1 -0
  347. package/dist/esm/files/services/file-upload-grant.backend.service.js +566 -0
  348. package/dist/esm/files/services/file-upload-grant.backend.service.js.map +1 -0
  349. package/dist/esm/files/services/files.backend.service.d.ts +87 -0
  350. package/dist/esm/files/services/files.backend.service.d.ts.map +1 -1
  351. package/dist/esm/files/services/files.backend.service.js +252 -19
  352. package/dist/esm/files/services/files.backend.service.js.map +1 -1
  353. package/dist/esm/files/storage/application-storage-key.backend.utils.d.ts +109 -0
  354. package/dist/esm/files/storage/application-storage-key.backend.utils.d.ts.map +1 -0
  355. package/dist/esm/files/storage/application-storage-key.backend.utils.js +123 -0
  356. package/dist/esm/files/storage/application-storage-key.backend.utils.js.map +1 -0
  357. package/dist/esm/files/storage/file-storage-provider.types.d.ts +16 -10
  358. package/dist/esm/files/storage/file-storage-provider.types.d.ts.map +1 -1
  359. package/dist/esm/files/storage/file-storage-provider.types.js.map +1 -1
  360. package/dist/esm/files/storage/local-directory-storage-provider.backend.service.d.ts +67 -8
  361. package/dist/esm/files/storage/local-directory-storage-provider.backend.service.d.ts.map +1 -1
  362. package/dist/esm/files/storage/local-directory-storage-provider.backend.service.js +101 -28
  363. package/dist/esm/files/storage/local-directory-storage-provider.backend.service.js.map +1 -1
  364. package/dist/esm/files/storage/wildo-managed-storage-provider.backend.service.d.ts.map +1 -1
  365. package/dist/esm/files/storage/wildo-managed-storage-provider.backend.service.js +8 -55
  366. package/dist/esm/files/storage/wildo-managed-storage-provider.backend.service.js.map +1 -1
  367. package/dist/esm/files/utils/file-field-schema-path.backend.utils.d.ts.map +1 -1
  368. package/dist/esm/files/utils/file-field-schema-path.backend.utils.js +20 -0
  369. package/dist/esm/files/utils/file-field-schema-path.backend.utils.js.map +1 -1
  370. package/dist/esm/files/utils/file-uploader.utils.d.ts.map +1 -1
  371. package/dist/esm/files/utils/file-uploader.utils.js +12 -0
  372. package/dist/esm/files/utils/file-uploader.utils.js.map +1 -1
  373. package/dist/esm/files/utils/office-document-text-extraction.backend.utils.d.ts +86 -0
  374. package/dist/esm/files/utils/office-document-text-extraction.backend.utils.d.ts.map +1 -0
  375. package/dist/esm/files/utils/office-document-text-extraction.backend.utils.js +288 -0
  376. package/dist/esm/files/utils/office-document-text-extraction.backend.utils.js.map +1 -0
  377. package/dist/esm/flows-actors/a2a/batches/a2a-abandoned-task-sweep.batch.backend.service.d.ts +15 -0
  378. package/dist/esm/flows-actors/a2a/batches/a2a-abandoned-task-sweep.batch.backend.service.d.ts.map +1 -1
  379. package/dist/esm/flows-actors/a2a/batches/a2a-abandoned-task-sweep.batch.backend.service.js +76 -5
  380. package/dist/esm/flows-actors/a2a/batches/a2a-abandoned-task-sweep.batch.backend.service.js.map +1 -1
  381. package/dist/esm/flows-actors/a2a/controllers/a2a.controller.d.ts.map +1 -1
  382. package/dist/esm/flows-actors/a2a/controllers/a2a.controller.js +6 -1
  383. package/dist/esm/flows-actors/a2a/controllers/a2a.controller.js.map +1 -1
  384. package/dist/esm/flows-actors/a2a/models/a2a.backend.schemas.d.ts +60 -0
  385. package/dist/esm/flows-actors/a2a/models/a2a.backend.schemas.d.ts.map +1 -1
  386. package/dist/esm/flows-actors/a2a/models/a2a.backend.schemas.js +63 -0
  387. package/dist/esm/flows-actors/a2a/models/a2a.backend.schemas.js.map +1 -1
  388. package/dist/esm/flows-actors/a2a/services/a2a-task-cancellation.backend.service.d.ts +74 -0
  389. package/dist/esm/flows-actors/a2a/services/a2a-task-cancellation.backend.service.d.ts.map +1 -1
  390. package/dist/esm/flows-actors/a2a/services/a2a-task-cancellation.backend.service.js +200 -44
  391. package/dist/esm/flows-actors/a2a/services/a2a-task-cancellation.backend.service.js.map +1 -1
  392. package/dist/esm/flows-actors/a2a/services/a2a-task.backend.service.d.ts +7 -1
  393. package/dist/esm/flows-actors/a2a/services/a2a-task.backend.service.d.ts.map +1 -1
  394. package/dist/esm/flows-actors/a2a/services/a2a-task.backend.service.js +53 -1
  395. package/dist/esm/flows-actors/a2a/services/a2a-task.backend.service.js.map +1 -1
  396. package/dist/esm/flows-actors/a2a/services/a2a-token-budget.backend.service.d.ts +18 -0
  397. package/dist/esm/flows-actors/a2a/services/a2a-token-budget.backend.service.d.ts.map +1 -1
  398. package/dist/esm/flows-actors/a2a/services/a2a-token-budget.backend.service.js +18 -0
  399. package/dist/esm/flows-actors/a2a/services/a2a-token-budget.backend.service.js.map +1 -1
  400. package/dist/esm/flows-actors/a2a/services/a2a.backend.service.d.ts +12 -7
  401. package/dist/esm/flows-actors/a2a/services/a2a.backend.service.d.ts.map +1 -1
  402. package/dist/esm/flows-actors/a2a/services/a2a.backend.service.js.map +1 -1
  403. package/dist/esm/flows-actors/models/agent-catalogs.backend.definitions.d.ts +0 -13
  404. package/dist/esm/flows-actors/models/agent-catalogs.backend.definitions.d.ts.map +1 -1
  405. package/dist/esm/flows-actors/models/agent-catalogs.backend.definitions.js +14 -22
  406. package/dist/esm/flows-actors/models/agent-catalogs.backend.definitions.js.map +1 -1
  407. package/dist/esm/flows-actors/models/core-facets.backend.definitions.d.ts +8 -3
  408. package/dist/esm/flows-actors/models/core-facets.backend.definitions.d.ts.map +1 -1
  409. package/dist/esm/flows-actors/models/core-facets.backend.definitions.js +25 -15
  410. package/dist/esm/flows-actors/models/core-facets.backend.definitions.js.map +1 -1
  411. package/dist/esm/flows-actors/models/flows-actors.backend.schemas.d.ts +13 -1
  412. package/dist/esm/flows-actors/models/flows-actors.backend.schemas.d.ts.map +1 -1
  413. package/dist/esm/flows-actors/models/flows-actors.backend.schemas.js.map +1 -1
  414. package/dist/esm/flows-actors/models/function-tools.backend.definitions.d.ts +88 -8
  415. package/dist/esm/flows-actors/models/function-tools.backend.definitions.d.ts.map +1 -1
  416. package/dist/esm/flows-actors/models/function-tools.backend.definitions.js +333 -31
  417. package/dist/esm/flows-actors/models/function-tools.backend.definitions.js.map +1 -1
  418. package/dist/esm/flows-actors/models/market-generation.actors-system.backend.definitions.d.ts.map +1 -1
  419. package/dist/esm/flows-actors/models/market-generation.actors-system.backend.definitions.js +4 -2
  420. package/dist/esm/flows-actors/models/market-generation.actors-system.backend.definitions.js.map +1 -1
  421. package/dist/esm/flows-actors/models/mcp-client.backend.definitions.d.ts +113 -0
  422. package/dist/esm/flows-actors/models/mcp-client.backend.definitions.d.ts.map +1 -0
  423. package/dist/esm/flows-actors/models/mcp-client.backend.definitions.js +62 -0
  424. package/dist/esm/flows-actors/models/mcp-client.backend.definitions.js.map +1 -0
  425. package/dist/esm/flows-actors/services/actors-system.backend.service.d.ts.map +1 -1
  426. package/dist/esm/flows-actors/services/actors-system.backend.service.js +0 -2
  427. package/dist/esm/flows-actors/services/actors-system.backend.service.js.map +1 -1
  428. package/dist/esm/flows-actors/services/agents.backend.service.d.ts +107 -1
  429. package/dist/esm/flows-actors/services/agents.backend.service.d.ts.map +1 -1
  430. package/dist/esm/flows-actors/services/agents.backend.service.js +519 -56
  431. package/dist/esm/flows-actors/services/agents.backend.service.js.map +1 -1
  432. package/dist/esm/flows-actors/services/conversational-execution.backend.service.d.ts +5 -1
  433. package/dist/esm/flows-actors/services/conversational-execution.backend.service.d.ts.map +1 -1
  434. package/dist/esm/flows-actors/services/conversational-execution.backend.service.js +79 -16
  435. package/dist/esm/flows-actors/services/conversational-execution.backend.service.js.map +1 -1
  436. package/dist/esm/flows-actors/services/flows-actors-registry.service.d.ts +34 -5
  437. package/dist/esm/flows-actors/services/flows-actors-registry.service.d.ts.map +1 -1
  438. package/dist/esm/flows-actors/services/flows-actors-registry.service.js +154 -20
  439. package/dist/esm/flows-actors/services/flows-actors-registry.service.js.map +1 -1
  440. package/dist/esm/flows-actors/services/flows.backend.services.d.ts.map +1 -1
  441. package/dist/esm/flows-actors/services/flows.backend.services.js +27 -23
  442. package/dist/esm/flows-actors/services/flows.backend.services.js.map +1 -1
  443. package/dist/esm/flows-actors/services/llm-observability-agent-call-trace-sink.backend.d.ts.map +1 -1
  444. package/dist/esm/flows-actors/services/llm-observability-agent-call-trace-sink.backend.js +7 -1
  445. package/dist/esm/flows-actors/services/llm-observability-agent-call-trace-sink.backend.js.map +1 -1
  446. package/dist/esm/flows-actors/services/mcp-client.backend.service.d.ts +90 -0
  447. package/dist/esm/flows-actors/services/mcp-client.backend.service.d.ts.map +1 -0
  448. package/dist/esm/flows-actors/services/mcp-client.backend.service.js +368 -0
  449. package/dist/esm/flows-actors/services/mcp-client.backend.service.js.map +1 -0
  450. package/dist/esm/flows-actors/services/prompt-compiler.backend.service.d.ts +9 -5
  451. package/dist/esm/flows-actors/services/prompt-compiler.backend.service.d.ts.map +1 -1
  452. package/dist/esm/flows-actors/services/prompt-compiler.backend.service.js +12 -17
  453. package/dist/esm/flows-actors/services/prompt-compiler.backend.service.js.map +1 -1
  454. package/dist/esm/flows-actors/utils/acp-session-runner.backend.utils.d.ts +151 -41
  455. package/dist/esm/flows-actors/utils/acp-session-runner.backend.utils.d.ts.map +1 -1
  456. package/dist/esm/flows-actors/utils/acp-session-runner.backend.utils.js +308 -143
  457. package/dist/esm/flows-actors/utils/acp-session-runner.backend.utils.js.map +1 -1
  458. package/dist/esm/flows-actors/utils/meta-workflow-canonical-json.backend.utils.d.ts +0 -207
  459. package/dist/esm/flows-actors/utils/meta-workflow-canonical-json.backend.utils.d.ts.map +1 -1
  460. package/dist/esm/flows-actors/utils/meta-workflow-canonical-json.backend.utils.js +8 -243
  461. package/dist/esm/flows-actors/utils/meta-workflow-canonical-json.backend.utils.js.map +1 -1
  462. package/dist/esm/flows-actors/utils/meta-workflow-structured-generation-plan.backend.utils.d.ts.map +1 -1
  463. package/dist/esm/flows-actors/utils/meta-workflow-structured-generation-plan.backend.utils.js.map +1 -1
  464. package/dist/esm/guidance/services/milestone-evaluator.backend.service.d.ts +9 -14
  465. package/dist/esm/guidance/services/milestone-evaluator.backend.service.d.ts.map +1 -1
  466. package/dist/esm/guidance/services/milestone-evaluator.backend.service.js +18 -89
  467. package/dist/esm/guidance/services/milestone-evaluator.backend.service.js.map +1 -1
  468. package/dist/esm/guidance/services/progression-state-store.backend.service.d.ts +86 -0
  469. package/dist/esm/guidance/services/progression-state-store.backend.service.d.ts.map +1 -0
  470. package/dist/esm/guidance/services/progression-state-store.backend.service.js +155 -0
  471. package/dist/esm/guidance/services/progression-state-store.backend.service.js.map +1 -0
  472. package/dist/esm/i18n/controllers/i18n-controller.backend.service.d.ts +10 -0
  473. package/dist/esm/i18n/controllers/i18n-controller.backend.service.d.ts.map +1 -1
  474. package/dist/esm/i18n/controllers/i18n-controller.backend.service.js +55 -5
  475. package/dist/esm/i18n/controllers/i18n-controller.backend.service.js.map +1 -1
  476. package/dist/esm/index.d.ts +15 -5
  477. package/dist/esm/index.d.ts.map +1 -1
  478. package/dist/esm/index.js +45 -5
  479. package/dist/esm/index.js.map +1 -1
  480. package/dist/esm/inject/models/container.d.ts.map +1 -1
  481. package/dist/esm/inject/models/container.js +82 -10
  482. package/dist/esm/inject/models/container.js.map +1 -1
  483. package/dist/esm/inject/models/service-types.d.ts +20 -3
  484. package/dist/esm/inject/models/service-types.d.ts.map +1 -1
  485. package/dist/esm/inject/models/service-types.js +21 -3
  486. package/dist/esm/inject/models/service-types.js.map +1 -1
  487. package/dist/esm/mcp/controllers/mcp.controller.d.ts.map +1 -1
  488. package/dist/esm/mcp/controllers/mcp.controller.js +32 -4
  489. package/dist/esm/mcp/controllers/mcp.controller.js.map +1 -1
  490. package/dist/esm/mcp/models/mcp-tool.backend.schemas.d.ts +34 -0
  491. package/dist/esm/mcp/models/mcp-tool.backend.schemas.d.ts.map +1 -1
  492. package/dist/esm/mcp/models/mcp-tool.backend.schemas.js +42 -0
  493. package/dist/esm/mcp/models/mcp-tool.backend.schemas.js.map +1 -1
  494. package/dist/esm/mcp/services/mcp-server.backend.service.d.ts +84 -1
  495. package/dist/esm/mcp/services/mcp-server.backend.service.d.ts.map +1 -1
  496. package/dist/esm/mcp/services/mcp-server.backend.service.js +235 -11
  497. package/dist/esm/mcp/services/mcp-server.backend.service.js.map +1 -1
  498. package/dist/esm/mcp/services/mcp-tool-adapter.backend.service.d.ts +64 -2
  499. package/dist/esm/mcp/services/mcp-tool-adapter.backend.service.d.ts.map +1 -1
  500. package/dist/esm/mcp/services/mcp-tool-adapter.backend.service.js +152 -6
  501. package/dist/esm/mcp/services/mcp-tool-adapter.backend.service.js.map +1 -1
  502. package/dist/esm/monitoring/analytics/controllers/analytics.backend.controller.d.ts.map +1 -1
  503. package/dist/esm/monitoring/analytics/controllers/analytics.backend.controller.js +49 -4
  504. package/dist/esm/monitoring/analytics/controllers/analytics.backend.controller.js.map +1 -1
  505. package/dist/esm/monitoring/analytics/services/value-moment-definition-registry.backend.service.d.ts +66 -0
  506. package/dist/esm/monitoring/analytics/services/value-moment-definition-registry.backend.service.d.ts.map +1 -0
  507. package/dist/esm/monitoring/analytics/services/value-moment-definition-registry.backend.service.js +199 -0
  508. package/dist/esm/monitoring/analytics/services/value-moment-definition-registry.backend.service.js.map +1 -0
  509. package/dist/esm/monitoring/analytics/services/value-moment-engine.backend.service.d.ts +149 -13
  510. package/dist/esm/monitoring/analytics/services/value-moment-engine.backend.service.d.ts.map +1 -1
  511. package/dist/esm/monitoring/analytics/services/value-moment-engine.backend.service.js +411 -19
  512. package/dist/esm/monitoring/analytics/services/value-moment-engine.backend.service.js.map +1 -1
  513. package/dist/esm/monitoring/analytics/services/value-moment-handler-registry.backend.service.d.ts +11 -2
  514. package/dist/esm/monitoring/analytics/services/value-moment-handler-registry.backend.service.d.ts.map +1 -1
  515. package/dist/esm/monitoring/analytics/services/value-moment-handler-registry.backend.service.js.map +1 -1
  516. package/dist/esm/monitoring/logger/models/logger.backend.schemas.d.ts +28 -9
  517. package/dist/esm/monitoring/logger/models/logger.backend.schemas.d.ts.map +1 -1
  518. package/dist/esm/monitoring/logger/models/logger.backend.schemas.js +30 -10
  519. package/dist/esm/monitoring/logger/models/logger.backend.schemas.js.map +1 -1
  520. package/dist/esm/monitoring/logger/services/logger.service.d.ts +12 -0
  521. package/dist/esm/monitoring/logger/services/logger.service.d.ts.map +1 -1
  522. package/dist/esm/monitoring/logger/services/logger.service.js +52 -11
  523. package/dist/esm/monitoring/logger/services/logger.service.js.map +1 -1
  524. package/dist/esm/monitoring/logger/utils/log-severity-floor.backend.utils.d.ts +62 -0
  525. package/dist/esm/monitoring/logger/utils/log-severity-floor.backend.utils.d.ts.map +1 -0
  526. package/dist/esm/monitoring/logger/utils/log-severity-floor.backend.utils.js +78 -0
  527. package/dist/esm/monitoring/logger/utils/log-severity-floor.backend.utils.js.map +1 -0
  528. package/dist/esm/monitoring/observability/audit-observation-emission.backend.d.ts +309 -0
  529. package/dist/esm/monitoring/observability/audit-observation-emission.backend.d.ts.map +1 -0
  530. package/dist/esm/monitoring/observability/audit-observation-emission.backend.js +385 -0
  531. package/dist/esm/monitoring/observability/audit-observation-emission.backend.js.map +1 -0
  532. package/dist/esm/monitoring/observability/models/observability.backend.schemas.d.ts +1 -0
  533. package/dist/esm/monitoring/observability/models/observability.backend.schemas.d.ts.map +1 -1
  534. package/dist/esm/monitoring/observability/models/observability.backend.schemas.js.map +1 -1
  535. package/dist/esm/monitoring/observability/services/metrics.service.d.ts +21 -0
  536. package/dist/esm/monitoring/observability/services/metrics.service.d.ts.map +1 -1
  537. package/dist/esm/monitoring/observability/services/metrics.service.js +38 -0
  538. package/dist/esm/monitoring/observability/services/metrics.service.js.map +1 -1
  539. package/dist/esm/notifications/email/models/email-context-provider.interface.d.ts +0 -80
  540. package/dist/esm/notifications/email/models/email-context-provider.interface.d.ts.map +0 -1
  541. package/dist/esm/notifications/email/models/email-context-provider.interface.js +0 -25
  542. package/dist/esm/notifications/email/models/email-context-provider.interface.js.map +0 -1
  543. package/dist/esm/notifications/email/services/email-context-provider-registry.backend.service.d.ts +0 -49
  544. package/dist/esm/notifications/email/services/email-context-provider-registry.backend.service.d.ts.map +0 -1
  545. package/dist/esm/notifications/email/services/email-context-provider-registry.backend.service.js +0 -141
  546. package/dist/esm/notifications/email/services/email-context-provider-registry.backend.service.js.map +0 -1
  547. package/dist/esm/notifications/email/services/email-template-compiler.backend.service.d.ts +0 -37
  548. package/dist/esm/notifications/email/services/email-template-compiler.backend.service.d.ts.map +0 -1
  549. package/dist/esm/notifications/email/services/email-template-compiler.backend.service.js +0 -121
  550. package/dist/esm/notifications/email/services/email-template-compiler.backend.service.js.map +0 -1
  551. package/dist/esm/notifications/email/services/email-template-registry.backend.service.d.ts +66 -1
  552. package/dist/esm/notifications/email/services/email-template-registry.backend.service.d.ts.map +1 -1
  553. package/dist/esm/notifications/email/services/email-template-registry.backend.service.js +105 -10
  554. package/dist/esm/notifications/email/services/email-template-registry.backend.service.js.map +1 -1
  555. package/dist/esm/notifications/email/services/email-template-sandbox.backend.service.d.ts +0 -58
  556. package/dist/esm/notifications/email/services/email-template-sandbox.backend.service.d.ts.map +0 -1
  557. package/dist/esm/notifications/email/services/email-template-sandbox.backend.service.js +0 -223
  558. package/dist/esm/notifications/email/services/email-template-sandbox.backend.service.js.map +0 -1
  559. package/dist/esm/notifications/email/services/email-template-validator.backend.service.d.ts.map +1 -1
  560. package/dist/esm/notifications/email/services/email-template-validator.backend.service.js +10 -1
  561. package/dist/esm/notifications/email/services/email-template-validator.backend.service.js.map +1 -1
  562. package/dist/esm/notifications/email/services/email.backend.service.d.ts +60 -4
  563. package/dist/esm/notifications/email/services/email.backend.service.d.ts.map +1 -1
  564. package/dist/esm/notifications/email/services/email.backend.service.js +145 -43
  565. package/dist/esm/notifications/email/services/email.backend.service.js.map +1 -1
  566. package/dist/esm/notifications/email/utils/color-conversion.utils.d.ts +0 -1
  567. package/dist/esm/notifications/email/utils/color-conversion.utils.d.ts.map +1 -1
  568. package/dist/esm/notifications/email/utils/color-conversion.utils.js.map +1 -1
  569. package/dist/esm/notifications/services/notification-badge.backend.service.d.ts +142 -21
  570. package/dist/esm/notifications/services/notification-badge.backend.service.d.ts.map +1 -1
  571. package/dist/esm/notifications/services/notification-badge.backend.service.js +283 -58
  572. package/dist/esm/notifications/services/notification-badge.backend.service.js.map +1 -1
  573. package/dist/esm/notifications/services/notifications-dispatcher.backend.service.d.ts +108 -13
  574. package/dist/esm/notifications/services/notifications-dispatcher.backend.service.d.ts.map +1 -1
  575. package/dist/esm/notifications/services/notifications-dispatcher.backend.service.js +432 -101
  576. package/dist/esm/notifications/services/notifications-dispatcher.backend.service.js.map +1 -1
  577. package/dist/esm/notifications/sms/services/sms.backend.service.d.ts +2 -2
  578. package/dist/esm/notifications/sms/services/sms.backend.service.d.ts.map +1 -1
  579. package/dist/esm/notifications/sms/services/sms.backend.service.js +5 -5
  580. package/dist/esm/notifications/sms/services/sms.backend.service.js.map +1 -1
  581. package/dist/esm/notifications/webhooks/controllers/webhook-auto-controller.backend.service.d.ts +117 -5
  582. package/dist/esm/notifications/webhooks/controllers/webhook-auto-controller.backend.service.d.ts.map +1 -1
  583. package/dist/esm/notifications/webhooks/controllers/webhook-auto-controller.backend.service.js +164 -6
  584. package/dist/esm/notifications/webhooks/controllers/webhook-auto-controller.backend.service.js.map +1 -1
  585. package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.d.ts +0 -6
  586. package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.d.ts.map +1 -1
  587. package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.js +54 -7
  588. package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.js.map +1 -1
  589. package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.utils.d.ts +5 -5
  590. package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.utils.d.ts.map +1 -1
  591. package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.utils.js +14 -13
  592. package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.utils.js.map +1 -1
  593. package/dist/esm/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.d.ts +2 -1
  594. package/dist/esm/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.d.ts.map +1 -1
  595. package/dist/esm/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.js +18 -8
  596. package/dist/esm/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.js.map +1 -1
  597. package/dist/esm/notifications/webhooks/outbound/services/webhook-config-test-endpoint.custom-impl.backend.service.d.ts.map +1 -1
  598. package/dist/esm/notifications/webhooks/outbound/services/webhook-config-test-endpoint.custom-impl.backend.service.js +20 -18
  599. package/dist/esm/notifications/webhooks/outbound/services/webhook-config-test-endpoint.custom-impl.backend.service.js.map +1 -1
  600. package/dist/esm/notifications/webhooks/services/webhook-handler.backend.service.d.ts +16 -0
  601. package/dist/esm/notifications/webhooks/services/webhook-handler.backend.service.d.ts.map +1 -1
  602. package/dist/esm/notifications/webhooks/services/webhook-handler.backend.service.js +18 -0
  603. package/dist/esm/notifications/webhooks/services/webhook-handler.backend.service.js.map +1 -1
  604. package/dist/esm/organizations/batches/organization-purge.batch.backend.service.d.ts +2 -2
  605. package/dist/esm/organizations/batches/organization-purge.batch.backend.service.js +2 -2
  606. package/dist/esm/organizations/batches/organization-purge.batch.backend.service.js.map +1 -1
  607. package/dist/esm/organizations/services/organization-custom-implementation.backend.service.d.ts.map +1 -1
  608. package/dist/esm/organizations/services/organization-custom-implementation.backend.service.js +63 -2
  609. package/dist/esm/organizations/services/organization-custom-implementation.backend.service.js.map +1 -1
  610. package/dist/esm/organizations/services/organization-unit-custom-implementation.backend.service.d.ts.map +1 -1
  611. package/dist/esm/organizations/services/organization-unit-custom-implementation.backend.service.js +4 -1
  612. package/dist/esm/organizations/services/organization-unit-custom-implementation.backend.service.js.map +1 -1
  613. package/dist/esm/queue/adapters/in-memory-queue-adapter.backend.service.d.ts +66 -0
  614. package/dist/esm/queue/adapters/in-memory-queue-adapter.backend.service.d.ts.map +1 -0
  615. package/dist/esm/queue/adapters/in-memory-queue-adapter.backend.service.js +257 -0
  616. package/dist/esm/queue/adapters/in-memory-queue-adapter.backend.service.js.map +1 -0
  617. package/dist/esm/queue/adapters/queue-adapter.backend.binding.d.ts +12 -0
  618. package/dist/esm/queue/adapters/queue-adapter.backend.binding.d.ts.map +1 -0
  619. package/dist/esm/queue/adapters/queue-adapter.backend.binding.js +47 -0
  620. package/dist/esm/queue/adapters/queue-adapter.backend.binding.js.map +1 -0
  621. package/dist/esm/queue/adapters/queue-adapter.backend.interface.d.ts +87 -0
  622. package/dist/esm/queue/adapters/queue-adapter.backend.interface.d.ts.map +1 -0
  623. package/dist/esm/queue/adapters/queue-adapter.backend.interface.js +1 -0
  624. package/dist/esm/queue/adapters/queue-adapter.backend.interface.js.map +1 -0
  625. package/dist/esm/queue/adapters/queue-adapter.backend.options.d.ts +31 -0
  626. package/dist/esm/queue/adapters/queue-adapter.backend.options.d.ts.map +1 -0
  627. package/dist/esm/queue/adapters/queue-adapter.backend.options.js +13 -0
  628. package/dist/esm/queue/adapters/queue-adapter.backend.options.js.map +1 -0
  629. package/dist/esm/queue/adapters/rabbitmq-adapter.backend.service.d.ts +19 -25
  630. package/dist/esm/queue/adapters/rabbitmq-adapter.backend.service.d.ts.map +1 -1
  631. package/dist/esm/queue/adapters/rabbitmq-adapter.backend.service.js +33 -0
  632. package/dist/esm/queue/adapters/rabbitmq-adapter.backend.service.js.map +1 -1
  633. package/dist/esm/queue/domain-queue-consumer.backend.service.d.ts +2 -2
  634. package/dist/esm/queue/domain-queue-consumer.backend.service.d.ts.map +1 -1
  635. package/dist/esm/queue/domain-queue-consumer.backend.service.js +1 -4
  636. package/dist/esm/queue/domain-queue-consumer.backend.service.js.map +1 -1
  637. package/dist/esm/queue/job-consumer.backend.service.d.ts +2 -2
  638. package/dist/esm/queue/job-consumer.backend.service.d.ts.map +1 -1
  639. package/dist/esm/queue/job-consumer.backend.service.js +1 -4
  640. package/dist/esm/queue/job-consumer.backend.service.js.map +1 -1
  641. package/dist/esm/queue/job-executor.backend.service.d.ts +2 -2
  642. package/dist/esm/queue/job-executor.backend.service.d.ts.map +1 -1
  643. package/dist/esm/queue/job-executor.backend.service.js +1 -4
  644. package/dist/esm/queue/job-executor.backend.service.js.map +1 -1
  645. package/dist/esm/queue/queue-monitoring.backend.service.d.ts +8 -4
  646. package/dist/esm/queue/queue-monitoring.backend.service.d.ts.map +1 -1
  647. package/dist/esm/queue/queue-monitoring.backend.service.js +25 -17
  648. package/dist/esm/queue/queue-monitoring.backend.service.js.map +1 -1
  649. package/dist/esm/queue/queue-worker-initializer.backend.service.d.ts +16 -1
  650. package/dist/esm/queue/queue-worker-initializer.backend.service.d.ts.map +1 -1
  651. package/dist/esm/queue/queue-worker-initializer.backend.service.js +16 -1
  652. package/dist/esm/queue/queue-worker-initializer.backend.service.js.map +1 -1
  653. package/dist/esm/queue/queue.backend.service.d.ts +3 -3
  654. package/dist/esm/queue/queue.backend.service.d.ts.map +1 -1
  655. package/dist/esm/queue/queue.backend.service.js +26 -4
  656. package/dist/esm/queue/queue.backend.service.js.map +1 -1
  657. package/dist/esm/queue/worker-shutdown-manager.backend.service.d.ts +2 -2
  658. package/dist/esm/queue/worker-shutdown-manager.backend.service.d.ts.map +1 -1
  659. package/dist/esm/queue/worker-shutdown-manager.backend.service.js +18 -3
  660. package/dist/esm/queue/worker-shutdown-manager.backend.service.js.map +1 -1
  661. package/dist/esm/rag/utils/rag-chunking.backend.utils.d.ts +50 -25
  662. package/dist/esm/rag/utils/rag-chunking.backend.utils.d.ts.map +1 -1
  663. package/dist/esm/rag/utils/rag-chunking.backend.utils.js +147 -39
  664. package/dist/esm/rag/utils/rag-chunking.backend.utils.js.map +1 -1
  665. package/dist/esm/rag/utils/rag-context-assembly.backend.utils.d.ts +12 -3
  666. package/dist/esm/rag/utils/rag-context-assembly.backend.utils.d.ts.map +1 -1
  667. package/dist/esm/rag/utils/rag-context-assembly.backend.utils.js +12 -3
  668. package/dist/esm/rag/utils/rag-context-assembly.backend.utils.js.map +1 -1
  669. package/dist/esm/requests/service/websocket.service.d.ts +9 -0
  670. package/dist/esm/requests/service/websocket.service.d.ts.map +1 -1
  671. package/dist/esm/requests/service/websocket.service.js +88 -15
  672. package/dist/esm/requests/service/websocket.service.js.map +1 -1
  673. package/dist/esm/resources/models/custom-service-implementations.backend.definition.d.ts.map +1 -1
  674. package/dist/esm/resources/models/custom-service-implementations.backend.definition.js +16 -2
  675. package/dist/esm/resources/models/custom-service-implementations.backend.definition.js.map +1 -1
  676. package/dist/esm/resources/models/resources-operations.backend.definitions.d.ts.map +1 -1
  677. package/dist/esm/resources/models/resources-operations.backend.definitions.js +2 -0
  678. package/dist/esm/resources/models/resources-operations.backend.definitions.js.map +1 -1
  679. package/dist/esm/resources/models/resources-relationships.backend.definitions.d.ts.map +1 -1
  680. package/dist/esm/resources/models/resources-relationships.backend.definitions.js +14 -0
  681. package/dist/esm/resources/models/resources-relationships.backend.definitions.js.map +1 -1
  682. package/dist/esm/resources/models/resources-types.backend.schemas.d.ts +2 -1
  683. package/dist/esm/resources/models/resources-types.backend.schemas.d.ts.map +1 -1
  684. package/dist/esm/resources/models/resources-types.backend.schemas.js +8 -0
  685. package/dist/esm/resources/models/resources-types.backend.schemas.js.map +1 -1
  686. package/dist/esm/resources/services/resource-id.backend.service.js +3 -3
  687. package/dist/esm/resources/services/resource-id.backend.service.js.map +1 -1
  688. package/dist/esm/resources/services/resources-registry.backend.service.d.ts +60 -5
  689. package/dist/esm/resources/services/resources-registry.backend.service.d.ts.map +1 -1
  690. package/dist/esm/resources/services/resources-registry.backend.service.js +91 -7
  691. package/dist/esm/resources/services/resources-registry.backend.service.js.map +1 -1
  692. package/dist/esm/runtime/controllers/health-controller.backend.service.d.ts +36 -3
  693. package/dist/esm/runtime/controllers/health-controller.backend.service.d.ts.map +1 -1
  694. package/dist/esm/runtime/controllers/health-controller.backend.service.js +32 -10
  695. package/dist/esm/runtime/controllers/health-controller.backend.service.js.map +1 -1
  696. package/dist/esm/runtime/domain-module.backend.definitions.d.ts +24 -0
  697. package/dist/esm/runtime/domain-module.backend.definitions.d.ts.map +1 -1
  698. package/dist/esm/runtime/domain-module.backend.definitions.js +24 -0
  699. package/dist/esm/runtime/domain-module.backend.definitions.js.map +1 -1
  700. package/dist/esm/runtime/services/execution-context-creator.backend.service.d.ts.map +1 -1
  701. package/dist/esm/runtime/services/execution-context-creator.backend.service.js +13 -7
  702. package/dist/esm/runtime/services/execution-context-creator.backend.service.js.map +1 -1
  703. package/dist/esm/runtime/services/health-readiness-contributor.backend.interface.d.ts +51 -0
  704. package/dist/esm/runtime/services/health-readiness-contributor.backend.interface.d.ts.map +1 -1
  705. package/dist/esm/runtime/services/health-readiness-contributor.backend.interface.js.map +1 -1
  706. package/dist/esm/runtime/services/http-server.backend.service.d.ts +26 -0
  707. package/dist/esm/runtime/services/http-server.backend.service.d.ts.map +1 -1
  708. package/dist/esm/runtime/services/http-server.backend.service.js +181 -1
  709. package/dist/esm/runtime/services/http-server.backend.service.js.map +1 -1
  710. package/dist/esm/runtime/services/start-application.backend.service.d.ts +47 -1
  711. package/dist/esm/runtime/services/start-application.backend.service.d.ts.map +1 -1
  712. package/dist/esm/runtime/services/start-application.backend.service.js +343 -77
  713. package/dist/esm/runtime/services/start-application.backend.service.js.map +1 -1
  714. package/dist/esm/security/api-keys/api-keys.custom-impl.backend.service.d.ts +15 -0
  715. package/dist/esm/security/api-keys/api-keys.custom-impl.backend.service.d.ts.map +1 -1
  716. package/dist/esm/security/api-keys/api-keys.custom-impl.backend.service.js +28 -0
  717. package/dist/esm/security/api-keys/api-keys.custom-impl.backend.service.js.map +1 -1
  718. package/dist/esm/security/authentications/batches/anonymous-session-cleanup.batch.backend.service.d.ts +5 -1
  719. package/dist/esm/security/authentications/batches/anonymous-session-cleanup.batch.backend.service.d.ts.map +1 -1
  720. package/dist/esm/security/authentications/batches/anonymous-session-cleanup.batch.backend.service.js +24 -4
  721. package/dist/esm/security/authentications/batches/anonymous-session-cleanup.batch.backend.service.js.map +1 -1
  722. package/dist/esm/security/authentications/controllers/authentication-controller.backend.service.d.ts.map +1 -1
  723. package/dist/esm/security/authentications/controllers/authentication-controller.backend.service.js +29 -4
  724. package/dist/esm/security/authentications/controllers/authentication-controller.backend.service.js.map +1 -1
  725. package/dist/esm/security/authentications/controllers/oauth-provider-controller.backend.service.d.ts +114 -0
  726. package/dist/esm/security/authentications/controllers/oauth-provider-controller.backend.service.d.ts.map +1 -1
  727. package/dist/esm/security/authentications/controllers/oauth-provider-controller.backend.service.js +354 -3
  728. package/dist/esm/security/authentications/controllers/oauth-provider-controller.backend.service.js.map +1 -1
  729. package/dist/esm/security/authentications/models/cimd.backend.schemas.d.ts +1 -0
  730. package/dist/esm/security/authentications/models/cimd.backend.schemas.d.ts.map +1 -1
  731. package/dist/esm/security/authentications/models/cimd.backend.schemas.js +22 -0
  732. package/dist/esm/security/authentications/models/cimd.backend.schemas.js.map +1 -1
  733. package/dist/esm/security/authentications/models/jwt.backend.schemas.d.ts +3 -23
  734. package/dist/esm/security/authentications/models/jwt.backend.schemas.d.ts.map +1 -1
  735. package/dist/esm/security/authentications/models/jwt.backend.schemas.js +20 -45
  736. package/dist/esm/security/authentications/models/jwt.backend.schemas.js.map +1 -1
  737. package/dist/esm/security/authentications/models/oauth2-connection.backend.schemas.d.ts +15 -0
  738. package/dist/esm/security/authentications/models/oauth2-connection.backend.schemas.d.ts.map +1 -1
  739. package/dist/esm/security/authentications/models/oauth2-connection.backend.schemas.js.map +1 -1
  740. package/dist/esm/security/authentications/services/admin-config/auth-organization-configuration.service.d.ts +0 -2
  741. package/dist/esm/security/authentications/services/admin-config/auth-organization-configuration.service.d.ts.map +1 -1
  742. package/dist/esm/security/authentications/services/admin-config/auth-organization-configuration.service.js +23 -14
  743. package/dist/esm/security/authentications/services/admin-config/auth-organization-configuration.service.js.map +1 -1
  744. package/dist/esm/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.d.ts +0 -1
  745. package/dist/esm/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.d.ts.map +1 -1
  746. package/dist/esm/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.js +15 -12
  747. package/dist/esm/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.js.map +1 -1
  748. package/dist/esm/security/authentications/services/admin-config/domain-verification.backend.service.d.ts +113 -3
  749. package/dist/esm/security/authentications/services/admin-config/domain-verification.backend.service.d.ts.map +1 -1
  750. package/dist/esm/security/authentications/services/admin-config/domain-verification.backend.service.js +207 -30
  751. package/dist/esm/security/authentications/services/admin-config/domain-verification.backend.service.js.map +1 -1
  752. package/dist/esm/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.d.ts +95 -2
  753. package/dist/esm/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.d.ts.map +1 -1
  754. package/dist/esm/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.js +153 -9
  755. package/dist/esm/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.js.map +1 -1
  756. package/dist/esm/security/authentications/services/anonymous-session.backend.service.d.ts +190 -0
  757. package/dist/esm/security/authentications/services/anonymous-session.backend.service.d.ts.map +1 -1
  758. package/dist/esm/security/authentications/services/anonymous-session.backend.service.js +377 -53
  759. package/dist/esm/security/authentications/services/anonymous-session.backend.service.js.map +1 -1
  760. package/dist/esm/security/authentications/services/auth-methods/auth-method-management.backend.service.d.ts +9 -1
  761. package/dist/esm/security/authentications/services/auth-methods/auth-method-management.backend.service.d.ts.map +1 -1
  762. package/dist/esm/security/authentications/services/auth-methods/auth-method-management.backend.service.js +77 -2
  763. package/dist/esm/security/authentications/services/auth-methods/auth-method-management.backend.service.js.map +1 -1
  764. package/dist/esm/security/authentications/services/auth-methods/auth-mfa.backend.service.d.ts.map +1 -1
  765. package/dist/esm/security/authentications/services/auth-methods/auth-mfa.backend.service.js +5 -3
  766. package/dist/esm/security/authentications/services/auth-methods/auth-mfa.backend.service.js.map +1 -1
  767. package/dist/esm/security/authentications/services/auth-methods/auth-registration.backend.service.d.ts +41 -0
  768. package/dist/esm/security/authentications/services/auth-methods/auth-registration.backend.service.d.ts.map +1 -1
  769. package/dist/esm/security/authentications/services/auth-methods/auth-registration.backend.service.js +202 -23
  770. package/dist/esm/security/authentications/services/auth-methods/auth-registration.backend.service.js.map +1 -1
  771. package/dist/esm/security/authentications/services/auth-methods/oauth2-authentication.backend.service.d.ts.map +1 -1
  772. package/dist/esm/security/authentications/services/auth-methods/oauth2-authentication.backend.service.js +42 -1
  773. package/dist/esm/security/authentications/services/auth-methods/oauth2-authentication.backend.service.js.map +1 -1
  774. package/dist/esm/security/authentications/services/auth-methods/oauth2-connection-resolver.backend.service.d.ts.map +1 -1
  775. package/dist/esm/security/authentications/services/auth-methods/oauth2-connection-resolver.backend.service.js +34 -4
  776. package/dist/esm/security/authentications/services/auth-methods/oauth2-connection-resolver.backend.service.js.map +1 -1
  777. package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.d.ts +29 -5
  778. package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.d.ts.map +1 -1
  779. package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.js +77 -5
  780. package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.js.map +1 -1
  781. package/dist/esm/security/authentications/services/auth-token-issuer.backend.service.d.ts +41 -1
  782. package/dist/esm/security/authentications/services/auth-token-issuer.backend.service.d.ts.map +1 -1
  783. package/dist/esm/security/authentications/services/auth-token-issuer.backend.service.js +87 -4
  784. package/dist/esm/security/authentications/services/auth-token-issuer.backend.service.js.map +1 -1
  785. package/dist/esm/security/authentications/services/authentication-orchestrator.backend.service.d.ts +43 -1
  786. package/dist/esm/security/authentications/services/authentication-orchestrator.backend.service.d.ts.map +1 -1
  787. package/dist/esm/security/authentications/services/authentication-orchestrator.backend.service.js +277 -97
  788. package/dist/esm/security/authentications/services/authentication-orchestrator.backend.service.js.map +1 -1
  789. package/dist/esm/security/authentications/services/cimd-client-metadata.backend.service.d.ts +28 -5
  790. package/dist/esm/security/authentications/services/cimd-client-metadata.backend.service.d.ts.map +1 -1
  791. package/dist/esm/security/authentications/services/cimd-client-metadata.backend.service.js +72 -12
  792. package/dist/esm/security/authentications/services/cimd-client-metadata.backend.service.js.map +1 -1
  793. package/dist/esm/security/authentications/services/custom-impls/auth-custom-implementations.backend.d.ts.map +1 -1
  794. package/dist/esm/security/authentications/services/custom-impls/auth-custom-implementations.backend.js +3 -0
  795. package/dist/esm/security/authentications/services/custom-impls/auth-custom-implementations.backend.js.map +1 -1
  796. package/dist/esm/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.d.ts +28 -0
  797. package/dist/esm/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.d.ts.map +1 -0
  798. package/dist/esm/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.js +283 -0
  799. package/dist/esm/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.js.map +1 -0
  800. package/dist/esm/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.d.ts +4 -3
  801. package/dist/esm/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.d.ts.map +1 -1
  802. package/dist/esm/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.js +4 -3
  803. package/dist/esm/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.js.map +1 -1
  804. package/dist/esm/security/authentications/services/oauth-provider-token.backend.service.d.ts +35 -0
  805. package/dist/esm/security/authentications/services/oauth-provider-token.backend.service.d.ts.map +1 -1
  806. package/dist/esm/security/authentications/services/oauth-provider-token.backend.service.js +111 -21
  807. package/dist/esm/security/authentications/services/oauth-provider-token.backend.service.js.map +1 -1
  808. package/dist/esm/security/authentications/services/oidc-authorization-code.backend.service.d.ts +14 -1
  809. package/dist/esm/security/authentications/services/oidc-authorization-code.backend.service.d.ts.map +1 -1
  810. package/dist/esm/security/authentications/services/oidc-authorization-code.backend.service.js +49 -8
  811. package/dist/esm/security/authentications/services/oidc-authorization-code.backend.service.js.map +1 -1
  812. package/dist/esm/security/authentications/services/utils/auth-policy-resolution.backend.utils.d.ts.map +1 -1
  813. package/dist/esm/security/authentications/services/utils/auth-policy-resolution.backend.utils.js +4 -0
  814. package/dist/esm/security/authentications/services/utils/auth-policy-resolution.backend.utils.js.map +1 -1
  815. package/dist/esm/security/authentications/services/utils/auth-user-lookup.backend.service.d.ts.map +1 -1
  816. package/dist/esm/security/authentications/services/utils/auth-user-lookup.backend.service.js +6 -0
  817. package/dist/esm/security/authentications/services/utils/auth-user-lookup.backend.service.js.map +1 -1
  818. package/dist/esm/security/authentications/services/utils/external-turn-rate-limit.backend.utils.d.ts +37 -1
  819. package/dist/esm/security/authentications/services/utils/external-turn-rate-limit.backend.utils.d.ts.map +1 -1
  820. package/dist/esm/security/authentications/services/utils/external-turn-rate-limit.backend.utils.js +51 -0
  821. package/dist/esm/security/authentications/services/utils/external-turn-rate-limit.backend.utils.js.map +1 -1
  822. package/dist/esm/security/authentications/utils/enterprise-sso-enforcement.backend.utils.d.ts +41 -0
  823. package/dist/esm/security/authentications/utils/enterprise-sso-enforcement.backend.utils.d.ts.map +1 -1
  824. package/dist/esm/security/authentications/utils/enterprise-sso-enforcement.backend.utils.js +45 -0
  825. package/dist/esm/security/authentications/utils/enterprise-sso-enforcement.backend.utils.js.map +1 -1
  826. package/dist/esm/security/authorizations/cross-tenant-read-observation.backend.d.ts +116 -0
  827. package/dist/esm/security/authorizations/cross-tenant-read-observation.backend.d.ts.map +1 -0
  828. package/dist/esm/security/authorizations/cross-tenant-read-observation.backend.js +162 -0
  829. package/dist/esm/security/authorizations/cross-tenant-read-observation.backend.js.map +1 -0
  830. package/dist/esm/security/authorizations/initiator-organization-confinement.backend.d.ts.map +1 -1
  831. package/dist/esm/security/authorizations/initiator-organization-confinement.backend.js +24 -1
  832. package/dist/esm/security/authorizations/initiator-organization-confinement.backend.js.map +1 -1
  833. package/dist/esm/security/authorizations/organization-owner-floor.backend.utils.d.ts +20 -20
  834. package/dist/esm/security/authorizations/organization-owner-floor.backend.utils.d.ts.map +1 -1
  835. package/dist/esm/security/authorizations/organization-owner-floor.backend.utils.js +27 -28
  836. package/dist/esm/security/authorizations/organization-owner-floor.backend.utils.js.map +1 -1
  837. package/dist/esm/security/authorizations/platform-access-grant-custom-implementation.backend.service.d.ts.map +1 -1
  838. package/dist/esm/security/authorizations/platform-access-grant-custom-implementation.backend.service.js +77 -3
  839. package/dist/esm/security/authorizations/platform-access-grant-custom-implementation.backend.service.js.map +1 -1
  840. package/dist/esm/security/authorizations/privileged-access-review.backend.utils.d.ts +117 -0
  841. package/dist/esm/security/authorizations/privileged-access-review.backend.utils.d.ts.map +1 -0
  842. package/dist/esm/security/authorizations/privileged-access-review.backend.utils.js +104 -0
  843. package/dist/esm/security/authorizations/privileged-access-review.backend.utils.js.map +1 -0
  844. package/dist/esm/security/authorizations/role-ceiling.backend.utils.d.ts +4 -0
  845. package/dist/esm/security/authorizations/role-ceiling.backend.utils.d.ts.map +1 -1
  846. package/dist/esm/security/authorizations/role-ceiling.backend.utils.js +4 -0
  847. package/dist/esm/security/authorizations/role-ceiling.backend.utils.js.map +1 -1
  848. package/dist/esm/security/authorizations/role-conferral.backend.utils.d.ts +93 -0
  849. package/dist/esm/security/authorizations/role-conferral.backend.utils.d.ts.map +1 -0
  850. package/dist/esm/security/authorizations/role-conferral.backend.utils.js +95 -0
  851. package/dist/esm/security/authorizations/role-conferral.backend.utils.js.map +1 -0
  852. package/dist/esm/security/authorizations/scope-root-collection-confinement.backend.d.ts +124 -1
  853. package/dist/esm/security/authorizations/scope-root-collection-confinement.backend.d.ts.map +1 -1
  854. package/dist/esm/security/authorizations/scope-root-collection-confinement.backend.js +142 -5
  855. package/dist/esm/security/authorizations/scope-root-collection-confinement.backend.js.map +1 -1
  856. package/dist/esm/security/authorizations/services/authorizations.backend.service.d.ts +175 -14
  857. package/dist/esm/security/authorizations/services/authorizations.backend.service.d.ts.map +1 -1
  858. package/dist/esm/security/authorizations/services/authorizations.backend.service.js +385 -49
  859. package/dist/esm/security/authorizations/services/authorizations.backend.service.js.map +1 -1
  860. package/dist/esm/security/authorizations/super-admin-floor.backend.utils.d.ts +6 -14
  861. package/dist/esm/security/authorizations/super-admin-floor.backend.utils.d.ts.map +1 -1
  862. package/dist/esm/security/authorizations/super-admin-floor.backend.utils.js +13 -22
  863. package/dist/esm/security/authorizations/super-admin-floor.backend.utils.js.map +1 -1
  864. package/dist/esm/security/connected-accounts/connection-target-authorization.backend.d.ts +60 -0
  865. package/dist/esm/security/connected-accounts/connection-target-authorization.backend.d.ts.map +1 -0
  866. package/dist/esm/security/connected-accounts/connection-target-authorization.backend.js +79 -0
  867. package/dist/esm/security/connected-accounts/connection-target-authorization.backend.js.map +1 -0
  868. package/dist/esm/security/connected-accounts/controllers/provider-connection.controller.backend.service.d.ts +161 -0
  869. package/dist/esm/security/connected-accounts/controllers/provider-connection.controller.backend.service.d.ts.map +1 -0
  870. package/dist/esm/security/connected-accounts/controllers/provider-connection.controller.backend.service.js +512 -0
  871. package/dist/esm/security/connected-accounts/controllers/provider-connection.controller.backend.service.js.map +1 -0
  872. package/dist/esm/security/connected-accounts/organization-provider-credential-resolver.port.d.ts +59 -0
  873. package/dist/esm/security/connected-accounts/organization-provider-credential-resolver.port.d.ts.map +1 -0
  874. package/dist/esm/security/connected-accounts/organization-provider-credential-resolver.port.js +22 -0
  875. package/dist/esm/security/connected-accounts/organization-provider-credential-resolver.port.js.map +1 -0
  876. package/dist/esm/security/connected-accounts/provider-oauth2-refresher.port.d.ts +44 -0
  877. package/dist/esm/security/connected-accounts/provider-oauth2-refresher.port.d.ts.map +1 -0
  878. package/dist/esm/security/connected-accounts/provider-oauth2-refresher.port.js +20 -0
  879. package/dist/esm/security/connected-accounts/provider-oauth2-refresher.port.js.map +1 -0
  880. package/dist/esm/security/connected-accounts/services/organization-provider-credential-store.backend.service.d.ts +191 -0
  881. package/dist/esm/security/connected-accounts/services/organization-provider-credential-store.backend.service.d.ts.map +1 -0
  882. package/dist/esm/security/connected-accounts/services/organization-provider-credential-store.backend.service.js +385 -0
  883. package/dist/esm/security/connected-accounts/services/organization-provider-credential-store.backend.service.js.map +1 -0
  884. package/dist/esm/security/connected-accounts/services/organization-provider-credentials.custom-impl.backend.service.d.ts +41 -0
  885. package/dist/esm/security/connected-accounts/services/organization-provider-credentials.custom-impl.backend.service.d.ts.map +1 -0
  886. package/dist/esm/security/connected-accounts/services/organization-provider-credentials.custom-impl.backend.service.js +358 -0
  887. package/dist/esm/security/connected-accounts/services/organization-provider-credentials.custom-impl.backend.service.js.map +1 -0
  888. package/dist/esm/security/connected-accounts/services/provider-oauth2-exchange.backend.d.ts +160 -0
  889. package/dist/esm/security/connected-accounts/services/provider-oauth2-exchange.backend.d.ts.map +1 -0
  890. package/dist/esm/security/connected-accounts/services/provider-oauth2-exchange.backend.js +266 -0
  891. package/dist/esm/security/connected-accounts/services/provider-oauth2-exchange.backend.js.map +1 -0
  892. package/dist/esm/security/connected-accounts/services/provider-oauth2-pending-authorization.backend.service.d.ts +111 -0
  893. package/dist/esm/security/connected-accounts/services/provider-oauth2-pending-authorization.backend.service.d.ts.map +1 -0
  894. package/dist/esm/security/connected-accounts/services/provider-oauth2-pending-authorization.backend.service.js +107 -0
  895. package/dist/esm/security/connected-accounts/services/provider-oauth2-pending-authorization.backend.service.js.map +1 -0
  896. package/dist/esm/security/connected-accounts/services/provider-oauth2-refresher.backend.service.d.ts +54 -0
  897. package/dist/esm/security/connected-accounts/services/provider-oauth2-refresher.backend.service.d.ts.map +1 -0
  898. package/dist/esm/security/connected-accounts/services/provider-oauth2-refresher.backend.service.js +153 -0
  899. package/dist/esm/security/connected-accounts/services/provider-oauth2-refresher.backend.service.js.map +1 -0
  900. package/dist/esm/security/connected-accounts/services/user-provider-credential-store.backend.service.d.ts +195 -0
  901. package/dist/esm/security/connected-accounts/services/user-provider-credential-store.backend.service.d.ts.map +1 -0
  902. package/dist/esm/security/connected-accounts/services/user-provider-credential-store.backend.service.js +387 -0
  903. package/dist/esm/security/connected-accounts/services/user-provider-credential-store.backend.service.js.map +1 -0
  904. package/dist/esm/security/connected-accounts/services/user-provider-credentials.custom-impl.backend.service.d.ts +45 -0
  905. package/dist/esm/security/connected-accounts/services/user-provider-credentials.custom-impl.backend.service.d.ts.map +1 -0
  906. package/dist/esm/security/connected-accounts/services/user-provider-credentials.custom-impl.backend.service.js +291 -0
  907. package/dist/esm/security/connected-accounts/services/user-provider-credentials.custom-impl.backend.service.js.map +1 -0
  908. package/dist/esm/security/connected-accounts/user-provider-credential-resolver.port.d.ts +62 -0
  909. package/dist/esm/security/connected-accounts/user-provider-credential-resolver.port.d.ts.map +1 -0
  910. package/dist/esm/security/connected-accounts/user-provider-credential-resolver.port.js +29 -0
  911. package/dist/esm/security/connected-accounts/user-provider-credential-resolver.port.js.map +1 -0
  912. package/dist/esm/security/connected-accounts/utils/provider-credential-envelope.backend.utils.d.ts +127 -0
  913. package/dist/esm/security/connected-accounts/utils/provider-credential-envelope.backend.utils.d.ts.map +1 -0
  914. package/dist/esm/security/connected-accounts/utils/provider-credential-envelope.backend.utils.js +277 -0
  915. package/dist/esm/security/connected-accounts/utils/provider-credential-envelope.backend.utils.js.map +1 -0
  916. package/dist/esm/security/connected-accounts/utils/stored-credential-value.backend.utils.d.ts +66 -0
  917. package/dist/esm/security/connected-accounts/utils/stored-credential-value.backend.utils.d.ts.map +1 -0
  918. package/dist/esm/security/connected-accounts/utils/stored-credential-value.backend.utils.js +75 -0
  919. package/dist/esm/security/connected-accounts/utils/stored-credential-value.backend.utils.js.map +1 -0
  920. package/dist/esm/security/consumable-tokens/batches/consumable-tokens-cleanup.batch.backend.service.d.ts +18 -1
  921. package/dist/esm/security/consumable-tokens/batches/consumable-tokens-cleanup.batch.backend.service.d.ts.map +1 -1
  922. package/dist/esm/security/consumable-tokens/batches/consumable-tokens-cleanup.batch.backend.service.js +110 -74
  923. package/dist/esm/security/consumable-tokens/batches/consumable-tokens-cleanup.batch.backend.service.js.map +1 -1
  924. package/dist/esm/security/consumable-tokens/consumable-token-models.exports.d.ts +22 -0
  925. package/dist/esm/security/consumable-tokens/consumable-token-models.exports.d.ts.map +1 -0
  926. package/dist/esm/security/consumable-tokens/consumable-token-models.exports.js +22 -0
  927. package/dist/esm/security/consumable-tokens/consumable-token-models.exports.js.map +1 -0
  928. package/dist/esm/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas.d.ts +17 -3
  929. package/dist/esm/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas.d.ts.map +1 -1
  930. package/dist/esm/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas.js +12 -0
  931. package/dist/esm/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas.js.map +1 -1
  932. package/dist/esm/security/consumable-tokens/services/consumable-token.backend.service.d.ts +41 -3
  933. package/dist/esm/security/consumable-tokens/services/consumable-token.backend.service.d.ts.map +1 -1
  934. package/dist/esm/security/consumable-tokens/services/consumable-token.backend.service.js +83 -20
  935. package/dist/esm/security/consumable-tokens/services/consumable-token.backend.service.js.map +1 -1
  936. package/dist/esm/security/credential-rotation-grace.backend.utils.d.ts +9 -4
  937. package/dist/esm/security/credential-rotation-grace.backend.utils.d.ts.map +1 -1
  938. package/dist/esm/security/credential-rotation-grace.backend.utils.js +9 -4
  939. package/dist/esm/security/credential-rotation-grace.backend.utils.js.map +1 -1
  940. package/dist/esm/security/jwt/services/jwt.backend.service.d.ts.map +1 -1
  941. package/dist/esm/security/jwt/services/jwt.backend.service.js +1 -18
  942. package/dist/esm/security/jwt/services/jwt.backend.service.js.map +1 -1
  943. package/dist/esm/security/oauth-clients/oauth-client-generation.backend.utils.d.ts +26 -0
  944. package/dist/esm/security/oauth-clients/oauth-client-generation.backend.utils.d.ts.map +1 -1
  945. package/dist/esm/security/oauth-clients/oauth-client-generation.backend.utils.js +43 -0
  946. package/dist/esm/security/oauth-clients/oauth-client-generation.backend.utils.js.map +1 -1
  947. package/dist/esm/security/oauth-clients/oauth-clients.custom-impl.backend.service.d.ts +8 -1
  948. package/dist/esm/security/oauth-clients/oauth-clients.custom-impl.backend.service.d.ts.map +1 -1
  949. package/dist/esm/security/oauth-clients/oauth-clients.custom-impl.backend.service.js +49 -0
  950. package/dist/esm/security/oauth-clients/oauth-clients.custom-impl.backend.service.js.map +1 -1
  951. package/dist/esm/security/scim/controllers/scim.backend.controller.d.ts.map +1 -1
  952. package/dist/esm/security/scim/controllers/scim.backend.controller.js +17 -5
  953. package/dist/esm/security/scim/controllers/scim.backend.controller.js.map +1 -1
  954. package/dist/esm/security/scim/models/scim-protocol.backend.schemas.d.ts +67 -29
  955. package/dist/esm/security/scim/models/scim-protocol.backend.schemas.d.ts.map +1 -1
  956. package/dist/esm/security/scim/models/scim-protocol.backend.schemas.js +47 -25
  957. package/dist/esm/security/scim/models/scim-protocol.backend.schemas.js.map +1 -1
  958. package/dist/esm/security/ssrf/outbound-target-guard.backend.utils.d.ts +10 -2
  959. package/dist/esm/security/ssrf/outbound-target-guard.backend.utils.d.ts.map +1 -1
  960. package/dist/esm/security/ssrf/outbound-target-guard.backend.utils.js +10 -2
  961. package/dist/esm/security/ssrf/outbound-target-guard.backend.utils.js.map +1 -1
  962. package/dist/esm/security/ssrf/pinned-outbound-fetch.backend.utils.d.ts +143 -0
  963. package/dist/esm/security/ssrf/pinned-outbound-fetch.backend.utils.d.ts.map +1 -0
  964. package/dist/esm/security/ssrf/pinned-outbound-fetch.backend.utils.js +258 -0
  965. package/dist/esm/security/ssrf/pinned-outbound-fetch.backend.utils.js.map +1 -0
  966. package/dist/esm/users/services/user-read-retained.custom-impl.backend.service.d.ts +39 -0
  967. package/dist/esm/users/services/user-read-retained.custom-impl.backend.service.d.ts.map +1 -0
  968. package/dist/esm/users/services/user-read-retained.custom-impl.backend.service.js +159 -0
  969. package/dist/esm/users/services/user-read-retained.custom-impl.backend.service.js.map +1 -0
  970. package/dist/tsconfig.build.tsbuildinfo +1 -1
  971. package/package.json +17 -9
  972. package/dist/esm/.builder.pid +0 -9
package/dist/esm/security/authentications/controllers/authentication-controller.backend.service.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"authentication-controller.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/controllers/authentication-controller.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,OAA4C,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAC5I,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AACvG,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAChJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EACL,wCAAwC,GAEzC,MAAM,kGAAkG,CAAC;AAC1G,OAAO,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,MAAM,wFAAwF,CAAC;AACvK,OAAO,EAAE,kCAAkC,EAAE,MAAM,yGAAyG,CAAC;AAC7J,OAAO,EAAE,sCAAsC,EAAE,MAAM,8GAA8G,CAAC;AACtK,OAAO,EAAE,6BAA6B,EAAE,oCAAoC,EAAE,MAAM,yFAAyF,CAAC;AAC9K,OAAO,EAAE,6BAA6B,EAAE,MAAM,0FAA0F,CAAC;AACzI,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,EAAE,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AACpI,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AACzJ,OAAO,EAAE,gCAAgC,EAAE,MAAM,uGAAuG,CAAC;AACzJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,iGAAiG,CAAC;AAC7I,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,uEAAuE,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mEAAmE,CAAC;AACtG,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAEhK,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,2EAA2E,CAAC;AACvH,OAAO,EAAE,mBAAmB,EAAE,MAAM,kFAAkF,CAAC;AACvH,OAAO,EAAE,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAClG,OAAO,EAAE,4BAA4B,EAAE,MAAM,oEAAoE,CAAC;AAClH,OAAO,EACL,mCAAmC,EACnC,oCAAoC,GACrC,MAAM,mFAAmF,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,iGAAiG,CAAC;AACnJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,yEAAyE,CAAC;AACrH,OAAO,EAAE,+BAA+B,EAAE,MAAM,uGAAuG,CAAC;AACxJ,OAAO,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,MAAM,qGAAqG,CAAC;AAC9K,OAAO,EAAE,qBAAqB,EAAE,MAAM,4FAA4F,CAAC;AACnI,OAAO,EAAE,mCAAmC,EAAE,MAAM,2GAA2G,CAAC;AAChK,OAAO,EAAE,kCAAkC,EAAE,MAAM,0GAA0G,CAAC;AAC9J,OAAO,EAAE,8BAA8B,EAAE,MAAM,wFAAwF,CAAC;AACxI,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAM3I,OAAO,EAAE,yBAAyB,EAAE,MAAM,+FAA+F,CAAC;AAC1I,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AACxG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,eAAe,EACf,6BAA6B,EAC7B,iCAAiC,EACjC,kCAAkC,EAClC,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,EAC3B,sBAAsB,EACtB,6BAA6B,EAC7B,8BAA8B,EAC9B,wBAAwB,EACxB,0BAA0B,EAC1B,gCAAgC,EAChC,oBAAoB,EACpB,UAAU,EACV,eAAe,EACf,0BAA0B,EAC1B,wBAAwB,EACxB,+BAA+B,EAC/B,0BAA0B,EAC1B,gBAAgB,EAEhB,sBAAsB,EAEtB,0BAA0B,EAC1B,oBAAoB,EACpB,cAAc,EACd,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,SAAS,EACT,2BAA2B,EAC3B,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,qBAAqB,EACrB,aAAa,EACb,WAAW,EACX,gCAAgC,EAChC,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AAChK,OAAO,EAAqB,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAGtH,yFAAyF;AACzF,iEAAiE;AACjE,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,MAAM,CAAC;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC;CAC9C,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAElD,sHAAsH;AACtH,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAEtF;;;;;;;;;;;GAWG;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAE5C,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,0BAA0B;IACrC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;IACnD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,+BAA+B,CAAC,UAAU,CAAC;IACvH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;KAC3C,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAClD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC1D,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAGI,IAAM,sCAAsC,GAA5C,MAAM,sCAAuC,SAAQ,gCAAgC;IAqCf;IAoBR;IAGiB;IA3DnE,WAAW,CAA2C;IACtD,WAAW,CAAgC;IAC3C,aAAa,CAAqC;IAClD,cAAc,CAAyC;IACvD,sBAAsB,CAAgC;IACtD,UAAU,CAAoB;IAC9B,YAAY,CAAsB;IAClC,gBAAgB,CAA0B;IAC1C,gBAAgB,CAA0B;IAC1C,gBAAgB,CAA0B;IAC1C,eAAe,CAAyB;IACxC,UAAU,CAAoB;IAC9B,iBAAiB,CAAkC;IACnD,eAAe,CAAmC;IAClD,mBAAmB,CAA6B;IAChD,kBAAkB,CAAmC;IACrD,YAAY,CAA6B;IACzC,oBAAoB,CAAkC;IACtD,mBAAmB,CAAiC;IACpD,UAAU,CAAwB;IAClC,wBAAwB,CAAsC;IAC9D,uBAAuB,CAAqC;IAC5D,uBAAuB,CAAiC;IACxD,UAAU,CAA+B;IAE1D,YACqC,MAAqB,EACR,YAAwC,EACxC,YAAiC,EACnB,WAAqD,EACvE,WAA0C,EAC9B,aAAiD,EAC7C,cAAsD,EAC/D,sBAAqD,EAC1D,UAA6B,EAClC,YAAiC,EACD,aAAwD,EACpF,gBAAyC,EACzC,gBAAyC,EAClC,gBAAyC,EACjD,eAAuC,EAC5C,UAA6B,EACf,iBAAkD,EACjD,eAAiD,EACvD,mBAA+C,EACzC,kBAAoD,EAC1D,YAAwC,EACnC,oBAAqD,EACtD,mBAAmD,EAC5D,UAAiC,EACnB,wBAA6D,EAC9D,uBAA2D,EAC/D,uBAAuD,EACzD,UAAwC,EAGzB,mBAA+C,EAG9B,gBAAsD;QAExI,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,0BAA0B,CAAC,CAAC;QAzBG,kBAAa,GAAb,aAAa,CAA2C;QAoBhE,wBAAmB,GAAnB,mBAAmB,CAA4B;QAG9B,qBAAgB,GAAhB,gBAAgB,CAAsC;QAGxI,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,sBAAsB,GAAG,sBAAsB,CAAC;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;QAC/C,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;QACjD,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;QAC/C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,wBAAwB,GAAG,wBAAwB,CAAC;QACzD,IAAI,CAAC,uBAAuB,GAAG,uBAAuB,CAAC;QACvD,IAAI,CAAC,uBAAuB,GAAG,uBAAuB,CAAC;QACvD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAES,WAAW;QACnB,yCAAyC;QAEzC,+BAA+B;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrI,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,kDAAkD,CAAC,CAAC;QAE7J,yBAAyB;QACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAEpJ,kDAAkD;QAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7I,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,iDAAiD,CAAC,CAAC;QAEhK,oFAAoF;QACpF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9I,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,0CAA0C,CAAC,CAAC;QAE1J,qBAAqB;QACrB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChJ,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,kCAAkC,CAAC,CAAC;QAEjJ,iCAAiC;QACjC,qEAAqE;QACrE,gEAAgE;QAChE,oFAAoF;QACpF,2DAA2D;QAC3D,iEAAiE;QACjE,wEAAwE;QACxE,uDAAuD;QAEvD,wEAAwE;QACxE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnJ,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,8CAA8C,CAAC,CAAC;QAEhK,4GAA4G;QAC5G,+CAA+C;QAC/C,oDAAoD;QACpD,MAAM,qBAAqB,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAChF,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,CAAC;QACvG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;QAC3D,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,iBAAiB,EAAE,sEAAsE,CAAC,CAAC;QAEjI,gFAAgF;QAChF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChJ,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,uCAAuC,CAAC,CAAC;QAExJ,qEAAqE;QACrE,6EAA6E;QAC7E,sEAAsE;QACtE,iFAAiF;QACjF,8EAA8E;QAC9E,iDAAiD;QACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,wDAAwD,CAAC,CAAC;QAEjL,gCAAgC;QAChC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjI,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,+BAA+B,CAAC,CAAC;QACxI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxI,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,yDAAyD,CAAC,CAAC;QAEtK,yCAAyC;QAEzC,uDAAuD;QACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,qDAAqD,CAAC,CAAC;QAE9K,+DAA+D;QAC/D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjK,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,+DAA+D,CAAC,CAAC;QAEzL,uCAAuC;QAEvC,oDAAoD;QACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrI,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,wDAAwD,CAAC,CAAC;QAEnK,gEAAgE;QAChE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtJ,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,gEAAgE,CAAC,CAAC;QAEpL,8EAA8E;QAC9E,+EAA+E;QAC/E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpJ,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,8FAA8F,CAAC,CAAC;QAE/M,6DAA6D;QAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtJ,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,qDAAqD,CAAC,CAAC;QAEzK,qFAAqF;QACrF,6FAA6F;QAC7F,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxJ,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,0DAA0D,CAAC,CAAC;QAE/K,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,+EAA+E,CAAC,CAAC;QAEtM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,oDAAoD,CAAC,CAAC;QAE3K,8CAA8C;QAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5I,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,uDAAuD,CAAC,CAAC;QAEtK,iCAAiC;QACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,6DAA6D,CAAC,CAAC;QAEnL,wDAAwD;QACxD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjK,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,wDAAwD,CAAC,CAAC;QAElL,0CAA0C;QAE1C,qDAAqD;QACrD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtJ,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,sCAAsC,CAAC,CAAC;QAE3J,sDAAsD;QACtD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,wCAAwC,CAAC,CAAC;QAE/J,qCAAqC;QAErC,uDAAuD;QACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/I,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,8CAA8C,CAAC,CAAC;QAE/J,gFAAgF;QAChF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,kDAAkD,CAAC,CAAC;QAE1K,oDAAoD;QACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjJ,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,wCAAwC,CAAC,CAAC;QAE1J,0CAA0C;QAC1C,6EAA6E;QAC7E,6GAA6G;QAC7G,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClK,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,8EAA8E,CAAC,CAAC;QAExM,yFAAyF;QACzF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrK,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,kFAAkF,CAAC,CAAC;QAE5M,+BAA+B;QAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7I,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,wCAAwC,CAAC,CAAC;QAEpJ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EACpF,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EACrD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACjD,CAAC;QACF,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,yDAAyD,CAAC,CAAC;QAEpK,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnJ,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,oDAAoD,CAAC,CAAC;QAEnK,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7I,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,2EAA2E,CAAC,CAAC;QAErL,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EACpF,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EACrD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACtD,CAAC;QACF,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,wCAAwC,CAAC,CAAC;QAEnJ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrJ,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,iCAAiC,CAAC,CAAC;QAElJ,6CAA6C;QAC7C,mCAAmC;QACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzK,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,4DAA4D,CAAC,CAAC;QAEvL,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvK,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,uDAAuD,CAAC,CAAC;QAEjL,wDAAwD;QACxD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjK,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,0DAA0D,CAAC,CAAC;QAEjL,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,2DAA2D,CAAC,CAAC;QAEjL,iCAAiC;QACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjJ,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,yCAAyC,CAAC,CAAC;QAEvJ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtJ,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,mCAAmC,CAAC,CAAC;QAEpJ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtJ,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,mCAAmC,CAAC,CAAC;QAEpJ,uCAAuC;QAEvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjJ,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,0DAA0D,CAAC,CAAC;QAE5K,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrJ,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,wDAAwD,CAAC,CAAC;QAE5K,oCAAoC;QAEpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3I,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,sCAAsC,CAAC,CAAC;QAErJ,+FAA+F;QAE/F,+CAA+C;QAE/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrJ,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,oDAAoD,CAAC,CAAC;QAExK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,0DAA0D,CAAC,CAAC;QAEjL,yCAAyC;QAEzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,2CAA2C,CAAC,CAAC;QAEpK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChK,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,+CAA+C,CAAC,CAAC;QAE5K,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChK,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,wCAAwC,CAAC,CAAC;QAEnK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,2DAA2D,CAAC,CAAC;QAEpL,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChK,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,+DAA+D,CAAC,CAAC;IAC9L,CAAC;IAED,kEAAkE;IAClE,yCAAyC;IACzC,kEAAkE;IAE1D,KAAK,CAAC,QAAQ,CAAC,GAAY,EAAE,GAAa;QAChD,gEAAgE;QAChE,yDAAyD;QACzD,8DAA8D;QAC9D,sDAAsD;QACtD,MAAM,IAAI,GAAG,+BAA+B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEnE,0DAA0D;QAC1D,2CAA2C;QAC3C,+DAA+D;QAC/D,8DAA8D;QAC9D,oDAAoD;QACpD,2DAA2D;QAC3D,2DAA2D;QAC3D,iEAAiE;QACjE,8DAA8D;QAC9D,4DAA4D;QAC5D,8DAA8D;QAC9D,yDAAyD;QACzD,6DAA6D;QAC7D,2DAA2D;QAC3D,6DAA6D;QAC7D,wDAAwD;QACxD,oBAAoB;QACpB,EAAE;QACF,wCAAwC;QACxC,8DAA8D;QAC9D,2DAA2D;QAC3D,qDAAqD;QACrD,6DAA6D;QAC7D,6DAA6D;QAC7D,qDAAqD;QACrD,+DAA+D;QAC/D,yBAAyB;QACzB,EAAE;QACF,iEAAiE;QACjE,gEAAgE;QAChE,2DAA2D;QAC3D,mDAAmD;QACnD,kIAAkI;QAClI,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtE,sDAAsD;QACtD,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,wBAAwB,EACxB,SAAS,EACT,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CACzB,CAAC;QACF,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,qBAAqB,CACtB,CAAC;QACF,0EAA0E;QAE1E,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,6EAA6E;QAC7E,MAAM,UAAU,GAAG;YACjB,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;YAC/D,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;SACvC,CAAC;QAEF,MAAM,qBAAqB,GAAG;YAC5B,GAAG,IAAI;YACP,UAAU;SACX,CAAC;QAEF,iFAAiF;QACjF,6EAA6E;QAC7E,+EAA+E;QAC/E,+FAA+F;QAC/F,MAAM,mBAAmB,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAuB,CAAC;QACrG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAC1D,MAAM,cAAc,GAAG,mBAAmB;YACxC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,sCAAsC,CAAC,mBAAmB,CAAC,IAAI,SAAS;YAChG,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,MAAM,GAA+B,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CACxE,EAAE,EACF,qBAAqB,EACrB,cAAc,EACd,mBAAmB,CACpB,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,GAAY,EAAE,GAAa;QAC5D,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,eAAe,GAAG;YACtB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,yEAAyE;YAC5F,UAAU,EAAE,KAAK;YACjB,qBAAqB,EAAE,EAAE;SAC1B,CAAC;QACF,MAAM,MAAM,GAAgC,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;QAC7G,MAAM,IAAI,CAAC,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC1D,oEAAoE;QACpE,oEAAoE;QACpE,mEAAmE;QACnE,wDAAwD;QACxD,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;QAC7C,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,wEAAwE;IAChE,KAAK,CAAC,YAAY,CAAC,GAAY,EAAE,GAAa;QACpD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA0B,CAAC;QAC3F,MAAM,MAAM,GAAgC,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC7F,MAAM,IAAI,CAAC,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC1D,iEAAiE;QACjE,oEAAoE;QACpE,mDAAmD;QACnD,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;QAC7C,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACK,KAAK,CAAC,YAAY,CAAC,GAAY,EAAE,GAAa;QACpD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,wDAAwD;QACxD,sEAAsE;QACtE,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;QACjF,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,qCAAqC;aAC1F,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,gGAAgG;YAChG,oGAAoG;YACpG,oGAAoG;YACpG,mGAAmG;YACnG,kGAAkG;YAClG,MAAM,WAAW,GAAG,8BAA8B,CAAC,YAAY,CAAC,CAAC;YACjE,IAAI,WAAW,EAAE,CAAC;gBAChB,KAAK,CAAC,KAAK,IAAI,EAAE;oBACf,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;oBACpG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gCAAgC,CAAC;wBAC3D,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,SAAS,EAAE,WAAW,CAAC,SAAS;wBAChC,SAAS,EAAE,WAAW,CAAC,SAAS;wBAChC,aAAa,EAAE,WAAW,CAAC,aAAa;wBACxC,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;qBACvC,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;gBACxB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACvB,CAAC;YACD,MAAM,YAAY,CAAC;QACrB,CAAC;QAED,0BAA0B;QAC1B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACjE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACpD,MAAM,OAAO,GAAG,OAAkC,CAAC;gBACnD,MAAM,aAAa,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;gBACtF,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;gBACxF,IAAI,aAAa,EAAE,CAAC;oBAClB,qFAAqF;oBACrF,yFAAyF;oBACzF,uFAAuF;oBACvF,2EAA2E;oBAC3E,KAAK,CAAC,KAAK,IAAI,EAAE;wBACf,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,CAAC;wBAC/F,MAAM,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC;4BAChD,MAAM,EAAE,aAAa;4BACrB,SAAS;4BACT,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;4BACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;yBAChE,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;oBACxB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,qDAAqD,CAAC,CAAC;QAEjE,8DAA8D;QAC9D,qEAAqE;QACrE,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;QAClE,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IACzE,CAAC;IAED,2CAA2C;IACnC,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa;QACvD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAA+B,CAAC;QAE7D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,6BAA6B,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAEzF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;QAC7D,CAAC;QAED,8EAA8E;QAC9E,2FAA2F;QAC3F,6FAA6F;QAC7F,MAAM,kBAAkB,GAAG;YACzB,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;YAC/C,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,2BAA2B,EAAE,YAAY,CAAC,2BAA2B;YACrE,4BAA4B,EAAE,YAAY,CAAC,4BAA4B;YACvE,2BAA2B,EAAE,YAAY,CAAC,2BAA2B;YACrE,yBAAyB,EAAE,YAAY,CAAC,yBAAyB;YACjE,WAAW,EAAE,YAAY,CAAC,WAAW;YACrC,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;YAC/C,kBAAkB,EAAE,YAAY,CAAC,kBAAkB;YACnD,SAAS,EAAE,YAAY,CAAC,SAAS;SAClC,CAAC;QAEF,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC5C,CAAC;IAED,kEAAkE;IAClE,iCAAiC;IACjC,kEAAkE;IAElE;;;;;;;OAOG;IACK,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa;QACvD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,WAAiC,CAAC;QAEjE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,mCAAmC,EAAE;aAC1D,CAAC,CAAC;QACL,CAAC;QAED,iFAAiF;QACjF,uFAAuF;QACvF,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,KAA2B,CAAC;QACxD,IAAI,YAAuE,CAAC;QAE5E,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YAC3D,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;gBAChF,IAAI,SAAS,EAAE,CAAC;oBACd,YAAY,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;oBAE9E,mGAAmG;oBACnG,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,iBAAiB,CACrE,EAAE,EAAE,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,WAAW,CACxD,CAAC;oBACF,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,MAAM,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC;4BACnD,KAAK,EAAE,SAAS;4BAChB,WAAW;4BACX,SAAS,EAAE,SAAS,CAAC,SAAS;4BAC9B,cAAc,EAAE,SAAS,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;gCAChE,CAAC,CAAC,SAAS,CAAC,OAAO;gCACnB,CAAC,CAAC,SAAS;4BACb,aAAa,EAAE,SAAS,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW;gCAC9D,CAAC,CAAC,SAAS,CAAC,OAAO;gCACnB,CAAC,CAAC,SAAS;4BACb,MAAM,EAAE,MAAM,IAAI,qBAAqB;4BACvC,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;4BACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;yBAChE,CAAC,CAAC;wBACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;4BACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;4BAChF,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,IAAI,2DAA2D,EAAE;yBAC5F,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,uFAAuF;QACvF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAClE,WAAW,EACX,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CACnD,CAAC;QAEF,kFAAkF;QAClF,2FAA2F;QAC3F,kGAAkG;QAClG,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,mBAAmB,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAW,CAAC;QACzF,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,KAAK,WAAW,CAAC,CAAC,uFAAuF;QACzG,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,yBAAyB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACzD,CAAC;QAED,sGAAsG;QACtG,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,UAAU,EAAE;YACtF,mBAAmB;YACnB,SAAS,EAAE,YAAY,EAAE,SAAS;YAClC,OAAO,EAAE,YAAY,EAAE,OAAO;YAC9B,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE;YAC9C,WAAW;YACX,cAAc,EAAE,UAAU,CAAC,cAAc;SAC1C,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,sBAAsB,CAAC,GAAY,EAAE,GAAa;QAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAA2B,CAAC;QACrD,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,YAAkC,CAAC;QAEnE,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,gDAAgD,EAAE;aACvE,CAAC,CAAC;QACL,CAAC;QAED,gDAAgD;QAChD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAE1H,mCAAmC;QACnC,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,mBAAmB,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAW,CAAC;QACzF,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,KAAK,WAAW,CAAC;QACjB,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,yBAAyB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACzD,CAAC;QAED,2DAA2D;QAC3D,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,UAAU,EAAE;YACtF,mBAAmB;YACnB,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE;YACtD,KAAK;YACL,YAAY;YACZ,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,yBAAyB,CAAC,GAAY,EAAE,GAAa;QACjE,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,YAAkC,CAAC;QAEnE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE;aAC3D,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAuB,CAAC;QAChF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,0DAA0D,EAAE;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAEzH,uEAAuE;QACvE,yDAAyD;QACzD,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,mBAAmB,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAW,CAAC;QACzF,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,KAAK,WAAW,CAAC;QACjB,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,yBAAyB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,UAAU,EAAE;YACtF,mBAAmB;YACnB,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,4CAA4C,EAAE;YAC1D,KAAK;YACL,YAAY;YACZ,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa;QACvD,iEAAiE;QACjE,+DAA+D;QAC/D,mEAAmE;QACnE,mEAAmE;QACnE,6DAA6D;QAC7D,iEAAiE;QACjE,2DAA2D;QAC3D,4DAA4D;QAC5D,6DAA6D;QAC7D,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,uBAAuB,CACxB,CAAC;QAEF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,YAAsB,CAAC;QACvD,MAAM,SAAS,GAAI,GAAG,CAAC,KAAK,CAAC,SAAoB,IAAI,GAAG,CAAC;QAEzD,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC9F,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;YACrE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oDAAoD,EAAE;oBACtE,YAAY;oBACZ,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,qBAAqB,CAAC,iBAAiB,EAAE,0CAA0C,EAAE,WAAW,CAAC,CAAC;QACjJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,aAAa,CAAC,GAAY,EAAE,GAAa;QACrD,+DAA+D;QAC/D,+DAA+D;QAC/D,+DAA+D;QAC/D,8DAA8D;QAC9D,0DAA0D;QAC1D,8DAA8D;QAC9D,gEAAgE;QAChE,+DAA+D;QAC/D,+DAA+D;QAC/D,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,qBAAqB,CACtB,CAAC;QAEF,MAAM,YAAY,GAAuB,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC;QAChE,MAAM,UAAU,GAAuB,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC;QAE5D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,qBAAqB,CAAC,gBAAgB,EAAE,wBAAwB,EAAE,WAAW,CAAC,CAAC;QAC9H,CAAC;QAED,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YACjG,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,qBAAqB,CAAC,gBAAgB,EAAE,wBAAwB,EAAE,WAAW,CAAC,CAAC;QAC9H,CAAC;QACD,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG;gBACpB,SAAS,EAAE,QAAQ;gBACnB,SAAS,EAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAY,IAAI,SAAS;aAC5E,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;YACjG,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;oBAC7C,QAAQ,EAAG,KAAa,CAAC,sBAAsB,IAAI,SAAS;iBAC7D,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;oBACzD,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,qBAAqB,CAAC,gBAAgB,EAAE,0CAA0C,EAAE,WAAW,CAAC,CAAC;QAChJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,kBAAkB,CAAC,GAAY,EAAE,GAAa;QAC1D,4EAA4E;QAC5E,iFAAiF;QACjF,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,0BAA0B,CAC3B,CAAC;QAEF,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;QAC5C,IACE,cAAc,KAAK,aAAa,CAAC,YAAY;eAC1C,cAAc,KAAK,aAAa,CAAC,WAAW,EAC/C,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,cAAc,KAAK,aAAa,CAAC,YAAY;YAC7D,CAAC,CAAC,aAAa,CAAC,YAAY;YAC5B,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC;QAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAiB,CAAC;QAE7C,sFAAsF;QACtF,iFAAiF;QACjF,2EAA2E;QAC3E,8EAA8E;QAC9E,kFAAkF;QAClF,sFAAsF;QACtF,4CAA4C;QAC5C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACxF,MAAM,mBAAmB,GACvB,SAAS,EAAE,eAAe,EAAE,mBAAmB,IAAI,IAAI,CAAC;QAE1D,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC7G,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,8BAA8B,CAAC,CAAC;QACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACzD,gEAAgE;QAChE,0DAA0D;QAC1D,sEAAsE;QACtE,2DAA2D;QAC3D,kEAAkE;QAClE,4DAA4D;QAC5D,8DAA8D;QAC9D,2DAA2D;QAC3D,2DAA2D;QAC3D,8DAA8D;QAC9D,kEAAkE;QAClE,4DAA4D;QAC5D,6DAA6D;QAC7D,gEAAgE;QAChE,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,qBAAqB,CACtB,CAAC;QAEF,MAAM,WAAW,GAAuB,GAAG,CAAC,KAAK,CAAC,WAAiC,CAAC;QACpF,MAAM,YAAY,GAAuB,GAAG,CAAC,KAAK,CAAC,YAAkC,CAAC;QACtF,MAAM,UAAU,GAAuB,GAAG,CAAC,KAAK,CAAC,UAAgC,CAAC;QAElF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,2EAA2E;gBAC3E,6EAA6E;gBAC7E,yEAAyE;gBACzE,8DAA8D;gBAC9D,MAAM,eAAe,GAAG,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACrD,MAAM,QAAQ,GAAG,eAAe,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxF,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,gCAAgC,CAAC,QAAQ,CAAC,CAAC;gBACzF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;gBAC5H,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;oBACtD,QAAQ,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS;oBACxF,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;gBACH,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;gBACnD,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,qBAAqB,CAAC,eAAe,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;YACrH,CAAC;QACH,CAAC;aAAM,IAAI,YAAY,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;YAC7E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE;oBAClE,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,EAAE,IAAI,GAAG,CAAC;YAC1D,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,WAAW,yBAAyB,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,kBAAkB,CAAC,GAAY,EAAE,GAAa;QAC1D,iEAAiE;QACjE,gEAAgE;QAChE,2DAA2D;QAC3D,4DAA4D;QAC5D,mBAAmB;QACnB,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,qBAAqB,CACtB,CAAC;QAEF,MAAM,WAAW,GAAuB,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC;QAC9D,MAAM,YAAY,GAAuB,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC;QAChE,MAAM,UAAU,GAAuB,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC;QAE5D,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;gBACrG,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE;oBACvD,QAAQ,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS;oBACxF,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;gBACH,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;gBACnD,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,qBAAqB,CAAC,eAAe,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;YACrH,CAAC;QACH,CAAC;aAAM,IAAI,YAAY,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE;oBACnE,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,EAAE,IAAI,GAAG,CAAC;YAC1D,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,WAAW,yBAAyB,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,KAAK,CAAC,kBAAkB,CAAC,GAAY,EAAE,GAAa;QAC1D,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,2BAA2B,CAAC,CAAC;QAE1G,MAAM,EAAE,YAAY,EAAE,GAAG,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACzE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,wGAAwG;QACxG,MAAM,YAAY,GAAG,mBAAmB,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;QAC5E,IAAI,MAA0B,CAAC;QAC/B,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;gBACvE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACpD,MAAM,OAAO,GAAG,OAAkC,CAAC;oBACnD,MAAM,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC3E,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,qCAAqC;aAC1F,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,GAAmC,IAAI,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;QACjF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oGAAoG;YACpG,uGAAuG;YACvG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wDAAwD,EAAE,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;QAED,+DAA+D;QAC/D,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAE9B,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC;YACxB,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,uBAAuB,CAAC,QAAiB;QAC/C,IAAI,CAAC;YACH,MAAM,mBAAmB,GAAG,QAAQ;gBAClC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,sCAAsC,CAAC,QAAQ,CAAC;gBACxE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,iCAAiC,EAAE,CAAC;YAC9D,IAAI,CAAC,mBAAmB;gBAAE,OAAO,SAAS,CAAC;YAC3C,OAAO,IAAI,CAAC,kDAAkD,CAAC,mBAAmB,CAAC,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACK,KAAK,CAAC,cAAc,CAAC,GAAY,EAAE,GAAa;QACtD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,+EAA+E;QAC/E,iFAAiF;QACjF,iFAAiF;QACjF,uCAAuC;QACvC,MAAM,QAAQ,GAAI,GAAG,CAAC,KAAK,CAAC,KAAgB,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC;QAChE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,gBAAgB,GAAI,GAAG,CAAC,KAAK,CAAC,iBAA4B,IAAI,GAAG,CAAC,IAAI,EAAE,iBAAiB,IAAI,4CAA4C,CAAC;YAEhJ,mFAAmF;YACnF,mEAAmE;YACnE,gEAAgE;YAChE,IAAI,gBAAoC,CAAC;YACzC,IAAI,cAAkC,CAAC;YACvC,MAAM,UAAU,GAAI,GAAG,CAAC,KAAK,CAAC,KAAgB,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC;YAClE,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;oBAC/E,MAAM,aAAa,GAAG,UAAU,CAAC,QAA+C,CAAC;oBACjF,MAAM,mBAAmB,GAAG,aAAa,EAAE,mBAAyC,CAAC;oBACrF,cAAc,GAAG,OAAO,aAAa,EAAE,SAAS,KAAK,QAAQ;wBAC3D,CAAC,CAAC,aAAa,CAAC,SAAS;wBACzB,CAAC,CAAC,SAAS,CAAC;oBACd,IAAI,mBAAmB,EAAE,CAAC;wBACxB,gBAAgB,GAAG,IAAI,CAAC,kDAAkD,CAAC,mBAAmB,CAAC,CAAC;oBAClG,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,8DAA8D;gBAChE,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;QAC7G,CAAC;QAED,4DAA4D;QAC5D,MAAM,IAAI,GAAI,GAAG,CAAC,KAAK,CAAC,IAAe,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1D,MAAM,KAAK,GAAI,GAAG,CAAC,KAAK,CAAC,KAAgB,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC;QAE7D,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,qBAAqB,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;QACxH,CAAC;QAED,4DAA4D;QAC5D,IAAI,WAA+B,CAAC;QACpC,IAAI,iBAAqC,CAAC;QAE1C,IAAI,CAAC;YACH,sEAAsE;YACtE,MAAM,cAAc,GAAG;gBACrB,IAAI;gBACJ,KAAK;gBACL,IAAI,EAAE,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,6CAA6C;aAClG,CAAC;YACF,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;YAEjH,6EAA6E;YAC7E,sFAAsF;YACtF,WAAW,GAAG,aAAa,CAAC,mBAAmB;gBAC7C,CAAC,CAAC,IAAI,CAAC,kDAAkD,CAAC,aAAa,CAAC,mBAAmB,CAAC;gBAC5F,CAAC,CAAC,SAAS,CAAC;YACd,iBAAiB,GAAG,aAAa,CAAC,SAAS,CAAC;YAE5C,yEAAyE;YACzE,8EAA8E;YAC9E,gFAAgF;YAChF,6EAA6E;YAC7E,MAAM,mBAAmB,GAAG,aAAa,CAAC,mBAAmB,CAAC;YAC9D,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,UAAU,EAAE,mBAAmB,CAAC,CAAC;YAE/H,IAAI,mBAAmB,EAAE,CAAC;gBACxB,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBACzE,MAAM,qBAAqB,GAAG,iBAAiB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChE,MAAM,cAAc,GAAG,qBAAqB;oBAC1C,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,qCAAqC,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;oBACzG,CAAC,CAAC,IAAI,CAAC;gBAET,IAAI,CAAC,qBAAqB,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;oBACpD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;wBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;wBACjE,OAAO,EAAE;4BACP,OAAO,EACL,oDAAoD,mBAAmB,GAAG;gCAC1E,CAAC,qBAAqB,CAAC,CAAC,CAAC,mBAAmB,qBAAqB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;4BAC5E,mBAAmB;4BACnB,cAAc,EAAE,qBAAqB;yBACtC;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE;gBAC1E,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;aACnD,CAAC,CAAC;YAEH,4EAA4E;YAC5E,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;gBAClE,SAAS,EAAE,wBAAwB,CAAC,kBAAkB;gBACtD,eAAe,EAAE,+BAA+B,CAAC,UAAU;gBAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;gBAC1C,QAAQ,EAAE;oBACR,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,SAAS,EAAE,SAAS;iBACrB;aACF,CAAC,CAAC;YAEH,iFAAiF;YACjF,MAAM,UAAU,GAAG;gBACjB,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;gBACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;aAChE,CAAC;YAEF,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;gBAC1C,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,iBAAiB,CAAC,KAAK;gBAC9B,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,UAAU,EAAE,UAAU,CAAC,IAAI;gBAC3B,SAAS,EAAE,UAAU,CAAC,cAAc,KAAK,iBAAiB,CAAC,UAAU;oBACnE,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS;oBAC7B,CAAC,CAAC,SAAS;gBACb,cAAc,EAAE,oCAAoC,CAAC,UAAU,CAAC,KAAK,CAAC;gBACtE,aAAa,EAAE,mCAAmC,CAAC,UAAU,CAAC,KAAK,CAAC;gBACpE,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,SAAS,EAAE,UAAU,UAAU,CAAC,WAAW,IAAI,MAAM,EAAE;aACxD,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,+BAA+B,CACzD,EAAE,EACF,oCAAoC,CAAC,UAAU,CAAC,KAAK,CAAC,EACtD,MAAM,CACP,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE;gBACtD,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,MAAM;gBACN,SAAS;aACV,CAAC,CAAC;YAEH,uEAAuE;YACvE,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;QAElG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6DAA6D;YAC7D,8EAA8E;YAC9E,6EAA6E;YAC7E,EAAE;YACF,8EAA8E;YAC9E,kFAAkF;YAClF,oEAAoE;YACpE,mFAAmF;YACnF,oFAAoF;YACpF,+EAA+E;YAC/E,qFAAqF;YACrF,2FAA2F;YAC3F,kFAAkF;YAClF,0DAA0D;YAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;gBACzC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;oBAC/B,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC,sBAAsB;oBACxD,CAAC,CAAC,KAAK,YAAY,KAAK;wBACtB,CAAC,CAAC,KAAK,CAAC,OAAO;wBACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBACnB,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC;oBAC5B,CAAC,CAAC;wBACE,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;wBACpD,SAAS,EAAE,KAAK,CAAC,IAAI;wBACrB,UAAU,EAAE,KAAK,CAAC,UAAU;wBAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;qBACvB;oBACH,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;aACjE,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,2BAA2B,CACrC,GAAG,EACH,qBAAqB,CAAC,YAAY,EAClC,0CAA0C,EAC1C,WAAW,EACX,iBAAiB,CAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,KAAK,CAAC,aAAa,CAAC,GAAY,EAAE,GAAa;QACrD,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,2BAA2B,CAC5B,CAAC;QAEF,MAAM,EAAE,IAAI,EAAE,GAAG,0BAA0B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAElE,2EAA2E;QAC3E,2EAA2E;QAC3E,kDAAkD;QAClD,IAAI,cAAc,CAAC;QACnB,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACxH,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,sBAAsB,GACzB,KAA0D,EAAE,sBAAsB,CAAC;YACtF,IACE,CAAC,mBAAmB,CAAC,KAAK,CAAC;gBACzB,KAAK,CAAC,sBAAsB,KAAK,2BAA2B,CAAC,8BAA8B,CAAC;gBAC9F,sBAAsB,KAAK,2BAA2B,CAAC,8BAA8B,EACrF,CAAC;gBACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;iBACjF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,mCAAmC,CAAC,GAAG,EAAE,cAAc,CAAC,QAAmC,CAAC,CAAC;QAElG,uFAAuF;QACvF,IAAI,aAAa,CAAC;QAClB,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,4GAA4G;QAC5G,IAAI,aAAa,CAAC,SAAS,KAAK,wBAAwB,CAAC,kBAAkB,EAAE,CAAC;YAC5E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAmC,CAAC;QAEnE,IAAI,aAAa,CAAC,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,4CAA4C,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAC1F,CAAC;QAED,oEAAoE;QACpE,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,uDAAuD;QACvD,oEAAoE;QACpE,yEAAyE;QACzE,6EAA6E;QAC7E,qEAAqE;QACrE,4EAA4E;QAC5E,0EAA0E;QAC1E,0CAA0C;QAC1C,EAAE;QACF,qDAAqD;QACrD,wEAAwE;QACxE,oEAAoE;QACpE,yEAAyE;QACzE,qCAAqC;QACrC,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,kDAAkD;QAClD,gEAAgE;QAChE,+EAA+E;QAC/E,yEAAyE;QACzE,2DAA2D;QAC3D,wEAAwE;QACxE,0EAA0E;QAC1E,sEAAsE;QACtE,oEAAoE;QACpE,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,aAAa,GAA4B;YAC7C,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;SAC9B,CAAC;QACF,IAAI,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC5C,aAAa,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;QACjD,CAAC;QACD,IAAI,OAAO,QAAQ,CAAC,yBAAyB,KAAK,QAAQ,EAAE,CAAC;YAC3D,aAAa,CAAC,yBAAyB,GAAG,QAAQ,CAAC,yBAAyB,CAAC;QAC/E,CAAC;QACD,IAAI,OAAO,QAAQ,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;YAClD,aAAa,CAAC,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC;QAC7D,CAAC;QACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAClE,MAAM,qBAAqB,GAAG,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ;YACrE,CAAC,CAAC,QAAQ,CAAC,YAAY;YACvB,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACK,KAAK,CAAC,oBAAoB,CAAC,GAAY,EAAE,GAAa;QAC5D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAI,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAwB,IAAI,SAAS,CAAC;QAE/F,uEAAuE;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAEhF,MAAM,yBAAyB,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAuB,CAAC;QAC3G,mFAAmF;QACnF,iFAAiF;QACjF,4EAA4E;QAC5E,mFAAmF;QACnF,qFAAqF;QACrF,6EAA6E;QAC7E,gCAAgC;QAChC,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;QAEhE,qEAAqE;QACrE,qEAAqE;QACrE,mEAAmE;QACnE,kEAAkE;QAClE,mEAAmE;QACnE,kEAAkE;QAClE,iEAAiE;QACjE,gEAAgE;QAChE,0DAA0D;QAC1D,2DAA2D;QAC3D,yDAAyD;QACzD,EAAE;QACF,kEAAkE;QAClE,gEAAgE;QAChE,yDAAyD;QACzD,iEAAiE;QACjE,EAAE;QACF,mEAAmE;QACnE,iEAAiE;QACjE,gEAAgE;QAChE,iEAAiE;QACjE,8DAA8D;QAC9D,iEAAiE;QACjE,8DAA8D;QAC9D,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,4CAA4C,EAC5C,SAAS,EACT,GAAG,MAAM,CAAC,MAAM,IAAI,yBAAyB,IAAI,SAAS,EAAE,CAC7D,CAAC;QAEF,MAAM,IAAI,GAAG,iCAAiC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAErE,2EAA2E;QAC3E,wFAAwF;QACxF,0EAA0E;QAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAC/C,MAAM,mBAAmB,GAAG,SAAS,EAAE,gBAAgB,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACjF,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE;oBACP,IAAI,EAAE,6BAA6B,CAAC,uBAAuB;oBAC3D,OAAO,EAAE,oCAAoC,IAAI,CAAC,gBAAgB,mDAAmD;oBACrH,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;iBACxC;aACF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,kBAAkB,GAAI,mBAAkD,CAAC,YAAY,CAAC;QAC5F,IACE,kBAAkB,KAAK,eAAe,CAAC,QAAQ;YAC/C,kBAAkB,KAAK,eAAe,CAAC,QAAQ,EAC/C,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE;oBACP,IAAI,EAAE,6BAA6B,CAAC,yCAAyC;oBAC7E,OAAO,EACL,oBAAoB,IAAI,CAAC,gBAAgB,iDAAiD;wBAC1F,sEAAsE;oBACxE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;oBACvC,YAAY,EAAE,OAAO,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;iBACtF;aACF,CAAC,CAAC;QACL,CAAC;QAED,yDAAyD;QACzD,4EAA4E;QAC5E,6EAA6E;QAC7E,wEAAwE;QACxE,uEAAuE;QACvE,0EAA0E;QAC1E,UAAU;QACV,MAAM,eAAe,GAAG,mBAAmB,CAAC,uBAAuB,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACtG,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE;oBACP,IAAI,EAAE,6BAA6B,CAAC,mCAAmC;oBACvE,OAAO,EACL,oBAAoB,IAAI,CAAC,gBAAgB,uCAAuC,IAAI,CAAC,gBAAgB,aAAa;wBAClH,4GAA4G;oBAC9G,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;iBACxC;aACF,CAAC,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,+EAA+E;QAC/E,+EAA+E;QAC/E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE;YACjF,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;SACnD,CAAC,CAAC;QAEH,+EAA+E;QAC/E,yFAAyF;QACzF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;YAClE,SAAS,EAAE,wBAAwB,CAAC,kBAAkB;YACtD,eAAe,EAAE,+BAA+B,CAAC,UAAU;YAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;YACpD,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;YAC1C,QAAQ,EAAE;gBACR,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,oEAAoE;gBACpE,wEAAwE;gBACxE,sEAAsE;gBACtE,kCAAkC;gBAClC,GAAG,CAAC,yBAAyB,KAAK,SAAS,IAAI,EAAE,yBAAyB,EAAE,CAAC;gBAC7E,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,2EAA2E;gBAC3E,6EAA6E;gBAC7E,qEAAqE;gBACrE,0EAA0E;gBAC1E,sEAAsE;gBACtE,sEAAsE;gBACtE,kEAAkE;gBAClE,8CAA8C;gBAC9C,6CAA6C;gBAC7C,kDAAkD;gBAClD,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B;SACF,CAAC,CAAC;QAEH,wEAAwE;QACxE,oEAAoE;QACpE,wCAAwC;QACxC,MAAM,WAAW,GAAG,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,GAAG,eAAe,uBAAuB,WAAW,WAAW,aAAa,EAAE,CAAC;QAElG,6FAA6F;QAC7F,IAAI,CAAC;YACH,oFAAoF;YACpF,iFAAiF;YACjF,0DAA0D;YAC1D,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/F,MAAM,IAAI,CAAC,gBAAgB,CAAC,iCAAiC,CAAC;gBAC5D,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,yBAAyB;gBACzB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,iBAAiB,EAAE,aAAa,CAAC,GAAG;gBACpC,SAAS;gBACT,SAAS;aACV,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;gBACvE,KAAK;gBACL,iBAAiB,EAAE,aAAa,CAAC,GAAG;aACrC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,+BAA+B,EAAE;YAC7C,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,yBAAyB;YACzB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,iBAAiB,EAAE,aAAa,CAAC,GAAG;SACrC,CAAC,CAAC;QAEH,2EAA2E;QAC3E,iFAAiF;QACjF,8EAA8E;QAC9E,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,aAAa,CAAC,SAAqC,CAAC,CAAC,WAAW,EAAE,CAAC;QACjG,MAAM,QAAQ,GAAG,kCAAkC,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;QACnG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,KAAK,CAAC,MAAM,CAAC,GAAY,EAAE,GAAa;QAC9C,8DAA8D;QAC9D,oEAAoE;QACpE,iDAAiD;QACjD,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACzC,mEAAmE;QACnE,oEAAoE;QACpE,8DAA8D;QAC9D,2BAA2B;QAC3B,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,YAAY,GAAG,mBAAmB,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;QAE5E,6GAA6G;QAC7G,IAAI,YAAgC,CAAC;QACrC,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;gBACvE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACpD,MAAM,OAAO,GAAG,OAAkC,CAAC;oBACnD,YAAY,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;gBACjF,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAC,wCAAwC,CAAC,CAAC;YAEpD,qEAAqE;YACrE,2FAA2F;YAC3F,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,eAAe,EAAE,CAAC;gBACzB,iEAAiE;gBACjE,iEAAiE;gBACjE,IAAI,CAAC,QAAQ,CAAC,sEAAsE,EAAE;oBACpF,MAAM,EAAE,YAAY,IAAI,SAAS;oBACjC,KAAK,EAAE,mBAAmB,CAAC,eAAe,CAAC;iBAC5C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,CAAC,8EAA8E,CAAC,CAAC;QAChG,CAAC;QAED,kEAAkE;QAClE,mEAAmE;QACnE,kEAAkE;QAClE,qCAAqC;QACrC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAE9B,mBAAmB;QACnB,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;YAClC,MAAM,EAAE,YAAY,IAAI,SAAS;YACjC,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;YACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;SAChE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB;QAEtC,IAAI,CAAC,QAAQ,CAAC,2DAA2D,CAAC,CAAC;QAE3E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,SAAS,CAAC,GAAY,EAAE,GAAa;QACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACtG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACzC,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEvC,MAAM,YAAY,GAAG,mBAAmB,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;QAC5E,IAAI,MAA0B,CAAC;QAC/B,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;gBACvE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACpD,MAAM,OAAO,GAAG,OAAkC,CAAC;oBACnD,MAAM,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC3E,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,qCAAqC;aAC1F,CAAC,CAAC;QACL,CAAC;QAED,mGAAmG;QACnG,MAAM,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAE9B,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;YAClC,MAAM;YACN,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;YACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;SAChE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB;QAEtC,IAAI,CAAC,QAAQ,CAAC,yEAAyE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACrG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,kEAAkE;IAClE,yCAAyC;IACzC,kEAAkE;IAElE;;OAEG;IACK,KAAK,CAAC,oBAAoB,CAAC,GAAY,EAAE,GAAa;QAC5D,qEAAqE;QACrE,gEAAgE;QAChE,8DAA8D;QAC9D,+DAA+D;QAC/D,8DAA8D;QAC9D,6DAA6D;QAC7D,4DAA4D;QAC5D,mBAAmB;QACnB,MAAM,EAAE,KAAK,EAAE,GAAG,6BAA6B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEtE,+DAA+D;QAC/D,gEAAgE;QAChE,gEAAgE;QAChE,mEAAmE;QACnE,EAAE;QACF,8DAA8D;QAC9D,+DAA+D;QAC/D,iEAAiE;QACjE,2DAA2D;QAC3D,+DAA+D;QAC/D,iCAAiC;QACjC,EAAE;QACF,yDAAyD;QACzD,0DAA0D;QAC1D,2DAA2D;QAC3D,8DAA8D;QAC9D,mEAAmE;QACnE,0DAA0D;QAC1D,0DAA0D;QAC1D,2DAA2D;QAC3D,iBAAiB;QACjB,EAAE;QACF,kEAAkE;QAClE,6DAA6D;QAC7D,0DAA0D;QAC1D,EAAE;QACF,kEAAkE;QAClE,gEAAgE;QAChE,8DAA8D;QAC9D,iEAAiE;QACjE,2DAA2D;QAC3D,gEAAgE;QAChE,kEAAkE;QAClE,uDAAuD;QACvD,6DAA6D;QAC7D,4DAA4D;QAC5D,8BAA8B;QAC9B,EAAE;QACF,oEAAoE;QACpE,iEAAiE;QACjE,uDAAuD;QACvD,0DAA0D;QAC1D,4CAA4C;QAC5C,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,eAAe,EAAE,CAAC,EAAE,EACtB,sCAAsC,EACtC,SAAS,EACT,KAAK,CAAC,WAAW,EAAE,CACpB,CAAC;QACF,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,eAAe,EAAE,CAAC,EAAE,EACtB,mCAAmC,CACpC,CAAC;QAEF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,EAAE,EAAE;YACtE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;SAC/F,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,qBAAqB,CAAC,GAAY,EAAE,GAAa;QAC7D,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,8BAA8B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEpF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,qBAAqB,CAAC,EAAE,EAAE;YACvE,KAAK,EAAE,WAAW;YAClB,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;YACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;SAChE,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,kEAAkE;IAClE,iEAAiE;IACjE,kEAAkE;IAElE;;OAEG;IACK,KAAK,CAAC,QAAQ,CAAC,GAAY,EAAE,GAAa;QAChD,oEAAoE;QACpE,8CAA8C;QAC9C,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,wBAAwB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAClH,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAE9C,oEAAoE;QACpE,qFAAqF;QACrF,kEAAkE;QAClE,+DAA+D;QAC/D,8DAA8D;QAC9D,8DAA8D;QAC9D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,6DAA6D;QAC7D,oEAAoE;QACpE,kEAAkE;QAClE,uDAAuD;QACvD,0DAA0D;QAC1D,EAAE;QACF,iEAAiE;QACjE,kEAAkE;QAClE,sDAAsD;QACtD,kEAAkE;QAClE,0DAA0D;QAC1D,uCAAuC;QACvC,EAAE;QACF,iEAAiE;QACjE,8DAA8D;QAC9D,+DAA+D;QAC/D,6DAA6D;QAC7D,6DAA6D;QAC7D,2DAA2D;QAC3D,4DAA4D;QAC5D,+DAA+D;QAC/D,iEAAiE;QACjE,4DAA4D;QAC5D,+DAA+D;QAC/D,mEAAmE;QACnE,gEAAgE;QAChE,EAAE;QACF,+DAA+D;QAC/D,iEAAiE;QACjE,6DAA6D;QAC7D,0DAA0D;QAC1D,gEAAgE;QAChE,4DAA4D;QAC5D,6DAA6D;QAC7D,eAAe;QACf,EAAE;QACF,kEAAkE;QAClE,kDAAkD;QAClD,iEAAiE;QACjE,0BAA0B;QAC1B,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,eAAe,EAAE,CAAC,EAAE,EACtB,wBAAwB,EACxB,SAAS,EACT,KAAK,CAAC,WAAW,EAAE,CACpB,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACvD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,eAAe,EAAE,EAAE,EAAE,EACvB,yBAAyB,EACzB,SAAS,EACT,WAAW,CACZ,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,CAAC,EAAE,EACxB,qBAAqB,CACtB,CAAC;QAEF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;QAE1D,mEAAmE;QACnE,6FAA6F;QAC7F,+FAA+F;QAC/F,qGAAqG;QACrG,MAAM,sBAAsB,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAuB,CAAC;QACxG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;QAC7D,MAAM,iBAAiB,GAAG,sBAAsB;YAC9C,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,sCAAsC,CAAC,sBAAsB,CAAC,IAAI,SAAS;YACnG,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,EAC3D,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAC1D,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAC5K,CAAC;QAEF,oEAAoE;QACpE,4EAA4E;QAC5E,0EAA0E;QAC1E,qEAAqE;QACrE,wEAAwE;QACxE,6DAA6D;QAC7D,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,4CAA4C,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACnF,CAAC;QAED,gEAAgE;QAChE,+DAA+D;QAC/D,iEAAiE;QACjE,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;QAC7C,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACzD,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,4BAA4B,CAC7B,CAAC;QAEF,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;QACrF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAAC,GAAY,EAAE,GAAa;QACxD,iEAAiE;QACjE,gEAAgE;QAChE,0DAA0D;QAC1D,6DAA6D;QAC7D,+DAA+D;QAC/D,yDAAyD;QACzD,4DAA4D;QAC5D,oCAAoC;QACpC,EAAE;QACF,6DAA6D;QAC7D,6DAA6D;QAC7D,gEAAgE;QAChE,2DAA2D;QAC3D,yBAAyB;QACzB,EAAE;QACF,iEAAiE;QACjE,6CAA6C;QAC7C,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,8BAA8B,CAC/B,CAAC;QAEF,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,0BAA0B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9H,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,EAAE,EAAE;YACjE,eAAe;YACf,SAAS;YACT,QAAQ;YACR,QAAQ;YACR,gBAAgB;YAChB,SAAS;YACT,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;SAChE,CAAC,CAAC;QAEH,iGAAiG;QACjG,iGAAiG;QACjG,8CAA8C;QAC9C,IAAI,MAAM,CAAC,OAAO,KAAK,uBAAuB,CAAC,eAAe,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC9D,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC,CAAC;YACvG,OAAO;QACT,CAAC;QAED,0FAA0F;QAC1F,+FAA+F;QAC/F,2FAA2F;QAC3F,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,4CAA4C,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACnF,CAAC;QAED,4FAA4F;QAC5F,+EAA+E;QAC/E,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;QAChE,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAAC,GAAY,EAAE,GAAa;QACxD,qDAAqD;QACrD,mEAAmE;QACnE,8DAA8D;QAC9D,6DAA6D;QAC7D,2DAA2D;QAC3D,gEAAgE;QAChE,4DAA4D;QAC5D,4DAA4D;QAC5D,EAAE;QACF,iEAAiE;QACjE,+CAA+C;QAC/C,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,8BAA8B,CAC/B,CAAC;QAEF,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,GAAG,gCAAgC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACpG,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,EAAE,EAAE;YACjE,eAAe;YACf,eAAe;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACzD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAC3D,yFAAyF;QACzF,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,6BAA6B,CAAC,CAAC;QAC5G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAEhF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,wBAAwB,CAAC,SAAS,EAAE;YACrF,YAAY,EAAE,MAAM,CAAC,MAAM;SAC5B,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IACzC,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,kBAAkB,CAAC,GAAY,EAAE,GAAa;QAC1D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAC3D,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,oCAAoC,CAAC,CAAC;QACnH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAChF,oFAAoF;QACpF,qCAAqC;QACrC,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAE7F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,EAAE;YAC1E,YAAY,EAAE,MAAM,CAAC,MAAM;YAC3B,YAAY;SACb,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,kBAAkB,CAAC,GAAY,EAAE,GAAa;QAC1D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAC3D,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,oCAAoC,CAAC,CAAC;QACnH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAChF,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;YACjD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;SAChD,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,EAAE;YAC1E,YAAY,EAAE,MAAM,CAAC,MAAM;YAC3B,YAAY;YACZ,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW,CAAC,GAAY,EAAE,GAAa;QACnD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,EAAE;YAC5D,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;YACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;SAChE,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,4CAA4C,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACnF,CAAC;QAED,2EAA2E;QAC3E,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;QAC7C,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,uBAAuB,CAAC,GAAY,EAAE,GAAa;QAC/D,oEAAoE;QACpE,8CAA8C;QAC9C,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;YACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;SAC1B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEzB,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,mEAAmE;QACnE,kEAAkE;QAClE,iEAAiE;QACjE,iEAAiE;QACjE,0DAA0D;QAC1D,kEAAkE;QAClE,oBAAoB;QACpB,EAAE;QACF,gEAAgE;QAChE,+DAA+D;QAC/D,6DAA6D;QAC7D,0DAA0D;QAC1D,+DAA+D;QAC/D,kCAAkC;QAClC,EAAE;QACF,yDAAyD;QACzD,8DAA8D;QAC9D,4DAA4D;QAC5D,gEAAgE;QAChE,0DAA0D;QAC1D,qDAAqD;QACrD,6DAA6D;QAC7D,oBAAoB;QACpB,EAAE;QACF,iEAAiE;QACjE,oEAAoE;QACpE,wCAAwC;QACxC,EAAE;QACF,4DAA4D;QAC5D,iDAAiD;QACjD,4DAA4D;QAC5D,6DAA6D;QAC7D,sDAAsD;QACtD,8BAA8B;QAC9B,EAAE;QACF,+CAA+C;QAC/C,mEAAmE;QACnE,0BAA0B;QAC1B,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,aAAa,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE,EACjE,4BAA4B,EAC5B,SAAS,EACT,KAAK,CAAC,WAAW,EAAE,CACpB,CAAC;QACF,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,aAAa,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE,EACjE,yBAAyB,CAC1B,CAAC;QAEF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,EAAE,EAAE;YACxE,KAAK,EAAE,WAAW,EAAE,SAAS;YAC7B,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;SAChE,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,qBAAqB,CAAC,GAAY,EAAE,GAAa;QAC7D,8DAA8D;QAC9D,+DAA+D;QAC/D,0DAA0D;QAC1D,gEAAgE;QAChE,4DAA4D;QAC5D,sDAAsD;QACtD,2DAA2D;QAC3D,oDAAoD;QACpD,EAAE;QACF,+DAA+D;QAC/D,gEAAgE;QAChE,+DAA+D;QAC/D,gEAAgE;QAChE,yDAAyD;QACzD,0DAA0D;QAC1D,sBAAsB;QACtB,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,oCAAoC,CACrC,CAAC;QAEF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;YAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;iBACzC,KAAK,CAAC,oBAAoB,EAAE,kDAAkD,CAAC;SACnF,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,qBAAqB,CAAC,EAAE,EAAE;YACtE,SAAS;YACT,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,EAAE;SAC1C,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,kEAAkE;IAClE,0CAA0C;IAC1C,kEAAkE;IAElE;;;;;;;OAOG;IACK,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa;QACvD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAE9E,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAE7E,qFAAqF;QACrF,yEAAyE;QACzE,MAAM,EACJ,QAAQ,EACR,YAAY,EACZ,KAAK,EACL,aAAa,GACd,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAE5D,qBAAqB;QACrB,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC;YAC7D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;gBAC/C,YAAY;gBACZ,WAAW,EAAE,sBAAsB,CAAC,SAAS;gBAC7C,MAAM,EAAE,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBAClE,IAAI,EAAE,iBAAiB,CAAC,aAAa;gBACrC,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,aAAa,EAAE,EAAE,KAAK,EAAE;oBACxB,aAAa,EAAE;wBACb,mBAAmB,EAAE;4BACnB,OAAO,EAAE,WAAW,CAAC,OAAO;4BAC5B,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,aAAa;4BAClD,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;gCACzD,WAAW,EAAE,qBAAqB,CAAC,MAAM;gCACzC,OAAO,EAAE,iBAAiB,CAAC,KAAK;6BACjC,CAAC,IAAI,SAAS;yBAChB;qBACF;oBACD,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,qEAAqE;oBACzG,iBAAiB,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAE;iBAC1E;aACF,CAAC,CAAC;YACH,aAAa;gBACX,WAAW,CAAC,OAAO;uBAChB,WAAW,CAAC,OAAO,KAAK,sBAAsB,CAAC,iBAAiB,CAAC;YACtE,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC,QAAQ,CAAC,4CAA4C,EAAE;oBAC1D,KAAK;oBACL,YAAY,EAAE,WAAW,CAAC,YAAY;oBACtC,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;iBACnD,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE;oBACrE,KAAK;oBACL,YAAY,EAAE,WAAW,CAAC,YAAY;oBACtC,OAAO,EAAE,WAAW,CAAC,OAAO;oBAC5B,KAAK,EAAE,WAAW,CAAC,KAAK;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;gBAChD,GAAG,2BAA2B,CAAC,UAAU,CAAC;aAC3C,CAAC,CAAC;YACH,2DAA2D;YAC3D,kDAAkD;QACpD,CAAC;QAED,mEAAmE;QACnE,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;gBAC3C,KAAK;gBACL,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;gBACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;aAChE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC5G,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACzD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC;YACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;SACnE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEzB,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAE/E,8EAA8E;QAC9E,kEAAkE;QAClE,MAAM,WAAW,GAAG;YAClB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,UAAU,CAAC,SAAkB;YACrC,WAAW,EAAE,eAAe,CAAC,MAAe;YAC5C,KAAK,EAAE,IAAI,CAAC,IAAI;YAChB,UAAU,EAAE,KAAK;YACjB,qBAAqB,EAAE,EAAE;SAC1B,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QACpE,yEAAyE;QACzE,6EAA6E;QAC7E,6EAA6E;QAC7E,0EAA0E;QAC1E,6EAA6E;QAC7E,6EAA6E;QAC7E,yEAAyE;QACzE,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,IAAI,CAAC,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC1D,iEAAiE;QACjE,4CAA4C;QAC5C,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;QAC7C,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,kEAAkE;IAClE,qCAAqC;IACrC,kEAAkE;IAElE;;;;;;;;;;OAUG;IACK,KAAK,CAAC,YAAY,CAAC,GAAY,EAAE,GAAa;QACpD,4DAA4D;QAC5D,oEAAoE;QACpE,8DAA8D;QAC9D,4DAA4D;QAC5D,6DAA6D;QAC7D,+DAA+D;QAC/D,2DAA2D;QAC3D,6DAA6D;QAC7D,2DAA2D;QAC3D,8DAA8D;QAC9D,6DAA6D;QAC7D,+BAA+B;QAC/B,EAAE;QACF,gEAAgE;QAChE,+DAA+D;QAC/D,8DAA8D;QAC9D,+DAA+D;QAC/D,yDAAyD;QACzD,8DAA8D;QAC9D,+DAA+D;QAC/D,gEAAgE;QAChE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACnF,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,eAAe,EAAE,CAAC,EAAE,EACtB,6BAA6B,EAC7B,SAAS,EACT,MAAM,CACP,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE;YACjD,MAAM;YACN,KAAK;YACL,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;YACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;SAChE,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,kBAAkB,CAAC,GAAY,EAAE,GAAa;QAC1D,4DAA4D;QAC5D,+DAA+D;QAC/D,4DAA4D;QAC5D,6DAA6D;QAC7D,mBAAmB;QACnB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,eAAe,EAAE,CAAC,EAAE,EACtB,6BAA6B,EAC7B,SAAS,EACT,MAAM,CACP,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;SACrF,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,EAAE;YACvD,MAAM;YACN,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;YACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;SAChE,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CAAC,GAAY,EAAE,GAAa;QACrD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC;YACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;SAC5D,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEzB,IAAI,CAAC,QAAQ,CAAC,2BAA2B,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAE1E,MAAM,WAAW,GAAG;YAClB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,UAAU,CAAC,IAAa;YAChC,WAAW,EAAE,eAAe,CAAC,MAAe;YAC5C,KAAK,EAAE,IAAI,CAAC,IAAI;YAChB,UAAU,EAAE,KAAK;YACjB,qBAAqB,EAAE,EAAE;SAC1B,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QACpE,wEAAwE;QACxE,6EAA6E;QAC7E,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,IAAI,CAAC,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC1D,oEAAoE;QACpE,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;QAC7C,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,kEAAkE;IAClE,6CAA6C;IAC7C,kEAAkE;IAElE;;;;;;;;;OASG;IACK,KAAK,CAAC,4BAA4B,CAAC,GAAY,EAAE,GAAa;QACpE,IAAI,CAAC;YACH,gEAAgE;YAChE,0DAA0D;YAC1D,sEAAsE;YACtE,kEAAkE;YAClE,8DAA8D;YAC9D,+DAA+D;YAC/D,+DAA+D;YAC/D,8DAA8D;YAC9D,2DAA2D;YAC3D,6DAA6D;YAC7D,+DAA+D;YAC/D,4DAA4D;YAC5D,2DAA2D;YAC3D,sBAAsB;YACtB,EAAE;YACF,0DAA0D;YAC1D,yDAAyD;YACzD,2CAA2C;YAC3C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACpD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACnF,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,eAAe,EAAE,EAAE,EAAE,EACvB,mCAAmC,EACnC,SAAS,EACT,MAAM,CACP,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,2BAA2B,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YAC1F,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,wBAAwB,EAAE;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,2BAA2B,CAAC,GAAY,EAAE,GAAa;QACnE,IAAI,CAAC;YACH,mEAAmE;YACnE,+DAA+D;YAC/D,iEAAiE;YACjE,sDAAsD;YACtD,4CAA4C;YAC5C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACpD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACnF,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,eAAe,EAAE,EAAE,EAAE,EACvB,mCAAmC,EACnC,SAAS,EACT,MAAM,CACP,CAAC;YACF,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;gBAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;oBACjB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;oBACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;oBACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;wBACjB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;qBAC3B,CAAC;oBACF,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,UAAU,CAAU,CAAC,CAAC,QAAQ,EAAE;oBACnF,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;oBACjE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;iBAC9B,CAAC;gBACF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;aACrC,CAAC,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,+BAA+B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YACjF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAErG,iFAAiF;YACjF,4DAA4D;YAC5D,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;YACxF,MAAM,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC;gBACnD,MAAM,EAAE,MAAM;gBACd,KAAK;gBACL,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,cAAc,EAAE,UAAU,CAAC,IAAI;gBAC/B,oBAAoB,EAAE,UAAU,CAAC,oBAAoB;gBACrD,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;gBACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;aAChE,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;YAEtB,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;gBACpB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE;oBACV,YAAY,EAAE,UAAU,CAAC,YAAY;oBACrC,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,SAAS,EAAE,UAAU,CAAC,SAAS;iBAChC;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,uBAAuB,EAAE;aAC/D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,wBAAwB,CAAC,GAAY,EAAE,GAAa;QAChE,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACpD,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;YAC/B,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE;iBAC7C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,6BAA6B,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACpF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;oBAClF,OAAO,EAAE,EAAE,SAAS,EAAE;iBACvB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;gBACxC,0BAA0B,CAAC,UAAU;gBACrC,0BAA0B,CAAC,wBAAwB;gBACnD,0BAA0B,CAAC,sBAAsB;gBACjD,0BAA0B,CAAC,YAAY;aACxC,CAAC,CAAC;YACH,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAmC,CAAC,EAAE,CAAC;gBAChF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kDAAkD,EAAE;iBACxE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,iCAAiC,EAAE;iBACvD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,6BAA6B,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrF,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,oBAAoB,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,uBAAuB,CAAC,GAAY,EAAE,GAAa;QAC/D,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACpD,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;gBAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;oBACjB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;oBACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;oBACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;wBACjB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;wBACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;qBAClC,CAAC;oBACF,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,UAAU,CAAU,CAAC,CAAC,QAAQ,EAAE;oBACnF,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;oBACjE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;iBAC9B,CAAC;gBACF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;aACnC,CAAC,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAE/F,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE;gBAC3D,SAAS;gBACT,MAAM,EAAE,UAAU,CAAC,OAAO;gBAC1B,WAAW,EAAG,WAA+B,IAAI,eAAe,CAAC,KAAK;gBACtE,QAAQ;gBACR,UAAU,EAAE,KAAK;gBACjB,qBAAqB,EAAE,EAAE;aAC1B,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;YAChE,oEAAoE;YACpE,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,YAAY,CAAC;YACnD,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,mBAAmB,EAAE;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACzD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;YAC3D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACpF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC,CAAC;YAChE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAE1E,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9C,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,oBAAoB,EAAE,CAAC,CAAC,oBAAoB;gBAC5C,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;aACzC,CAAC,CAAC,CAAC;YACJ,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,YAAY,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,mBAAmB,CAAC,GAAY,EAAE,GAAa;QAC3D,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;YAC3D,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAC3F,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC,CAAC;YAChE,MAAM,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;YAClC,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE;iBAChD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,CAAC,uBAAuB,CAAC,+BAA+B,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAE/E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC1E,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;YAExE,8DAA8D;YAC9D,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACzF,IAAI,gBAAgB,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;YAEtE,iFAAiF;YACjF,2BAA2B;YAC3B,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;YACxF,MAAM,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC;gBAChD,MAAM,EAAE,MAAM;gBACd,KAAK;gBACL,YAAY;gBACZ,cAAc,EAAE,MAAM,EAAE,IAAI,IAAI,SAAS;gBACzC,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;gBACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;aAChE,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;YAEtB,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,cAAc,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,mBAAmB,CAAC,GAAY,EAAE,GAAa;QAC3D,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;YAC3D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACpF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC,CAAC;YAChE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;YACxC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,oCAAoC,EAAE;iBAC1D,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;YAC5E,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,cAAc,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAGD,kEAAkE;IAClE,6DAA6D;IAC7D,kEAAkE;IAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACK,6BAA6B,CACnC,GAAa,EACb,IAAa,EACb,YAAgC,EAChC,aAAqB,GAAG;QAExB,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,mBAAmB,CAAC,gBAAgB,CAClC,GAAG,EACH,YAAY,EACZ,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,EAC3D,IAAI,CAAC,gBAAgB,CAAC,cAAc,CACrC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;OAKG;IACK,mBAAmB,CAAC,GAAa;QACvC,mBAAmB,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;IACpF,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,2BAA2B;QACvC,OAAO,IAAI,CAAC,aAAa,CAAC,yBAAyB,CAAC,IAAI,CAAC,aAAa,CAAC,yBAAyB,EAAE,CAAC,CAAC;IACtG,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,iCAAiC,CAAC,MAAc;QAC5D,OAAO,IAAI,CAAC,aAAa,CAAC,mCAAmC,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,yBAAyB,EAAE,CAAC,CAAC;IACxH,CAAC;IAED,kEAAkE;IAClE,qCAAqC;IACrC,kEAAkE;IAElE;;;;;;OAMG;IACK,0BAA0B,CAChC,GAAa,EACb,YAAoB,EACpB,WAAoB,EACpB,SAAkB;QAElB,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;gBAChE,OAAO,EAAE,EAAE,OAAO,EAAE,iHAAiH,EAAE;aACxI,CAAC,CAAC;QACL,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC;YACvC,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;QACH,IAAI,SAAS,EAAE,CAAC;YACd,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,WAAW,GAAG,GAAG,WAAW,kBAAkB,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC9E,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;;OAUG;IACK,2BAA2B,CACjC,GAAa,EACb,KAAa,EACb,WAAmB,EACnB,WAAoB,EACpB,SAAkB;QAElB,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC;YACvC,KAAK;YACL,MAAM,EAAE,WAAW;SACpB,CAAC,CAAC;QACH,IAAI,SAAS,EAAE,CAAC;YACd,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,WAAW,GAAG,GAAG,WAAW,UAAU,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC;QACtE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACjC,CAAC;IAEO,yBAAyB,CAAC,SAAiB,EAAE,WAAmB;QACtE,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QACzC,IAAI,CAAC;YACH,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;QAED,KAAK,MAAM,mBAAmB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,EAAE,CAAC;YACnG,MAAM,SAAS,GAAG,mBAAmB,CAAC,uBAAuB,CAC3D,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAC5B,mBAAmB,CACpB,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,SAAS;YACX,CAAC;YACD,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YAClC,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;YAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;YAC9D,OAAO,EAAE;gBACP,OAAO,EAAE,0EAA0E;gBACnF,SAAS;aACV;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACK,2BAA2B,CAAC,GAAY;QAC9C,MAAM,mBAAmB,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAuB,CAAC;QAErG,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,gCAAgC;gBACpF,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM,EAAE,eAAe,CAAC,qBAAqB;iBAC9C;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACK,kDAAkD,CAAC,mBAA2B;QACpF,OAAO,IAAI,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACK,wBAAwB,CAAC,mBAA2B;QAC1D,MAAM,GAAG,GAAG,mBAAmB,CAAC,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;QAC3G,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;gBAChE,OAAO,EAAE;oBACP,OAAO,EAAE,kDAAkD,mBAAmB,IAAI;oBAClF,mBAAmB;iBACpB;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,0BAA0B,CAAC,GAAY,EAAE,0BAA8C;QAC7F,IAAI,CAAC,0BAA0B;YAAE,OAAO;QAExC,MAAM,aAAa,GAAG,mBAAmB,CAAC,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;QAC5H,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,iDAAiD,0BAA0B,KAAK;wBAChF,oEAAoE,0BAA0B,wCAAwC;oBACxI,mBAAmB,EAAE,0BAA0B;iBAChD;aACF,CAAC,CAAC;QACL,CAAC;QAED,oFAAoF;QACpF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAuB,CAAC;QACzE,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,IAAI,gBAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,gBAAgB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,+BAA+B,0BAA0B,cAAc;wBACvE,+EAA+E;oBACjF,mBAAmB,EAAE,0BAA0B;oBAC/C,SAAS,EAAE,aAAa;iBACzB;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,CAAC,gFAAgF,EAAE;gBAC9F,0BAA0B;gBAC1B,aAAa,EAAE,MAAM;gBACrB,gBAAgB;aACjB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE,EAAE,OAAO,EAAE,sEAAsE,EAAE;aAC7F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,mCAAmC,CACzC,GAAY,EACZ,QAAwC;QAExC,IAAI,OAAO,QAAQ,CAAC,gBAAgB,KAAK,QAAQ;YAAE,OAAO;QAE1D,MAAM,0BAA0B,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAuB,CAAC;QAC5G,IAAI,CAAC,0BAA0B,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,gCAAgC;gBACpF,OAAO,EAAE;oBACP,wBAAwB;oBACxB,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;iBAC5C;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,0BAA0B,KAAK,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,kFAAkF;oBAC3F,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;oBAC3C,0BAA0B;iBAC3B;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IACnE,CAAC;IAED,kEAAkE;IAClE,uCAAuC;IACvC,kEAAkE;IAElE;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CAAC,GAAY,EAAE,GAAa;QACrD,gEAAgE;QAChE,yDAAyD;QACzD,8DAA8D;QAC9D,sDAAsD;QACtD,MAAM,IAAI,GAAG,0BAA0B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAE9D,2DAA2D;QAC3D,2DAA2D;QAC3D,gEAAgE;QAChE,4CAA4C;QAC5C,4DAA4D;QAC5D,4DAA4D;QAC5D,6DAA6D;QAC7D,8DAA8D;QAC9D,iEAAiE;QACjE,8DAA8D;QAC9D,+DAA+D;QAC/D,iCAAiC;QACjC,4DAA4D;QAC5D,qDAAqD;QACrD,0DAA0D;QAC1D,8DAA8D;QAC9D,EAAE;QACF,6DAA6D;QAC7D,6DAA6D;QAC7D,+DAA+D;QAC/D,iEAAiE;QACjE,8DAA8D;QAC9D,gEAAgE;QAChE,8DAA8D;QAC9D,kEAAkE;QAClE,WAAW;QACX,EAAE;QACF,iEAAiE;QACjE,gEAAgE;QAChE,2DAA2D;QAC3D,iEAAiE;QACjE,4DAA4D;QAC5D,4DAA4D;QAC5D,EAAE;QACF,qEAAqE;QACrE,+DAA+D;QAC/D,6DAA6D;QAC7D,6DAA6D;QAC7D,8DAA8D;QAC9D,6DAA6D;QAC7D,6DAA6D;QAC7D,6CAA6C;QAC7C,8DAA8D;QAC9D,6DAA6D;QAC7D,sCAAsC;QACtC,+DAA+D;QAC/D,+DAA+D;QAC/D,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC;QAC/E,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,eAAe,CAAC,kBAAkB,EAAE,eAAe,EAAE,eAAe,CAAC,gBAAgB,EAAE,EAC5G,+BAA+B,EAC/B,SAAS,EACT,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CACzB,CAAC;QACF,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,EAAE,4BAA4B,CAAC,CAAC;QAEzG,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;QAEvE,IAAI,CAAC,QAAQ,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAElE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QAExF,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAE5C,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC,CAAC;IACzG,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,mBAAmB,CAC/B,GAAY,EACZ,QAMC;QAED,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK;YAAE,OAAO;QAC/C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;YAC1D,MAAM,YAAY,GAAG,GAAG,WAAW,iCAAiC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAErJ,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC;YAC7D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;gBAC/C,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,WAAW,EAAE,sBAAsB,CAAC,UAAU;gBAC9C,MAAM,EAAE,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBAClE,IAAI,EAAE,iBAAiB,CAAC,aAAa;gBACrC,EAAE,EAAE,QAAQ,CAAC,KAAK;gBAClB,OAAO,EAAE;oBACP,aAAa,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;oBACxC,aAAa,EAAE;wBACb,mBAAmB,EAAE;4BACnB,OAAO,EAAE,WAAW,CAAC,OAAO;4BAC5B,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,aAAa;yBACnD;qBACF;oBACD,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;oBAC5E,iBAAiB,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE;iBAC7G;aACF,CAAC,CAAC;YACH,IACE,CAAC,WAAW,CAAC,OAAO;mBACjB,WAAW,CAAC,OAAO,KAAK,sBAAsB,CAAC,iBAAiB,EACnE,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sDAAsD,EAAE;oBACxE,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,YAAY,EAAE,WAAW,CAAC,YAAY;oBACtC,OAAO,EAAE,WAAW,CAAC,OAAO;oBAC5B,KAAK,EAAE,WAAW,CAAC,KAAK;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;gBACnD,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,yDAAyD;QAC3D,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa;QACvD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,4BAA4B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;QAEvE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,wBAAwB,CAAC,CAAC;QAEvG,IAAI,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC;QAE7C,wGAAwG;QACxG,uGAAuG;QACvG,sGAAsG;QACtG,qGAAqG;QACrG,qEAAqE;QACrE,EAAE;QACF,qGAAqG;QACrG,kGAAkG;QAClG,wGAAwG;QACxG,sGAAsG;QACtG,MAAM,4BAA4B,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAuB,CAAC;QAC9G,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;QACnE,MAAM,uBAAuB,GAAG,4BAA4B;YAC1D,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,sCAAsC,CAAC,4BAA4B,CAAC,IAAI,SAAS;YACzG,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,uBAAuB,CAAC,CAAC;QAEzH,MAAM,IAAI,CAAC,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;QAChE,oEAAoE;QACpE,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,YAAY,CAAC;QACnD,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,kEAAkE;IAClE,oCAAoC;IACpC,kEAAkE;IAElE;;;;;;;OAOG;IACK,KAAK,CAAC,UAAU,CAAC,GAAY,EAAE,GAAa;QAClD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC;YACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC,QAAQ,EAAE;SAClG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEzB,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAEvE,sEAAsE;QACtE,mEAAmE;QACnE,kEAAkE;QAClE,iEAAiE;QACjE,kEAAkE;QAClE,6DAA6D;QAC7D,+DAA+D;QAC/D,0DAA0D;QAC1D,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAE/F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAEvF,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAC1C,MAAM,CAAC,WAAW,EAClB,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,oBAAoB,CAAC,qBAAqB,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CACxI,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE;gBAC3C,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,KAAK,EAAE,SAAS,CAAC,KAAK;aACvB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,EAAE;aACzG,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAClH,CAAC;IAED,kEAAkE;IAClE,+CAA+C;IAC/C,kEAAkE;IAElE;;;;;;;OAOG;IACK,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa;QACvD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,4BAA4B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAChE,oEAAoE;QACpE,kEAAkE;QAClE,mEAAmE;QACnE,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAE9C,qEAAqE;QACrE,iEAAiE;QACjE,iEAAiE;QACjE,EAAE;QACF,kEAAkE;QAClE,mEAAmE;QACnE,oEAAoE;QACpE,6DAA6D;QAC7D,mEAAmE;QACnE,mEAAmE;QACnE,iEAAiE;QACjE,kEAAkE;QAClE,0DAA0D;QAC1D,kEAAkE;QAClE,gEAAgE;QAChE,gEAAgE;QAChE,gEAAgE;QAChE,kBAAkB;QAClB,EAAE;QACF,gEAAgE;QAChE,mEAAmE;QACnE,kEAAkE;QAClE,yCAAyC;QACzC,EAAE;QACF,2DAA2D;QAC3D,0DAA0D;QAC1D,8DAA8D;QAC9D,gCAAgC;QAChC,EAAE;QACF,kEAAkE;QAClE,qDAAqD;QACrD,gEAAgE;QAChE,4DAA4D;QAC5D,uDAAuD;QACvD,8DAA8D;QAC9D,qBAAqB;QACrB,EAAE;QACF,mEAAmE;QACnE,kEAAkE;QAClE,wEAAwE;QACxE,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,aAAa,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE,EACjE,iCAAiC,EACjC,SAAS,EACT,mBAAmB,CAAC,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,CAC9D,CAAC;QACF,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,eAAe,EAAE,CAAC,EAAE,EACtB,8BAA8B,CAC/B,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAEzD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,EAAE;YACjF,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS;SACV,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAC1C,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,oBAAoB,CAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CACjJ,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;YACvH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,EAAE;aACzG,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;IACxH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,kBAAkB,CAAC,GAAY,EAAE,GAAa;QAC1D,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,+BAA+B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEnE,oEAAoE;QACpE,gEAAgE;QAChE,kEAAkE;QAClE,kEAAkE;QAClE,iEAAiE;QACjE,qCAAqC;QACrC,kEAAkE;QAClE,2DAA2D;QAC3D,4DAA4D;QAC5D,+DAA+D;QAC/D,+DAA+D;QAC/D,qDAAqD;QACrD,EAAE;QACF,mEAAmE;QACnE,mEAAmE;QACnE,oDAAoD;QACpD,EAAE;QACF,mEAAmE;QACnE,6DAA6D;QAC7D,6DAA6D;QAC7D,iEAAiE;QACjE,gEAAgE;QAChE,+DAA+D;QAC/D,4CAA4C;QAC5C,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,aAAa,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE,EACjE,oCAAoC,EACpC,SAAS,EACT,mBAAmB,CAAC,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,CAC9D,CAAC;QACF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,EAAE;YACzE,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM;YACN,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;YACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;SAChE,CAAC,CAAC;QAEH,0EAA0E;QAC1E,kEAAkE;QAClE,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,6EAA6E;QAC7E,0EAA0E;QAC1E,qEAAqE;QACrE,iEAAiE;QACjE,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,4CAA4C,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5E,CAAC;QAED,mEAAmE;QACnE,mEAAmE;QACnE,6DAA6D;QAC7D,kEAAkE;QAClE,mDAAmD;QACnD,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7D,CAAC;IAED,kEAAkE;IAClE,wCAAwC;IACxC,kEAAkE;IAE1D,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACzD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAC3D,8DAA8D;QAC9D,qEAAqE;QACrE,gEAAgE;QAChE,oEAAoE;QACpE,oEAAoE;QACpE,gEAAgE;QAChE,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAEpG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAChF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,8BAA8B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAElE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;aACjC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;gBAClF,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;aACjC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB;aAC3D,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAC/C,MAAM,cAAc,GAAG,SAAS,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;YAChD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;gBACzE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,wBAAwB;aAChD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM,UAAU,GACd,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,GAAG,IAAI;YAC1D,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,GAAG,IAAI,GAAG,IAAI;gBAC5D,CAAC,CAAC,SAAS,CAAC,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;QAEnC,uGAAuG;QACvG,uGAAuG;QACvG,0GAA0G;QAC1G,uGAAuG;QACvG,wFAAwF;QACxF,MAAM,kBAAkB,GAAG,IAAI,CAAC,GAAG,CACjC,cAAc,CAAC,IAAI,CAAC,+BAA+B,IAAI,oCAAoC,EAC3F,oCAAoC,CACrC,CAAC;QACF,IAAI,UAAU,GAAG,kBAAkB,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;gBACxF,OAAO,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,EAAE,UAAU,EAAE,kBAAkB,EAAE,EAAE,wBAAwB;aACxH,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,cAAoC,CAAC;QACvE,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,aAAmC,CAAC;QAErE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;YAChE,SAAS,EAAE,IAAI,CAAC,SAAmB;YACnC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,CAAC,YAAY,EAAE;YACjE,cAAc;YACd,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YAC3E,KAAK,EAAE,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC9C,KAAK,EAAE,CAAC,IAAI,CAAC;gBACb,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;aACtD,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,oBAAoB,EAAE,IAAI;YAC1B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;gBAC1C,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,cAAc;gBACd,SAAS,EAAE,0BAA0B,CAAC,MAAM;gBAC5C,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;gBACvD,SAAS,EAAE;oBACT,OAAO,EAAE,WAAW,CAAC,GAAG;oBACxB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,YAAY,EAAE,IAAI,CAAC,MAAM;oBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,YAAY,EAAE,MAAM,CAAC,MAAM;oBAC3B,SAAS;oBACT,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;iBAChE;aACF,EAAE,EAAE,CAAC,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;YACpB,UAAU,EAAE,WAAW,CAAC,KAAK;YAC7B,OAAO,EAAE,WAAW,CAAC,GAAG;YACxB,SAAS,EAAE,WAAW,CAAC,SAAS;SACjC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,GAAY,EAAE,GAAa;QAC3D,oEAAoE;QACpE,qEAAqE;QACrE,oEAAoE;QACpE,mEAAmE;QACnE,mEAAmE;QACnE,oEAAoE;QACpE,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,EAC/C,uBAAuB,CACxB,CAAC;QAEF,MAAM,IAAI,GAAG,+BAA+B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEnE,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEpF,IAAI,CAAC,eAAe,CAAC,oBAAoB,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;aACnF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;aACtF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;QAClF,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;gBAClF,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAC/C,MAAM,cAAc,GAAG,SAAS,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;YAChD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;gBACzE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,wBAAwB;aAChD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,oBAAwC,CAAC;QAC7C,IAAI,eAAe,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,oBAAoB,GAAG,IAAI,CAAC,KAAK,CAAC;QACpC,CAAC;QAED,sGAAsG;QACtG,yGAAyG;QACzG,2GAA2G;QAC3G,0GAA0G;QAC1G,6FAA6F;QAC7F,MAAM,gBAAgB,GAAG,6BAA6B,CAAC,eAAe,EAAE,IAAI,IAAI,EAAE,EAAE,oCAAoC,CAAC,CAAC;QAC1H,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CACtD,eAAe,CAAC,MAAM,EACtB,SAAS,EACT,EAAE,WAAW,EAAE,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,EAC9D;YACE,mBAAmB,EAAE,IAAI;YACzB,qBAAqB,EAAE,gBAAgB;SACxC,CACF,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;gBAC1C,MAAM,EAAE,eAAe,CAAC,MAAM;gBAC9B,cAAc,EAAE,eAAe,CAAC,cAAc;gBAC9C,SAAS,EAAE,0BAA0B,CAAC,MAAM;gBAC5C,SAAS,EAAE,sBAAsB,CAAC,uBAAuB;gBACzD,SAAS,EAAE;oBACT,OAAO,EAAE,eAAe,CAAC,GAAG;oBAC5B,SAAS,EAAE,eAAe,CAAC,SAAS;oBACpC,SAAS,EAAE,eAAe,CAAC,SAAS;oBACpC,QAAQ,EAAE,eAAe,CAAC,SAAS,KAAK,UAAU;oBAClD,SAAS;oBACT,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;iBAChE;aACF,EAAE,EAAE,CAAC,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,4DAA4D;QAC5D,iEAAiE;QACjE,8DAA8D;QAC9D,kEAAkE;QAClE,8DAA8D;QAC9D,kEAAkE;QAClE,iEAAiE;QACjE,gEAAgE;QAChE,gEAAgE;QAChE,0DAA0D;QAC1D,IAAI,CAAC,6BAA6B,CAChC,GAAG,EACH;YACE,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,WAAW,EAAE,WAAW,CAAC,OAAO;YAChC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;gBACzB,oBAAoB;gBACpB,cAAc,EAAE,eAAe,CAAC,SAAS,CAAC,WAAW,EAAE;aACxD,CAAC,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,EAAE;gBACP,OAAO,EAAE,eAAe,CAAC,GAAG;gBAC5B,SAAS,EAAE,eAAe,CAAC,SAAS;gBACpC,SAAS,EAAE,eAAe,CAAC,SAAS;gBACpC,cAAc,EAAE,eAAe,CAAC,cAAc;gBAC9C,aAAa,EAAG,eAAe,CAAC,QAAgD,EAAE,aAAmC;gBACrH,MAAM,EAAE,eAAe,CAAC,MAAM;aAC/B;SACF,EACD,MAAM,CAAC,YAAY,CACpB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACzD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAC3D,kFAAkF;QAClF,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAEpG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAChF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAEvE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAiB,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAEvE,sGAAsG;QACtG,uGAAuG;QACvG,gFAAgF;QAChF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,wBAAwB;aAC/C,CAAC,CAAC;QACL,CAAC;QAED,iGAAiG;QACjG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,yGAAyG;QACzG,kHAAkH;QAClH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAEzE,wGAAwG;QACxG,0GAA0G;QAC1G,gHAAgH;QAChH,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;oBAC1C,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;oBACvD,SAAS,EAAE;wBACT,OAAO,EAAE,KAAK,CAAC,GAAG;wBAClB,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,YAAY,EAAE,KAAK,CAAC,MAAM;wBAC1B,YAAY,EAAE,MAAM,CAAC,MAAM;wBAC3B,SAAS;wBACT,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;qBAChE;iBACF,EAAE,EAAE,CAAC,CAAC;YACT,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,kEAAkE;IAClE,2DAA2D;IAC3D,kEAAkE;IAElE;;;;;;;;;;;;;;;;;OAiBG;IACK,kCAAkC,CAAC,GAAY;QACrD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC;QACnE,MAAM,eAAe,GAAG;YACtB,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW;YACzD,mBAAmB,CAAC,iCAAiC,CAAC,GAAG,CAAC;SAC3D,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEpF,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC;YAChF,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;gBACnE,wCAAwC;YAC1C,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,4BAA4B,CAAC,GAAY,EAAE,GAAa,EAAE,UAAkC;QACxG,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG;YAAE,OAAO;QAEzD,MAAM,eAAe,GAAG,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,CAAC;QACrE,IAAI,CAAC,eAAe;YAAE,OAAO;QAE7B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC;mBAChD,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;mBAC9B,SAAS,CAAC;YAEf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAClE,eAAe,EACf,UAAU,CAAC,IAAI,CAAC,GAAG,EACnB,QAAQ,CACT,CAAC;YAEF,mEAAmE;YACnE,yEAAyE;YACzE,uEAAuE;YACvE,mEAAmE;YACnE,yDAAyD;YACzD,IAAI,MAAM,CAAC,MAAM,KAAK,gCAAgC,CAAC,OAAO,EAAE,CAAC;gBAC/D,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACvD,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,2CAA2C,EAAE;gBACzD,eAAe;gBACf,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG;gBAC3B,QAAQ;gBACR,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM;aACvC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE;gBACxE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG;gBAC3B,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,4CAA4C,CAAC,GAAY,EAAE,GAAa,EAAE,MAAc;QACpG,MAAM,eAAe,GAAG,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,CAAC;QACrE,IAAI,CAAC,eAAe;YAAE,OAAO;QAE7B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;YAEnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAExG,yEAAyE;YACzE,6EAA6E;YAC7E,IAAI,MAAM,CAAC,MAAM,KAAK,gCAAgC,CAAC,OAAO,EAAE,CAAC;gBAC/D,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACvD,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,4DAA4D,EAAE;gBAC1E,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM;gBACxD,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM;aAChF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE;gBAC1F,MAAM,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,0BAA0B,CAAC,GAAY;QAC7C,MAAM,mBAAmB,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAuB,CAAC;QACrG,IAAI,CAAC,mBAAmB;YAAE,OAAO,SAAS,CAAC;QAC3C,OAAO,IAAI,CAAC,gBAAgB,CAAC,sCAAsC,CAAC,mBAAmB,CAAC,IAAI,SAAS,CAAC;IACxG,CAAC;CACF,CAAA;AAlrIY,sCAAsC;IADlD,UAAU,EAAE;IA4BR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,CAAA;IAC5D,WAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAC1C,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,+BAA+B,CAAC,CAAA;IAC1D,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAC5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,YAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,YAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,YAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,YAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAClD,YAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAC1C,YAAA,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAA;IACrC,YAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,YAAA,MAAM,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAA;IACpD,YAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAA;IACpD,YAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,YAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAClD,YAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IACzC,YAAA,MAAM,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,CAAA;IACvD,YAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,YAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAClD,YAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAGhD,YAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAG9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;qCAjCrB,aAAa;QACM,0BAA0B;QAC1B,mBAAmB;QACN,wCAAwC;QAC1D,6BAA6B;QACf,kCAAkC;QAC7B,sCAAsC;QACvC,6BAA6B;QAC9C,iBAAiB;QACpB,mBAAmB;QACc,yCAAyC;QAClE,uBAAuB;QACvB,uBAAuB;QAChB,uBAAuB;QAChC,sBAAsB;QAChC,iBAAiB;QACI,+BAA+B;QAChC,gCAAgC;QAClC,0BAA0B;QACrB,gCAAgC;QAC5C,0BAA0B;QACb,+BAA+B;QACjC,8BAA8B;QAChD,qBAAqB;QACO,mCAAmC;QACrC,kCAAkC;QACtC,8BAA8B;QAC7C,4BAA4B;GAtDjF,sCAAsC,CAkrIlD","sourcesContent":["import 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport express, { Request, Response, NextFunction } from 'express';\nimport { AbstractControllerBackendService } from '~wildo-backend-lib/base-classes/services/controllers/abstract-controller.backend.service';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ErrorHandlerService } from '~wildo-backend-lib/errors/services/error-handler.backend.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport {\n AuthenticationOrchestratorBackendService,\n type AuthenticationServiceResult,\n} from '~wildo-backend-lib/security/authentications/services/authentication-orchestrator.backend.service';\nimport { AuthTokenIssuerBackendService, extractRefreshTokenReuseSignal } from '~wildo-backend-lib/security/authentications/services/auth-token-issuer.backend.service';\nimport { OAuth2AuthenticationBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/oauth2-authentication.backend.service';\nimport { OAuth2ConnectionResolverBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/oauth2-connection-resolver.backend.service';\nimport { ConsumableTokenBackendService, ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport { computeOneOffSessionExpiresAt } from '~wildo-backend-lib/security/authentications/utils/one-off-session-lifetime.backend.utils';\nimport { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport { WebAuthnBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/webauthn.backend.service';\nimport { DomainToOrgLookupBackendService } from '~wildo-backend-lib/security/authentications/services/admin-config/domain-to-org-lookup.backend.service';\nimport { SAMLAuthenticationBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/saml-authentication.backend.service';\nimport { SAMLMetadataBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/saml-metadata.backend.service';\nimport {\n EmailBackendService,\n EmailSubmissionOutcome,\n} from '~wildo-backend-lib/notifications/email/services/email.backend.service';\nimport { SMSBackendService } from '~wildo-backend-lib/notifications/sms/services/sms.backend.service';\nimport { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { AUTH_OPERATION, AuthSource } from '~wildo-backend-lib/security/authentications/models/auth-constants.backend';\nimport { AuthControllerUtils } from '~wildo-backend-lib/security/authentications/services/utils/auth-controller.utils';\nimport { getClientIpFromRequest } from '~wildo-backend-lib/runtime/utils/request-client-ip.utils';\nimport { getConfiguredPrimaryLanguage } from '~wildo-backend-lib/config/services/app-configuration.backend.utils';\nimport {\n getApplicationIdFromEnterpriseScope,\n getOrganizationIdFromEnterpriseScope,\n} from '~wildo-backend-lib/security/authentications/models/sso-connection.backend.schemas';\nimport { AuthResponseHelperBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-response-helper.backend.service';\nimport { AuthJwtGuardBackendService } from '~wildo-backend-lib/security/jwt/services/auth-jwt-guard.backend.service';\nimport { AuthPasswordResetBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/auth-password-reset.backend.service';\nimport { AuthRegistrationBackendService, AcceptInvitationOutcome } from '~wildo-backend-lib/security/authentications/services/auth-methods/auth-registration.backend.service';\nimport { AuthMfaBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/auth-mfa.backend.service';\nimport { AuthPhoneVerificationBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/auth-phone-verification.backend.service';\nimport { AuthMethodManagementBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/auth-method-management.backend.service';\nimport { AnonymousSessionBackendService } from '~wildo-backend-lib/security/authentications/services/anonymous-session.backend.service';\nimport { AuthUserLookupBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-user-lookup.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\n// Type-only (resolved via symbol): loads the SSO config that owns\n// `sessionSettings.singleLogoutEnabled` so the public SP-metadata endpoint can gate\n// SLO-endpoint advertising on it.\nimport type { AuthOrganizationConfigurationService } from '~wildo-backend-lib/security/authentications/services/admin-config/auth-organization-configuration.service';\nimport { resolveActiveMemberOrgIds } from '~wildo-backend-lib/security/authentications/services/resolve-active-member-orgs.backend.utils';\nimport { RateLimitBackendService } from '~wildo-backend-lib/errors/services/rate-limit.backend.service';\nimport { z } from 'zod';\nimport {\n AppFrontendType,\n CrossFrontendHandoffErrorCode,\n CrossFrontendHandoffRequestSchema,\n CrossFrontendHandoffResponseSchema,\n TokenExchangeRequestSchema,\n TokenExchangeResponseSchema,\n} from '@wildo-ai/saas-models/public-runtime';\nimport {\n AuthIdentificationRequestSchema,\n AuthenticationRequestSchema,\n AuthLoginFormDtoSchema,\n PasswordResetRequestDtoSchema,\n PasswordResetCompleteDtoSchema,\n UserRegisterApiDtoSchema,\n UserInvitationApiDtoSchema,\n UserInvitationRejectApiDtoSchema,\n EmailVerifyDtoSchema,\n AuthMethod,\n AuthFactorLevel,\n AuthenticationSessionState,\n CoreConsumableTokenTypes,\n ConsumableToken_ConsumptionMode,\n ConsumableTokenTypesSchema,\n CoreResourceType,\n CoreResourceOperation,\n CoreAuditableEventType,\n ResourceOperationVariantType,\n ResourceOperationRiskLevel,\n ResourcePrimaryScope,\n CORE_APP_ROLES,\n UserStatus,\n SsoConnectionType,\n EmailTemplateType,\n SystemEmailTemplateRef,\n ErrorType,\n ErrorCustomMessageReference,\n isWildoBackendError,\n MANUAL_CONTROLLER_ROUTES_URLS,\n ManualControllerRouteKey,\n AuthRedirectErrorCode,\n AuthScopeType,\n SessionType,\n AnonymousUserTranspositionStatus,\n WildoHeaderKeys,\n} from '@wildo-ai/saas-models';\nimport { BrandAssetComposition, BrandAssetPurpose } from '@wildo-ai/saas-models';\nimport { DurationUnit } from '@wildo-ai/zod-decorators';\nimport type { AuthIdentificationResponse, AuthenticationRequest, AuthenticationResponse, User } from '@wildo-ai/saas-models';\nimport { MagicLinkSendRequestSchema, MagicLinkVerifyRequestSchema, PhoneVerifySendRequestSchema, PhoneVerifyConfirmRequestSchema } from '@wildo-ai/saas-models';\nimport { AvailableLanguage, AuthResponseMessageRef, BackendSmsMessageRef } from '@wildo-ai/presets-components-models';\n\n\n// Password auth body extends the shared login form DTO with session/method/factor fields\n// that are added programmatically by the frontend service layer.\nconst PasswordAuthBodySchema = AuthLoginFormDtoSchema.extend({\n sessionId: z.string(),\n method: z.literal(AuthMethod.PASSWORD),\n factorLevel: z.literal(AuthFactorLevel.FIRST),\n});\n\n/**\n * Refresh-token body schema — **strict-empty** post Auth-hardening\n * Slice A Step 6 (2026-04-13). The handler reads the refresh token\n * EXCLUSIVELY from the `__wildo_refresh` cookie via\n * `AuthControllerUtils.extractRefreshTokenFromCookie()` and raises a\n * 400 when the cookie is absent.\n *\n * Why `z.strictObject({})` instead of \"schema dropped\":\n * - **Defense-in-depth**: a client mistakenly serializing\n * `{ refreshToken: '…' }` in the body is rejected with a clear\n * validation error, NOT silently ignored. Silent ignore would mask\n * a regression where a client thinks it sent the token (and trusts\n * the response) but the server never saw it.\n * - **Migration loudness**: a stale legacy client (pre-A-Step-3)\n * still sending the body field gets a 400 → forced re-login. This\n * is the explicit migration cost A-Step 6 trades for the cleaner\n * threat model (the body channel can no longer be used as an\n * exfiltration target by JS-resident attackers).\n *\n * Pre-Slice-A this schema accepted `refreshToken: z.string().min(1)`;\n * the A-K-5 transitional window made it `.optional()`; A-Step 6 drops\n * the field entirely.\n */\nconst RefreshTokenBodySchema = z.strictObject({});\n\n/** Body of `POST /auth/saml/logout` (SP-initiated SLO kickoff) — the SAML connection the caller is logging out of. */\nconst SAMLSPLogoutRequestSchema = z.strictObject({ connectionId: z.string().min(1) });\n\n/**\n * Logout body schema — **strict-empty** post Auth-hardening Slice A\n * Step 6 (2026-04-13). `logout()` reads the refresh token EXCLUSIVELY\n * from the `__wildo_refresh` cookie via\n * `AuthControllerUtils.extractRefreshTokenFromCookie()`.\n *\n * Even when no refresh token is present (cookie absent / already\n * cleared), the handler still emits `Set-Cookie: __wildo_refresh=…;\n * Max-Age=0` — clearing is the user-visible action and a stale cookie\n * with no JS-side state must still be revoked client-side. Redis-side\n * blacklist runs only when a token IS present (best-effort).\n */\nconst LogoutBodySchema = z.strictObject({});\n\nconst CreateOneOffTokenRequestSchema = z.object({\n userId: z.string().min(1),\n tokenType: ConsumableTokenTypesSchema,\n consumeAt: z.enum(['EXCHANGE', 'TARGET_OPERATION']),\n consumptionMode: z.enum(ConsumableToken_ConsumptionMode).optional().default(ConsumableToken_ConsumptionMode.SINGLE_USE),\n maxUses: z.number().int().min(1).optional(),\n expiresIn: z.object({\n value: z.number().int().min(1),\n unit: z.enum(['minutes', 'hours', 'days']),\n }).optional().default({ value: 1, unit: 'hours' }),\n resourceIdentifier: z.string().optional(),\n relatedId: z.string().optional(),\n metadata: z.record(z.string(), z.any()).optional(),\n targeting: z.object({\n initiatorIds: z.record(z.string(), z.string()).optional(),\n }).optional(),\n});\n\nconst OneOffSessionExchangeBodySchema = z.object({\n token: z.string().min(1),\n});\n\n@injectable()\nexport class AuthenticationControllerBackendService extends AbstractControllerBackendService {\n private readonly authService: AuthenticationOrchestratorBackendService;\n private readonly tokenIssuer: AuthTokenIssuerBackendService;\n private readonly oauth2Service: OAuth2AuthenticationBackendService;\n private readonly oauth2Resolver: OAuth2ConnectionResolverBackendService;\n private readonly consumableTokenService: ConsumableTokenBackendService;\n private readonly jwtService: JwtBackendService;\n private readonly emailService: EmailBackendService;\n private readonly appConfigService: AppConfigurationService;\n private readonly auditLogsService: AuditLogsBackendService;\n private readonly rateLimitService: RateLimitBackendService;\n private readonly webAuthnService: WebAuthnBackendService;\n private readonly smsService: SMSBackendService;\n private readonly domainToOrgLookup: DomainToOrgLookupBackendService;\n private readonly samlAuthService: SAMLAuthenticationBackendService;\n private readonly samlMetadataService: SAMLMetadataBackendService;\n private readonly authResponseHelper: AuthResponseHelperBackendService;\n private readonly authJwtGuard: AuthJwtGuardBackendService;\n private readonly passwordResetService: AuthPasswordResetBackendService;\n private readonly registrationService: AuthRegistrationBackendService;\n private readonly mfaService: AuthMfaBackendService;\n private readonly phoneVerificationService: AuthPhoneVerificationBackendService;\n private readonly methodManagementService: AuthMethodManagementBackendService;\n private readonly anonymousSessionService: AnonymousSessionBackendService;\n private readonly userLookup: AuthUserLookupBackendService;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ErrorHandlerService) errorHandler: ErrorHandlerService,\n @inject(SAAS_SERVICE_TYPES.AuthenticationOrchestratorService) authService: AuthenticationOrchestratorBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthTokenIssuer) tokenIssuer: AuthTokenIssuerBackendService,\n @inject(SAAS_SERVICE_TYPES.OAuth2AuthenticationService) oauth2Service: OAuth2AuthenticationBackendService,\n @inject(SAAS_SERVICE_TYPES.OAuth2ConnectionResolverService) oauth2Resolver: OAuth2ConnectionResolverBackendService,\n @inject(SAAS_SERVICE_TYPES.ConsumableTokenService) consumableTokenService: ConsumableTokenBackendService,\n @inject(SAAS_SERVICE_TYPES.JwtBackendService) jwtService: JwtBackendService,\n @inject(SAAS_SERVICE_TYPES.EmailService) emailService: EmailBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory) private readonly authEcFactory: AuthExecutionContextFactoryBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) auditLogsService: AuditLogsBackendService,\n @inject(SAAS_SERVICE_TYPES.RateLimitBackendService) rateLimitService: RateLimitBackendService,\n @inject(SAAS_SERVICE_TYPES.WebAuthnService) webAuthnService: WebAuthnBackendService,\n @inject(SAAS_SERVICE_TYPES.SMSService) smsService: SMSBackendService,\n @inject(SAAS_SERVICE_TYPES.DomainToOrgLookupService) domainToOrgLookup: DomainToOrgLookupBackendService,\n @inject(SAAS_SERVICE_TYPES.SAMLAuthenticationService) samlAuthService: SAMLAuthenticationBackendService,\n @inject(SAAS_SERVICE_TYPES.SAMLMetadataService) samlMetadataService: SAMLMetadataBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthResponseHelperService) authResponseHelper: AuthResponseHelperBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthJwtGuardService) authJwtGuard: AuthJwtGuardBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthPasswordResetService) passwordResetService: AuthPasswordResetBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthRegistrationService) registrationService: AuthRegistrationBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthMfaService) mfaService: AuthMfaBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthPhoneVerificationService) phoneVerificationService: AuthPhoneVerificationBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthMethodManagementService) methodManagementService: AuthMethodManagementBackendService,\n @inject(SAAS_SERVICE_TYPES.AnonymousSessionService) anonymousSessionService: AnonymousSessionBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthUserLookupService) userLookup: AuthUserLookupBackendService,\n // F4 per-org SIEM routing — resolves a user's VERIFIED ACTIVE member orgs for auth-event\n // dispatch (`resolveActiveMemberOrgIds`). Appended LAST to keep positional construction stable.\n @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n // SLO metadata gating — reads `sessionSettings.singleLogoutEnabled` for the SP\n // metadata endpoint. Appended LAST to keep positional construction stable.\n @inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService) private readonly orgConfigService: AuthOrganizationConfigurationService,\n ) {\n super(logger, errorBuilder, errorHandler, 'AuthenticationController');\n this.authService = authService;\n this.tokenIssuer = tokenIssuer;\n this.oauth2Service = oauth2Service;\n this.oauth2Resolver = oauth2Resolver;\n this.consumableTokenService = consumableTokenService;\n this.jwtService = jwtService;\n this.emailService = emailService;\n this.appConfigService = appConfigService;\n this.auditLogsService = auditLogsService;\n this.rateLimitService = rateLimitService;\n this.webAuthnService = webAuthnService;\n this.smsService = smsService;\n this.domainToOrgLookup = domainToOrgLookup;\n this.samlAuthService = samlAuthService;\n this.samlMetadataService = samlMetadataService;\n this.authResponseHelper = authResponseHelper;\n this.authJwtGuard = authJwtGuard;\n this.passwordResetService = passwordResetService;\n this.registrationService = registrationService;\n this.mfaService = mfaService;\n this.phoneVerificationService = phoneVerificationService;\n this.methodManagementService = methodManagementService;\n this.anonymousSessionService = anonymousSessionService;\n this.userLookup = userLookup;\n }\n\n protected setupRoutes(): void {\n // ─── Existing Authentication Routes ───\n\n // User/Customer identification\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_IDENTIFY], this.asyncHandler(this.identify.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_IDENTIFY], 'Identify user/customer and get available methods');\n\n // Authentication methods\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_AUTHENTICATE_PASSWORD], this.asyncHandler(this.authenticatePassword.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_AUTHENTICATE_PASSWORD], 'Authenticate with password');\n\n // Generic authentication endpoint for all methods\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_AUTHENTICATE], this.asyncHandler(this.authenticate.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_AUTHENTICATE], 'Universal authentication endpoint (all methods)');\n\n // Token refresh (TRAP 11: NOT behind JWT auth — user's access token may be expired)\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_TOKEN_REFRESH], this.asyncHandler(this.refreshToken.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_TOKEN_REFRESH], 'Refresh access token using refresh token');\n\n // Session management\n this.router.get(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SESSION_STATE], this.asyncHandler(this.getSessionState.bind(this)));\n this.logRouteRegistration('GET', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SESSION_STATE], 'Get authentication session state');\n\n // ─── OAuth2 Routes (Step 5) ───\n // Browser-only routes — the framework targets web stacks exclusively\n // (`AppFrontendType` ∈ { SAAS_APP, STATIC_WEBSITE, TECH_DOC }):\n // - oauth2Authorize: returns authorizationUrl — frontend uses window.location.href.\n // - oauth2Callback: IdP redirects here (server-to-server).\n // - tokenExchange: frontend exchanges the one-time code for JWT.\n // No native-SDK / Capacitor / Electron variants exist; all OAuth2 flows\n // go through the standard web authorization-code path.\n\n // OAuth2 authorize — returns authorization URL for frontend to redirect\n this.router.get(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_OAUTH2_AUTHORIZE], this.asyncHandler(this.oauth2Authorize.bind(this)));\n this.logRouteRegistration('GET', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_OAUTH2_AUTHORIZE], 'OAuth2 authorize — get IdP authorization URL');\n\n // OAuth2 callback — accepts GET and POST only (L7 fix: was router.all(), narrowed to reduce attack surface)\n // GET: standard OAuth2 authorization code flow\n // POST: Apple uses response_mode=form_post (TRAP 5)\n const oauth2CallbackHandler = this.asyncHandler(this.oauth2Callback.bind(this));\n const oauth2CallbackUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_OAUTH2_CALLBACK];\n this.router.get(oauth2CallbackUrl, oauth2CallbackHandler);\n this.router.post(oauth2CallbackUrl, oauth2CallbackHandler);\n this.logRouteRegistration('GET+POST', oauth2CallbackUrl, 'OAuth2 callback — handle IdP redirect (GET+POST for Apple form_post)');\n\n // Token exchange — frontend exchanges one-time code for JWT tokens (Decision 7)\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_TOKEN_EXCHANGE], this.asyncHandler(this.tokenExchange.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_TOKEN_EXCHANGE], 'Exchange one-time code for JWT tokens');\n\n // Cross-frontend session handoff (cross-app-jwt-propagation Step 2).\n // Authenticated user requests a one-time AUTH_CODE_EXCHANGE token bound to a\n // target frontend service, then redirects the browser to the target's\n // /auth/exchange page with the code. Bearer-only (no cookies / withCredentials);\n // CORS for callers is auto-allowed via the existing deriveCorsOrigins() seam,\n // which iterates every declared frontendService.\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_CROSS_FRONTEND_HANDOFF], this.asyncHandler(this.crossFrontendHandoff.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_CROSS_FRONTEND_HANDOFF], 'Issue one-time code for cross-frontend session handoff');\n\n // Logout — revoke refresh token\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_LOGOUT], this.asyncHandler(this.logout.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_LOGOUT], 'Logout — revoke refresh token');\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_LOGOUT_ALL], this.asyncHandler(this.logoutAll.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_LOGOUT_ALL], 'Logout-all — sign out everywhere (fence the whole user)');\n\n // ─── Password Reset Routes (Step 7) ───\n\n // Request password reset — sends email with reset link\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSWORD_RESET_REQUEST], this.asyncHandler(this.passwordResetRequest.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSWORD_RESET_REQUEST], 'Request password reset — send email with reset link');\n\n // Complete password reset — validate token and update password\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSWORD_RESET_COMPLETE], this.asyncHandler(this.passwordResetComplete.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSWORD_RESET_COMPLETE], 'Complete password reset — validate token and set new password');\n\n // ─── Registration Routes (Step 8) ───\n\n // Register — create account with email verification\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REGISTER], this.asyncHandler(this.register.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REGISTER], 'Register — create user account with email verification');\n\n // Accept invitation — public token-driven invitation completion\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ACCEPT_INVITATION], this.asyncHandler(this.acceptInvitation.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ACCEPT_INVITATION], 'Accept invitation — create/link account and continue auth flow');\n\n // Invitation info — public, NON-consuming discovery of the invited org's auth\n // methods + SSO/SCIM mode (drives the multi-method accept chooser). Read-only.\n this.router.get(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_INVITATION_INFO], this.asyncHandler(this.getInvitationInfo.bind(this)));\n this.logRouteRegistration('GET', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_INVITATION_INFO], 'Invitation info — available auth methods + SSO/SCIM mode for the invited org (non-consuming)');\n\n // Reject invitation — public token-driven invitation decline\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REJECT_INVITATION], this.asyncHandler(this.rejectInvitation.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REJECT_INVITATION], 'Reject invitation — mark invitee decline explicitly');\n\n // In-app authenticated invitation management (Approach P) — a signed-in user lists +\n // accepts/rejects THEIR OWN pending invitations (email-ownership), no token, no new session.\n this.router.get(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_LIST_MY_INVITATIONS], this.asyncHandler(this.listMyInvitations.bind(this)));\n this.logRouteRegistration('GET', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_LIST_MY_INVITATIONS], 'List my pending invitations — authenticated, email-owned');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ACCEPT_MY_INVITATION], this.asyncHandler(this.acceptMyInvitation.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ACCEPT_MY_INVITATION], 'Accept my invitation — authenticated in-app accept (no token, no new session)');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REJECT_MY_INVITATION], this.asyncHandler(this.rejectMyInvitation.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REJECT_MY_INVITATION], 'Reject my invitation — authenticated in-app reject');\n\n // Verify email — confirm email and auto-login\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_VERIFY_EMAIL], this.asyncHandler(this.verifyEmail.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_VERIFY_EMAIL], 'Verify email — confirm email address and issue tokens');\n\n // Resend verification email (F5)\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_RESEND_VERIFICATION], this.asyncHandler(this.resendVerificationEmail.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_RESEND_VERIFICATION], 'Resend verification email — re-send email verification link');\n\n // W5.7: Complete org onboarding (deferred org creation)\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_COMPLETE_ORG_ONBOARDING], this.asyncHandler(this.completeOrgOnboarding.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_COMPLETE_ORG_ONBOARDING], 'Complete org onboarding — create deferred organization');\n\n // ─── MFA: Email OTP Routes (Step 10) ───\n\n // Send email OTP — generates OTP and sends via email\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_SEND], this.asyncHandler(this.mfaEmailOTPSend.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_SEND], 'Send email OTP for MFA second factor');\n\n // Verify email OTP — validates the submitted OTP code\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_VERIFY], this.asyncHandler(this.mfaEmailOTPVerify.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_VERIFY], 'Verify email OTP for MFA second factor');\n\n // ─── MFA: TOTP Routes (Step 11) ───\n\n // TOTP setup — generate secret + QR URI for enrollment\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_SETUP], this.asyncHandler(this.mfaTOTPSetup.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_SETUP], 'Setup TOTP — generate secret and QR code URI');\n\n // TOTP verify setup — confirm enrollment with a code from the authenticator app\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY_SETUP], this.asyncHandler(this.mfaTOTPVerifySetup.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY_SETUP], 'Verify TOTP setup — confirm enrollment with code');\n\n // TOTP verify — validate TOTP code during login MFA\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY], this.asyncHandler(this.mfaTOTPVerify.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY], 'Verify TOTP code for MFA second factor');\n\n // ─── Enterprise SSO Routes (Step 15) ───\n // Enterprise OIDC authorize — initiate SSO flow for an org's OIDC connection\n // Callback reuses the same /auth/oauth2/callback/:providerRef route — state token carries enterprise context\n this.router.get(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ENTERPRISE_SSO_AUTHORIZE], this.asyncHandler(this.enterpriseSSOAuthorize.bind(this)));\n this.logRouteRegistration('GET', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ENTERPRISE_SSO_AUTHORIZE], 'Enterprise SSO authorize — get IdP authorization URL for org OIDC connection');\n\n // App-enterprise OIDC authorize — initiate SSO flow for an APPLICATION-scoped connection\n this.router.get(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_APP_ENTERPRISE_AUTHORIZE], this.asyncHandler(this.appEnterpriseSSOAuthorize.bind(this)));\n this.logRouteRegistration('GET', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_APP_ENTERPRISE_AUTHORIZE], 'App-enterprise SSO authorize — get IdP authorization URL for app OIDC connection');\n\n // ─── SAML Routes (AUTH-2) ───\n this.router.get(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_LOGIN], this.asyncHandler(this.handleSAMLLogin.bind(this)));\n this.logRouteRegistration('GET', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_LOGIN], 'SAML login — initiate SP-initiated SSO');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_ACS],\n express.urlencoded({ extended: false, limit: '2mb' }),\n this.asyncHandler(this.handleSAMLACS.bind(this)),\n );\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_ACS], 'SAML ACS — process IdP response (SC-30: 2mb urlencoded)');\n\n this.router.get(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_METADATA], this.asyncHandler(this.handleSAMLMetadata.bind(this)));\n this.logRouteRegistration('GET', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_METADATA], 'SAML SP metadata — public XML endpoint (10/min/IP)');\n\n this.router.get(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_SLO], this.asyncHandler(this.handleSAMLSLO_GET.bind(this)));\n this.logRouteRegistration('GET', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_SLO], 'SAML SLO — IdP-initiated via HTTP-Redirect or SP-initiated LogoutResponse');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_SLO],\n express.urlencoded({ extended: false, limit: '2mb' }),\n this.asyncHandler(this.handleSAMLSLO_POST.bind(this)),\n );\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_SLO], 'SAML SLO — IdP-initiated via HTTP-POST');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_SP_LOGOUT], this.asyncHandler(this.handleSAMLSPLogout.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_SP_LOGOUT], 'SAML SLO — SP-initiated kickoff');\n\n // ─── WebAuthn/Passkey Routes (Phase G1) ───\n // Registration (JWT-authenticated)\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_OPTIONS], this.asyncHandler(this.handlePasskeyRegisterOptions.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_OPTIONS], 'Passkey register options — generate registration challenge');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_VERIFY], this.asyncHandler(this.handlePasskeyRegisterVerify.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_VERIFY], 'Passkey register verify — verify and store credential');\n\n // Authentication (unauthenticated — part of login flow)\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_AUTH_OPTIONS], this.asyncHandler(this.handlePasskeyAuthOptions.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_AUTH_OPTIONS], 'Passkey auth options — generate authentication challenge');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_AUTH_VERIFY], this.asyncHandler(this.handlePasskeyAuthVerify.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_AUTH_VERIFY], 'Passkey auth verify — verify assertion and complete login');\n\n // Management (JWT-authenticated)\n this.router.get(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_LIST], this.asyncHandler(this.handlePasskeyList.bind(this)));\n this.logRouteRegistration('GET', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_LIST], 'Passkey list — list registered passkeys');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_REMOVE], this.asyncHandler(this.handlePasskeyRemove.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_REMOVE], 'Passkey remove — remove a passkey');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_RENAME], this.asyncHandler(this.handlePasskeyRename.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_RENAME], 'Passkey rename — rename a passkey');\n\n // ─── Magic Link Routes (Phase G2) ───\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MAGIC_LINK_SEND], this.asyncHandler(this.magicLinkSend.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MAGIC_LINK_SEND], 'Magic link send — send passwordless login link via email');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MAGIC_LINK_VERIFY], this.asyncHandler(this.magicLinkVerify.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MAGIC_LINK_VERIFY], 'Magic link verify — verify token and issue auth tokens');\n\n // ─── SMS OTP Routes (Phase G2) ───\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SMS_OTP_SEND], this.asyncHandler(this.smsOTPSend.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SMS_OTP_SEND], 'SMS OTP send — send OTP code via SMS');\n\n // Note: SMS OTP verify goes through the generic /auth/authenticate endpoint via SMS_OTP method\n\n // ─── Phone Verification Routes (Phase G2) ───\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PHONE_VERIFY_SEND], this.asyncHandler(this.phoneVerifySend.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PHONE_VERIFY_SEND], 'Phone verify send — send verification code via SMS');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PHONE_VERIFY_CONFIRM], this.asyncHandler(this.phoneVerifyConfirm.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PHONE_VERIFY_CONFIRM], 'Phone verify confirm — confirm phone ownership with code');\n\n // ─── One-Off Session Routes (W7.3b) ───\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE], this.asyncHandler(this.createOneOffToken.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE], 'Create one-off session token (app-scoped)');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE_ORG], this.asyncHandler(this.createOneOffToken.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE_ORG], 'Create one-off session token (org+app-scoped)');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_EXCHANGE], this.asyncHandler(this.exchangeOneOffToken.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_EXCHANGE], 'Exchange one-off token for JWT session');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE], this.asyncHandler(this.revokeOneOffToken.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE], 'Revoke an un-exchanged one-off session token (app-scoped)');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE_ORG], this.asyncHandler(this.revokeOneOffToken.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE_ORG], 'Revoke an un-exchanged one-off session token (org+app-scoped)');\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Existing Authentication Route Handlers\n // ═══════════════════════════════════════════════════════════════\n\n private async identify(req: Request, res: Response): Promise<void> {\n // PR-7b-fixes F-22 fail-fast ordering generalized: body parse →\n // rate-limit → ec. Same victim-protective ranking as the\n // account-lifecycle family (named-account FIRST, source-noise\n // LAST) — see `register` for the full F-20 rationale.\n const body = AuthIdentificationRequestSchema.parse(req.body || {});\n\n // PR 8c (rate-limit unification, Step 5 — Option D, third\n // service-layer lift). The dual rate-limit\n // (formerly `${AUTH_REDIS_KEYS.IDENTIFY_IP}${ip}` 10/60 per-IP\n // + `${AUTH_REDIS_KEYS.IDENTIFY_EMAIL}${email.toLowerCase()}`\n // 10/60 per-email, both raw `checkRateLimit` inside\n // `AuthenticationOrchestratorBackendService.identify`) now\n // lives at the controller as TWO declarative `checkPolicy`\n // companions. Pre-PR-8c the controller had ZERO local rate-limit\n // cap of its own at this seam — the orchestrator was the SOLE\n // protection layer. The lift simultaneously closes a latent\n // unknown-IP bypass: the orchestrator wrapped its IP check in\n // `if (deviceInfo?.ipAddress)`, which would have skipped\n // rate-limiting entirely if `deviceInfo` were undefined; the\n // unified path uses `getClientIpFromRequest` which returns\n // the `'unknown'` sentinel and co-buckets unknown-IP callers\n // (same net-upgrade pattern PR 7b applied to 6 account-\n // lifecycle sites).\n //\n // `body.email` is ALREADY lowercased by\n // `AuthIdentificationRequestSchema` (`.email().toLowerCase()`\n // on the schema), so the explicit `.toLowerCase()` here is\n // a defense-in-depth no-op that keeps the bucket-key\n // normalization invariant readable at the call site (matches\n // every other email-keyed bucket in the family — `register`,\n // `passwordResetRequest`, `resendVerificationEmail`,\n // `magicLinkSend`). D-4 baseline only (plus-tail and Gmail-dot\n // tricks NOT collapsed).\n //\n // Order — VICTIM-PROTECTIVE bucket FIRST per F-20 (named-account\n // before loud-source): per-email THEN per-IP. When both buckets\n // would trip on the same request, the per-email 429 short-\n // circuits and the per-IP increment never happens.\n /** @wildo_source:part:start example.rate-limit.custom-controller-surface facet:kind:usage-example facet:audience:app-developer */\n // Dual-bucket at the controller seam: per-email FIRST (victim-protective\n // ordering — the named account is decremented before the loud source),\n // then per-IP. Distinct scope keys prevent collision; both run before\n // execution-context creation so the limit fails fast.\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10 },\n 'auth:identify:by-email',\n undefined,\n body.email.toLowerCase(),\n );\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10 },\n 'auth:identify:by-ip',\n );\n /** @wildo_source:part:end example.rate-limit.custom-controller-surface */\n\n const ec = await this._getPreAuthExecutionContext();\n\n // Capture device information from request headers (consistent IP extraction)\n const deviceInfo = {\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n ipAddress: getClientIpFromRequest(req),\n };\n\n const identificationRequest = {\n ...body,\n deviceInfo\n };\n\n // W3.5 + W3.11: Resolve activeUserType hint from X-Frontend-Service-Name header.\n // AUTH-10: This is only a hint for pre-identification flows (unknown users).\n // For known users, the orchestrator overrides with the DB-stored userTypes[0].\n // AUTH-10: Cross-validate Origin against claimed frontend service identity (defense-in-depth).\n const frontendServiceName = req.headers[WildoHeaderKeys.FRONTEND_SERVICE_NAME] as string | undefined;\n this._validateFrontendAppOrigin(req, frontendServiceName);\n const activeUserType = frontendServiceName\n ? this.appConfigService.resolveUserTypeFromFrontendServiceName(frontendServiceName) ?? undefined\n : undefined;\n\n const result: AuthIdentificationResponse = await this.authService.identify(\n ec,\n identificationRequest,\n activeUserType,\n frontendServiceName,\n );\n this.jsonSuccess(res, result);\n }\n\n private async authenticatePassword(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const body = PasswordAuthBodySchema.parse(req.body || {});\n const passwordRequest = {\n sessionId: body.sessionId,\n method: body.method,\n factorLevel: body.factorLevel,\n password: body.password,\n email: body.email, // Email should be available from session, but included for compatibility\n rememberMe: false,\n requestedIntegrations: []\n };\n const result: AuthenticationServiceResult = await this.authService.authenticatePassword(ec, passwordRequest);\n await this.handleAnonymousTransposition(req, res, result);\n // Auth-hardening A-Step 6 (2026-04-13): destructure the cookie-only\n // `refreshToken` out of the orchestrator's internal result shape so\n // the wire body (`AuthenticationResponse`) physically cannot carry\n // it. The wrapper sets `Set-Cookie` from the third arg.\n const { refreshToken, ...wireBody } = result;\n this._jsonSuccessWithRefreshCookie(res, wireBody, refreshToken);\n }\n\n // Generic authenticate endpoint for future extensibility (SSO/MFA/etc.)\n private async authenticate(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const request = AuthenticationRequestSchema.parse(req.body || {}) as AuthenticationRequest;\n const result: AuthenticationServiceResult = await this.authService.authenticate(ec, request);\n await this.handleAnonymousTransposition(req, res, result);\n // Auth-hardening A-Step 6 — see `authenticatePassword()` for the\n // destructure-and-pass-explicitly contract. Same pattern is used at\n // every wire-leaving auth seam in this controller.\n const { refreshToken, ...wireBody } = result;\n this._jsonSuccessWithRefreshCookie(res, wireBody, refreshToken);\n }\n\n /**\n * Refresh access token using a valid refresh token.\n * POST /auth/token/refresh\n *\n * **Cookie-only contract** (Auth-hardening Slice A Step 6, 2026-04-13).\n * The refresh token is read EXCLUSIVELY from the `__wildo_refresh`\n * `HttpOnly` cookie via\n * `AuthControllerUtils.extractRefreshTokenFromCookie()`. The body\n * schema (`RefreshTokenBodySchema`) is `z.strictObject({})`, so a\n * stale legacy client still sending `{ refreshToken: '…' }` in the\n * body fails validation BEFORE reaching this handler — surfaced as\n * a 400 rather than silently ignored (defense-in-depth).\n *\n * Response body: `{ accessToken, expiresIn }` (NO `refreshToken` —\n * the rotated refresh token reaches the browser exclusively via\n * `Set-Cookie: __wildo_refresh=<rotated>` set by\n * `_jsonSuccessWithRefreshCookie`).\n *\n * Pre-A-Step-6 history (preserved for chronological context):\n * - A-K-3 (2026-04-13) added the `Set-Cookie` channel as a\n * parallel emit to the body field.\n * - A-K-5 (2026-04-13) added a transitional dual-read so legacy\n * body-only clients could still rotate during the migration.\n * - A-Step 3 (2026-04-13) made the SaaS frontend stop persisting\n * the body field.\n * - A-Step 6 (THIS step) drops the body channel entirely.\n *\n * TRAP 11: This endpoint is NOT behind JWT auth middleware.\n * The user's access token is expired — that's why they're calling refresh.\n */\n private async refreshToken(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n // Validate body shape (strict-empty post A-Step 6 — see\n // `RefreshTokenBodySchema` JSDoc). Throws on `{ refreshToken: '…' }`.\n RefreshTokenBodySchema.parse(req.body || {});\n const refreshTokenValue = AuthControllerUtils.extractRefreshTokenFromCookie(req);\n if (!refreshTokenValue) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_REFRESH_TOKEN_REQUIRED,\n });\n }\n let tokens;\n try {\n tokens = await this.tokenIssuer.refreshAccessToken(refreshTokenValue);\n } catch (refreshError) {\n // A-9: the issuer performs the family-wide revoke but does NOT audit (TRAP 13); it TAGS a reuse\n // rejection with the theft signal. Emit `USER_REFRESH_TOKEN_REUSE_DETECTED` for the theft case ONLY\n // (a routine expired/revoked/invalid refresh carries no signal ⇒ no event — deliberate anti-flood).\n // Fire-and-forget, OFF the response path; F4 per-org routing to the victim's VERIFIED member orgs.\n // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — credential-theft detection + response.\n const reuseSignal = extractRefreshTokenReuseSignal(refreshError);\n if (reuseSignal) {\n void (async () => {\n const routingOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, reuseSignal.userId);\n await this.auditLogsService.logUserRefreshTokenReuseDetected({\n userId: reuseSignal.userId,\n reusedJti: reuseSignal.reusedJti,\n sessionId: reuseSignal.sessionId,\n familyRevoked: reuseSignal.familyRevoked,\n ipAddress: getClientIpFromRequest(req),\n }, ec, routingOrgIds);\n })().catch(() => {});\n }\n throw refreshError;\n }\n\n // H5: Audit token refresh\n try {\n const decoded = await this.jwtService.verify(tokens.accessToken);\n if (typeof decoded === 'object' && decoded !== null) {\n const payload = decoded as Record<string, unknown>;\n const refreshUserId = typeof payload.userId === 'string' ? payload.userId : undefined;\n const sessionId = typeof payload.sessionId === 'string' ? payload.sessionId : 'unknown';\n if (refreshUserId) {\n // Fire-and-forget (token-refresh is HIGH frequency + latency-sensitive). Resolve the\n // user's VERIFIED ACTIVE member orgs (F4 routing) and emit inside an async IIFE kept OFF\n // the response critical path so a membership-read failure can never block the refresh.\n // `refreshUserId` is the verified refresh-token subject (server-resolved).\n void (async () => {\n const routingOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, refreshUserId);\n await this.auditLogsService.logUserTokenRefreshed({\n userId: refreshUserId,\n sessionId,\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n }, ec, routingOrgIds);\n })().catch(() => {});\n }\n }\n } catch { /* token decode failure — don't block the response */ }\n\n // Cookie-only: extract `refreshToken` from the issuer's typed\n // result so the wire body carries ONLY `{ accessToken, expiresIn }`.\n const { refreshToken: rotatedRefreshToken, ...wireBody } = tokens;\n this._jsonSuccessWithRefreshCookie(res, wireBody, rotatedRefreshToken);\n }\n\n // Get current authentication session state\n private async getSessionState(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const sessionId = req.params.sessionId as string | undefined;\n\n if (!sessionId) {\n return this.jsonError(res, 'Session ID is required');\n }\n\n const sessionState = await this.authService.getAuthenticationSessionState(ec, sessionId);\n\n if (!sessionState) {\n return this.jsonError(res, 'Session not found or expired');\n }\n\n // H2 fix: Strip sensitive fields from public endpoint to prevent enumeration.\n // Removed: email, userExists, userId (H2), remainingAttempts, lockedUntil (review fix #5).\n // Frontend uses error responses (customMessageReference, authResponse) for retry/lockout UI.\n const publicSessionState = {\n sessionId: sessionState.sessionId,\n state: sessionState.state,\n completedFactors: sessionState.completedFactors,\n currentFactor: sessionState.currentFactor,\n availableFirstFactorMethods: sessionState.availableFirstFactorMethods,\n availableSecondFactorMethods: sessionState.availableSecondFactorMethods,\n enrolledSecondFactorMethods: sessionState.enrolledSecondFactorMethods,\n usableSecondFactorMethods: sessionState.usableSecondFactorMethods,\n requiresMFA: sessionState.requiresMFA,\n requireStrongMFA: sessionState.requireStrongMFA,\n mfaMethodsRequired: sessionState.mfaMethodsRequired,\n expiresAt: sessionState.expiresAt,\n };\n\n this.jsonSuccess(res, publicSessionState);\n }\n\n // ═══════════════════════════════════════════════════════════════\n // OAuth2 Route Handlers (Step 5)\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * GET /auth/oauth2/authorize/:providerRef\n *\n * Initiates an OAuth2 authorization flow for an application-level social OAuth2 provider.\n * Returns the IdP authorization URL for the frontend to redirect to.\n * Enterprise OIDC/SAML entrypoints are handled by the dedicated\n * `enterpriseSSOAuthorize` / `appEnterpriseSSOAuthorize` routes below.\n */\n private async oauth2Authorize(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const providerRef = req.params.providerRef as string | undefined;\n\n if (!providerRef) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { message: 'providerRef parameter is required' },\n });\n }\n\n // G3 + P3: Determine scope context from email hint before resolving credentials.\n // Used for both provider restriction checks (G3) and social credential overrides (P3).\n const emailHint = req.query.email as string | undefined;\n let scopeContext: { scopeType: AuthScopeType; scopeId: string } | undefined;\n\n if (emailHint) {\n const emailDomain = emailHint.split('@')[1]?.toLowerCase();\n if (emailDomain) {\n const orgLookup = await this.domainToOrgLookup.findOrgByDomain(ec, emailDomain);\n if (orgLookup) {\n scopeContext = { scopeType: orgLookup.scopeType, scopeId: orgLookup.scopeId };\n\n // G3: Check org-level provider restrictions (UX optimization — hard enforcement in callback G3-M5)\n const { allowed, reason } = await this.oauth2Resolver.isProviderAllowed(\n ec, orgLookup.scopeType, orgLookup.scopeId, providerRef,\n );\n if (!allowed) {\n await this.auditLogsService.logOAuth2ProviderBlocked({\n email: emailHint,\n providerRef,\n scopeType: orgLookup.scopeType,\n organizationId: orgLookup.scopeType === AuthScopeType.ORGANIZATION\n ? orgLookup.scopeId\n : undefined,\n applicationId: orgLookup.scopeType === AuthScopeType.APPLICATION\n ? orgLookup.scopeId\n : undefined,\n reason: reason || 'Organization policy',\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { message: reason || 'This login provider is not allowed for your organization.' },\n });\n }\n }\n }\n }\n\n // Resolve connection config from catalog + app config + secrets + scope overrides (P3)\n const connection = await this.oauth2Resolver.resolveSocialConnection(\n providerRef,\n scopeContext ? { ec, ...scopeContext } : undefined,\n );\n\n // Validate the frontend originator early — fail now with a clear error instead of\n // silently storing undefined in the state token and getting a confusing error on callback.\n // resolveFrontendAppPublicUrl throws if the header is missing or the frontend service is unknown.\n const frontendUrl = this.resolveFrontendAppPublicUrl(req);\n const frontendServiceName = req.headers[WildoHeaderKeys.FRONTEND_SERVICE_NAME] as string;\n const returnUrl = typeof req.query.returnUrl === 'string' ? req.query.returnUrl : undefined;\n void frontendUrl; // validated and discarded — the URL is resolved again on callback from the state token\n if (returnUrl) {\n this.validateFrontendReturnUrl(returnUrl, frontendUrl);\n }\n\n // Build the authorization URL with PKCE + state token (includes frontendServiceName + scope in state)\n const { authorizationUrl } = await this.oauth2Service.buildAuthorizationUrl(connection, {\n frontendServiceName,\n scopeType: scopeContext?.scopeType,\n scopeId: scopeContext?.scopeId,\n returnUrl,\n });\n\n this.logDebug('OAuth2 authorize URL generated', {\n providerRef,\n connectionType: connection.connectionType,\n });\n\n this.jsonSuccess(res, { authorizationUrl });\n }\n\n /**\n * GET /auth/enterprise/authorize/:orgId/:connectionId\n *\n * Initiates an enterprise SSO OIDC flow for an organization's connection.\n * Uses the same OAuth2 engine — only the resolver path is different.\n * The callback reuses /auth/oauth2/callback/:providerRef — the state token\n * carries `connectionType: SsoConnectionType.ENTERPRISE`, organizationId,\n * and connectionId.\n *\n * Step 15: Enterprise SSO authorize route.\n */\n private async enterpriseSSOAuthorize(req: Request, res: Response): Promise<void> {\n const orgId = req.params.orgId as string | undefined;\n const connectionId = req.params.connectionId as string | undefined;\n\n if (!orgId || !connectionId) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { message: 'orgId and connectionId parameters are required' },\n });\n }\n\n // Resolve enterprise connection from org config\n const connection = await this.oauth2Resolver.resolveEnterpriseConnection(AuthScopeType.ORGANIZATION, orgId, connectionId);\n\n // Validate the frontend originator\n const frontendUrl = this.resolveFrontendAppPublicUrl(req);\n const frontendServiceName = req.headers[WildoHeaderKeys.FRONTEND_SERVICE_NAME] as string;\n const returnUrl = typeof req.query.returnUrl === 'string' ? req.query.returnUrl : undefined;\n void frontendUrl;\n if (returnUrl) {\n this.validateFrontendReturnUrl(returnUrl, frontendUrl);\n }\n\n // Build the authorization URL using the same OAuth2 engine\n const { authorizationUrl } = await this.oauth2Service.buildAuthorizationUrl(connection, {\n frontendServiceName,\n returnUrl,\n });\n\n this.logDebug('Enterprise SSO authorize URL generated', {\n orgId,\n connectionId,\n connectionType: connection.connectionType,\n providerRef: connection.providerRef,\n });\n\n this.jsonSuccess(res, { authorizationUrl });\n }\n\n /**\n * GET /auth/app-enterprise/authorize/:connectionId\n *\n * Application-scoped enterprise SSO authorize route.\n * Same flow as org-scoped enterpriseSSOAuthorize but resolves from APPLICATION scope.\n */\n private async appEnterpriseSSOAuthorize(req: Request, res: Response): Promise<void> {\n const connectionId = req.params.connectionId as string | undefined;\n\n if (!connectionId) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { message: 'connectionId parameter is required' },\n });\n }\n\n const appId = req.headers[WildoHeaderKeys.APPLICATION_ID] as string | undefined;\n if (!appId) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { message: 'Application ID header is required for app-enterprise SSO' },\n });\n }\n\n const connection = await this.oauth2Resolver.resolveEnterpriseConnection(AuthScopeType.APPLICATION, appId, connectionId);\n\n // Validate the frontend originator early so OAuth state always carries\n // a usable frontendServiceName for callback redirection.\n const frontendUrl = this.resolveFrontendAppPublicUrl(req);\n const frontendServiceName = req.headers[WildoHeaderKeys.FRONTEND_SERVICE_NAME] as string;\n const returnUrl = typeof req.query.returnUrl === 'string' ? req.query.returnUrl : undefined;\n void frontendUrl;\n if (returnUrl) {\n this.validateFrontendReturnUrl(returnUrl, frontendUrl);\n }\n const { authorizationUrl } = await this.oauth2Service.buildAuthorizationUrl(connection, {\n frontendServiceName,\n returnUrl,\n });\n\n this.logDebug('App-enterprise SSO authorize URL generated', {\n appId,\n connectionId,\n connectionType: connection.connectionType,\n providerRef: connection.providerRef,\n });\n\n this.jsonSuccess(res, { authorizationUrl });\n }\n\n /**\n * GET /auth/saml/login/:connectionId\n *\n * Initiate SP-initiated SAML SSO. Generates an AuthnRequest,\n * creates a state token, and redirects the browser to the IdP SSO URL.\n *\n * Rate limit: SC-38 — 10 req/min per IP.\n */\n private async handleSAMLLogin(req: Request, res: Response): Promise<void> {\n // PR 7c — SAML login migration. 10/min/IP, pre-auth, IP-keyed by\n // default. Per the SC-38 cap design, this is the cheapest SAML\n // amplification target (synthetic AuthnRequest generation + state-\n // token Redis write per call); the per-IP cap is the right defense\n // because no userId exists yet (login is INITIATED here, not\n // verified). Local `clientIp` extraction dropped — sole-consumed\n // by the rate-limit; `checkPolicy` re-derives via the same\n // `getClientIpFromRequest` helper. F-22 fail-fast preserved\n // (rate-limit before EC creation, body-parse-free endpoint).\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10 },\n 'auth:saml:login:by-ip',\n );\n\n const ec = await this._getPreAuthExecutionContext();\n const connectionId = req.params.connectionId as string;\n const returnUrl = (req.query.returnUrl as string) || '/';\n\n try {\n const { redirectUrl } = await this.samlAuthService.initiateLogin(ec, connectionId, returnUrl);\n res.redirect(302, redirectUrl);\n } catch (error) {\n if (isWildoBackendError(error)) {\n this.logger.warn('SAML login initiation failed', { connectionId });\n } else {\n this.logger.error('SAML login initiation failed with unexpected error', {\n connectionId,\n ...projectCaughtErrorLogFields(error),\n });\n }\n const frontendUrl = this._resolveSAMLRedirectUrl();\n return this.redirectToFrontendWithError(res, AuthRedirectErrorCode.SAML_LOGIN_FAILED, 'Authentication failed. Please try again.', frontendUrl);\n }\n }\n\n /**\n * POST /auth/saml/acs\n *\n * Assertion Consumer Service — processes the SAML Response from the IdP.\n * Route-specific body parser: `express.urlencoded({ extended: false, limit: '2mb' })` (SC-30).\n *\n * Rate limit: SC-39 — 20 req/min per IP (higher because IdPs may retry).\n * E16: POST-only (enforced by route registration).\n * E19: RelayState size check — accept up to 1024 bytes, warn if >80.\n */\n private async handleSAMLACS(req: Request, res: Response): Promise<void> {\n // PR 7c — SAML ACS migration. 20/min/IP, pre-auth, IP-keyed by\n // default. Higher cap than `handleSAMLLogin` per SC-39 because\n // IdPs may legitimately retry (network timeout / Assertion not\n // yet ready). `clientIp` extraction PRESERVED — threaded into\n // `samlAuthService.handleACS` via `clientContext` for the\n // post-auth audit trail (single-source-of-truth pattern: same\n // helper `checkPolicy` re-derives for the bucket key, so bucket\n // and audit row always agree on the IP). F-22 fail-fast: rate-\n // limit precedes the bounded body extraction (only `req.body?.\n // SAMLResponse` access, no parse) AND precedes EC creation.\n const clientIp = getClientIpFromRequest(req);\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 20 },\n 'auth:saml:acs:by-ip',\n );\n\n const samlResponse: string | undefined = req.body?.SAMLResponse;\n const relayState: string | undefined = req.body?.RelayState;\n\n if (!samlResponse) {\n const frontendUrl = this._resolveSAMLRedirectUrl();\n return this.redirectToFrontendWithError(res, AuthRedirectErrorCode.SAML_AUTH_FAILED, 'Authentication failed.', frontendUrl);\n }\n\n if (relayState && relayState.length > 1024) {\n this.logger.warn('SAML RelayState exceeds 1024 bytes, rejecting', { length: relayState.length });\n const frontendUrl = this._resolveSAMLRedirectUrl();\n return this.redirectToFrontendWithError(res, AuthRedirectErrorCode.SAML_AUTH_FAILED, 'Authentication failed.', frontendUrl);\n }\n if (relayState && relayState.length > 80) {\n this.logger.warn('SAML RelayState exceeds 80-byte spec limit (accepted)', { length: relayState.length });\n }\n\n const ec = await this._getPreAuthExecutionContext();\n\n try {\n const clientContext = {\n ipAddress: clientIp,\n userAgent: (req.headers[WildoHeaderKeys.USER_AGENT] as string) || 'unknown',\n };\n const result = await this.samlAuthService.handleACS(ec, samlResponse, relayState, clientContext);\n res.redirect(302, result.redirectUrl);\n } catch (error) {\n if (isWildoBackendError(error)) {\n this.logger.warn('SAML ACS processing failed', {\n errorRef: (error as any).customMessageReference || 'unknown',\n });\n } else {\n this.logger.error('SAML ACS failed with unexpected error', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n const frontendUrl = this._resolveSAMLRedirectUrl();\n return this.redirectToFrontendWithError(res, AuthRedirectErrorCode.SAML_AUTH_FAILED, 'Authentication failed. Please try again.', frontendUrl);\n }\n }\n\n /**\n * GET /auth/saml/metadata/:scopeType/:scopeId\n *\n * Public endpoint — returns SP metadata XML for IdP admins to configure their IdP.\n * No auth middleware required (D16).\n * Content-Type: application/samlmetadata+xml\n *\n * Rate limit: 10 req/min per IP (matches the SAML login / SLO GET convention). This\n * is an unauthenticated GET that runs samlify metadata generation + a system read of\n * the SSO config on every hit — cap it so it can't be used as an amplification vector.\n */\n private async handleSAMLMetadata(req: Request, res: Response): Promise<void> {\n // 10/min/IP. `checkPolicy` throws `ErrorType.RATE_LIMIT` when exceeded (the\n // asyncHandler turns it into a 429), so nothing below runs for a tripped caller.\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10 },\n 'auth:saml:metadata:by-ip',\n );\n\n const scopeTypeParam = req.params.scopeType;\n if (\n scopeTypeParam !== AuthScopeType.ORGANIZATION\n && scopeTypeParam !== AuthScopeType.APPLICATION\n ) {\n res.status(400).json({ error: 'Invalid SAML metadata scope type' });\n return;\n }\n const scopeType = scopeTypeParam === AuthScopeType.ORGANIZATION\n ? AuthScopeType.ORGANIZATION\n : AuthScopeType.APPLICATION;\n const scopeId = req.params.scopeId as string;\n\n // Gate SLO-endpoint advertising on the tenant's `sessionSettings.singleLogoutEnabled`\n // so a disabled-SLO tenant's SP metadata omits the SingleLogoutService endpoints\n // (well-behaved IdPs then never send a LogoutRequest we would only no-op).\n // READ-ONLY (`readSSOConfigIfExists`, not `loadSSOConfig`): this is a PUBLIC,\n // rate-limited endpoint, so it must never attempt the read-then-CREATE that would\n // fire an ACL-rejected create + error-log per arbitrary caller-supplied scope. Absent\n // config ⇒ undefined ⇒ default (advertise).\n const ssoConfig = await this.orgConfigService.readSSOConfigIfExists(scopeType, scopeId);\n const singleLogoutEnabled =\n ssoConfig?.sessionSettings?.singleLogoutEnabled ?? true;\n\n const metadataXml = this.samlMetadataService.generateSPMetadata(scopeType, scopeId, { singleLogoutEnabled });\n res.set(WildoHeaderKeys.CONTENT_TYPE, 'application/samlmetadata+xml');\n res.status(200).send(metadataXml);\n }\n\n /**\n * GET /auth/saml/slo\n *\n * Handles two distinct cases via query params:\n * - `SAMLRequest` present → IdP-initiated SLO (HTTP-Redirect binding)\n * - `SAMLResponse` present → IdP's response to our SP-initiated SLO\n *\n * Rate limit: SC-40 — 10 req/min per IP.\n */\n private async handleSAMLSLO_GET(req: Request, res: Response): Promise<void> {\n // PR 7c — SAML SLO (HTTP-Redirect binding) migration. 10/min/IP\n // per SC-40. CRITICAL: scope key DELIBERATELY shared with\n // `handleSAMLSLO_POST` (`auth:saml:slo:by-ip`, NOT `:slo-get:by-ip`).\n // Pre-PR-7c the same Redis prefix `SAML_SLO_IP` was reused\n // verbatim by both methods — the two SLO methods are functionally\n // ONE logical SLO endpoint with two SAML transport bindings\n // (HTTP-Redirect via GET vs HTTP-POST per the SAML SLO spec).\n // Splitting them into separate scope keys would let an IdP\n // alternate bindings to extract 2x the cap — an unintended\n // weakening of SC-40. The K-3 escape-hatch (custom controller\n // surface owning its own scope-key composition) is the framework-\n // blessed way to express \"two methods, one bucket\" — single\n // string-literal slot keeps the invariant inspectable. Local\n // `clientIp` extraction dropped (sole-consumed; see SAMLLogin).\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10 },\n 'auth:saml:slo:by-ip',\n );\n\n const samlRequest: string | undefined = req.query.SAMLRequest as string | undefined;\n const samlResponse: string | undefined = req.query.SAMLResponse as string | undefined;\n const relayState: string | undefined = req.query.RelayState as string | undefined;\n\n const ec = await this._getPreAuthExecutionContext();\n\n if (samlRequest) {\n try {\n // HTTP-Redirect SLO carries a DETACHED query-string signature. Rebuild the\n // signed octet string from the RAW request query (decoded `req.query` values\n // would not byte-match what the IdP signed). `undefined` for an unsigned\n // request → samlify fails closed (`wantLogoutRequestSigned`).\n const questionMarkIdx = req.originalUrl.indexOf('?');\n const rawQuery = questionMarkIdx >= 0 ? req.originalUrl.slice(questionMarkIdx + 1) : '';\n const redirectSignature = AuthControllerUtils.buildRedirectSLOSignatureContext(rawQuery);\n const result = await this.samlAuthService.handleIdPInitiatedSLO(ec, 'redirect', samlRequest, relayState, redirectSignature);\n res.redirect(302, result.logoutResponseUrl);\n } catch (error) {\n this.logger.warn('SAML SLO (IdP-initiated GET) failed', {\n errorRef: isWildoBackendError(error) ? (error as any).customMessageReference : 'unknown',\n ...projectCaughtErrorLogFields(error),\n });\n const frontendUrl = this._resolveSAMLRedirectUrl();\n return this.redirectToFrontendWithError(res, AuthRedirectErrorCode.SAML_SLO_FAILED, 'Logout failed.', frontendUrl);\n }\n } else if (samlResponse) {\n try {\n await this.samlAuthService.handleSLOResponse(ec, 'redirect', samlResponse);\n } catch (error) {\n this.logger.warn('SAML SLO LogoutResponse processing failed (GET)', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n const frontendUrl = this._resolveSAMLRedirectUrl() || '/';\n res.redirect(302, `${frontendUrl}/auth/login?slo=success`);\n } else {\n res.status(400).json({ error: 'Missing SAMLRequest or SAMLResponse parameter' });\n }\n }\n\n /**\n * POST /auth/saml/slo\n *\n * IdP-initiated SLO via HTTP-POST binding.\n * Route-specific body parser: `express.urlencoded({ extended: false, limit: '2mb' })`.\n *\n * Rate limit: SC-40 — 10 req/min per IP.\n */\n private async handleSAMLSLO_POST(req: Request, res: Response): Promise<void> {\n // PR 7c — SAML SLO (HTTP-POST binding) migration. SAME 10/min/IP\n // bucket as `handleSAMLSLO_GET` — see that method's comment for\n // the shared-scope-key rationale (`auth:saml:slo:by-ip` is\n // intentionally identical so the SLO-spec dual-binding pair\n // shares one cap).\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10 },\n 'auth:saml:slo:by-ip',\n );\n\n const samlRequest: string | undefined = req.body?.SAMLRequest;\n const samlResponse: string | undefined = req.body?.SAMLResponse;\n const relayState: string | undefined = req.body?.RelayState;\n\n const ec = await this._getPreAuthExecutionContext();\n\n if (samlRequest) {\n try {\n const result = await this.samlAuthService.handleIdPInitiatedSLO(ec, 'post', samlRequest, relayState);\n res.redirect(302, result.logoutResponseUrl);\n } catch (error) {\n this.logger.warn('SAML SLO (IdP-initiated POST) failed', {\n errorRef: isWildoBackendError(error) ? (error as any).customMessageReference : 'unknown',\n ...projectCaughtErrorLogFields(error),\n });\n const frontendUrl = this._resolveSAMLRedirectUrl();\n return this.redirectToFrontendWithError(res, AuthRedirectErrorCode.SAML_SLO_FAILED, 'Logout failed.', frontendUrl);\n }\n } else if (samlResponse) {\n try {\n await this.samlAuthService.handleSLOResponse(ec, 'post', samlResponse);\n } catch (error) {\n this.logger.warn('SAML SLO LogoutResponse processing failed (POST)', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n const frontendUrl = this._resolveSAMLRedirectUrl() || '/';\n res.redirect(302, `${frontendUrl}/auth/login?slo=success`);\n } else {\n res.status(400).json({ error: 'Missing SAMLRequest or SAMLResponse parameter' });\n }\n }\n\n /**\n * POST /auth/saml/logout — SP-initiated SLO kickoff (SC-36/SC-37).\n *\n * The app asks us to log the caller out of their SAML session. We identify the caller from the SIGNED\n * `__wildo_refresh` cookie — robust (works even if the access token has expired, mirroring `/auth/logout`)\n * and unforgeable (the refresh token is server-signed, so the client cannot claim another user's id).\n * `initiateSPLogout` revokes the caller's Wildo session (the user-wide token-invalidation fence, via\n * `_terminateSAMLSessionByUser`) and, when the IdP advertises SLO, returns a redirect to the IdP's SLO\n * endpoint — the IdP then round-trips a LogoutResponse to the inbound `/auth/saml/slo`. The refresh cookie\n * is ALWAYS cleared, so the client is logged out even when the IdP round-trip is unavailable.\n *\n * Response: 302 to the IdP SLO URL when the IdP supports it; 204 when the logout completed locally with no\n * IdP redirect (`singleLogoutEnabled=false`, the connection has no `sloUrl`, or the connection was not\n * found). Rate limit: 10/min per IP (mirrors the inbound SLO cap).\n */\n private async handleSAMLSPLogout(req: Request, res: Response): Promise<void> {\n await this.rateLimitService.checkPolicy(req, res, { requestsPerMinute: 10 }, 'auth:saml:sp-logout:by-ip');\n\n const { connectionId } = SAMLSPLogoutRequestSchema.parse(req.body || {});\n const ec = await this._getPreAuthExecutionContext();\n\n // Identify the caller from the SIGNED refresh cookie — trusted, and the client cannot forge the userId.\n const refreshToken = AuthControllerUtils.extractRefreshTokenFromCookie(req);\n let userId: string | undefined;\n if (refreshToken) {\n try {\n const decoded = await this.jwtService.verifyRefreshToken(refreshToken);\n if (typeof decoded === 'object' && decoded !== null) {\n const payload = decoded as Record<string, unknown>;\n userId = typeof payload.userId === 'string' ? payload.userId : undefined;\n }\n } catch {\n // Invalid/expired refresh token — treated as unauthenticated below.\n }\n }\n if (!userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_REFRESH_TOKEN_REQUIRED,\n });\n }\n\n let result: { redirectUrl: string } | null = null;\n try {\n result = await this.samlAuthService.initiateSPLogout(ec, userId, connectionId);\n } catch (error) {\n // A failure building the IdP redirect must not strand the caller logged-in on the client — we still\n // clear the cookie below. (initiateSPLogout revokes the session before it can reach a redirect error.)\n this.logger.warn('SAML SP-initiated SLO failed to build the IdP redirect', { ...projectCaughtErrorLogFields(error) });\n }\n\n // Always clear the refresh cookie — the caller is logging out.\n this._clearRefreshCookie(res);\n\n if (result?.redirectUrl) {\n res.redirect(302, result.redirectUrl);\n } else {\n res.status(204).send();\n }\n }\n\n /**\n * Resolve a frontend URL for SAML redirects.\n * Uses the user-type → frontend-service reverse lookup from `frontendServices.usersManagement`.\n * When `userType` is provided (post-identification), resolves the frontend service that serves that user type.\n * Falls back to the config's default frontend service (first with any `isDefault` entry).\n */\n private _resolveSAMLRedirectUrl(userType?: string): string | undefined {\n try {\n const frontendServiceName = userType\n ? this.appConfigService.resolveFrontendServiceNameFromUserType(userType)\n : this.appConfigService.resolveDefaultFrontendServiceName();\n if (!frontendServiceName) return undefined;\n return this.resolveFrontendAppPublicUrlFromFrontendServiceName(frontendServiceName);\n } catch {\n return undefined;\n }\n }\n\n /**\n * GET+POST /auth/oauth2/callback/:providerRef\n *\n * Handles the IdP redirect after user authentication.\n * Accepts both GET and POST — TRAP 5: Apple uses response_mode=form_post.\n *\n * Flow:\n * 1. Extract code/state from query (GET) or body (POST)\n * 2. handleCallback() — validate state, exchange code, extract profile\n * 3. provisionOrLinkUser() — find/create user, create identity link\n * 4. Issue JWT tokens via AuthTokenIssuer.issueTokensForUser() (TRAP 12)\n * 5. Create AUTH_CODE_EXCHANGE consumable token containing JWT tokens\n * 6. Redirect to frontend /auth/callback?code={consumableTokenCode}\n *\n * Browser-only — the framework targets web stacks exclusively, so the\n * final redirect URL ({frontendUrl}/auth/callback?code=xxx) is always a\n * standard HTTPS navigation. No Universal Link / App Link / custom URL\n * scheme variants are needed.\n *\n * TRAP 13: Audit logging for OAuth2 logins happens HERE (not in the engine).\n */\n private async oauth2Callback(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n // M10 fix: Check for IdP error parameters FIRST, before extracting code/state.\n // If the IdP sends both error and code/state (some IdPs do this), we must handle\n // the error rather than consuming the state token and attempting a code exchange\n // that will fail with an opaque error.\n const idpError = (req.query.error as string) || req.body?.error;\n if (idpError) {\n const errorDescription = (req.query.error_description as string) || req.body?.error_description || 'Authentication denied by identity provider';\n\n // Try to peek at the state token (without consuming it) to resolve the frontendUrl\n // for a user-friendly redirect instead of a raw JSON 400 response.\n // The state token expires naturally — not consuming it is safe.\n let errorRedirectUrl: string | undefined;\n let errorReturnUrl: string | undefined;\n const stateValue = (req.query.state as string) || req.body?.state;\n if (stateValue) {\n try {\n const stateToken = await this.consumableTokenService.validateToken(stateValue);\n const stateMetadata = stateToken.metadata as Record<string, unknown> | undefined;\n const frontendServiceName = stateMetadata?.frontendServiceName as string | undefined;\n errorReturnUrl = typeof stateMetadata?.returnUrl === 'string'\n ? stateMetadata.returnUrl\n : undefined;\n if (frontendServiceName) {\n errorRedirectUrl = this.resolveFrontendAppPublicUrlFromFrontendServiceName(frontendServiceName);\n }\n } catch {\n // State token invalid/expired — fall through to JSON fallback\n }\n }\n\n return this.redirectToFrontendWithError(res, idpError, errorDescription, errorRedirectUrl, errorReturnUrl);\n }\n\n // 1. Extract code and state from query (GET) or body (POST)\n const code = (req.query.code as string) || req.body?.code;\n const state = (req.query.state as string) || req.body?.state;\n\n if (!code || !state) {\n return this.redirectToFrontendWithError(res, AuthRedirectErrorCode.MISSING_PARAMS, 'Missing code or state parameter');\n }\n\n // Hoisted so the catch block can use it for error redirects\n let frontendUrl: string | undefined;\n let callbackReturnUrl: string | undefined;\n\n try {\n // 2. Handle callback — validate state, exchange code, extract profile\n const callbackParams = {\n code,\n state,\n body: req.method === 'POST' ? req.body : undefined, // Apple form_post: body contains `user` JSON\n };\n const { normalizedProfile, connection, stateMetadata } = await this.oauth2Service.handleCallback(callbackParams);\n\n // Resolve the frontend URL from the state token's frontendServiceName field.\n // This is the frontend that initiated the OAuth2 flow — redirects must go back there.\n frontendUrl = stateMetadata.frontendServiceName\n ? this.resolveFrontendAppPublicUrlFromFrontendServiceName(stateMetadata.frontendServiceName)\n : undefined;\n callbackReturnUrl = stateMetadata.returnUrl;\n\n // 3. Provision or link user. Pass the initiating frontend service so the\n // provisioner can assign the base user type (mirroring password registration)\n // when neither an org-type grant nor a prior assignment populated `userTypes` —\n // otherwise the session-issuance gate below rejects the empty-userType user.\n const frontendServiceName = stateMetadata.frontendServiceName;\n const { userId, isNewUser } = await this.oauth2Service.provisionOrLinkUser(normalizedProfile, connection, frontendServiceName);\n\n if (frontendServiceName) {\n const authenticatedUser = await this.userLookup.findUserById(ec, userId);\n const authenticatedUserType = authenticatedUser?.userTypes?.[0];\n const userManagement = authenticatedUserType\n ? this.appConfigService.getFrontendServiceUserManagementEntry(frontendServiceName, authenticatedUserType)\n : null;\n\n if (!authenticatedUserType || !userManagement?.auth) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,\n context: {\n message:\n `Authentication is disabled for frontend service \"${frontendServiceName}\"` +\n (authenticatedUserType ? ` and user type \"${authenticatedUserType}\"` : ''),\n frontendServiceName,\n activeUserType: authenticatedUserType,\n },\n });\n }\n }\n\n const tokens = await this.tokenIssuer.issueTokensForUser(userId, undefined, {\n lastAuthenticatedAt: Math.floor(Date.now() / 1000),\n });\n\n // 5. Create AUTH_CODE_EXCHANGE consumable token with JWT tokens as metadata\n const exchangeToken = await this.consumableTokenService.createToken({\n tokenType: CoreConsumableTokenTypes.AUTH_CODE_EXCHANGE,\n consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n expiresIn: { value: 5, unit: DurationUnit.MINUTES },\n userId: userId,\n resourceIdentifier: CoreResourceType.USERS,\n metadata: {\n accessToken: tokens.accessToken,\n refreshToken: tokens.refreshToken,\n expiresIn: tokens.expiresIn,\n providerRef: connection.providerRef,\n isNewUser: isNewUser,\n },\n });\n\n // TRAP 13: Audit log OAuth2 login (audit stays in the route handler, not engine)\n const deviceInfo = {\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n };\n\n await this.auditLogsService.logUserSSOLogin({\n userId: userId,\n email: normalizedProfile.email,\n providerRef: connection.providerRef,\n connectionType: connection.connectionType,\n authSource: AuthSource.OIDC,\n scopeType: connection.connectionType === SsoConnectionType.ENTERPRISE\n ? connection.scope?.scopeType\n : undefined,\n organizationId: getOrganizationIdFromEnterpriseScope(connection.scope),\n applicationId: getApplicationIdFromEnterpriseScope(connection.scope),\n ipAddress: deviceInfo.ipAddress,\n userAgent: deviceInfo.userAgent,\n sessionId: `oauth2:${connection.providerRef}:${userId}`,\n }, await this.authEcFactory.createForAuditRoutingOrFallback(\n ec,\n getOrganizationIdFromEnterpriseScope(connection.scope),\n userId,\n ));\n\n this.logDebug('OAuth2 callback processed successfully', {\n providerRef: connection.providerRef,\n userId,\n isNewUser,\n });\n\n // 6. Redirect to frontend with the one-time exchange code (Decision 7)\n this.redirectToFrontendWithCode(res, exchangeToken.token, frontendUrl, stateMetadata.returnUrl);\n\n } catch (error) {\n // Redirect to frontend with error instead of returning JSON.\n // frontendUrl may be set if handleCallback succeeded but a later step failed.\n // If handleCallback itself failed, frontendUrl is undefined → JSON fallback.\n //\n // Observability: WildoBackendErrors are structured PLAIN OBJECTS, not `Error`\n // instances (see `isWildoBackendError`), so `error instanceof Error` is false for\n // them. Reading `error.message` therefore silently dropped the real\n // `customMessageReference` + `context.message`, collapsing every OIDC/SSO callback\n // abort (token-exchange, profile-extraction, provisioning) into a generic string in\n // the log. Log the FULL structured detail at WARN level (matching the SAML ACS\n // failure path above) so a callback abort is diagnosable end-to-end. The user-facing\n // redirect keeps a STABLE generic reason — structured detail (raw `customMessageReference`\n // enum names, internal service/config strings) belongs in the server log, not the\n // browser URL. Same posture as the SAML redirect sibling.\n this.logger.warn('OAuth2 callback failed', {\n error: isWildoBackendError(error)\n ? error.context?.message ?? error.customMessageReference\n : error instanceof Error\n ? error.message\n : String(error),\n ...(isWildoBackendError(error)\n ? {\n customMessageReference: error.customMessageReference,\n errorType: error.type,\n statusCode: error.statusCode,\n context: error.context,\n }\n : { stack: error instanceof Error ? error.stack : undefined }),\n });\n return this.redirectToFrontendWithError(\n res,\n AuthRedirectErrorCode.OAUTH_FAILED,\n 'Authentication failed. Please try again.',\n frontendUrl,\n callbackReturnUrl,\n );\n }\n }\n\n /**\n * POST /auth/token/exchange\n * Body: { code: string }\n * Response: { accessToken, expiresIn, returnPath?, sourceFrontendServiceName?, targetServiceKey? }\n * + `Set-Cookie: __wildo_refresh=<rotated>` header.\n *\n * The frontend calls this after receiving the one-time code from\n * either the OAuth2 callback redirect or a cross-frontend handoff.\n * Validates and consumes the AUTH_CODE_EXCHANGE consumable token,\n * returns the access token in the body and the rotated refresh\n * token in the `__wildo_refresh` cookie.\n *\n * Decision 7: Tokens never appear in URL — only a one-time code.\n *\n * Auth-hardening A-Step 6 (2026-04-13): the `refreshToken` field is\n * NO LONGER in the wire body — `TokenExchangeResponseSchema` is a\n * strict-object that would reject the key. The refresh token still\n * lives on `metadata.refreshToken` (issuer-side consumable-token\n * store), and the controller routes it to the cookie. See the\n * `_jsonSuccessWithRefreshCookie` JSDoc for the cookie-emission\n * contract.\n */\n private async tokenExchange(req: Request, res: Response): Promise<void> {\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 60 },\n 'auth:token-exchange:by-ip',\n );\n\n const { code } = TokenExchangeRequestSchema.parse(req.body || {});\n\n // Validate target binding BEFORE the destructive consume. `consumeToken()`\n // remains the atomic replay barrier, but a request from the wrong frontend\n // must not burn the user's one-time handoff code.\n let validatedToken;\n try {\n validatedToken = await this.consumableTokenService.validateToken(code, [CoreConsumableTokenTypes.AUTH_CODE_EXCHANGE]);\n } catch (cause: unknown) {\n const customMessageReference =\n (cause as { customMessageReference?: unknown } | undefined)?.customMessageReference;\n if (\n (isWildoBackendError(cause) &&\n cause.customMessageReference === ErrorCustomMessageReference.CONSUMABLE_TOKEN_TYPE_MISMATCH) ||\n customMessageReference === ErrorCustomMessageReference.CONSUMABLE_TOKEN_TYPE_MISMATCH\n ) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n });\n }\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n });\n }\n this._validateTokenExchangeTargetBinding(req, validatedToken.metadata as Record<string, unknown>);\n\n // Consume the token atomically (prevents race conditions vs separate validate+consume)\n let consumedToken;\n try {\n consumedToken = await this.consumableTokenService.consumeToken(code);\n } catch {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n });\n }\n\n // Defense-in-depth: verify the token type is AUTH_CODE_EXCHANGE (same pattern as Step 4 OAUTH2_STATE check)\n if (consumedToken.tokenType !== CoreConsumableTokenTypes.AUTH_CODE_EXCHANGE) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n });\n }\n\n const metadata = consumedToken.metadata as Record<string, unknown>;\n\n if (consumedToken.userId) {\n await this.handleAnonymousTranspositionForTokenExchange(req, res, consumedToken.userId);\n }\n\n // Surface the cross-frontend-handoff metadata fields (`returnPath`,\n // `sourceFrontendServiceName`, `targetServiceKey`) when present. They are\n // populated only by the cross-frontend-handoff issuer (Step 2 / Step 5);\n // OAuth2-callback codes do not carry them, so the receiving frontend can\n // detect \"this came from a handoff\" by simply checking\n // `typeof returnPath === 'string'`. The response shape is pinned by\n // `TokenExchangeResponseSchema` (saas-models, public-runtime-safe), with\n // these three fields all `.optional()` precisely to preserve OAuth2-callback\n // backward compatibility — adding them as required would break every\n // existing OAuth2 receiver. We use `omit-when-absent` (NOT explicit `null`)\n // to mirror the metadata-write convention in `crossFrontendHandoff()` and\n // to keep `strictObject` consumers happy.\n //\n // Defense-in-depth: pipe the response object through\n // `TokenExchangeResponseSchema.parse()` BEFORE shipping. Three reasons:\n // 1. Locks the wire shape — a future regression that adds a stray\n // metadata field cannot accidentally leak into the response (strict\n // object rejects unknown keys).\n // 2. Re-runs the `RETURN_PATH_REFINES` guard set on `returnPath` so a\n // hand-tampered consumable-token row in the store cannot smuggle an\n // open-redirect / path-traversal payload past the issuer schema by\n // bypassing the issuance code path entirely.\n // 3. Ensures `tokenExchange()` callers (Auth_OneOffSession in\n // cross-frontend-handoff mode, AuthSessionContext.handleAuthCodeExchange,\n // docs-site `beginExchange`) and the controller share ONE source of\n // truth — the schema is no longer documentation-only.\n // Auth-hardening A-Step 6 (2026-04-13): `refreshToken` is intentionally\n // OMITTED from the wire response (`TokenExchangeResponseSchema` no longer\n // declares it — strict-object would reject it as an unknown key). The\n // refresh token still lives on `metadata.refreshToken` (issuer-side\n // consumable-token store carries it), but the controller routes it to\n // `Set-Cookie` via the wrapper's third argument instead of the body.\n const responseDraft: Record<string, unknown> = {\n accessToken: metadata.accessToken,\n expiresIn: metadata.expiresIn,\n };\n if (typeof metadata.returnPath === 'string') {\n responseDraft.returnPath = metadata.returnPath;\n }\n if (typeof metadata.sourceFrontendServiceName === 'string') {\n responseDraft.sourceFrontendServiceName = metadata.sourceFrontendServiceName;\n }\n if (typeof metadata.targetServiceKey === 'string') {\n responseDraft.targetServiceKey = metadata.targetServiceKey;\n }\n const response = TokenExchangeResponseSchema.parse(responseDraft);\n const refreshTokenForCookie = typeof metadata.refreshToken === 'string'\n ? metadata.refreshToken\n : undefined;\n this._jsonSuccessWithRefreshCookie(res, response, refreshTokenForCookie);\n }\n\n /**\n * POST /auth/cross-frontend-handoff (cross-app-jwt-propagation Step 2).\n *\n * Issues a one-time AUTH_CODE_EXCHANGE consumable token bound to a target\n * frontend service so the user can transfer their authenticated session to\n * a sibling frontend (e.g. app → docs) WITHOUT re-authenticating and WITHOUT\n * the source frontend ever seeing the target frontend's URL space directly\n * (defense-in-depth: the target's `/auth/exchange` page consumes the code via\n * the existing `tokenExchange()` flow, so all the JWT validation,\n * anonymous-transposition, and audit hooks remain unchanged).\n *\n * Bearer-only — caller MUST send `Authorization: Bearer <accessToken>` from the\n * source frontend's session. CORS auto-allows every declared frontendService\n * via `deriveCorsOrigins()`, so callers do NOT need `credentials: 'include'`\n * (cookies are out of scope for Step 2 — auth-hardening Slice A handles cookies).\n *\n * Failure modes (HTTP 400, stable codes in `error.details.code` so the\n * docs-site `docsAuthClient` can branch on them):\n * - `UNKNOWN_TARGET_FRONTEND` — `targetServiceKey` is not declared.\n * - `TARGET_FRONTEND_HOST_NOT_CONFIGURED` — declared but no\n * `runtime.endPoints[targetServiceKey].publicUrl` for the current env\n * (fail-closed; we never auto-derive a guessed host).\n *\n * Audit: emits `USER_CROSS_FRONTEND_HANDOFF_ISSUED` with a SHA-256 hash of the\n * validated `returnPath` (NEVER the raw path — deep links can carry org IDs,\n * draft IDs, or one-off tokens that must not appear in audit logs).\n */\n private async crossFrontendHandoff(req: Request, res: Response): Promise<void> {\n const preAuthEc = await this._getPreAuthExecutionContext();\n const ipAddress = getClientIpFromRequest(req);\n const userAgent = (req.headers[WildoHeaderKeys.USER_AGENT] as string | undefined) || 'unknown';\n\n // Authenticate first (bearer-only). Must come BEFORE rate-limit so the\n // rate-limit key can be scoped to (userId, sourceFrontend) — keying on IP\n // alone would let a shared-NAT client get throttled by an unrelated user.\n const caller = await this.authJwtGuard.extractAuthenticatedUser(preAuthEc, req);\n\n const sourceFrontendServiceName = req.headers[WildoHeaderKeys.FRONTEND_SERVICE_NAME] as string | undefined;\n // AUTH-10 cross-validation: reject browser callers whose `X-Frontend-Service-Name`\n // disagrees with the browser-enforced `Origin` header. Without this, a logged-in\n // user could spoof the source-frontend header to (a) poison the audit row's\n // `sourceFrontendServiceName` (forensic correlation broken) and (b) multiply their\n // rate-limit budget by N declared frontends (each `<userId>:<sourceFrontend>` bucket\n // is independent). No-op when the header is absent (server-to-server callers\n // preserve existing behaviour).\n this._validateFrontendAppOrigin(req, sourceFrontendServiceName);\n\n // PR 7b — cross-frontend handoff migration (account lifecycle wave).\n // 30 issuances / 60 s per (user, source-frontend). Matches docs-chat\n // contract C-7. Composite identifier `${userId}:${sourceFrontend}`\n // is passed as `clientIdOverride` so the bucket reflects BOTH the\n // authenticated user AND the source frontend dimension — keying on\n // userId alone would merge per-frontend budgets (a docs-app abuse\n // path would consume the app-shell's budget); keying on IP would\n // throttle a shared-NAT user pool by an unrelated user's burst.\n // Composite-clientId is the framework-blessed pattern for\n // multi-dimensional buckets (same shape PR 5 used for SCIM\n // per-token, generalized to N dimensions joined by `:`).\n //\n // Scope-key uses the F-15 `:by-user-source` suffix to reserve the\n // namespace slot for any future per-IP companion (e.g. a global\n // per-IP cap on cross-frontend handoffs would slot in as\n // `auth:cross-frontend-handoff:by-ip` without prefix collision).\n //\n // Rate-limit STAYS AFTER `extractAuthenticatedUser` — neither F-18\n // (rate-limit before JWT extract) NOR F-22 (rate-limit before EC\n // creation) apply here because the bucket key REQUIRES `userId`\n // from the verified JWT, and `extractAuthenticatedUser` REQUIRES\n // `preAuthEc`. The pre-bucket auth verify cost is bounded and\n // necessary; the alternative (bucket on IP, then bucket again on\n // user post-auth) doubles bookkeeping for no meaningful gain.\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 30 },\n 'auth:cross-frontend-handoff:by-user-source',\n undefined,\n `${caller.userId}:${sourceFrontendServiceName ?? 'unknown'}`,\n );\n\n const body = CrossFrontendHandoffRequestSchema.parse(req.body || {});\n\n // Resolve target service. Differentiate \"unknown\" vs \"host not configured\"\n // ourselves rather than collapsing into AuthControllerUtils.lookupFrontendPublicUrl()'s\n // single null — callers branch on the stable code, not the error message.\n const appConfig = this.appConfigService.config;\n const targetServiceConfig = appConfig?.frontendServices?.[body.targetServiceKey];\n if (!targetServiceConfig) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: {\n code: CrossFrontendHandoffErrorCode.UNKNOWN_TARGET_FRONTEND,\n message: `Unknown target frontend service \"${body.targetServiceKey}\". Declare it in wildo.saas.config.ts → services.`,\n targetServiceKey: body.targetServiceKey,\n },\n });\n }\n const targetFrontendType = (targetServiceConfig as { frontendType?: unknown }).frontendType;\n if (\n targetFrontendType !== AppFrontendType.SAAS_APP &&\n targetFrontendType !== AppFrontendType.TECH_DOC\n ) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: {\n code: CrossFrontendHandoffErrorCode.TARGET_FRONTEND_AUTH_EXCHANGE_UNSUPPORTED,\n message:\n `Target frontend \"${body.targetServiceKey}\" does not support AUTH_CODE_EXCHANGE handoff. ` +\n `Only SAAS_APP and TECH_DOC frontends mount /auth/exchange receivers.`,\n targetServiceKey: body.targetServiceKey,\n frontendType: typeof targetFrontendType === 'string' ? targetFrontendType : 'unknown',\n },\n });\n }\n\n // Browser handoff URL composition. Canonical URL seam is\n // runtime.endPoints[targetServiceKey].publicUrl. We deliberately do NOT use\n // infra.serviceHosts directly — that's the future authoring seam, propagated\n // to runtime.endPoints by the (deferred) apps-manager refactor. Reading\n // runtime.endPoints keeps URL composition consistent with CORS, OAuth2\n // callbacks, resolveFrontendAppPublicUrl, and every other consumer in the\n // system.\n const targetPublicUrl = AuthControllerUtils.lookupFrontendPublicUrl(appConfig, body.targetServiceKey);\n if (!targetPublicUrl) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: {\n code: CrossFrontendHandoffErrorCode.TARGET_FRONTEND_HOST_NOT_CONFIGURED,\n message:\n `Target frontend \"${body.targetServiceKey}\" is declared but runtime.endPoints.${body.targetServiceKey}.publicUrl ` +\n `is missing for the current environment. Configure it via the env-resolution chain (no auto-derived guess).`,\n targetServiceKey: body.targetServiceKey,\n },\n });\n }\n\n // Re-issue a fresh JWT pair so the target frontend receives its own session\n // (avoids leaking the source frontend's accessToken via the consumable token's\n // metadata, and ensures the target's session has a fresh `iat` / refresh JTI).\n const tokens = await this.tokenIssuer.issueTokensForUser(caller.userId, undefined, {\n lastAuthenticatedAt: Math.floor(Date.now() / 1000),\n });\n\n // 60 s TTL — caller is mid-redirect, NOT waiting on a third-party IdP. Shorter\n // than OAuth2's 5 min reduces the replay window. SINGLE_USE matches Step 4 OAUTH2_STATE.\n const exchangeToken = await this.consumableTokenService.createToken({\n tokenType: CoreConsumableTokenTypes.AUTH_CODE_EXCHANGE,\n consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n expiresIn: { value: 60, unit: DurationUnit.SECONDS },\n userId: caller.userId,\n resourceIdentifier: CoreResourceType.USERS,\n metadata: {\n accessToken: tokens.accessToken,\n refreshToken: tokens.refreshToken,\n expiresIn: tokens.expiresIn,\n // Omit-when-absent (NOT explicit null) — Zod `.optional()` produces\n // `undefined`, never `null`. Storing `null` would diverge from the rest\n // of the metadata convention and trip `strictObject` consumers in any\n // future schema-validated reader.\n ...(sourceFrontendServiceName !== undefined && { sourceFrontendServiceName }),\n targetServiceKey: body.targetServiceKey,\n // Step 5 — surface `returnPath` from the metadata so `tokenExchange()` can\n // round-trip it back to the receiving frontend. The URL query string carries\n // the same value (defense-in-depth duplication); the metadata is the\n // canonical source. Receiver consumers MUST still sanitize the value (the\n // issuance schema's refines do not survive a round-trip through Mongo\n // serialization in case of future schema drift). Empty-string default\n // ('/') is preserved verbatim — the schema rewrites missing/empty\n // `returnPath` to '/' before we get here, see\n // `CrossFrontendHandoff_ReturnPathSchema` in\n // `cross-frontend-handoff.shared.dto.schemas.ts`.\n returnPath: body.returnPath,\n },\n });\n\n // Compose the handoff URL: `<publicUrl>/auth/exchange?code=…&return=…`.\n // Receiver is the existing exchange page on every frontend — Step 2\n // introduced NO new client route there.\n const encodedCode = encodeURIComponent(exchangeToken.token);\n const encodedReturn = encodeURIComponent(body.returnPath);\n const handoffUrl = `${targetPublicUrl}/auth/exchange?code=${encodedCode}&return=${encodedReturn}`;\n\n // Audit issuance (helper SHA-256-hashes returnPath internally; never persists the raw path).\n try {\n // F4 per-org SIEM routing — route ONLY on the caller's VERIFIED ACTIVE member orgs.\n // `caller.userId` is the verified-JWT user id; the surrounding try/catch keeps a\n // membership-read failure from breaking handoff issuance.\n const routingOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, caller.userId);\n await this.auditLogsService.logUserCrossFrontendHandoffIssued({\n userId: caller.userId,\n sourceFrontendServiceName,\n targetServiceKey: body.targetServiceKey,\n returnPath: body.returnPath,\n consumableTokenId: exchangeToken._id,\n ipAddress,\n userAgent,\n }, preAuthEc, routingOrgIds);\n } catch (error) {\n this.logger.warn('Audit log failed for cross-frontend handoff issuance', {\n error,\n consumableTokenId: exchangeToken._id,\n });\n }\n\n this.logDebug('Cross-frontend handoff issued', {\n userId: caller.userId,\n sourceFrontendServiceName,\n targetServiceKey: body.targetServiceKey,\n consumableTokenId: exchangeToken._id,\n });\n\n // Schema: CrossFrontendHandoffResponseSchema requires `expiresAt: string`.\n // ConsumableToken.expiresAt is a Date in-memory (createToken stores it as Date);\n // wrap in `new Date()` for resilience against any future serialization drift.\n const expiresAtIso = new Date(exchangeToken.expiresAt as unknown as Date | string).toISOString();\n const response = CrossFrontendHandoffResponseSchema.parse({ handoffUrl, expiresAt: expiresAtIso });\n this.jsonSuccess(res, response);\n }\n\n /**\n * POST /auth/logout\n *\n * **Cookie-only contract** (Auth-hardening Slice A Step 6, 2026-04-13).\n * Reads the refresh token EXCLUSIVELY from the `__wildo_refresh`\n * cookie via `AuthControllerUtils.extractRefreshTokenFromCookie()`.\n * The body schema (`LogoutBodySchema`) is `z.strictObject({})`, so a\n * stale legacy client still sending `{ refreshToken: '…' }` fails\n * validation BEFORE reaching this handler (defense-in-depth).\n *\n * When no cookie is present, the cookie-clear is STILL emitted\n * (defensive — covers the \"stale cookie + lost JS state\" case where\n * the browser still holds the cookie but the JS context lost the\n * access token). The Redis JTI-blacklist revocation is best-effort\n * and skipped when there's no token to revoke.\n *\n * Pre-A-Step-6 history: A-K-3 added the cookie channel; A-K-5 added\n * the transitional dual-read; A-Step 6 (this) drops the body channel.\n *\n * Response: 200 OK + `Set-Cookie: __wildo_refresh=; Max-Age=0`.\n *\n * Accessible both with and without a valid JWT (user's access token\n * may be expired when they logout).\n */\n private async logout(req: Request, res: Response): Promise<void> {\n // ec discarded intentionally — logout doesn't read EC, but we\n // honour the same pre-auth bootstrap that every public handler does\n // for consistency with audit-trail expectations.\n await this._getPreAuthExecutionContext();\n // Validate body shape (strict-empty post Auth-hardening A-Step 6 —\n // see `LogoutBodySchema` JSDoc). Throws on `{ refreshToken: '…' }`,\n // surfacing stale-client misuse as a 400 rather than silently\n // ignoring the body field.\n LogoutBodySchema.parse(req.body || {});\n const refreshToken = AuthControllerUtils.extractRefreshTokenFromCookie(req);\n\n // Try to decode the refresh token to get identity for audit (best-effort, don't fail logout if decode fails)\n let logoutUserId: string | undefined;\n if (refreshToken) {\n try {\n const decoded = await this.jwtService.verifyRefreshToken(refreshToken);\n if (typeof decoded === 'object' && decoded !== null) {\n const payload = decoded as Record<string, unknown>;\n logoutUserId = typeof payload.userId === 'string' ? payload.userId : undefined;\n }\n } catch { /* token may be expired — that's fine */ }\n\n // Revoke the refresh token by adding its JTI to the Redis blacklist.\n // The token issuer's refreshAccessToken() checks this blacklist before issuing new tokens.\n try {\n await this.tokenIssuer.revokeRefreshToken(refreshToken);\n } catch (revocationError) {\n // Don't block logout on a stale/already-revoked token — clearing\n // the cookie is the user-visible action and must always succeed.\n this.logDebug('Refresh-token revocation failed during logout (likely stale/expired)', {\n userId: logoutUserId || 'unknown',\n error: describeCaughtError(revocationError),\n });\n }\n } else {\n this.logDebug('Logout called without `__wildo_refresh` cookie — clearing cookie defensively');\n }\n\n // ALWAYS clear the cookie, even when no token was supplied — this\n // covers the \"stale cookie + lost JS state\" case where the browser\n // still holds the cookie but the JS context lost the access token\n // (page crash, storage clear, etc.).\n this._clearRefreshCookie(res);\n\n // H5: Audit logout\n this.auditLogsService.logUserLogout({\n userId: logoutUserId || 'unknown',\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n }).catch(() => {}); // fire-and-forget\n\n this.logDebug('Logout completed — refresh token revoked + cookie cleared');\n\n res.status(204).send();\n }\n\n /**\n * POST /auth/logout-all — sign out EVERYWHERE (every device / session).\n *\n * Where `/auth/logout` revokes only the presented session's refresh chain (leaving other devices, and this\n * session's short-lived access token, alive until expiry), this fences the WHOLE user via\n * `invalidateAllTokensForUser` — writing the `TOKEN_INVALID_BEFORE:<userId>` timestamp that EVERY auth front\n * (HTTP guard, refresh, socket handshake, delegated A2A/MCP) checks — so every access AND refresh token the\n * user holds, on every device, is revoked immediately. This is the immediate-full-revocation path industry\n * best practice recommends pairing with short-lived access tokens (OWASP JWT Cheat Sheet); the per-user fence\n * is the denylist-equivalent, already on the token-verification hot path.\n *\n * The caller is identified from the SIGNED `__wildo_refresh` cookie — proof of an active session, and\n * unforgeable — mirroring `/auth/logout` and the SAML SP-logout. No valid cookie ⇒ 401. Unlike single logout,\n * the revocation is AWAITED and NOT swallowed: a \"signed out everywhere\" that silently failed to revoke would\n * be a security lie, so a revocation failure fails the request rather than returning a false success.\n *\n * Response: 204 + cleared cookie. Rate limit: 10/min per IP.\n */\n private async logoutAll(req: Request, res: Response): Promise<void> {\n await this.rateLimitService.checkPolicy(req, res, { requestsPerMinute: 10 }, 'auth:logout-all:by-ip');\n await this._getPreAuthExecutionContext();\n LogoutBodySchema.parse(req.body || {});\n\n const refreshToken = AuthControllerUtils.extractRefreshTokenFromCookie(req);\n let userId: string | undefined;\n if (refreshToken) {\n try {\n const decoded = await this.jwtService.verifyRefreshToken(refreshToken);\n if (typeof decoded === 'object' && decoded !== null) {\n const payload = decoded as Record<string, unknown>;\n userId = typeof payload.userId === 'string' ? payload.userId : undefined;\n }\n } catch {\n // Invalid/expired refresh token — treated as unauthenticated below.\n }\n }\n if (!userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_REFRESH_TOKEN_REQUIRED,\n });\n }\n\n // Fence the WHOLE user — awaited, NOT swallowed (see JSDoc): a failure here must fail the request.\n await this.tokenIssuer.invalidateAllTokensForUser(userId);\n this._clearRefreshCookie(res);\n\n this.auditLogsService.logUserLogout({\n userId,\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n }).catch(() => {}); // fire-and-forget\n\n this.logDebug('Logout-all completed — every token fenced for the user + cookie cleared', { userId });\n res.status(204).send();\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Password Reset Route Handlers (Step 7)\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * POST /auth/password-reset/request → AuthPasswordResetService.requestPasswordReset\n */\n private async passwordResetRequest(req: Request, res: Response): Promise<void> {\n // PR-7b-fixes F-22 fail-fast ordering: body parse → rate-limit → ec.\n // Body parse is required input for the per-email bucket key; ec\n // creation is needed only for the downstream service call and\n // moves AFTER the rate-limit gate so over-budget callers don't\n // pay the EC-construction cost (cosmetic for perf, materially\n // better for the fail-fast invariant PR-7-D-3 established at\n // F-18 for JWT extraction — generalized here to all bounded\n // pre-auth setup).\n const { email } = PasswordResetRequestDtoSchema.parse(req.body || {});\n\n // PR 7b — password-reset migration. Two policies AND-ed at the\n // same seam, with DIFFERENT identifiers (separate `checkPolicy`\n // calls because the bucket suffix can't be both email and IP at\n // once — same pattern PR 7-D-3 established for `phoneVerifySend`):\n //\n // 1) Per-email 3/hour. Defense against an attacker spamming a\n // single victim's inbox with reset emails (cost-bearing for\n // the SMTP egress AND a deliverability/reputation hit for our\n // sending domain). Email-keyed via `clientIdOverride` —\n // IP-keying would let a botnet sidestep the cap by rotating\n // sources against one victim.\n //\n // Email normalization is `email.toLowerCase()` only —\n // matching the previous shape exactly. Plus-addressing\n // (`foo+a@x.com` vs `foo+b@x.com`) and Gmail-dot tricks\n // (`f.oo@gmail.com` vs `foo@gmail.com`) are NOT normalized\n // here: the local-part semantics vary by provider, and treating\n // them as one bucket could merge legitimately distinct\n // accounts. Tracked as D-4 in the plan for a follow-up\n // decision if the plus-addressing bypass becomes a real\n // abuse path.\n //\n // 2) Per-IP 5/hour. Defense against a single source pumping reset\n // requests across many email addresses (account-discovery\n // probe). IP-keyed by default (no `clientIdOverride`).\n //\n // Drop the `if (ipAddress !== 'unknown')` guard from the previous\n // shape: per the `getClientIpFromRequest` contract, `'unknown'`\n // is a sentinel that the bucket MUST treat as a single shared\n // bucket — co-bucketing all unknown-IP callers is the documented\n // \"over-throttle one shared bucket rather than under-count\n // distinct clients\" rule. The previous guard SKIPPED rate-limit\n // entirely on unknown-IP requests, which let a caller suppressing\n // proxy headers bypass the per-IP cap. Net upgrade for\n // security; minor behavior change for legitimate `'unknown'`\n // scenarios (which are rare and now share one bucket as the\n // helper's contract intends).\n //\n // Both calls run BEFORE `passwordResetService.requestPasswordReset`\n // — the cost-bearing service call (DB lookup, SMTP send) doesn't\n // run for over-budget callers. Body parse precedes the\n // rate-limit by necessity (need `email` for the per-email\n // bucket); body parse is cheap and bounded.\n const ipAddress = getClientIpFromRequest(req);\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerHour: 3 },\n 'auth:password-reset:request:by-email',\n undefined,\n email.toLowerCase(),\n );\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerHour: 5 },\n 'auth:password-reset:request:by-ip',\n );\n\n const ec = await this._getPreAuthExecutionContext();\n const frontendUrl = this.resolveFrontendAppPublicUrl(req);\n const result = await this.passwordResetService.requestPasswordReset(ec, {\n email, frontendUrl, ipAddress, userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n });\n this.jsonSuccess(res, result);\n }\n\n /**\n * POST /auth/password-reset/complete → AuthPasswordResetService.completePasswordReset\n */\n private async passwordResetComplete(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const { token, newPassword } = PasswordResetCompleteDtoSchema.parse(req.body || {});\n\n const result = await this.passwordResetService.completePasswordReset(ec, {\n token, newPassword,\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n });\n this.jsonSuccess(res, result);\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Registration Route Handlers (Step 8) → AuthRegistrationService\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * POST /auth/register → AuthRegistrationService.registerUser\n */\n private async register(req: Request, res: Response): Promise<void> {\n // PR-7b-fixes F-22 fail-fast ordering: body parse → rate-limit → ec\n // (see `passwordResetRequest` for rationale).\n const { email, firstName, lastName, password, organizationName } = UserRegisterApiDtoSchema.parse(req.body || {});\n const ipAddress = getClientIpFromRequest(req);\n\n // PR 7b — register migration. THREE policies AND-ed (PR 8a Option D\n // lifted the per-email-domain bucket UP from `auth-registration.backend.service.ts`;\n // see plan body for the architectural rationale — rate limits are\n // intrinsically HTTP concerns and the service layer should not\n // reach for `req`/`res`-equivalent state). Order standardized\n // VICTIM-PROTECTIVE first → SOURCE-NOISE last per PR-7b-fixes\n // F-20: when multiple buckets would trip on the same request, the\n // FIRST one short-circuits and the LATER ones never increment, so\n // the binding constraint surfaced to the client (and to operators\n // tailing 429s) reflects the most-relevant defensive intent.\n // Generalized victim-protective ranking for register: named-account\n // (per-email) → named-tenant (per-domain) → loud-source (per-IP).\n // Same email-first ordering as `passwordResetRequest`,\n // `resendVerificationEmail`, `phoneVerifySend`/`Confirm`.\n //\n // 1) Per-email 3/hour. Defense against an attacker re-attempting\n // registration on a known email (e.g. to brute-force collision\n // against an existing account or to re-trigger the\n // \"email already registered\" enumeration channel). Email-keyed\n // via `clientIdOverride` (`email.toLowerCase()` only —\n // plus-addressing punted, see D-4).\n //\n // 2) Per-domain 50/hour. Defense against an attacker fanning out\n // registrations across many local-parts on the same domain\n // (a single-org targeted enrolment-spam attack — would burn\n // the org's verification-email reputation and pollute its\n // user table). Domain-keyed via `clientIdOverride` on the\n // `email.split('@')[1]?.toLowerCase()` — same lowercase\n // normalization the now-deleted service-layer call used.\n // Empty-domain case (no `@` in submitted email) is filtered\n // The `if (emailDomain)` guard is preserved verbatim from the\n // pre-PR-8a service-layer shape: the upstream `.email()`\n // schema refinement should make the empty case unreachable,\n // but the guard is defense-in-depth (and a no-op for legitimate\n // callers — keeps the migration purely behavior-preserving).\n //\n // 3) Per-IP 3/min. Defense against a single source spinning up\n // accounts in bulk (account-creation amplification — DB rows,\n // org provisioning, verification email cost). IP-keyed by\n // default. The `if (ipAddress !== 'unknown')` guard is\n // dropped (same rationale as `passwordResetRequest`: per the\n // helper's contract, unknown-IP callers SHARE one bucket\n // rather than bypassing the limit entirely — net security\n // upgrade).\n //\n // `ipAddress` extraction stays — threaded into `registerUser` for\n // audit/anti-fraud (single IP source of truth via\n // `getClientIpFromRequest`, same helper `checkPolicy` re-derives\n // for the per-IP bucket).\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerHour: 3 },\n 'auth:register:by-email',\n undefined,\n email.toLowerCase(),\n );\n const emailDomain = email.split('@')[1]?.toLowerCase();\n if (emailDomain) {\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerHour: 50 },\n 'auth:register:by-domain',\n undefined,\n emailDomain,\n );\n }\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 3 },\n 'auth:register:by-ip',\n );\n\n const ec = await this._getPreAuthExecutionContext();\n const frontendUrl = this.resolveFrontendAppPublicUrl(req);\n\n // W3.4 + AUTH-10: Resolve activeUserType for registration context.\n // For registration, the header is the authoritative source since the user doesn't exist yet.\n // The registration service validates the resolved type allows registration (mode != disabled).\n // AUTH-10: Cross-validate Origin against the claimed frontend service to prevent user-type spoofing.\n const frontendServiceNameReg = req.headers[WildoHeaderKeys.FRONTEND_SERVICE_NAME] as string | undefined;\n this._validateFrontendAppOrigin(req, frontendServiceNameReg);\n const activeUserTypeReg = frontendServiceNameReg\n ? this.appConfigService.resolveUserTypeFromFrontendServiceName(frontendServiceNameReg) ?? undefined\n : undefined;\n\n const result = await this.registrationService.registerUser(ec,\n { email, firstName, lastName, password, organizationName },\n { frontendUrl, ipAddress, userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown', frontendServiceName: frontendServiceNameReg, activeUserType: activeUserTypeReg },\n );\n\n // Deferred-verification registration issues tokens immediately (see\n // `registerUser`), so this is the anonymous→authenticated conversion moment\n // for direct-register users. Transpose the anonymous website capture onto\n // the new account — guarded on token issuance + a resolved `userId`,\n // identical to `verifyEmail()` / `acceptInvitation()`. The non-deferred\n // branch returns no `accessToken`, so this is a no-op there.\n if (result.accessToken && result.userId) {\n await this.handleAnonymousTranspositionForTokenExchange(req, res, result.userId);\n }\n\n // Auth-hardening A-Step 6 (2026-04-13): destructure cookie-only\n // `refreshToken` out of the registration result. The wire body\n // (`{ messageRef, message, ssoRedirectHint?, sessionId?, state?,\n // purpose?, nextStep?, userId?, accessToken?, expiresIn? }`) carries no\n // refresh token; the wrapper sets `Set-Cookie` from the third arg.\n const { refreshToken, ...wireBody } = result;\n this._jsonSuccessWithRefreshCookie(res, wireBody, refreshToken);\n }\n\n /**\n * GET /auth/invitation/info?token=… → AuthRegistrationService.getInvitationInfo\n *\n * Public, NON-consuming discovery for the multi-method accept screen: returns the\n * invited org's available auth methods + SSO/SCIM management mode. Per-IP rate\n * limited to blunt invitation-token probing (the token is the only credential).\n */\n private async getInvitationInfo(req: Request, res: Response): Promise<void> {\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 30 },\n 'auth:invitation:info:by-ip',\n );\n\n const invitationToken = String(req.query.token ?? '');\n const ec = await this._getPreAuthExecutionContext();\n const result = await this.registrationService.getInvitationInfo(ec, invitationToken);\n res.status(200).json(result);\n }\n\n /**\n * POST /auth/invitation/accept → AuthRegistrationService.acceptInvitation\n */\n private async acceptInvitation(req: Request, res: Response): Promise<void> {\n // PR 7b — invitation accept migration. Per-IP 10/min cap defends\n // against invitation-token bruteforce. NOT per-token-keyed: the\n // bucket would reset every new token tried, defeating the\n // bruteforce defense (same anti-pattern PR 7a documented for\n // `magicLinkVerify`). The `if (ipAddress !== 'unknown')` guard\n // is dropped (same rationale as `passwordResetRequest` /\n // `register` above: per-helper contract, unknown-IP callers\n // co-bucket; net security upgrade).\n //\n // PR-7b-fixes F-22 fail-fast ordering: rate-limit FIRST (the\n // bucket key is per-IP only — body parse is NOT a rate-limit\n // input here, unlike the dual-key sites). Then body parse, then\n // ec creation. Over-budget callers don't pay body-parse OR\n // ec-construction costs.\n //\n // `ipAddress` is also threaded into `acceptInvitation` below for\n // the audit row — single IP source of truth.\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10 },\n 'auth:invitation:accept:by-ip',\n );\n\n const { invitationToken, firstName, lastName, password, credentialMethod } = UserInvitationApiDtoSchema.parse(req.body || {});\n const ipAddress = getClientIpFromRequest(req);\n const ec = await this._getPreAuthExecutionContext();\n\n const result = await this.registrationService.acceptInvitation(ec, {\n invitationToken,\n firstName,\n lastName,\n password,\n credentialMethod,\n ipAddress,\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n });\n\n // MAGIC_LINK-at-accept issues NO session: dispatch the link email (shared helper) and return the\n // generic \"check your email\" message. The minted token never touches the wire (anti-enumeration,\n // identical to `POST /auth/magic-link/send`).\n if (result.outcome === AcceptInvitationOutcome.MAGIC_LINK_SENT) {\n await this._sendMagicLinkEmail(req, result.magicLinkDelivery);\n this.jsonSuccess(res, this.authResponseHelper.getAuthResponse(AuthResponseMessageRef.MAGIC_LINK_SENT));\n return;\n }\n\n // SESSION outcome (password / no-password / passkey). The invitation token bootstrapped a\n // session; `passkeyRegistrationOptions`, when present, rides the wire body so the frontend can\n // complete the WebAuthn ceremony against the existing authenticated register-verify route.\n if (result.accessToken && result.userId) {\n await this.handleAnonymousTranspositionForTokenExchange(req, res, result.userId);\n }\n\n // Auth-hardening A-Step 6 — see `register()` for the cookie-only contract. `outcome` is the\n // internal service↔controller discriminant and is stripped from the wire body.\n const { refreshToken, outcome: _outcome, ...wireBody } = result;\n this._jsonSuccessWithRefreshCookie(res, wireBody, refreshToken);\n }\n\n /**\n * POST /auth/invitation/reject → AuthRegistrationService.rejectInvitation\n */\n private async rejectInvitation(req: Request, res: Response): Promise<void> {\n // PR 7b — invitation reject migration. Same shape as\n // `acceptInvitation` above (per-IP 10/min, no per-token keying for\n // the same bruteforce-defense reason). The `if (ipAddress !==\n // 'unknown')` guard and the local `ipAddress` extraction are\n // dropped together — the variable was sole-consumed by the\n // dropped guard (unlike `acceptInvitation` where `ipAddress` is\n // still threaded into the service for audit). `checkPolicy`\n // re-derives the IP via the same helper for the bucket key.\n //\n // PR-7b-fixes F-22 fail-fast ordering: rate-limit → body parse →\n // ec (same shape as `acceptInvitation` above).\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10 },\n 'auth:invitation:reject:by-ip',\n );\n\n const { invitationToken, rejectionReason } = UserInvitationRejectApiDtoSchema.parse(req.body || {});\n const ec = await this._getPreAuthExecutionContext();\n\n const result = await this.registrationService.rejectInvitation(ec, {\n invitationToken,\n rejectionReason,\n });\n\n this.jsonSuccess(res, result);\n }\n\n /**\n * GET /auth/invitations/mine → AuthRegistrationService.listMyPendingInvitations\n *\n * Authenticated (Approach P). Returns the caller's OWN pending invitations across\n * all organizations, matched by their primary email. No token — the caller is\n * identified by their JWT. The cross-org reads run under a system context inside the\n * service; the pre-auth EC carries the cross-org-capable context for the caller lookup.\n */\n private async listMyInvitations(req: Request, res: Response): Promise<void> {\n const preAuthEc = await this._getPreAuthExecutionContext();\n // IP-keyed rate-limit before JWT extraction (fail-fast, same shape as the token routes).\n await this.rateLimitService.checkPolicy(req, res, { requestsPerMinute: 30 }, 'auth:invitations:mine:by-ip');\n const caller = await this.authJwtGuard.extractAuthenticatedUser(preAuthEc, req);\n\n const invitations = await this.registrationService.listMyPendingInvitations(preAuthEc, {\n callerUserId: caller.userId,\n });\n this.jsonSuccess(res, { invitations });\n }\n\n /**\n * POST /auth/invitations/accept → AuthRegistrationService.acceptMyInvitation\n *\n * Authenticated in-app accept (Approach P) of one of the caller's OWN pending\n * invitations (email-ownership). No token, no new session — the caller is already\n * signed in; the shared acceptance core creates the membership + marks it accepted.\n */\n private async acceptMyInvitation(req: Request, res: Response): Promise<void> {\n const preAuthEc = await this._getPreAuthExecutionContext();\n await this.rateLimitService.checkPolicy(req, res, { requestsPerMinute: 10 }, 'auth:invitations:accept-mine:by-ip');\n const caller = await this.authJwtGuard.extractAuthenticatedUser(preAuthEc, req);\n // `membershipId` = the INVITED membership row the invitee accepts (junction model —\n // the invitation IS the membership).\n const { membershipId } = z.object({ membershipId: z.string().min(1) }).parse(req.body || {});\n\n const result = await this.registrationService.acceptMyInvitation(preAuthEc, {\n callerUserId: caller.userId,\n membershipId,\n });\n this.jsonSuccess(res, result);\n }\n\n /**\n * POST /auth/invitations/reject → AuthRegistrationService.rejectMyInvitation\n *\n * Authenticated in-app decline (Approach P) of one of the caller's OWN pending\n * invitations (userId-ownership of the INVITED membership row). Decline DELETEs the\n * pending membership (which revokes its accept token via the membership DELETE prefix).\n */\n private async rejectMyInvitation(req: Request, res: Response): Promise<void> {\n const preAuthEc = await this._getPreAuthExecutionContext();\n await this.rateLimitService.checkPolicy(req, res, { requestsPerMinute: 10 }, 'auth:invitations:reject-mine:by-ip');\n const caller = await this.authJwtGuard.extractAuthenticatedUser(preAuthEc, req);\n const { membershipId, rejectionReason } = z.object({\n membershipId: z.string().min(1),\n rejectionReason: z.string().max(500).optional(),\n }).parse(req.body || {});\n\n const result = await this.registrationService.rejectMyInvitation(preAuthEc, {\n callerUserId: caller.userId,\n membershipId,\n rejectionReason,\n });\n this.jsonSuccess(res, result);\n }\n\n /**\n * POST /auth/verify-email → AuthRegistrationService.verifyEmail\n */\n private async verifyEmail(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const { token, email } = EmailVerifyDtoSchema.parse(req.body || {});\n\n const result = await this.registrationService.verifyEmail(ec, {\n token, email,\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n });\n\n if (result.accessToken && result.userId) {\n await this.handleAnonymousTranspositionForTokenExchange(req, res, result.userId);\n }\n\n // Auth-hardening A-Step 6 — see `register()` for the cookie-only contract.\n const { refreshToken, ...wireBody } = result;\n this._jsonSuccessWithRefreshCookie(res, wireBody, refreshToken);\n }\n\n /**\n * POST /auth/resend-verification → AuthRegistrationService.resendVerificationEmail\n */\n private async resendVerificationEmail(req: Request, res: Response): Promise<void> {\n // PR-7b-fixes F-22 fail-fast ordering: body parse → rate-limit → ec\n // (see `passwordResetRequest` for rationale).\n const { email } = z.object({\n email: z.string().email(),\n }).parse(req.body || {});\n\n const ipAddress = getClientIpFromRequest(req);\n // PR 7b — resend-verification-email migration. Two policies AND-ed\n // (same pattern as `passwordResetRequest` / `register`), but BOTH\n // use the same 600-second (10-minute) window — which doesn't fit\n // the canonical `requestsPerMinute / Hour / Day` schema. This is\n // the SECOND consumer of `customWindows` (D-3, Option A —\n // phone-verify was the first, end-of-PR-7-D-3). Rationale for the\n // 10-minute window:\n //\n // - 60s (round to `requestsPerMinute: 3`): 5x looser — 3 emails\n // per minute is generous enough to amplify victim-inbox spam\n // meaningfully (180/hour vs the current 18/hour hard cap).\n // - 3600s (round to `requestsPerHour: 3`): 6x looser at a\n // different point — would let an attacker burst all 3 in the\n // first 10 seconds of the hour.\n //\n // Neither rounding preserves the original UX-and-defense\n // intersection (~3 emails per ~3-minute spacing, matching how\n // long users typically wait before re-checking inbox). Same\n // shape as phone-verify's 300s decision: when the window length\n // encodes a domain-meaningful interval (here, the typical\n // inbox-check cycle; for phone-verify, the OTP TTL),\n // `customWindows` is the right escape hatch — NOT a knob for\n // arbitrary tuning.\n //\n // 1) Per-email 3/600s. Defense against pumping a single victim's\n // inbox. Email-keyed via `clientIdOverride: email.toLowerCase()`\n // (plus-addressing punted, see D-4).\n //\n // 2) Per-IP 5/600s. Defense against a single source pumping\n // resend requests across many email addresses\n // (account-discovery probe / SMTP egress amplification).\n // IP-keyed by default. The `if (ipAddress !== 'unknown')`\n // guard is dropped (same rationale as `register` /\n // `passwordResetRequest`).\n //\n // `ipAddress` extraction stays — threaded into\n // `resendVerificationEmail` for audit (same single-source-of-truth\n // pattern as `register`).\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { customWindows: [{ requestsPerWindow: 3, windowSeconds: 600 }] },\n 'auth:resend-verif:by-email',\n undefined,\n email.toLowerCase(),\n );\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { customWindows: [{ requestsPerWindow: 5, windowSeconds: 600 }] },\n 'auth:resend-verif:by-ip',\n );\n\n const ec = await this._getPreAuthExecutionContext();\n const frontendUrl = this.resolveFrontendAppPublicUrl(req);\n const result = await this.registrationService.resendVerificationEmail(ec, {\n email, frontendUrl, ipAddress,\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n });\n this.jsonSuccess(res, result);\n }\n\n /**\n * POST /auth/onboarding/complete-org → AuthRegistrationService.completeOrgOnboarding\n */\n private async completeOrgOnboarding(req: Request, res: Response): Promise<void> {\n // PR 7b — org-onboarding migration. Per-IP 10/min cap defends\n // against bulk org-completion (each successful call provisions\n // an organization row + membership + tenant scaffolding —\n // cost-bearing). IP-keyed by default. No prior unknown-IP guard\n // to drop (this site already rate-limited unconditionally —\n // pre-existing correct behavior). Rate-limit precedes\n // `_getPreAuthExecutionContext` AND body parse — strictest\n // fail-fast among the PR 7b sites, preserved as-is.\n //\n // Local `clientIp` extraction REMOVED: it was sole-consumed by\n // the `checkRateLimit` key suffix; `checkPolicy` re-derives via\n // `getClientIpFromRequest` internally, so the local extraction\n // becomes dead code. (Compare `register` / `acceptInvitation` /\n // `resendVerificationEmail` which keep their `ipAddress`\n // extractions because the value is also threaded into the\n // service for audit.)\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10 },\n 'auth:onboarding:complete-org:by-ip',\n );\n\n const ec = await this._getPreAuthExecutionContext();\n const { sessionId, organizationName } = z.object({\n sessionId: z.string(),\n organizationName: z.string().min(1).max(200)\n .regex(/^[^<>\"'`;{}()\\\\]+$/, 'Organization name contains disallowed characters'),\n }).parse(req.body || {});\n\n const result = await this.registrationService.completeOrgOnboarding(ec, {\n sessionId,\n organizationName: organizationName.trim(),\n });\n this.jsonSuccess(res, result);\n }\n\n // ═══════════════════════════════════════════════════════════════\n // MFA: Email OTP Route Handlers (Step 10)\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * POST /auth/mfa/email-otp/send\n * Body: { sessionId: string }\n * Response: { message: string }\n *\n * Generates a 6-digit OTP, stores as consumable token, sends email to user.\n * Must be called after first factor completion (session state = FIRST_FACTOR_COMPLETED).\n */\n private async mfaEmailOTPSend(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const body = z.object({ sessionId: z.string().min(1) }).parse(req.body || {});\n\n this.logDebug('MFA Email OTP send requested', { sessionId: body.sessionId });\n\n // Orchestrator handles validation, rate limiting, OTP generation, and token storage.\n // It returns the OTP code and the user's email — we send the email here.\n const {\n otpToken,\n submissionId,\n email,\n expiryMinutes,\n } = await this.authService.sendEmailOTP(ec, body.sessionId);\n\n // Send the OTP email\n let emailAccepted = false;\n try {\n const appIdentity = this.appConfigService.config.appIdentity;\n const emailResult = await this.emailService.send({\n submissionId,\n templateRef: SystemEmailTemplateRef.EMAIL_OTP,\n locale: getConfiguredPrimaryLanguage(this.appConfigService.config),\n type: EmailTemplateType.TRANSACTIONAL,\n to: email,\n context: {\n currentObject: { email },\n objectContext: {\n primaryScopeContext: {\n appName: appIdentity.appName,\n applicationId: this.appConfigService.applicationId,\n logoUrl: this.appConfigService.resolveBrandLogoAbsoluteUrl({\n composition: BrandAssetComposition.LOCKUP,\n purpose: BrandAssetPurpose.EMAIL,\n }) ?? undefined,\n },\n },\n userContext: { userId: '', email }, // userId not available in pre-auth flow; email is the key identifier\n additionalContext: { otpCode: otpToken, expiresInMinutes: expiryMinutes },\n },\n });\n emailAccepted =\n emailResult.success\n && emailResult.outcome === EmailSubmissionOutcome.PROVIDER_ACCEPTED;\n if (emailAccepted) {\n this.logDebug('MFA Email OTP provider accepted submission', {\n email,\n submissionId: emailResult.submissionId,\n providerMessageIds: emailResult.providerMessageIds,\n });\n } else {\n this.logger.error('MFA email OTP provider did not confirm acceptance', {\n email,\n submissionId: emailResult.submissionId,\n outcome: emailResult.outcome,\n error: emailResult.error,\n });\n }\n } catch (emailError) {\n this.logger.error('Failed to send MFA email OTP', {\n ...projectCaughtErrorLogFields(emailError),\n });\n // Still return success — the OTP was generated and stored.\n // User can retry sending if email delivery fails.\n }\n\n // A \"sent\" audit event is acceptance evidence, not an attempt log.\n if (emailAccepted) {\n this.auditLogsService.logUserMFAEmailOTPSent({\n email,\n sessionId: body.sessionId,\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n }).catch(() => {});\n }\n\n this.jsonSuccess(res, this.authResponseHelper.getAuthResponse(AuthResponseMessageRef.MFA_EMAIL_OTP_SENT));\n }\n\n /**\n * POST /auth/mfa/email-otp/verify\n * Body: { sessionId: string, code: string }\n * Response: AuthenticationResponse (from orchestrator)\n *\n * Verifies the submitted OTP code against stored consumable tokens.\n * On success, returns authentication result (may complete auth or require more factors).\n */\n private async mfaEmailOTPVerify(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const body = z.object({\n sessionId: z.string().min(1),\n code: z.string().regex(/^\\d{4,8}$/, { error: 'Invalid OTP code' }),\n }).parse(req.body || {});\n\n this.logDebug('MFA Email OTP verify requested', { sessionId: body.sessionId });\n\n // Build an EmailOTPAuthRequest and route through the main authenticate method\n // so that completion logic (token issuance) is handled uniformly.\n const authRequest = {\n sessionId: body.sessionId,\n method: AuthMethod.EMAIL_OTP as const,\n factorLevel: AuthFactorLevel.SECOND as const,\n token: body.code,\n rememberMe: false,\n requestedIntegrations: [],\n };\n\n const result = await this.authService.authenticate(ec, authRequest);\n // Anonymous→authenticated transposition. The MFA *first* factor returned\n // MFA_REQUIRED, at which point `handleAnonymousTransposition` early-returned\n // on `!success` (no tokens issued yet), so the anonymous website capture was\n // never consumed. This SECOND-factor completion is the real token-issuing\n // moment for MFA-enabled users — transpose here, before the wire response is\n // sent (the trigger may `Set-Cookie` to clear the anon-session cookie, which\n // must precede `res.json`). Guarded internally on `success` + a resolved\n // `user._id`, so an incomplete multi-factor step (success, no tokens, no\n // user) is a safe no-op. Mirrors the sibling `authenticate()` site.\n await this.handleAnonymousTransposition(req, res, result);\n // Auth-hardening A-Step 6 — see `authenticatePassword()` for the\n // destructure-and-pass-explicitly contract.\n const { refreshToken, ...wireBody } = result;\n this._jsonSuccessWithRefreshCookie(res, wireBody, refreshToken);\n }\n\n // ═══════════════════════════════════════════════════════════════\n // MFA: TOTP Route Handlers (Step 11)\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * POST /auth/mfa/totp/setup\n * Headers: Authorization: Bearer <accessToken>\n * Response: { secret: string, qrCodeUri: string, backupCodes: string[] }\n *\n * Uses `extractFromSessionOrJwt` — the caller may be fully authenticated (JWT)\n * or partially authenticated (MFA_REQUIRED / MFA_ENROLLMENT_REQUIRED session).\n * In the partial-auth path, identity is not yet fully proven, so we intentionally\n * use a pre-auth EC (no userId attribution). Security relies on the JWT guard /\n * session state validation in `extractFromSessionOrJwt`, not on the EC's role.\n */\n private async mfaTOTPSetup(req: Request, res: Response): Promise<void> {\n // PR 7c — TOTP setup migration. 5/hour per-user, post-auth.\n // CRITICAL: scope key DELIBERATELY shared with `mfaTOTPVerifySetup`\n // (`auth:mfa:totp:setup:by-user`, NOT `:setup-init:by-user` /\n // `:setup-verify:by-user`). Pre-PR-7c the same Redis prefix\n // `TOTP_SETUP` was reused verbatim by both methods — setup +\n // verify-setup form ONE enrollment ceremony (generate-secret →\n // user-enters-6-digits-from-authenticator → verify), and a\n // legitimate user retry alternates between the two endpoints\n // when their first code attempt fails. Splitting them into\n // separate scope keys would let an attacker run setup-verify-\n // setup-verify-... to extract 2x the cap (10 ceremonies/hour\n // instead of the SC-spec'd 5).\n //\n // Rate-limit STAYS AFTER `extractFromSessionOrJwt` — the bucket\n // key REQUIRES the verified `userId`, so neither F-18 nor F-22\n // fail-fast applies (same situation as `crossFrontendHandoff`\n // and the upcoming Passkey sites; bucket-on-IP-then-bucket-on-\n // user would double bookkeeping for no meaningful gain).\n // `clientIdOverride: userId` is the framework-blessed pattern\n // for per-authenticated-subject buckets (PR 5 SCIM established\n // this for per-token; same shape generalized to per-user here).\n const ec = await this._getPreAuthExecutionContext();\n const { userId, email } = await this.authJwtGuard.extractFromSessionOrJwt(ec, req);\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerHour: 5 },\n 'auth:mfa:totp:setup:by-user',\n undefined,\n userId,\n );\n\n const result = await this.mfaService.setupTOTP(ec, {\n userId,\n email,\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n });\n\n this.jsonSuccess(res, result);\n }\n\n /**\n * POST /auth/mfa/totp/verify-setup\n * Headers: Authorization: Bearer <accessToken>\n * Body: { code: string }\n * Response: { verified: boolean }\n *\n * Uses `extractFromSessionOrJwt` — caller may be partially authenticated\n * (mid-MFA enrollment). Pre-auth EC used intentionally: identity is not\n * fully proven until MFA setup completes. See mfaTOTPSetup JSDoc.\n */\n private async mfaTOTPVerifySetup(req: Request, res: Response): Promise<void> {\n // PR 7c — TOTP verify-setup migration. SAME 5/hour per-user\n // bucket as `mfaTOTPSetup` — see that method's comment for the\n // shared-scope-key rationale (`auth:mfa:totp:setup:by-user`\n // is intentionally identical so the enrollment-ceremony pair\n // shares one cap).\n const ec = await this._getPreAuthExecutionContext();\n const { userId } = await this.authJwtGuard.extractFromSessionOrJwt(ec, req);\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerHour: 5 },\n 'auth:mfa:totp:setup:by-user',\n undefined,\n userId,\n );\n const body = z.object({\n code: z.string().regex(/^\\d{6}$/, { error: 'Invalid TOTP code — must be 6 digits' }),\n }).parse(req.body || {});\n\n const result = await this.mfaService.verifyTOTPSetup(ec, {\n userId,\n code: body.code,\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n });\n\n this.jsonSuccess(res, result);\n }\n\n /**\n * POST /auth/mfa/totp/verify\n * Body: { sessionId: string, code: string }\n * Response: AuthenticationResponse (from orchestrator)\n *\n * Verifies a TOTP code during login MFA flow.\n * Routes through the main authenticate method for uniform completion logic.\n */\n private async mfaTOTPVerify(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const body = z.object({\n sessionId: z.string().min(1),\n code: z.string().min(1, { error: 'TOTP code is required' }),\n }).parse(req.body || {});\n\n this.logDebug('MFA TOTP verify requested', { sessionId: body.sessionId });\n\n const authRequest = {\n sessionId: body.sessionId,\n method: AuthMethod.TOTP as const,\n factorLevel: AuthFactorLevel.SECOND as const,\n token: body.code,\n rememberMe: false,\n requestedIntegrations: [],\n };\n\n const result = await this.authService.authenticate(ec, authRequest);\n // Anonymous→authenticated transposition — MFA second-factor completion.\n // See `mfaEmailOTPVerify()` for why the first-factor MFA_REQUIRED path could\n // not transpose; this is the token-issuing moment for TOTP users (affects\n // every MFA-enabled account). Safe no-op if the step is not yet complete.\n await this.handleAnonymousTransposition(req, res, result);\n // Auth-hardening A-Step 6 — destructure cookie-only `refreshToken`.\n const { refreshToken, ...wireBody } = result;\n this._jsonSuccessWithRefreshCookie(res, wireBody, refreshToken);\n }\n\n // ═══════════════════════════════════════════════════════════════\n // WebAuthn/Passkey Route Handlers (Phase G1)\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * POST /auth/passkey/register/options\n * Headers: Authorization: Bearer <accessToken>\n * Response: PublicKeyCredentialCreationOptionsJSON\n *\n * Uses `extractFromSessionOrJwt` — caller may be partially authenticated\n * (mid-MFA enrollment, registering a passkey as their MFA method).\n * Pre-auth EC used intentionally: identity not fully proven until\n * MFA enrollment completes. See mfaTOTPSetup JSDoc.\n */\n private async handlePasskeyRegisterOptions(req: Request, res: Response): Promise<void> {\n try {\n // PR 7c — passkey register-options migration. 10/hour per-user,\n // post-auth. CRITICAL: scope key DELIBERATELY shared with\n // `handlePasskeyRegisterVerify` (`auth:mfa:passkey:register:by-user`,\n // NOT `:options:by-user` / `:verify:by-user`). Pre-PR-7c the same\n // Redis prefix `PASSKEY_REGISTER` was reused verbatim by both\n // methods — same enrollment-ceremony rationale as TOTP setup +\n // verify-setup above. Splitting them would let an attacker run\n // options-verify-options-verify-... to extract 2x the cap (20\n // ceremonies/hour instead of the spec'd 10), defeating the\n // per-user enrollment cap that exists to bound CBOR-decode +\n // attestation-verify cost (passkey verify is meaningfully more\n // CPU than TOTP verify; the looser 10/hour vs TOTP's 5/hour\n // reflects passkey UX needing more retries on cross-device\n // attestation flows).\n //\n // Rate-limit STAYS AFTER `extractFromSessionOrJwt` — same\n // F-18/F-22 exception as TOTP and `crossFrontendHandoff`\n // (bucket key requires verified `userId`).\n const ec = await this._getPreAuthExecutionContext();\n const { userId, email } = await this.authJwtGuard.extractFromSessionOrJwt(ec, req);\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerHour: 10 },\n 'auth:mfa:passkey:register:by-user',\n undefined,\n userId,\n );\n const options = await this.webAuthnService.generateRegistrationOptions(ec, userId, email);\n this.jsonSuccess(res, options);\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { operation: AUTH_OPERATION.PASSKEY_REGISTER_OPTIONS },\n });\n }\n }\n\n /**\n * POST /auth/passkey/register/verify\n * Headers: Authorization: Bearer <accessToken>\n * Body: { response: RegistrationResponseJSON, name?: string }\n * Response: { registered: boolean, credential: { credentialId, name, createdAt } }\n *\n * Uses `extractFromSessionOrJwt` — caller may be partially authenticated\n * (mid-MFA enrollment). Pre-auth EC used intentionally: identity not fully\n * proven until MFA enrollment completes. See mfaTOTPSetup JSDoc.\n */\n private async handlePasskeyRegisterVerify(req: Request, res: Response): Promise<void> {\n try {\n // PR 7c — passkey register-verify migration. SAME 10/hour per-user\n // bucket as `handlePasskeyRegisterOptions` — see that method's\n // comment for the shared-scope-key rationale (`auth:mfa:passkey:\n // register:by-user` is intentionally identical so the\n // enrollment-ceremony pair shares one cap).\n const ec = await this._getPreAuthExecutionContext();\n const { userId, email } = await this.authJwtGuard.extractFromSessionOrJwt(ec, req);\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerHour: 10 },\n 'auth:mfa:passkey:register:by-user',\n undefined,\n userId,\n );\n const PasskeyRegisterVerifyBodySchema = z.object({\n response: z.object({\n id: z.string(),\n rawId: z.string(),\n response: z.object({\n attestationObject: z.string(),\n clientDataJSON: z.string(),\n }),\n authenticatorAttachment: z.enum(['cross-platform', 'platform'] as const).optional(),\n clientExtensionResults: z.record(z.string(), z.any()).default({}),\n type: z.literal('public-key'),\n }),\n name: z.string().max(100).optional(),\n });\n const { response, name } = PasskeyRegisterVerifyBodySchema.parse(req.body || {});\n const credential = await this.webAuthnService.verifyRegistrationResponse(ec, userId, response, name);\n\n // F4 per-org SIEM routing — route ONLY on the user's VERIFIED ACTIVE member orgs\n // (server-resolved, ≥ first-factor authenticated `userId`).\n const routingOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, userId);\n await this.auditLogsService.logUserPasskeyRegistered({\n userId: userId,\n email,\n credentialId: credential.credentialId,\n credentialName: credential.name,\n credentialDeviceType: credential.credentialDeviceType,\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n }, ec, routingOrgIds);\n\n this.jsonSuccess(res, {\n registered: true,\n credential: {\n credentialId: credential.credentialId,\n name: credential.name,\n createdAt: credential.createdAt,\n },\n });\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { operation: AUTH_OPERATION.PASSKEY_REGISTER_VERIFY },\n });\n }\n }\n\n /**\n * POST /auth/passkey/authenticate/options\n * Body: { sessionId: string }\n * Response: PublicKeyCredentialRequestOptionsJSON\n *\n * Unauthenticated. Part of login flow. Generates authentication options for the session's user.\n */\n private async handlePasskeyAuthOptions(req: Request, res: Response): Promise<void> {\n try {\n const ec = await this._getPreAuthExecutionContext();\n const { sessionId } = req.body;\n if (!sessionId) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: 'sessionId is required' },\n });\n }\n\n const session = await this.authService.getAuthenticationSessionState(ec, sessionId);\n if (!session) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,\n context: { sessionId },\n });\n }\n\n const validStatesForPasskeyAuth = new Set([\n AuthenticationSessionState.IDENTIFIED,\n AuthenticationSessionState.FIRST_FACTOR_IN_PROGRESS,\n AuthenticationSessionState.FIRST_FACTOR_COMPLETED,\n AuthenticationSessionState.MFA_REQUIRED,\n ]);\n if (!validStatesForPasskeyAuth.has(session.state as AuthenticationSessionState)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'Invalid session state for passkey authentication' },\n });\n }\n\n const userId = session.userId;\n if (!userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'No user associated with session' },\n });\n }\n\n const options = await this.webAuthnService.generateAuthenticationOptions(ec, userId);\n this.jsonSuccess(res, options);\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { operation: AUTH_OPERATION.PASSKEY_AUTH_OPTIONS },\n });\n }\n }\n\n /**\n * POST /auth/passkey/authenticate/verify\n * Body: { sessionId: string, response: AuthenticationResponseJSON, factorLevel?: AuthFactorLevel }\n * Response: AuthenticationResponse (from orchestrator)\n *\n * Unauthenticated. Routes through authService.authenticate() for uniform completion logic.\n */\n private async handlePasskeyAuthVerify(req: Request, res: Response): Promise<void> {\n try {\n const ec = await this._getPreAuthExecutionContext();\n const PasskeyAuthVerifyBodySchema = z.object({\n sessionId: z.string().min(1),\n response: z.object({\n id: z.string(),\n rawId: z.string(),\n response: z.object({\n authenticatorData: z.string(),\n clientDataJSON: z.string(),\n signature: z.string(),\n userHandle: z.string().optional(),\n }),\n authenticatorAttachment: z.enum(['cross-platform', 'platform'] as const).optional(),\n clientExtensionResults: z.record(z.string(), z.any()).default({}),\n type: z.literal('public-key'),\n }),\n factorLevel: z.string().optional(),\n });\n const { sessionId, response, factorLevel } = PasskeyAuthVerifyBodySchema.parse(req.body || {});\n\n const authResponse = await this.authService.authenticate(ec, {\n sessionId,\n method: AuthMethod.PASSKEY,\n factorLevel: (factorLevel as AuthFactorLevel) || AuthFactorLevel.FIRST,\n response,\n rememberMe: false,\n requestedIntegrations: [],\n });\n await this.handleAnonymousTransposition(req, res, authResponse);\n // Auth-hardening A-Step 6 — destructure cookie-only `refreshToken`.\n const { refreshToken, ...wireBody } = authResponse;\n this._jsonSuccessWithRefreshCookie(res, wireBody, refreshToken);\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { operation: AUTH_OPERATION.PASSKEY_AUTH_VERIFY },\n });\n }\n }\n\n /**\n * GET /auth/passkey/list\n * Headers: Authorization: Bearer <accessToken>\n * Response: { credentials: PasskeyCredentialEntry[] } (safe fields only)\n *\n * JWT-authenticated. Lists registered passkeys for the authenticated user.\n */\n private async handlePasskeyList(req: Request, res: Response): Promise<void> {\n try {\n const preAuthEc = await this._getPreAuthExecutionContext();\n const { userId } = await this.authJwtGuard.extractAuthenticatedUser(preAuthEc, req);\n const ec = await this._getAuthenticatedExecutionContext(userId);\n const credentials = await this.webAuthnService.getCredentials(ec, userId);\n\n const safeCredentials = credentials.map((c) => ({\n credentialId: c.credentialId,\n name: c.name,\n createdAt: c.createdAt,\n lastUsedAt: c.lastUsedAt,\n credentialDeviceType: c.credentialDeviceType,\n credentialBackedUp: c.credentialBackedUp,\n }));\n this.jsonSuccess(res, { credentials: safeCredentials });\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { operation: AUTH_OPERATION.PASSKEY_LIST },\n });\n }\n }\n\n /**\n * POST /auth/passkey/remove\n * Headers: Authorization: Bearer <accessToken>\n * Body: { credentialId: string }\n * Response: { removed: boolean }\n *\n * JWT-authenticated. Removes a passkey from the authenticated user.\n */\n private async handlePasskeyRemove(req: Request, res: Response): Promise<void> {\n try {\n const preAuthEc = await this._getPreAuthExecutionContext();\n const { userId, email } = await this.authJwtGuard.extractAuthenticatedUser(preAuthEc, req);\n const ec = await this._getAuthenticatedExecutionContext(userId);\n const { credentialId } = req.body;\n if (!credentialId) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: 'credentialId is required' },\n });\n }\n await this.methodManagementService.enforceUserMethodRemovalAllowed(ec, userId);\n\n const credentials = await this.webAuthnService.getCredentials(ec, userId);\n const target = credentials.find((c) => c.credentialId === credentialId);\n\n // D9 safety check: count password + passkeys + identity links\n const authMethodCounts = await this.methodManagementService.countAuthMethods(ec, userId);\n if (authMethodCounts.total <= 1) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: 'Cannot remove your only authentication method' },\n });\n }\n\n await this.webAuthnService.removeCredential(ec, userId, credentialId);\n\n // F4 per-org SIEM routing — route ONLY on the user's VERIFIED ACTIVE member orgs\n // (verified-JWT `userId`).\n const routingOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, userId);\n await this.auditLogsService.logUserPasskeyRemoved({\n userId: userId,\n email,\n credentialId,\n credentialName: target?.name || 'Unknown',\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n }, ec, routingOrgIds);\n\n this.jsonSuccess(res, { removed: true });\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { operation: AUTH_OPERATION.PASSKEY_REMOVE },\n });\n }\n }\n\n /**\n * POST /auth/passkey/rename\n * Headers: Authorization: Bearer <accessToken>\n * Body: { credentialId: string, name: string }\n * Response: { renamed: boolean }\n *\n * JWT-authenticated. Renames a passkey for the authenticated user.\n */\n private async handlePasskeyRename(req: Request, res: Response): Promise<void> {\n try {\n const preAuthEc = await this._getPreAuthExecutionContext();\n const { userId } = await this.authJwtGuard.extractAuthenticatedUser(preAuthEc, req);\n const ec = await this._getAuthenticatedExecutionContext(userId);\n const { credentialId, name } = req.body;\n if (!credentialId || !name) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: 'credentialId and name are required' },\n });\n }\n await this.webAuthnService.renameCredential(ec, userId, credentialId, name);\n this.jsonSuccess(res, { renamed: true });\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { operation: AUTH_OPERATION.PASSKEY_RENAME },\n });\n }\n }\n\n\n // ═══════════════════════════════════════════════════════════════\n // Refresh-token cookie seam (auth-hardening Slice A — A-K-3)\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * Drop-in replacement for `this.jsonSuccess(res, body)` that ALSO\n * emits `Set-Cookie: __wildo_refresh=<refreshToken>` when the caller\n * passes a non-empty `refreshToken` string as the third argument.\n *\n * **Cookie-only contract** (Auth-hardening Slice A Step 6, 2026-04-13).\n * Pre-A-Step-6 this wrapper auto-discovered `body.refreshToken` and\n * emitted both the cookie AND the body field (transitional dual-\n * write per A-K-5 so legacy clients could still read the field\n * during the migration window). A-Step 6 removed `refreshToken`\n * from the wire schemas entirely; the wrapper now requires the\n * caller to pass the refresh-token VALUE explicitly so the wire\n * payload (`body`) physically cannot contain the field anymore.\n *\n * Why an explicit argument rather than implicit body inspection:\n * - **Honest contract**: every auth seam that hands a refresh\n * token to the wire is now visible at the call site\n * (`this._jsonSuccessWithRefreshCookie(res, body, refreshToken)`).\n * A future handler that issues a refresh token and forgets to\n * pass it through this argument silently fails to set the\n * cookie — caught by the schema-pin tests, NOT by accidental\n * body-key collision.\n * - **No accidental leakage**: with implicit body inspection, a\n * caller serialising a `refreshToken` field by mistake would\n * emit it on the wire (the bug A-Step 6 closes). Explicit\n * argument means the body cannot carry the token even by\n * accident — it's not in the schema and it's not where the\n * wrapper looks.\n *\n * Why a wrapper rather than touching `jsonSuccess` in the abstract\n * base controller (unchanged from pre-A-Step-6):\n * - `jsonSuccess` is shared by every controller in the platform;\n * the cookie semantics are auth-specific.\n * - Centralising the cookie write at the wire-leaving seam means\n * ANY future auth handler gets the same `Set-Cookie` shape via\n * a single function — no chance of attribute drift.\n * - The wrapper is a no-op when `refreshToken` is undefined (or\n * an empty string), so it's safe to use as the default\n * replacement for `jsonSuccess` in this controller — non-token\n * payloads (session-state, OAuth authorize URL, etc.) call it\n * with `refreshToken: undefined` and pass through unchanged.\n */\n private _jsonSuccessWithRefreshCookie(\n res: Response,\n body: unknown,\n refreshToken: string | undefined,\n statusCode: number = 200,\n ): void {\n if (typeof refreshToken === 'string' && refreshToken.length > 0) {\n AuthControllerUtils.setRefreshCookie(\n res,\n refreshToken,\n this.appConfigService.config.jwt.refreshTokenExpirationDays,\n this.appConfigService.applicationEnv,\n );\n }\n this.jsonSuccess(res, body, statusCode);\n }\n\n /**\n * Clear the refresh cookie on logout / session invalidation. Reads\n * the runtime env from `appConfigService` so the same `Secure`\n * attribute that was set at issuance is used at clearance — the\n * browser only honours deletion when the attributes match.\n */\n private _clearRefreshCookie(res: Response): void {\n AuthControllerUtils.clearRefreshCookie(res, this.appConfigService.applicationEnv);\n }\n\n /**\n * Pre-auth EC for operations where the caller is not yet authenticated.\n * Uses PUBLIC_EXECUTION with APP_PUBLIC (minimal privilege, no initiator).\n * Primary intent: user identification/lookup across auth handlers.\n *\n * Also used as the bootstrap EC for JWT/session extraction calls\n * (`extractAuthenticatedUser`, `extractFromSessionOrJwt`) since identity\n * is unknown at that point.\n */\n private async _getPreAuthExecutionContext() {\n return this.authEcFactory.createForPreAuthOperation(this.authEcFactory.getUsersReadOperationPath());\n }\n\n /**\n * Authenticated EC for operations where the caller's identity has been\n * confirmed via JWT. Carries userId attribution for audit trail and\n * uses APP_USER role.\n *\n * Endpoints that call `extractAuthenticatedUser` (requiring a valid JWT)\n * should use this for all downstream service calls after extraction.\n */\n private async _getAuthenticatedExecutionContext(userId: string) {\n return this.authEcFactory.createForAuthenticatedAuthOperation(userId, this.authEcFactory.getUsersReadOperationPath());\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Private: Frontend Redirect Helpers\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * Redirect to the frontend callback page with the one-time exchange code.\n * URL: {frontendUrl}/auth/callback?code={exchangeCode}\n *\n * @param frontendUrl - The resolved frontend publicUrl from the OAuth2 state token.\n * If undefined (state token didn't carry frontendServiceName — legacy flows), throws.\n */\n private redirectToFrontendWithCode(\n res: Response,\n exchangeCode: string,\n frontendUrl?: string,\n returnUrl?: string,\n ): void {\n if (!frontendUrl) {\n throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {\n context: { message: 'Cannot redirect: frontendServiceName was not stored in OAuth2 state token. The originating frontend is unknown.' },\n });\n }\n const searchParams = new URLSearchParams({\n code: exchangeCode,\n });\n if (returnUrl) {\n searchParams.set('redirect', returnUrl);\n }\n const redirectUrl = `${frontendUrl}/auth/callback?${searchParams.toString()}`;\n res.redirect(302, redirectUrl);\n }\n\n /**\n * Redirect to the frontend login page with an error.\n * URL: {frontendUrl}/login?error={error}&reason={description}\n *\n * TRAP 6: Error redirect goes to login page (not generic error page)\n * so the user can retry.\n *\n * If frontendUrl is undefined (state token didn't carry frontendServiceName, or error\n * occurred before state could be read), falls back to a plain JSON error\n * since we can't redirect to an unknown frontend.\n */\n private redirectToFrontendWithError(\n res: Response,\n error: string,\n description: string,\n frontendUrl?: string,\n returnUrl?: string,\n ): void {\n if (!frontendUrl) {\n res.status(400).json({ error, error_description: description });\n return;\n }\n const searchParams = new URLSearchParams({\n error,\n reason: description,\n });\n if (returnUrl) {\n searchParams.set('redirect', returnUrl);\n }\n const redirectUrl = `${frontendUrl}/login?${searchParams.toString()}`;\n res.redirect(302, redirectUrl);\n }\n\n private validateFrontendReturnUrl(returnUrl: string, frontendUrl: string): void {\n if (returnUrl.startsWith('/') && !returnUrl.startsWith('//')) {\n return;\n }\n\n const allowedOrigins = new Set<string>();\n try {\n allowedOrigins.add(new URL(frontendUrl).origin);\n } catch {\n // frontendUrl comes from validated config, but keep the helper defensive.\n }\n\n for (const frontendServiceName of Object.keys(this.appConfigService.config.frontendServices ?? {})) {\n const publicUrl = AuthControllerUtils.lookupFrontendPublicUrl(\n this.appConfigService.config,\n frontendServiceName,\n );\n if (!publicUrl) {\n continue;\n }\n allowedOrigins.add(new URL(publicUrl).origin);\n }\n\n try {\n const parsed = new URL(returnUrl);\n if (allowedOrigins.has(parsed.origin)) {\n return;\n }\n } catch {\n // Invalid absolute URL — reject below.\n }\n\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: {\n message: 'Invalid returnUrl: must be a relative path or an allowed frontend origin',\n returnUrl,\n },\n });\n }\n\n /**\n * Resolve the public URL of the frontend app that initiated this request.\n *\n * Reads the X-Frontend-Service-Name header (a configured frontend service identity),\n * then looks up the\n * corresponding publicUrl from the configured runtime endpoints.\n *\n * Fail-fast: throws if the header is missing, the frontend service is unknown,\n * or no publicUrl is configured for that frontend service.\n */\n private resolveFrontendAppPublicUrl(req: Request): string {\n const frontendServiceName = req.headers[WildoHeaderKeys.FRONTEND_SERVICE_NAME] as string | undefined;\n\n if (!frontendServiceName) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.FRONTEND_SERVICE_HEADER_REQUIRED,\n context: {\n // diagnostic (log-only)\n header: WildoHeaderKeys.FRONTEND_SERVICE_NAME,\n },\n });\n }\n\n return this._lookupFrontendPublicUrl(frontendServiceName);\n }\n\n /**\n * Resolve the frontend service identity from a raw string (e.g., from state token metadata).\n * Returns the publicUrl for that frontend service. Throws if invalid or not configured.\n */\n private resolveFrontendAppPublicUrlFromFrontendServiceName(frontendServiceName: string): string {\n return this._lookupFrontendPublicUrl(frontendServiceName);\n }\n\n /**\n * Core lookup: delegates to AuthControllerUtils.lookupFrontendPublicUrl (returns null on failure),\n * then throws if null. Preserves the original fail-fast behavior in the controller.\n */\n private _lookupFrontendPublicUrl(frontendServiceName: string): string {\n const url = AuthControllerUtils.lookupFrontendPublicUrl(this.appConfigService.config, frontendServiceName);\n if (!url) {\n throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {\n context: {\n message: `Cannot resolve publicUrl for frontend service \"${frontendServiceName}\".`,\n frontendServiceName,\n },\n });\n }\n return url;\n }\n\n /**\n * AUTH-10: Cross-validate X-Frontend-Service-Name header against the browser Origin header.\n *\n * The Origin header is browser-enforced (forbidden header per Fetch spec) and cannot\n * be spoofed by client-side JavaScript. If the Origin doesn't match the configured\n * publicUrl for the claimed frontend service, the request is rejected.\n *\n * Non-browser clients (curl, Postman, mobile SDKs) do not send the Origin header,\n * so this validation is skipped for them. This is acceptable because:\n * - Rate limiting gates all registration/identify endpoints\n * - Registration policy enforcement (mode, password policy) applies regardless\n * - The DB override in the orchestrator protects known users independently\n * If non-browser registration restriction is needed, use invitation tokens or API keys.\n */\n private _validateFrontendAppOrigin(req: Request, claimedFrontendServiceName: string | undefined): void {\n if (!claimedFrontendServiceName) return;\n\n const configuredUrl = AuthControllerUtils.lookupFrontendPublicUrl(this.appConfigService.config, claimedFrontendServiceName);\n if (!configuredUrl) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,\n context: {\n message:\n `Unknown or unbound frontend service identity \"${claimedFrontendServiceName}\". ` +\n `Declare it in frontendServices and materialize runtime.endPoints.${claimedFrontendServiceName}.publicUrl before using it at runtime.`,\n frontendServiceName: claimedFrontendServiceName,\n },\n });\n }\n\n // Origin absent → non-browser client or same-origin; skip (see JSDoc for rationale)\n const origin = req.headers[WildoHeaderKeys.ORIGIN] as string | undefined;\n if (!origin) return;\n\n let configuredOrigin: string;\n try {\n configuredOrigin = new URL(configuredUrl).origin;\n } catch {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Malformed runtime.endPoints.${claimedFrontendServiceName}.publicUrl; ` +\n `cannot validate request Origin against the claimed frontend service identity.`,\n frontendServiceName: claimedFrontendServiceName,\n publicUrl: configuredUrl,\n },\n });\n }\n\n if (origin !== configuredOrigin) {\n this.logDebug('Origin mismatch — X-Frontend-Service-Name header does not match request Origin', {\n claimedFrontendServiceName,\n requestOrigin: origin,\n configuredOrigin,\n });\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,\n context: { message: 'Request origin does not match the claimed frontend service identity.' },\n });\n }\n }\n\n /**\n * Redeem-time binding for cross-frontend handoff codes.\n *\n * Handoff issuance stores the intended `targetServiceKey` in the\n * consumable-token metadata. A leaked code should not be redeemable from a\n * different configured frontend during its short lifetime. OAuth2 callback\n * codes do not carry `targetServiceKey`, so they intentionally bypass this\n * check and keep their existing `/auth/token/exchange` behavior.\n */\n private _validateTokenExchangeTargetBinding(\n req: Request,\n metadata: { targetServiceKey?: unknown },\n ): void {\n if (typeof metadata.targetServiceKey !== 'string') return;\n\n const claimedFrontendServiceName = req.headers[WildoHeaderKeys.FRONTEND_SERVICE_NAME] as string | undefined;\n if (!claimedFrontendServiceName) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.FRONTEND_SERVICE_HEADER_REQUIRED,\n context: {\n // diagnostic (log-only)\n targetServiceKey: metadata.targetServiceKey,\n },\n });\n }\n\n if (claimedFrontendServiceName !== metadata.targetServiceKey) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,\n context: {\n message: 'AUTH_CODE_EXCHANGE handoff redemption attempted from the wrong frontend service.',\n targetServiceKey: metadata.targetServiceKey,\n claimedFrontendServiceName,\n },\n });\n }\n\n this._validateFrontendAppOrigin(req, claimedFrontendServiceName);\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Magic Link Route Handlers (Phase G2)\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * POST /auth/magic-link/send\n * Body: { email: string }\n * Response: { message: string }\n *\n * Generates a magic link token and sends an email containing the link.\n * Always returns success to prevent email enumeration.\n */\n private async magicLinkSend(req: Request, res: Response): Promise<void> {\n // PR-7b-fixes F-22 fail-fast ordering generalized: body parse →\n // rate-limit → ec. Same victim-protective ranking as the\n // account-lifecycle family (named-account FIRST, source-noise\n // LAST) — see `register` for the full F-20 rationale.\n const body = MagicLinkSendRequestSchema.parse(req.body || {});\n\n // PR 8b (rate-limit unification, Step 5 — Option D, second\n // service-layer lift). The dual-window per-email burst cap\n // (formerly `${AUTH_REDIS_KEYS.MAGIC_LINK_MIN}${email}:min` AND\n // `:hour`, both raw `checkRateLimit` inside\n // `AuthenticationOrchestratorBackendService.sendMagicLink`)\n // moved UP to `AuthenticationController.magicLinkSend` as a\n // SINGLE multi-window declarative `checkPolicy` companion to\n // the existing per-IP cap (PR 7a). The two raw calls collapse\n // into ONE `checkPolicy` because the rate-limit service composes\n // both windows via `deriveWindows`, and F-9's compare-and-set\n // guard surfaces the TIGHTEST active window in `X-RateLimit-*`\n // headers. Caps are sourced from\n // `appConfigService.config.auth.magicLinkOperational` (same\n // configuration the orchestrator previously read via\n // `this.magicLinkConfig`) — no behavior change beyond the\n // header surfacing and the F-15 `:by-<dim>` namespace rename.\n //\n // Rationale for the lift: rate limits are intrinsically HTTP\n // concerns — bucket keys (email, IP) live at the HTTP layer,\n // 429 feedback is HTTP-only, and service contracts must remain\n // HTTP-type-free. Unlike `authenticatePassword` (PR 8e Option K)\n // and `sendSMSOTP` (PR 8d Option K), `sendMagicLink`'s bucket\n // key IS an HTTP-layer artefact (`request.email` from the body,\n // not session-stored or DB-resolved state) so the K-3 escape-\n // hatch does NOT apply here — the lift is the framework-canonical\n // outcome.\n //\n // Order — VICTIM-PROTECTIVE bucket FIRST per F-20 (named-account\n // before loud-source): per-email THEN per-IP. When both buckets\n // would trip on the same request, the per-email 429 short-\n // circuits and the per-IP increment never happens — surfaces the\n // most-relevant defensive intent (an attacker hammering one\n // victim email gets the per-email cap, not the per-IP cap).\n //\n // `body.email` is ALREADY lowercased by `MagicLinkSendRequestSchema`\n // (`.email().toLowerCase()`), so the explicit `.toLowerCase()`\n // here is a defense-in-depth no-op kept verbatim to preserve\n // the intent-revealing call-site invariant shared with every\n // other email-keyed bucket in the family (D-4 baseline; plus-\n // tail and Gmail-dot tricks NOT collapsed). F-15 `:by-email`\n // and `:by-ip` scope suffixes (the per-IP bucket's PR-7a-era\n // `auth:magic-link:send` scope is renamed to\n // `auth:magic-link:send:by-ip` for namespace consistency with\n // the new per-email companion — Redis key shape changes from\n // `auth:magic-link:send:<ip>:hour` to\n // `auth:magic-link:send:by-ip:<ip>:hour`; rolling-window reset\n // of in-flight per-IP buckets is acceptable, max 1-hour blip).\n const magicLinkConfig = this.appConfigService.config.auth.magicLinkOperational;\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: magicLinkConfig.rateLimitPerMinute, requestsPerHour: magicLinkConfig.rateLimitPerHour },\n 'auth:magic-link:send:by-email',\n undefined,\n body.email.toLowerCase(),\n );\n await this.rateLimitService.checkPolicy(req, res, { requestsPerHour: 10 }, 'auth:magic-link:send:by-ip');\n\n const ec = await this._getPreAuthExecutionContext();\n const ipAddress = getClientIpFromRequest(req);\n const userAgent = req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown';\n\n this.logDebug('Magic link send requested', { email: body.email });\n\n const result = await this.authService.sendMagicLink(ec, body, { ipAddress, userAgent });\n\n await this._sendMagicLinkEmail(req, result);\n\n this.jsonSuccess(res, this.authResponseHelper.getAuthResponse(AuthResponseMessageRef.MAGIC_LINK_SENT));\n }\n\n /**\n * Build the magic-link URL and dispatch the delivery email. Shared by `magicLinkSend` (the\n * standalone magic-link login) and `acceptInvitation` (magic-link-at-accept) so the URL shape,\n * template, and anti-enumeration error-swallowing live in ONE place. The frontend origin comes\n * from the request (`resolveFrontendAppPublicUrl`), which is why this lives at the HTTP layer and\n * the service only mints the token. A no-op when no token was minted (anti-enumeration).\n */\n private async _sendMagicLinkEmail(\n req: Request,\n delivery: {\n token?: string;\n submissionId?: string;\n email?: string;\n userId?: string;\n expiresInMinutes?: number;\n },\n ): Promise<void> {\n if (!delivery.token || !delivery.email) return;\n try {\n const frontendUrl = this.resolveFrontendAppPublicUrl(req);\n const magicLinkUrl = `${frontendUrl}/auth/magic-link/verify?token=${encodeURIComponent(delivery.token)}&email=${encodeURIComponent(delivery.email)}`;\n\n const appIdentity = this.appConfigService.config.appIdentity;\n const emailResult = await this.emailService.send({\n submissionId: delivery.submissionId,\n templateRef: SystemEmailTemplateRef.MAGIC_LINK,\n locale: getConfiguredPrimaryLanguage(this.appConfigService.config),\n type: EmailTemplateType.TRANSACTIONAL,\n to: delivery.email,\n context: {\n currentObject: { email: delivery.email },\n objectContext: {\n primaryScopeContext: {\n appName: appIdentity.appName,\n applicationId: this.appConfigService.applicationId,\n },\n },\n userContext: { userId: delivery.userId || 'unknown', email: delivery.email },\n additionalContext: { magicLinkUrl, tokenValue: delivery.token, expiresInMinutes: delivery.expiresInMinutes },\n },\n });\n if (\n !emailResult.success\n || emailResult.outcome !== EmailSubmissionOutcome.PROVIDER_ACCEPTED\n ) {\n this.logger.error('Magic link email provider did not confirm acceptance', {\n email: delivery.email,\n submissionId: emailResult.submissionId,\n outcome: emailResult.outcome,\n error: emailResult.error,\n });\n }\n } catch (error) {\n this.logger.error('Failed to send magic link email', {\n email: delivery.email,\n ...projectCaughtErrorLogFields(error),\n });\n // Don't reveal email delivery failure (anti-enumeration)\n }\n }\n\n /**\n * POST /auth/magic-link/verify\n * Body: { token: string, email: string }\n * Response: AuthenticationResponse\n *\n * Validates a magic link token and returns auth tokens on success.\n * Email is included for defense-in-depth constant-time comparison against token metadata.\n * This is a standalone auth endpoint (not dispatched through authenticate()).\n */\n private async magicLinkVerify(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const body = MagicLinkVerifyRequestSchema.parse(req.body || {});\n const ipAddress = getClientIpFromRequest(req);\n const userAgent = req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown';\n\n // IP-based rate limit for resource protection. PR 7a — same passwordless\n // wave as `magicLinkSend` above. 20/min/IP, IP-keyed (per-token keying\n // would defeat the very token-bruteforce defense this is meant to catch\n // — the bucket would reset every time the attacker tries a new token).\n await this.rateLimitService.checkPolicy(req, res, { requestsPerMinute: 20 }, 'auth:magic-link:verify');\n\n this.logDebug('Magic link verify requested');\n\n // W3.5 + W3.11: resolve the `activeUserType` hint from `X-Frontend-Service-Name`, exactly as `identify`\n // and `register` do (including the AUTH-10 Origin cross-validation). This call site previously omitted\n // the argument entirely, which left the session created by `verifyMagicLink` with NO `activeUserType`\n // and — before the service was made to resolve the type from the user itself — made every magic-link\n // login fail the AUTH-24 policy gate against `FALLBACK_AUTH_POLICY`.\n //\n // The service no longer DEPENDS on this hint for the policy decision (it prefers the resolved user's\n // `userTypes[0]`), so this is not the fix for that bug on its own. It matters because the hint is\n // stamped onto the created session, and the MFA-after-magic-link continuation reads it back — a session\n // with no `activeUserType` degrades that leg's policy resolution and skips the W3.1b user-type check.\n const magicLinkFrontendServiceName = req.headers[WildoHeaderKeys.FRONTEND_SERVICE_NAME] as string | undefined;\n this._validateFrontendAppOrigin(req, magicLinkFrontendServiceName);\n const magicLinkActiveUserType = magicLinkFrontendServiceName\n ? this.appConfigService.resolveUserTypeFromFrontendServiceName(magicLinkFrontendServiceName) ?? undefined\n : undefined;\n\n const authResponse = await this.authService.verifyMagicLink(ec, body, { ipAddress, userAgent }, magicLinkActiveUserType);\n\n await this.handleAnonymousTransposition(req, res, authResponse);\n // Auth-hardening A-Step 6 — destructure cookie-only `refreshToken`.\n const { refreshToken, ...wireBody } = authResponse;\n this._jsonSuccessWithRefreshCookie(res, wireBody, refreshToken);\n }\n\n // ═══════════════════════════════════════════════════════════════\n // SMS OTP Route Handlers (Phase G2)\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * POST /auth/sms-otp/send\n * Body: { sessionId: string, phoneNumber?: string }\n * Response: { message: string }\n *\n * Generates an OTP code and sends it via SMS.\n * Requires an active auth session. Can be used for first or second factor.\n */\n private async smsOTPSend(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const body = z.object({\n sessionId: z.string().min(1),\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/, { error: 'Invalid phone number' }).optional(),\n }).parse(req.body || {});\n\n this.logDebug('SMS OTP send requested', { sessionId: body.sessionId });\n\n // IP-based rate limit to prevent SMS pump fraud from a single source.\n // PR 7a — passwordless wave. 5/hour/IP, IP-keyed (sessionId-keying\n // would let an attacker rotate sessions to amplify; the IP cap is\n // the right defense against SMS pump fraud — actual cost-bearing\n // resource is the SMS spend per source IP). `checkPolicy` derives\n // the IP internally — the local `ipAddress` extraction is no\n // longer needed here (was previously the only consumer at this\n // seam; the SMS-send call itself doesn't take ipAddress).\n await this.rateLimitService.checkPolicy(req, res, { requestsPerHour: 5 }, 'auth:sms-otp:send');\n\n const result = await this.authService.sendSMSOTP(ec, body.sessionId, body.phoneNumber);\n\n const appIdentity = this.appConfigService.config.appIdentity;\n const smsResult = await this.smsService.send(\n result.targetPhone,\n this.authResponseHelper.getSmsLabel(BackendSmsMessageRef.OTP_VERIFICATION_CODE, { appName: appIdentity.appName, code: result.otpCode }),\n );\n if (!smsResult.success) {\n this.logger.error('SMS OTP delivery failed', {\n sessionId: body.sessionId,\n error: smsResult.error,\n });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { message: this.authResponseHelper.getSmsLabel(BackendSmsMessageRef.VERIFICATION_SEND_FAILED) },\n });\n }\n\n this.jsonSuccess(res, { message: this.authResponseHelper.getSmsLabel(BackendSmsMessageRef.VERIFICATION_SENT) });\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Phone Verification Route Handlers (Phase G2)\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * POST /auth/phone/verify/send\n * Body: { phoneNumber: string, sessionId?: string }\n * Response: { message: string }\n *\n * Sends a verification code to prove phone number ownership.\n * Used during account setup, not authentication.\n */\n private async phoneVerifySend(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const body = PhoneVerifySendRequestSchema.parse(req.body || {});\n // `ipAddress` MUST stay extracted locally — it's threaded down into\n // `phoneVerificationService.createVerificationCode` below for the\n // audit/anti-fraud trail. `checkPolicy` re-derives the same IP via\n // `getClientIpFromRequest` for the per-IP bucket — the two derivations\n // agree by construction (same helper, single source of truth — F-3).\n const ipAddress = getClientIpFromRequest(req);\n\n // PR 7-D-3 — phone-verify migration. Two policies AND-ed at the same\n // seam, with DIFFERENT identifiers (separate `checkPolicy` calls\n // because the bucket suffix can't be both phone and IP at once):\n //\n // 1) Per-phone-number 3/5min throttle. The 5-minute (300s) window\n // matches the OTP TTL that `createVerificationCode` issues — an\n // attacker can't spam SMS to a single victim faster than the OTP\n // they'd be racing against. This is the FIRST consumer of\n // `customWindows` (D-3, Option A — chosen because rounding 300s\n // to 60s would let an attacker burst 12x the intended rate, and\n // rounding to 3600s would silently relax victim protection by\n // 12x). Phone-keyed via `clientIdOverride` — must be per-phone\n // (not IP) so a botnet can't sidestep it. The phone is\n // NORMALIZED via `AuthControllerUtils.phoneRateLimitBucketKey`\n // so `+33...` and `33...` (and a future-permitted `0033...`)\n // share one bucket — without normalization an attacker could\n // double the cap by alternating prefix forms (F-14, PR 7-D-3\n // review fix).\n //\n // 2) Per-IP 5/hour cap. Defense against a single source pumping\n // SMS spend across many victim phone numbers (cost defense, not\n // victim defense — the per-phone limit handles that). IP-keyed\n // by default (no `clientIdOverride`).\n //\n // Scope-key naming follows the F-15 `:by-phone` / `:by-ip`\n // convention so the two scope namespaces never overlap as\n // prefixes (`auth:phone-verify:send` is no longer a prefix of\n // `auth:phone-verify:send:ip`).\n //\n // BOTH calls run BEFORE `extractFromSessionOrJwt` (F-18 fail-fast\n // pattern, mirroring PR 6's `handlePasswordChange` /\n // `handleReauth`). Abusive callers exceeding either bucket fail\n // before the JWT-verify round trip — important because this\n // endpoint is the cheapest amplification target in the\n // phone-verify family (the orchestrator-level OTP issuance is\n // SMS-cost-bearing).\n //\n // F-9 compare-and-set: the response advertises the tightest active\n // window across both checks, and on 429 `Retry-After` reports the\n // latest tripped window's recovery because declared windows are AND-ed.\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { customWindows: [{ requestsPerWindow: 3, windowSeconds: 300 }] },\n 'auth:phone-verify:send:by-phone',\n undefined,\n AuthControllerUtils.phoneRateLimitBucketKey(body.phoneNumber),\n );\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerHour: 5 },\n 'auth:phone-verify:send:by-ip',\n );\n\n await this.authJwtGuard.extractFromSessionOrJwt(ec, req);\n\n const { otpCode } = await this.phoneVerificationService.createVerificationCode(ec, {\n phoneNumber: body.phoneNumber,\n ipAddress,\n });\n\n const appIdentity = this.appConfigService.config.appIdentity;\n const smsResult = await this.smsService.send(\n body.phoneNumber,\n this.authResponseHelper.getSmsLabel(BackendSmsMessageRef.PHONE_VERIFICATION_CODE, { appName: appIdentity.appName, code: otpCode, expiry: '10' }),\n );\n if (!smsResult.success) {\n this.logger.error('Phone verification SMS delivery failed', { phoneNumber: body.phoneNumber, error: smsResult.error });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { message: this.authResponseHelper.getSmsLabel(BackendSmsMessageRef.VERIFICATION_SEND_FAILED) },\n });\n }\n\n this.jsonSuccess(res, { message: this.authResponseHelper.getSmsLabel(BackendSmsMessageRef.PHONE_VERIFICATION_SENT) });\n }\n\n /**\n * POST /auth/phone/verify/confirm\n * Body: { phoneNumber: string, code: string }\n * Response: { verified: boolean }\n *\n * Confirms phone ownership by validating the submitted code.\n * On success, marks the phone as verified on the user's credentials.\n */\n private async phoneVerifyConfirm(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const body = PhoneVerifyConfirmRequestSchema.parse(req.body || {});\n\n // PR 7-D-3 — phone-verify migration. 5/5min/phone — defense against\n // OTP brute-force on a known target phone number. Same 5-minute\n // (300s) window-of-protection as `phoneVerifySend` above and same\n // `customWindows` rationale: the window length is dictated by the\n // OTP TTL, not by an arbitrary minute/hour grid. Phone-keyed via\n // `clientIdOverride` (NORMALIZED via\n // `AuthControllerUtils.phoneRateLimitBucketKey` — see F-14) — IP-\n // keying would be wrong here (an attacker bruteforcing one\n // victim's OTP from a botnet would each get fresh 5-attempt\n // buckets). No per-IP companion limit at this seam: the global\n // HTTP limiter (1000/min/IP) catches IP-level pumping, and the\n // per-phone cap is the right defense-in-depth layer.\n //\n // Scope-key uses the `:by-phone` suffix (F-15 — same convention as\n // `phoneVerifySend` above; reserves space for a future `:by-ip` or\n // `:by-userId` companion without prefix collision).\n //\n // Rate-limit runs BEFORE `extractFromSessionOrJwt` (F-18 fail-fast\n // — same rationale as `phoneVerifySend` above). The endpoint\n // requires authentication on the success path, but having to\n // verify a JWT or session for every bruteforce attempt would let\n // an attacker amplify our verification cost; the bucket trip is\n // cheap and identifies the attack surface (`body.phoneNumber`)\n // independently of the caller's auth state.\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { customWindows: [{ requestsPerWindow: 5, windowSeconds: 300 }] },\n 'auth:phone-verify:confirm:by-phone',\n undefined,\n AuthControllerUtils.phoneRateLimitBucketKey(body.phoneNumber),\n );\n const { userId } = await this.authJwtGuard.extractFromSessionOrJwt(ec, req);\n\n const result = await this.phoneVerificationService.confirmVerification(ec, {\n phoneNumber: body.phoneNumber,\n code: body.code,\n userId,\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n });\n\n // Defensive anonymous→authenticated transposition (feature-owner opt-in).\n // Unlike the login/registration seams, the caller here is ALREADY\n // authenticated (`extractFromSessionOrJwt`), so a website capture normally\n // transposed at their real login. This is a belt-and-braces catch-all for\n // the edge case where a still-attached `__wildo_anon_session` (header or\n // cookie) was never consumed. Gated on a SUCCESSFUL verification so a failed\n // OTP attempt never triggers it; the trigger is idempotent + non-blocking\n // (swallows errors, keeps the cookie on PENDING) and runs before the\n // response so any cookie-clear `Set-Cookie` precedes `res.json`.\n if (result.verified && userId) {\n await this.handleAnonymousTranspositionForTokenExchange(req, res, userId);\n }\n\n // Phone verify-confirm does NOT issue a refresh token (the service\n // returns `{ verified, messageRef?, message? }`); pass `undefined`\n // for the cookie arg so the wrapper is a clean no-op for the\n // cookie path. Wrapper still routes through `jsonSuccess` for the\n // body — uniform call shape across the controller.\n this._jsonSuccessWithRefreshCookie(res, result, undefined);\n }\n\n // ═══════════════════════════════════════════════════════════════\n // W7.3b: One-Off Session Token Handlers\n // ═══════════════════════════════════════════════════════════════\n\n private async createOneOffToken(req: Request, res: Response): Promise<void> {\n const preAuthEc = await this._getPreAuthExecutionContext();\n // PR 7a — passwordless / one-off wave. 30/min/IP, kept BEFORE\n // `extractAuthenticatedUser` (deliberate fail-fast — abusive callers\n // shouldn't consume a JWT-verification round trip per attempt).\n // IP-keyed by construction at this point. Per-userId quota could be\n // layered post-auth in a follow-up (super-admin rate is the natural\n // upper bound — 30/min is generous for any single super-admin).\n const ipAddress = getClientIpFromRequest(req);\n await this.rateLimitService.checkPolicy(req, res, { requestsPerMinute: 30 }, 'auth:one-off:create');\n\n const caller = await this.authJwtGuard.extractAuthenticatedUser(preAuthEc, req);\n const ec = await this._getAuthenticatedExecutionContext(caller.userId);\n const body = CreateOneOffTokenRequestSchema.parse(req.body || {});\n\n const callerUser = await this.userLookup.findUserById(ec, caller.userId);\n const callerRoles = callerUser?.appRoles || [];\n const isAdmin = callerRoles.includes(CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN);\n if (!isAdmin) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED,\n });\n }\n\n if (caller.userId === body.userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED,\n });\n }\n\n const targetUser = await this.userLookup.findUserById(ec, body.userId);\n if (!targetUser) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_FOUND,\n context: { userId: body.userId },\n });\n }\n if (targetUser.status !== UserStatus.ACTIVE) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_ACTIVE,\n context: { userId: body.userId },\n });\n }\n\n const userType = targetUser.userTypes?.[0];\n if (!userType) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_TYPE_MISMATCH,\n context: { userId: body.userId }, // diagnostic (log-only)\n });\n }\n\n const appConfig = this.appConfigService.config;\n const userTypeConfig = appConfig?.userTypes?.[userType];\n if (!userTypeConfig?.auth?.oneOffSessionAllowed) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.FEATURE_NOT_AVAILABLE,\n context: { userType }, // diagnostic (log-only)\n });\n }\n\n const expiresIn = body.expiresIn;\n const durationMs =\n expiresIn.unit === 'minutes' ? expiresIn.value * 60 * 1000\n : expiresIn.unit === 'hours' ? expiresIn.value * 3600 * 1000\n : expiresIn.value * 86400 * 1000;\n\n // revocation-B1: cap the requested lifetime at the per-user-type policy, which itself can only TIGHTEN\n // below the framework-wide one-off SESSION ceiling (ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES, ~12h per AWS\n // STS / GCP / OWASP). This is the request-path (super-admin) tightening; the absolute ceiling is enforced\n // for EVERY mint path at the `createToken` chokepoint, so a config-declared mint is bounded there too.\n // `userTypeConfig.auth` is narrowed non-null by the `oneOffSessionAllowed` guard above.\n const maxDurationMinutes = Math.min(\n userTypeConfig.auth.oneOffSessionMaxDurationMinutes ?? ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES,\n ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES,\n );\n if (durationMs > maxDurationMinutes * 60 * 1000) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.ONE_OFF_SESSION_DURATION_EXCEEDS_MAX,\n context: { requestedMinutes: Math.round(durationMs / 60000), maxMinutes: maxDurationMinutes }, // diagnostic (log-only)\n });\n }\n\n const organizationId = req.params.organizationId as string | undefined;\n const applicationId = req.params.applicationId as string | undefined;\n\n const tokenResult = await this.consumableTokenService.createToken({\n tokenType: body.tokenType as string,\n consumptionMode: body.consumptionMode,\n expiresIn: { value: durationMs, unit: DurationUnit.MILLISECONDS },\n organizationId,\n userId: body.userId,\n resourceIdentifier: body.resourceIdentifier,\n relatedId: body.relatedId,\n metadata: { ...body.metadata, ...(applicationId ? { applicationId } : {}) },\n roles: (targetUser.appRoles || []).map(role => ({\n roles: [role],\n relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n })),\n maxUses: body.maxUses,\n createsOneOffSession: true,\n consumeAt: body.consumeAt,\n targeting: body.targeting,\n });\n\n try {\n await this.auditLogsService.logGenericEvent({\n userId: caller.userId,\n organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.ONE_OFF_TOKEN_CREATED,\n eventData: {\n tokenId: tokenResult._id,\n tokenType: body.tokenType,\n targetUserId: body.userId,\n consumeAt: body.consumeAt,\n callerUserId: caller.userId,\n ipAddress,\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n },\n }, ec);\n } catch (error) {\n this.logger.warn('Audit log failed for one-off token creation', { error, tokenId: tokenResult._id });\n }\n\n this.jsonSuccess(res, {\n tokenValue: tokenResult.token,\n tokenId: tokenResult._id,\n expiresAt: tokenResult.expiresAt,\n });\n }\n\n private async exchangeOneOffToken(req: Request, res: Response): Promise<void> {\n // PR 7a — passwordless / one-off wave. The two raw `checkRateLimit`\n // calls (10/min/IP + 100/hour/IP) collapse into a single declarative\n // `checkPolicy` with multi-window AND-semantics. Net code reduction\n // (2 calls → 1) AND consolidation: F-9's compare-and-set guard now\n // automatically reports the TIGHTEST active window in the response\n // headers (the binding constraint), not whichever check fired last.\n const ipAddress = getClientIpFromRequest(req);\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10, requestsPerHour: 100 },\n 'auth:one-off:exchange',\n );\n\n const body = OneOffSessionExchangeBodySchema.parse(req.body || {});\n\n const consumableToken = await this.consumableTokenService.validateToken(body.token);\n\n if (!consumableToken.createsOneOffSession) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_TYPE_MISMATCH,\n });\n }\n\n if (!consumableToken.userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_CONTEXT_MISMATCH,\n });\n }\n\n const ec = await this._getPreAuthExecutionContext();\n\n const targetUser = await this.userLookup.findUserById(ec, consumableToken.userId);\n if (!targetUser || targetUser.status !== UserStatus.ACTIVE) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_ACTIVE,\n context: { userId: consumableToken.userId },\n });\n }\n\n const userType = targetUser.userTypes?.[0];\n if (!userType) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_TYPE_MISMATCH,\n context: { userId: consumableToken.userId },\n });\n }\n\n const appConfig = this.appConfigService.config;\n const userTypeConfig = appConfig?.userTypes?.[userType];\n if (!userTypeConfig?.auth?.oneOffSessionAllowed) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.FEATURE_NOT_AVAILABLE,\n context: { userType }, // diagnostic (log-only)\n });\n }\n\n let consumableTokenValue: string | undefined;\n if (consumableToken.consumeAt === 'EXCHANGE') {\n await this.consumableTokenService.consumeToken(body.token);\n } else {\n consumableTokenValue = body.token;\n }\n\n // The one-off SESSION's absolute lifetime is anchored at CONSUMPTION (this exchange), not at when the\n // token was produced. Pinning it to the token's `expiresAt` (production + authored duration) understated\n // a late exchange and conflated the LINK window with the SESSION lifetime; `computeOneOffSessionExpiresAt`\n // re-anchors the authored duration to `now` and clamps to the ceiling (OWASP absolute timeout is measured\n // from session creation; AWS STS / GCP measure a delegated credential's life from issuance).\n const sessionExpiresAt = computeOneOffSessionExpiresAt(consumableToken, new Date(), ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES);\n const tokens = await this.tokenIssuer.issueTokensForUser(\n consumableToken.userId,\n undefined,\n { sessionType: SessionType.ONE_OFF, activeUserType: userType },\n {\n skipSessionTracking: true,\n refreshTokenExpiresAt: sessionExpiresAt,\n },\n );\n\n try {\n await this.auditLogsService.logGenericEvent({\n userId: consumableToken.userId,\n organizationId: consumableToken.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.ONE_OFF_TOKEN_EXCHANGED,\n eventData: {\n tokenId: consumableToken._id,\n tokenType: consumableToken.tokenType,\n consumeAt: consumableToken.consumeAt,\n consumed: consumableToken.consumeAt === 'EXCHANGE',\n ipAddress,\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n },\n }, ec);\n } catch (error) {\n this.logger.warn('Audit log failed for one-off token exchange', { error, tokenId: consumableToken._id });\n }\n\n // Auth-hardening A-Step 6 (2026-04-13): the one-off-session\n // exchange response no longer carries `refreshToken` in the body\n // (`OneOffTokenExchangeResponseSchema` strips the field). The\n // refresh token is set as `Set-Cookie: __wildo_refresh=…` via the\n // wrapper's third argument so the receiving frontend (one-off\n // session entry pages) can rotate transparently if they share the\n // origin; non-cookie consumers (out-of-band one-off-session deep\n // links into a different origin) get NO refresh capability — by\n // design, since `Path=/api/v1/auth` + `SameSite=Strict` prevent\n // cross-origin cookie attachment on the rotation request.\n this._jsonSuccessWithRefreshCookie(\n res,\n {\n accessToken: tokens.accessToken,\n sessionType: SessionType.ONE_OFF,\n ...(consumableTokenValue ? {\n consumableTokenValue,\n tokenExpiresAt: consumableToken.expiresAt.toISOString(),\n } : {}),\n context: {\n tokenId: consumableToken._id,\n tokenType: consumableToken.tokenType,\n targeting: consumableToken.targeting,\n organizationId: consumableToken.organizationId,\n applicationId: (consumableToken.metadata as Record<string, unknown> | undefined)?.applicationId as string | undefined,\n userId: consumableToken.userId,\n },\n },\n tokens.refreshToken,\n );\n }\n\n /**\n * revocation-B1: cancel an un-exchanged one-off session token.\n *\n * A super-admin mints a one-off (impersonation) session token for another user via\n * `createOneOffToken`; until now there was no way to CANCEL one before it was exchanged — the\n * soft-revoke primitive `ConsumableTokenBackendService.revokeToken` existed with zero callers. This is\n * that door, and the tail of issue #15 (\"every logout/revocation revokes the app session\").\n *\n * Semantics:\n * - Super-admin only (mirrors the mint gate) — an operator action, never self-service.\n * - Reads the token by id and refuses anything that is NOT a one-off session token: this route must\n * never revoke a password-reset / invitation / magic-link token by id. A missing id and a non-one-off\n * id collapse to the SAME 404 (anti-enumeration; and we never touch a foreign token through this door).\n * - Idempotent: revoking an already-revoked token returns success WITHOUT re-stamping `revokedAt` (the\n * first revocation's timestamp is the truthful one) and WITHOUT emitting a duplicate audit.\n * - Revoking only prevents a token that has not yet been EXCHANGED from establishing a session. An\n * already-exchanged one-off session is reachable by the subject's `/auth/logout-all` (its JWT carries\n * the subject userId + iat), which is deliberately out of scope here (deferred per-session JTI kill).\n */\n private async revokeOneOffToken(req: Request, res: Response): Promise<void> {\n const preAuthEc = await this._getPreAuthExecutionContext();\n // Mirror the mint's IP-keyed fail-fast rate limit (kept BEFORE JWT verification).\n const ipAddress = getClientIpFromRequest(req);\n await this.rateLimitService.checkPolicy(req, res, { requestsPerMinute: 30 }, 'auth:one-off:revoke');\n\n const caller = await this.authJwtGuard.extractAuthenticatedUser(preAuthEc, req);\n const ec = await this._getAuthenticatedExecutionContext(caller.userId);\n\n const callerUser = await this.userLookup.findUserById(ec, caller.userId);\n const callerRoles = callerUser?.appRoles || [];\n if (!callerRoles.includes(CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED,\n });\n }\n\n const tokenId = req.params.tokenId as string;\n const token = await this.consumableTokenService.findTokenById(tokenId);\n\n // Missing id OR a non-one-off token id → the same 404. This door owns ONE-OFF tokens only; disclosing\n // that an id belongs to another token kind (or acting on it) would be both an enumeration oracle and a\n // cross-purpose write against a password-reset / invitation / magic-link token.\n if (!token || !token.createsOneOffSession) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_NOT_FOUND,\n context: { tokenId }, // diagnostic (log-only)\n });\n }\n\n // Idempotent: an already-revoked token succeeds without a second write or a duplicate audit row.\n if (token.revokedAt) {\n this.jsonSuccess(res, { tokenId, alreadyRevoked: true });\n return;\n }\n\n // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revoking a one-off session token terminates a\n // session-establishing credential minted for another user; the ONE_OFF_TOKEN_REVOKED audit below is the evidence.\n const didRevoke = await this.consumableTokenService.revokeToken(tokenId);\n\n // Emit the audit ONLY on the real transition. `revokeToken` is conditional on the row not already being\n // revoked, so under a concurrent double-revoke exactly one caller sees `didRevoke === true` and the trail\n // records one revocation, not two. The token ends revoked either way, so the response is unconditional success.\n if (didRevoke) {\n try {\n await this.auditLogsService.logGenericEvent({\n userId: caller.userId,\n organizationId: token.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.ONE_OFF_TOKEN_REVOKED,\n eventData: {\n tokenId: token._id,\n tokenType: token.tokenType,\n targetUserId: token.userId,\n callerUserId: caller.userId,\n ipAddress,\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n },\n }, ec);\n } catch (error) {\n this.logger.warn('Audit log failed for one-off token revocation', { error, tokenId: token._id });\n }\n }\n\n this.jsonSuccess(res, { tokenId, revoked: true });\n }\n\n // ═══════════════════════════════════════════════════════════════\n // W7.3a: Anonymous Session Transposition on Login/Register\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * Resolve the anonymous userId to transpose, trying BOTH the\n * `x-anonymous-session` header (same-origin app flow) AND the parent-domain\n * `__wildo_anon_session` cookie (cross-origin website capture) through JWT\n * verification, returning the FIRST that validates.\n *\n * Why verify both rather than `header ?? cookie`: the app fans its\n * `localStorage` anonymous session onto auth requests, so the header is\n * frequently PRESENT but may hold a STALE/expired token. A naive\n * header-first `??` would let that dead header preempt a fresh website-capture\n * cookie, silently orphaning the captured lead / draft (then reaped by\n * `cleanupExpiredSessions`). Verifying each candidate and skipping the ones\n * that throw lets a valid cookie win when the header token is unusable. The\n * header is tried first so a live same-origin session keeps priority. A\n * duplicated header (`string[]`) is normalised to its first value.\n *\n * Returns `undefined` when neither candidate is present or verifiable.\n */\n private resolveTransposableAnonymousUserId(req: Request): string | undefined {\n const headerValue = req.headers[WildoHeaderKeys.ANONYMOUS_SESSION];\n const candidateTokens = [\n Array.isArray(headerValue) ? headerValue[0] : headerValue,\n AuthControllerUtils.extractAnonymousSessionFromCookie(req),\n ].filter((token): token is string => typeof token === 'string' && token.length > 0);\n\n for (const token of candidateTokens) {\n try {\n return this.anonymousSessionService.verifySessionToken(token).anonymousUserId;\n } catch {\n // Stale / invalid candidate — try the next (a dead header must not\n // preempt a valid cross-origin cookie).\n }\n }\n return undefined;\n }\n\n /**\n * Called after a successful authentication. If the request carries an\n * anonymous session (header or cross-origin cookie), transposes ownership of\n * anonymous resources to the newly authenticated user.\n *\n * Errors are swallowed to avoid blocking the auth response.\n */\n private async handleAnonymousTransposition(req: Request, res: Response, authResult: AuthenticationResponse): Promise<void> {\n if (!authResult.success || !authResult.user?._id) return;\n\n const anonymousUserId = this.resolveTransposableAnonymousUserId(req);\n if (!anonymousUserId) return;\n\n try {\n const userType = this.resolveUserTypeFromRequest(req)\n ?? authResult.user.userTypes?.[0]\n ?? 'default';\n\n const result = await this.anonymousSessionService.transposeOwnership(\n anonymousUserId,\n authResult.user._id,\n userType,\n );\n\n // Clear the cross-origin cookie only when the session was actually\n // processed (COMPLETE / PARTIAL). On PENDING — a userType with anonymous\n // sessions disabled, or an all-failed transpose — KEEP the cookie so a\n // later login (into an anon-enabled userType, or after a transient\n // failure clears) can still consume the website capture.\n if (result.status !== AnonymousUserTranspositionStatus.PENDING) {\n this.anonymousSessionService.clearSessionCookie(res);\n }\n\n this.logDebug('Anonymous session transposition completed', {\n anonymousUserId,\n userId: authResult.user._id,\n userType,\n status: result.status,\n transposedTypes: result.transposedTypes,\n failedCount: result.failedTypes.length,\n });\n } catch (error) {\n this.logger.warn('Anonymous session transposition failed (non-blocking)', {\n userId: authResult.user._id,\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n /**\n * Simplified transposition for OAuth2 token exchange, where we have a userId\n * but no AuthenticationResponse. Uses header-resolved userType.\n */\n private async handleAnonymousTranspositionForTokenExchange(req: Request, res: Response, userId: string): Promise<void> {\n const anonymousUserId = this.resolveTransposableAnonymousUserId(req);\n if (!anonymousUserId) return;\n\n try {\n const userType = this.resolveUserTypeFromRequest(req) ?? 'default';\n\n const result = await this.anonymousSessionService.transposeOwnership(anonymousUserId, userId, userType);\n\n // Clear the cross-origin cookie only when actually processed (COMPLETE /\n // PARTIAL) — see the sibling trigger for the PENDING-keeps-cookie rationale.\n if (result.status !== AnonymousUserTranspositionStatus.PENDING) {\n this.anonymousSessionService.clearSessionCookie(res);\n }\n\n this.logDebug('Anonymous session transposition completed (token exchange)', {\n anonymousUserId, userId, userType, status: result.status,\n transposedTypes: result.transposedTypes, failedCount: result.failedTypes.length,\n });\n } catch (error) {\n this.logger.warn('Anonymous session transposition failed in token exchange (non-blocking)', {\n userId, ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n private resolveUserTypeFromRequest(req: Request): string | undefined {\n const frontendServiceName = req.headers[WildoHeaderKeys.FRONTEND_SERVICE_NAME] as string | undefined;\n if (!frontendServiceName) return undefined;\n return this.appConfigService.resolveUserTypeFromFrontendServiceName(frontendServiceName) ?? undefined;\n }\n}\n"]}
1
+ {"version":3,"file":"authentication-controller.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/controllers/authentication-controller.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,OAA4C,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAC5I,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AACvG,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAChJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EACL,wCAAwC,GAEzC,MAAM,kGAAkG,CAAC;AAC1G,OAAO,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,MAAM,wFAAwF,CAAC;AACvK,OAAO,EAAE,kCAAkC,EAAE,MAAM,yGAAyG,CAAC;AAC7J,OAAO,EAAE,sCAAsC,EAAE,MAAM,8GAA8G,CAAC;AACtK,OAAO,EAAE,6BAA6B,EAAE,oCAAoC,EAAE,MAAM,yFAAyF,CAAC;AAC9K,OAAO,EAAE,6BAA6B,EAAE,MAAM,0FAA0F,CAAC;AACzI,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,EAAE,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AACpI,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AACzJ,OAAO,EAAE,gCAAgC,EAAE,MAAM,uGAAuG,CAAC;AACzJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,iGAAiG,CAAC;AAC7I,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,uEAAuE,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mEAAmE,CAAC;AACtG,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAEhK,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,2EAA2E,CAAC;AACvH,OAAO,EAAE,mBAAmB,EAAE,MAAM,kFAAkF,CAAC;AACvH,OAAO,EAAE,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAClG,OAAO,EAAE,4BAA4B,EAAE,MAAM,oEAAoE,CAAC;AAClH,OAAO,EACL,mCAAmC,EACnC,oCAAoC,GACrC,MAAM,mFAAmF,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,iGAAiG,CAAC;AACnJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,yEAAyE,CAAC;AACrH,OAAO,EAAE,+BAA+B,EAAE,MAAM,uGAAuG,CAAC;AACxJ,OAAO,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,MAAM,qGAAqG,CAAC;AAC9K,OAAO,EAAE,qBAAqB,EAAE,MAAM,4FAA4F,CAAC;AACnI,OAAO,EAAE,mCAAmC,EAAE,MAAM,2GAA2G,CAAC;AAChK,OAAO,EAAE,kCAAkC,EAAE,MAAM,0GAA0G,CAAC;AAC9J,OAAO,EAAE,8BAA8B,EAAE,MAAM,wFAAwF,CAAC;AACxI,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAM3I,OAAO,EAAE,yBAAyB,EAAE,MAAM,+FAA+F,CAAC;AAC1I,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AACxG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,eAAe,EACf,6BAA6B,EAC7B,iCAAiC,EACjC,kCAAkC,EAClC,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,EAC3B,sBAAsB,EACtB,6BAA6B,EAC7B,8BAA8B,EAC9B,wBAAwB,EACxB,0BAA0B,EAC1B,gCAAgC,EAChC,oBAAoB,EACpB,UAAU,EACV,eAAe,EACf,0BAA0B,EAC1B,wBAAwB,EACxB,+BAA+B,EAC/B,0BAA0B,EAC1B,gBAAgB,EAEhB,sBAAsB,EAEtB,0BAA0B,EAC1B,oBAAoB,EACpB,cAAc,EACd,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,SAAS,EACT,2BAA2B,EAC3B,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,qBAAqB,EACrB,aAAa,EACb,WAAW,EACX,gCAAgC,EAChC,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AAChK,OAAO,EAAqB,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAGtH,yFAAyF;AACzF,iEAAiE;AACjE,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,MAAM,CAAC;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC;CAC9C,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAElD,sHAAsH;AACtH,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAEtF;;;;;;;;;;;GAWG;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAE5C,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,0BAA0B;IACrC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;IACnD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,+BAA+B,CAAC,UAAU,CAAC;IACvH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;KAC3C,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAClD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC1D,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAGI,IAAM,sCAAsC,GAA5C,MAAM,sCAAuC,SAAQ,gCAAgC;IAqCf;IAoBR;IAGiB;IA3DnE,WAAW,CAA2C;IACtD,WAAW,CAAgC;IAC3C,aAAa,CAAqC;IAClD,cAAc,CAAyC;IACvD,sBAAsB,CAAgC;IACtD,UAAU,CAAoB;IAC9B,YAAY,CAAsB;IAClC,gBAAgB,CAA0B;IAC1C,gBAAgB,CAA0B;IAC1C,gBAAgB,CAA0B;IAC1C,eAAe,CAAyB;IACxC,UAAU,CAAoB;IAC9B,iBAAiB,CAAkC;IACnD,eAAe,CAAmC;IAClD,mBAAmB,CAA6B;IAChD,kBAAkB,CAAmC;IACrD,YAAY,CAA6B;IACzC,oBAAoB,CAAkC;IACtD,mBAAmB,CAAiC;IACpD,UAAU,CAAwB;IAClC,wBAAwB,CAAsC;IAC9D,uBAAuB,CAAqC;IAC5D,uBAAuB,CAAiC;IACxD,UAAU,CAA+B;IAE1D,YACqC,MAAqB,EACR,YAAwC,EACxC,YAAiC,EACnB,WAAqD,EACvE,WAA0C,EAC9B,aAAiD,EAC7C,cAAsD,EAC/D,sBAAqD,EAC1D,UAA6B,EAClC,YAAiC,EACD,aAAwD,EACpF,gBAAyC,EACzC,gBAAyC,EAClC,gBAAyC,EACjD,eAAuC,EAC5C,UAA6B,EACf,iBAAkD,EACjD,eAAiD,EACvD,mBAA+C,EACzC,kBAAoD,EAC1D,YAAwC,EACnC,oBAAqD,EACtD,mBAAmD,EAC5D,UAAiC,EACnB,wBAA6D,EAC9D,uBAA2D,EAC/D,uBAAuD,EACzD,UAAwC,EAGzB,mBAA+C,EAG9B,gBAAsD;QAExI,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,0BAA0B,CAAC,CAAC;QAzBG,kBAAa,GAAb,aAAa,CAA2C;QAoBhE,wBAAmB,GAAnB,mBAAmB,CAA4B;QAG9B,qBAAgB,GAAhB,gBAAgB,CAAsC;QAGxI,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,sBAAsB,GAAG,sBAAsB,CAAC;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;QAC/C,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;QACjD,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;QAC/C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,wBAAwB,GAAG,wBAAwB,CAAC;QACzD,IAAI,CAAC,uBAAuB,GAAG,uBAAuB,CAAC;QACvD,IAAI,CAAC,uBAAuB,GAAG,uBAAuB,CAAC;QACvD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAES,WAAW;QACnB,yCAAyC;QAEzC,+BAA+B;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrI,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,kDAAkD,CAAC,CAAC;QAE7J,yBAAyB;QACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAEpJ,kDAAkD;QAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7I,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,iDAAiD,CAAC,CAAC;QAEhK,oFAAoF;QACpF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9I,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,0CAA0C,CAAC,CAAC;QAE1J,qBAAqB;QACrB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChJ,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,kCAAkC,CAAC,CAAC;QAEjJ,iCAAiC;QACjC,qEAAqE;QACrE,gEAAgE;QAChE,oFAAoF;QACpF,2DAA2D;QAC3D,iEAAiE;QACjE,wEAAwE;QACxE,uDAAuD;QAEvD,wEAAwE;QACxE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnJ,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,8CAA8C,CAAC,CAAC;QAEhK,4GAA4G;QAC5G,+CAA+C;QAC/C,oDAAoD;QACpD,MAAM,qBAAqB,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAChF,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,CAAC;QACvG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;QAC3D,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,iBAAiB,EAAE,sEAAsE,CAAC,CAAC;QAEjI,gFAAgF;QAChF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChJ,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,uCAAuC,CAAC,CAAC;QAExJ,qEAAqE;QACrE,6EAA6E;QAC7E,sEAAsE;QACtE,iFAAiF;QACjF,8EAA8E;QAC9E,iDAAiD;QACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,wDAAwD,CAAC,CAAC;QAEjL,gCAAgC;QAChC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjI,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,+BAA+B,CAAC,CAAC;QACxI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxI,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,yDAAyD,CAAC,CAAC;QAEtK,yCAAyC;QAEzC,uDAAuD;QACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,qDAAqD,CAAC,CAAC;QAE9K,+DAA+D;QAC/D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjK,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,+DAA+D,CAAC,CAAC;QAEzL,uCAAuC;QAEvC,oDAAoD;QACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrI,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,wDAAwD,CAAC,CAAC;QAEnK,gEAAgE;QAChE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtJ,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,gEAAgE,CAAC,CAAC;QAEpL,8EAA8E;QAC9E,+EAA+E;QAC/E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpJ,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,8FAA8F,CAAC,CAAC;QAE/M,6DAA6D;QAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtJ,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,qDAAqD,CAAC,CAAC;QAEzK,qFAAqF;QACrF,6FAA6F;QAC7F,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxJ,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,0DAA0D,CAAC,CAAC;QAE/K,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,+EAA+E,CAAC,CAAC;QAEtM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,oDAAoD,CAAC,CAAC;QAE3K,8CAA8C;QAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5I,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,uDAAuD,CAAC,CAAC;QAEtK,iCAAiC;QACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,6DAA6D,CAAC,CAAC;QAEnL,wDAAwD;QACxD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjK,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,wDAAwD,CAAC,CAAC;QAElL,0CAA0C;QAE1C,qDAAqD;QACrD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtJ,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,sCAAsC,CAAC,CAAC;QAE3J,sDAAsD;QACtD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,wCAAwC,CAAC,CAAC;QAE/J,qCAAqC;QAErC,uDAAuD;QACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/I,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,8CAA8C,CAAC,CAAC;QAE/J,gFAAgF;QAChF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,kDAAkD,CAAC,CAAC;QAE1K,oDAAoD;QACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjJ,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,wCAAwC,CAAC,CAAC;QAE1J,0CAA0C;QAC1C,6EAA6E;QAC7E,6GAA6G;QAC7G,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClK,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,8EAA8E,CAAC,CAAC;QAExM,yFAAyF;QACzF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrK,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,kFAAkF,CAAC,CAAC;QAE5M,+BAA+B;QAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7I,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,wCAAwC,CAAC,CAAC;QAEpJ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EACpF,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EACrD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACjD,CAAC;QACF,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,yDAAyD,CAAC,CAAC;QAEpK,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnJ,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,oDAAoD,CAAC,CAAC;QAEnK,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7I,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,2EAA2E,CAAC,CAAC;QAErL,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EACpF,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EACrD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACtD,CAAC;QACF,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,wCAAwC,CAAC,CAAC;QAEnJ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrJ,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,iCAAiC,CAAC,CAAC;QAElJ,6CAA6C;QAC7C,mCAAmC;QACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzK,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,4DAA4D,CAAC,CAAC;QAEvL,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvK,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,uDAAuD,CAAC,CAAC;QAEjL,wDAAwD;QACxD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjK,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,0DAA0D,CAAC,CAAC;QAEjL,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,2DAA2D,CAAC,CAAC;QAEjL,iCAAiC;QACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjJ,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,yCAAyC,CAAC,CAAC;QAEvJ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtJ,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,mCAAmC,CAAC,CAAC;QAEpJ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtJ,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,mCAAmC,CAAC,CAAC;QAEpJ,uCAAuC;QAEvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjJ,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,0DAA0D,CAAC,CAAC;QAE5K,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrJ,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,wDAAwD,CAAC,CAAC;QAE5K,oCAAoC;QAEpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3I,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,sCAAsC,CAAC,CAAC;QAErJ,+FAA+F;QAE/F,+CAA+C;QAE/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrJ,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,oDAAoD,CAAC,CAAC;QAExK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,0DAA0D,CAAC,CAAC;QAEjL,yCAAyC;QAEzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,2CAA2C,CAAC,CAAC;QAEpK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChK,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,+CAA+C,CAAC,CAAC;QAE5K,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChK,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,wCAAwC,CAAC,CAAC;QAEnK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,2DAA2D,CAAC,CAAC;QAEpL,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChK,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,+DAA+D,CAAC,CAAC;IAC9L,CAAC;IAED,kEAAkE;IAClE,yCAAyC;IACzC,kEAAkE;IAE1D,KAAK,CAAC,QAAQ,CAAC,GAAY,EAAE,GAAa;QAChD,gEAAgE;QAChE,yDAAyD;QACzD,8DAA8D;QAC9D,sDAAsD;QACtD,MAAM,IAAI,GAAG,+BAA+B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEnE,0DAA0D;QAC1D,2CAA2C;QAC3C,+DAA+D;QAC/D,8DAA8D;QAC9D,oDAAoD;QACpD,2DAA2D;QAC3D,2DAA2D;QAC3D,iEAAiE;QACjE,8DAA8D;QAC9D,4DAA4D;QAC5D,8DAA8D;QAC9D,yDAAyD;QACzD,6DAA6D;QAC7D,2DAA2D;QAC3D,6DAA6D;QAC7D,wDAAwD;QACxD,oBAAoB;QACpB,EAAE;QACF,wCAAwC;QACxC,8DAA8D;QAC9D,2DAA2D;QAC3D,qDAAqD;QACrD,6DAA6D;QAC7D,6DAA6D;QAC7D,qDAAqD;QACrD,+DAA+D;QAC/D,yBAAyB;QACzB,EAAE;QACF,iEAAiE;QACjE,gEAAgE;QAChE,2DAA2D;QAC3D,mDAAmD;QACnD,kIAAkI;QAClI,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtE,sDAAsD;QACtD,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,wBAAwB,EACxB,SAAS,EACT,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CACzB,CAAC;QACF,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,qBAAqB,CACtB,CAAC;QACF,0EAA0E;QAE1E,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,6EAA6E;QAC7E,MAAM,UAAU,GAAG;YACjB,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;YAC/D,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;SACvC,CAAC;QAEF,MAAM,qBAAqB,GAAG;YAC5B,GAAG,IAAI;YACP,UAAU;SACX,CAAC;QAEF,iFAAiF;QACjF,6EAA6E;QAC7E,+EAA+E;QAC/E,+FAA+F;QAC/F,MAAM,mBAAmB,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAuB,CAAC;QACrG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAC1D,MAAM,cAAc,GAAG,mBAAmB;YACxC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,sCAAsC,CAAC,mBAAmB,CAAC,IAAI,SAAS;YAChG,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,MAAM,GAA+B,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CACxE,EAAE,EACF,qBAAqB,EACrB,cAAc,EACd,mBAAmB,CACpB,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,GAAY,EAAE,GAAa;QAC5D,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,eAAe,GAAG;YACtB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,yEAAyE;YAC5F,UAAU,EAAE,KAAK;YACjB,qBAAqB,EAAE,EAAE;SAC1B,CAAC;QACF,MAAM,MAAM,GAAgC,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;QAC7G,MAAM,IAAI,CAAC,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC1D,oEAAoE;QACpE,oEAAoE;QACpE,mEAAmE;QACnE,wDAAwD;QACxD,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;QAC7C,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,wEAAwE;IAChE,KAAK,CAAC,YAAY,CAAC,GAAY,EAAE,GAAa;QACpD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA0B,CAAC;QAC3F,MAAM,MAAM,GAAgC,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC7F,MAAM,IAAI,CAAC,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC1D,iEAAiE;QACjE,oEAAoE;QACpE,mDAAmD;QACnD,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;QAC7C,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACK,KAAK,CAAC,YAAY,CAAC,GAAY,EAAE,GAAa;QACpD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,wDAAwD;QACxD,sEAAsE;QACtE,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;QACjF,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,qCAAqC;aAC1F,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,gGAAgG;YAChG,oGAAoG;YACpG,oGAAoG;YACpG,mGAAmG;YACnG,kGAAkG;YAClG,MAAM,WAAW,GAAG,8BAA8B,CAAC,YAAY,CAAC,CAAC;YACjE,IAAI,WAAW,EAAE,CAAC;gBAChB,KAAK,CAAC,KAAK,IAAI,EAAE;oBACf,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;oBACpG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gCAAgC,CAAC;wBAC3D,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,SAAS,EAAE,WAAW,CAAC,SAAS;wBAChC,SAAS,EAAE,WAAW,CAAC,SAAS;wBAChC,aAAa,EAAE,WAAW,CAAC,aAAa;wBACxC,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;qBACvC,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;gBACxB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACvB,CAAC;YACD,MAAM,YAAY,CAAC;QACrB,CAAC;QAED,0BAA0B;QAC1B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACjE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACpD,MAAM,OAAO,GAAG,OAAkC,CAAC;gBACnD,MAAM,aAAa,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;gBACtF,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;gBACxF,IAAI,aAAa,EAAE,CAAC;oBAClB,qFAAqF;oBACrF,yFAAyF;oBACzF,uFAAuF;oBACvF,2EAA2E;oBAC3E,KAAK,CAAC,KAAK,IAAI,EAAE;wBACf,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,CAAC;wBAC/F,MAAM,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC;4BAChD,MAAM,EAAE,aAAa;4BACrB,SAAS;4BACT,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;4BACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;yBAChE,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;oBACxB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,qDAAqD,CAAC,CAAC;QAEjE,8DAA8D;QAC9D,qEAAqE;QACrE,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;QAClE,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IACzE,CAAC;IAED,2CAA2C;IACnC,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa;QACvD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAA+B,CAAC;QAE7D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,6BAA6B,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAEzF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;QAC7D,CAAC;QAED,8EAA8E;QAC9E,2FAA2F;QAC3F,6FAA6F;QAC7F,MAAM,kBAAkB,GAAG;YACzB,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;YAC/C,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,2BAA2B,EAAE,YAAY,CAAC,2BAA2B;YACrE,4BAA4B,EAAE,YAAY,CAAC,4BAA4B;YACvE,2BAA2B,EAAE,YAAY,CAAC,2BAA2B;YACrE,yBAAyB,EAAE,YAAY,CAAC,yBAAyB;YACjE,WAAW,EAAE,YAAY,CAAC,WAAW;YACrC,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;YAC/C,kBAAkB,EAAE,YAAY,CAAC,kBAAkB;YACnD,SAAS,EAAE,YAAY,CAAC,SAAS;SAClC,CAAC;QAEF,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC5C,CAAC;IAED,kEAAkE;IAClE,iCAAiC;IACjC,kEAAkE;IAElE;;;;;;;OAOG;IACK,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa;QACvD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,WAAiC,CAAC;QAEjE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,mCAAmC,EAAE;aAC1D,CAAC,CAAC;QACL,CAAC;QAED,iFAAiF;QACjF,uFAAuF;QACvF,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,KAA2B,CAAC;QACxD,IAAI,YAAuE,CAAC;QAE5E,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YAC3D,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;gBAChF,IAAI,SAAS,EAAE,CAAC;oBACd,YAAY,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;oBAE9E,mGAAmG;oBACnG,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,iBAAiB,CACrE,EAAE,EAAE,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,WAAW,CACxD,CAAC;oBACF,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,MAAM,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC;4BACnD,KAAK,EAAE,SAAS;4BAChB,WAAW;4BACX,SAAS,EAAE,SAAS,CAAC,SAAS;4BAC9B,cAAc,EAAE,SAAS,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;gCAChE,CAAC,CAAC,SAAS,CAAC,OAAO;gCACnB,CAAC,CAAC,SAAS;4BACb,aAAa,EAAE,SAAS,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW;gCAC9D,CAAC,CAAC,SAAS,CAAC,OAAO;gCACnB,CAAC,CAAC,SAAS;4BACb,MAAM,EAAE,MAAM,IAAI,qBAAqB;4BACvC,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;4BACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;yBAChE,CAAC,CAAC;wBACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;4BACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;4BAChF,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,IAAI,2DAA2D,EAAE;yBAC5F,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,uFAAuF;QACvF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAClE,WAAW,EACX,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CACnD,CAAC;QAEF,kFAAkF;QAClF,2FAA2F;QAC3F,kGAAkG;QAClG,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,mBAAmB,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAW,CAAC;QACzF,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,KAAK,WAAW,CAAC,CAAC,uFAAuF;QACzG,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,yBAAyB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACzD,CAAC;QAED,sGAAsG;QACtG,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,UAAU,EAAE;YACtF,mBAAmB;YACnB,SAAS,EAAE,YAAY,EAAE,SAAS;YAClC,OAAO,EAAE,YAAY,EAAE,OAAO;YAC9B,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE;YAC9C,WAAW;YACX,cAAc,EAAE,UAAU,CAAC,cAAc;SAC1C,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,sBAAsB,CAAC,GAAY,EAAE,GAAa;QAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAA2B,CAAC;QACrD,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,YAAkC,CAAC;QAEnE,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,gDAAgD,EAAE;aACvE,CAAC,CAAC;QACL,CAAC;QAED,gDAAgD;QAChD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAE1H,mCAAmC;QACnC,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,mBAAmB,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAW,CAAC;QACzF,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,KAAK,WAAW,CAAC;QACjB,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,yBAAyB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACzD,CAAC;QAED,2DAA2D;QAC3D,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,UAAU,EAAE;YACtF,mBAAmB;YACnB,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE;YACtD,KAAK;YACL,YAAY;YACZ,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,yBAAyB,CAAC,GAAY,EAAE,GAAa;QACjE,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,YAAkC,CAAC;QAEnE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE;aAC3D,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAuB,CAAC;QAChF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,0DAA0D,EAAE;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAEzH,uEAAuE;QACvE,yDAAyD;QACzD,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,mBAAmB,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAW,CAAC;QACzF,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,KAAK,WAAW,CAAC;QACjB,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,yBAAyB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,UAAU,EAAE;YACtF,mBAAmB;YACnB,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,4CAA4C,EAAE;YAC1D,KAAK;YACL,YAAY;YACZ,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa;QACvD,iEAAiE;QACjE,+DAA+D;QAC/D,mEAAmE;QACnE,mEAAmE;QACnE,6DAA6D;QAC7D,iEAAiE;QACjE,2DAA2D;QAC3D,4DAA4D;QAC5D,6DAA6D;QAC7D,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,uBAAuB,CACxB,CAAC;QAEF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,YAAsB,CAAC;QACvD,MAAM,SAAS,GAAI,GAAG,CAAC,KAAK,CAAC,SAAoB,IAAI,GAAG,CAAC;QAEzD,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC9F,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;YACrE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oDAAoD,EAAE;oBACtE,YAAY;oBACZ,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,qBAAqB,CAAC,iBAAiB,EAAE,0CAA0C,EAAE,WAAW,CAAC,CAAC;QACjJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,aAAa,CAAC,GAAY,EAAE,GAAa;QACrD,+DAA+D;QAC/D,+DAA+D;QAC/D,+DAA+D;QAC/D,8DAA8D;QAC9D,0DAA0D;QAC1D,8DAA8D;QAC9D,gEAAgE;QAChE,+DAA+D;QAC/D,+DAA+D;QAC/D,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,qBAAqB,CACtB,CAAC;QAEF,MAAM,YAAY,GAAuB,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC;QAChE,MAAM,UAAU,GAAuB,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC;QAE5D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,qBAAqB,CAAC,gBAAgB,EAAE,wBAAwB,EAAE,WAAW,CAAC,CAAC;QAC9H,CAAC;QAED,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YACjG,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,qBAAqB,CAAC,gBAAgB,EAAE,wBAAwB,EAAE,WAAW,CAAC,CAAC;QAC9H,CAAC;QACD,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG;gBACpB,SAAS,EAAE,QAAQ;gBACnB,SAAS,EAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAY,IAAI,SAAS;aAC5E,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;YACjG,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;oBAC7C,QAAQ,EAAG,KAAa,CAAC,sBAAsB,IAAI,SAAS;iBAC7D,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;oBACzD,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,qBAAqB,CAAC,gBAAgB,EAAE,0CAA0C,EAAE,WAAW,CAAC,CAAC;QAChJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,kBAAkB,CAAC,GAAY,EAAE,GAAa;QAC1D,4EAA4E;QAC5E,iFAAiF;QACjF,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,0BAA0B,CAC3B,CAAC;QAEF,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;QAC5C,IACE,cAAc,KAAK,aAAa,CAAC,YAAY;eAC1C,cAAc,KAAK,aAAa,CAAC,WAAW,EAC/C,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,cAAc,KAAK,aAAa,CAAC,YAAY;YAC7D,CAAC,CAAC,aAAa,CAAC,YAAY;YAC5B,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC;QAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAiB,CAAC;QAE7C,sFAAsF;QACtF,iFAAiF;QACjF,2EAA2E;QAC3E,8EAA8E;QAC9E,kFAAkF;QAClF,sFAAsF;QACtF,4CAA4C;QAC5C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACxF,MAAM,mBAAmB,GACvB,SAAS,EAAE,eAAe,EAAE,mBAAmB,IAAI,IAAI,CAAC;QAE1D,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC7G,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,8BAA8B,CAAC,CAAC;QACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACzD,gEAAgE;QAChE,0DAA0D;QAC1D,sEAAsE;QACtE,2DAA2D;QAC3D,kEAAkE;QAClE,4DAA4D;QAC5D,8DAA8D;QAC9D,2DAA2D;QAC3D,2DAA2D;QAC3D,8DAA8D;QAC9D,kEAAkE;QAClE,4DAA4D;QAC5D,6DAA6D;QAC7D,gEAAgE;QAChE,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,qBAAqB,CACtB,CAAC;QAEF,MAAM,WAAW,GAAuB,GAAG,CAAC,KAAK,CAAC,WAAiC,CAAC;QACpF,MAAM,YAAY,GAAuB,GAAG,CAAC,KAAK,CAAC,YAAkC,CAAC;QACtF,MAAM,UAAU,GAAuB,GAAG,CAAC,KAAK,CAAC,UAAgC,CAAC;QAElF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,2EAA2E;gBAC3E,6EAA6E;gBAC7E,yEAAyE;gBACzE,8DAA8D;gBAC9D,MAAM,eAAe,GAAG,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACrD,MAAM,QAAQ,GAAG,eAAe,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxF,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,gCAAgC,CAAC,QAAQ,CAAC,CAAC;gBACzF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;gBAC5H,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;oBACtD,QAAQ,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS;oBACxF,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;gBACH,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;gBACnD,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,qBAAqB,CAAC,eAAe,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;YACrH,CAAC;QACH,CAAC;aAAM,IAAI,YAAY,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;YAC7E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE;oBAClE,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,EAAE,IAAI,GAAG,CAAC;YAC1D,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,WAAW,yBAAyB,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,kBAAkB,CAAC,GAAY,EAAE,GAAa;QAC1D,iEAAiE;QACjE,gEAAgE;QAChE,2DAA2D;QAC3D,4DAA4D;QAC5D,mBAAmB;QACnB,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,qBAAqB,CACtB,CAAC;QAEF,MAAM,WAAW,GAAuB,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC;QAC9D,MAAM,YAAY,GAAuB,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC;QAChE,MAAM,UAAU,GAAuB,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC;QAE5D,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;gBACrG,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE;oBACvD,QAAQ,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS;oBACxF,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;gBACH,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;gBACnD,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,qBAAqB,CAAC,eAAe,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;YACrH,CAAC;QACH,CAAC;aAAM,IAAI,YAAY,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE;oBACnE,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,EAAE,IAAI,GAAG,CAAC;YAC1D,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,WAAW,yBAAyB,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,KAAK,CAAC,kBAAkB,CAAC,GAAY,EAAE,GAAa;QAC1D,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,2BAA2B,CAAC,CAAC;QAE1G,MAAM,EAAE,YAAY,EAAE,GAAG,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACzE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,wGAAwG;QACxG,MAAM,YAAY,GAAG,mBAAmB,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;QAC5E,IAAI,MAA0B,CAAC;QAC/B,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;gBACvE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACpD,MAAM,OAAO,GAAG,OAAkC,CAAC;oBACnD,MAAM,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC3E,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,qCAAqC;aAC1F,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,GAAmC,IAAI,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;QACjF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oGAAoG;YACpG,uGAAuG;YACvG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wDAAwD,EAAE,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;QAED,+DAA+D;QAC/D,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAE9B,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC;YACxB,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,uBAAuB,CAAC,QAAiB;QAC/C,IAAI,CAAC;YACH,MAAM,mBAAmB,GAAG,QAAQ;gBAClC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,sCAAsC,CAAC,QAAQ,CAAC;gBACxE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,iCAAiC,EAAE,CAAC;YAC9D,IAAI,CAAC,mBAAmB;gBAAE,OAAO,SAAS,CAAC;YAC3C,OAAO,IAAI,CAAC,kDAAkD,CAAC,mBAAmB,CAAC,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACK,KAAK,CAAC,cAAc,CAAC,GAAY,EAAE,GAAa;QACtD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,+EAA+E;QAC/E,iFAAiF;QACjF,iFAAiF;QACjF,uCAAuC;QACvC,MAAM,QAAQ,GAAI,GAAG,CAAC,KAAK,CAAC,KAAgB,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC;QAChE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,gBAAgB,GAAI,GAAG,CAAC,KAAK,CAAC,iBAA4B,IAAI,GAAG,CAAC,IAAI,EAAE,iBAAiB,IAAI,4CAA4C,CAAC;YAEhJ,mFAAmF;YACnF,mEAAmE;YACnE,gEAAgE;YAChE,IAAI,gBAAoC,CAAC;YACzC,IAAI,cAAkC,CAAC;YACvC,MAAM,UAAU,GAAI,GAAG,CAAC,KAAK,CAAC,KAAgB,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC;YAClE,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;oBAC/E,MAAM,aAAa,GAAG,UAAU,CAAC,QAA+C,CAAC;oBACjF,MAAM,mBAAmB,GAAG,aAAa,EAAE,mBAAyC,CAAC;oBACrF,cAAc,GAAG,OAAO,aAAa,EAAE,SAAS,KAAK,QAAQ;wBAC3D,CAAC,CAAC,aAAa,CAAC,SAAS;wBACzB,CAAC,CAAC,SAAS,CAAC;oBACd,IAAI,mBAAmB,EAAE,CAAC;wBACxB,gBAAgB,GAAG,IAAI,CAAC,kDAAkD,CAAC,mBAAmB,CAAC,CAAC;oBAClG,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,8DAA8D;gBAChE,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;QAC7G,CAAC;QAED,4DAA4D;QAC5D,MAAM,IAAI,GAAI,GAAG,CAAC,KAAK,CAAC,IAAe,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1D,MAAM,KAAK,GAAI,GAAG,CAAC,KAAK,CAAC,KAAgB,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC;QAE7D,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,qBAAqB,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;QACxH,CAAC;QAED,4DAA4D;QAC5D,IAAI,WAA+B,CAAC;QACpC,IAAI,iBAAqC,CAAC;QAE1C,IAAI,CAAC;YACH,sEAAsE;YACtE,MAAM,cAAc,GAAG;gBACrB,IAAI;gBACJ,KAAK;gBACL,IAAI,EAAE,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,6CAA6C;aAClG,CAAC;YACF,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;YAEjH,6EAA6E;YAC7E,sFAAsF;YACtF,WAAW,GAAG,aAAa,CAAC,mBAAmB;gBAC7C,CAAC,CAAC,IAAI,CAAC,kDAAkD,CAAC,aAAa,CAAC,mBAAmB,CAAC;gBAC5F,CAAC,CAAC,SAAS,CAAC;YACd,iBAAiB,GAAG,aAAa,CAAC,SAAS,CAAC;YAE5C,yEAAyE;YACzE,8EAA8E;YAC9E,gFAAgF;YAChF,6EAA6E;YAC7E,MAAM,mBAAmB,GAAG,aAAa,CAAC,mBAAmB,CAAC;YAC9D,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,UAAU,EAAE,mBAAmB,CAAC,CAAC;YAE/H,IAAI,mBAAmB,EAAE,CAAC;gBACxB,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBACzE,MAAM,qBAAqB,GAAG,iBAAiB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChE,MAAM,cAAc,GAAG,qBAAqB;oBAC1C,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,qCAAqC,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;oBACzG,CAAC,CAAC,IAAI,CAAC;gBAET,IAAI,CAAC,qBAAqB,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;oBACpD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;wBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;wBACjE,OAAO,EAAE;4BACP,OAAO,EACL,oDAAoD,mBAAmB,GAAG;gCAC1E,CAAC,qBAAqB,CAAC,CAAC,CAAC,mBAAmB,qBAAqB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;4BAC5E,mBAAmB;4BACnB,cAAc,EAAE,qBAAqB;yBACtC;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE;gBAC1E,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;aACnD,CAAC,CAAC;YAEH,4EAA4E;YAC5E,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;gBAClE,SAAS,EAAE,wBAAwB,CAAC,kBAAkB;gBACtD,eAAe,EAAE,+BAA+B,CAAC,UAAU;gBAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;gBAC1C,QAAQ,EAAE;oBACR,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,SAAS,EAAE,SAAS;iBACrB;aACF,CAAC,CAAC;YAEH,iFAAiF;YACjF,MAAM,UAAU,GAAG;gBACjB,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;gBACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;aAChE,CAAC;YAEF,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;gBAC1C,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,iBAAiB,CAAC,KAAK;gBAC9B,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,UAAU,EAAE,UAAU,CAAC,IAAI;gBAC3B,SAAS,EAAE,UAAU,CAAC,cAAc,KAAK,iBAAiB,CAAC,UAAU;oBACnE,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS;oBAC7B,CAAC,CAAC,SAAS;gBACb,cAAc,EAAE,oCAAoC,CAAC,UAAU,CAAC,KAAK,CAAC;gBACtE,aAAa,EAAE,mCAAmC,CAAC,UAAU,CAAC,KAAK,CAAC;gBACpE,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,SAAS,EAAE,UAAU,UAAU,CAAC,WAAW,IAAI,MAAM,EAAE;aACxD,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,+BAA+B,CACzD,EAAE,EACF,oCAAoC,CAAC,UAAU,CAAC,KAAK,CAAC,EACtD,MAAM,CACP,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE;gBACtD,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,MAAM;gBACN,SAAS;aACV,CAAC,CAAC;YAEH,uEAAuE;YACvE,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;QAElG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6DAA6D;YAC7D,8EAA8E;YAC9E,6EAA6E;YAC7E,EAAE;YACF,8EAA8E;YAC9E,kFAAkF;YAClF,oEAAoE;YACpE,mFAAmF;YACnF,oFAAoF;YACpF,+EAA+E;YAC/E,qFAAqF;YACrF,2FAA2F;YAC3F,kFAAkF;YAClF,0DAA0D;YAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;gBACzC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;oBAC/B,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC,sBAAsB;oBACxD,CAAC,CAAC,KAAK,YAAY,KAAK;wBACtB,CAAC,CAAC,KAAK,CAAC,OAAO;wBACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBACnB,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC;oBAC5B,CAAC,CAAC;wBACE,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;wBACpD,SAAS,EAAE,KAAK,CAAC,IAAI;wBACrB,UAAU,EAAE,KAAK,CAAC,UAAU;wBAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;qBACvB;oBACH,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;aACjE,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,2BAA2B,CACrC,GAAG,EACH,qBAAqB,CAAC,YAAY,EAClC,0CAA0C,EAC1C,WAAW,EACX,iBAAiB,CAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,KAAK,CAAC,aAAa,CAAC,GAAY,EAAE,GAAa;QACrD,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,2BAA2B,CAC5B,CAAC;QAEF,MAAM,EAAE,IAAI,EAAE,GAAG,0BAA0B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAElE,2EAA2E;QAC3E,2EAA2E;QAC3E,kDAAkD;QAClD,IAAI,cAAc,CAAC;QACnB,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACxH,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,sBAAsB,GACzB,KAA0D,EAAE,sBAAsB,CAAC;YACtF,IACE,CAAC,mBAAmB,CAAC,KAAK,CAAC;gBACzB,KAAK,CAAC,sBAAsB,KAAK,2BAA2B,CAAC,8BAA8B,CAAC;gBAC9F,sBAAsB,KAAK,2BAA2B,CAAC,8BAA8B,EACrF,CAAC;gBACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;iBACjF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,mCAAmC,CAAC,GAAG,EAAE,cAAc,CAAC,QAAmC,CAAC,CAAC;QAElG,uFAAuF;QACvF,IAAI,aAAa,CAAC;QAClB,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,4GAA4G;QAC5G,IAAI,aAAa,CAAC,SAAS,KAAK,wBAAwB,CAAC,kBAAkB,EAAE,CAAC;YAC5E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAmC,CAAC;QAEnE,IAAI,aAAa,CAAC,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,4CAA4C,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAC1F,CAAC;QAED,oEAAoE;QACpE,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,uDAAuD;QACvD,oEAAoE;QACpE,yEAAyE;QACzE,6EAA6E;QAC7E,qEAAqE;QACrE,4EAA4E;QAC5E,0EAA0E;QAC1E,0CAA0C;QAC1C,EAAE;QACF,qDAAqD;QACrD,wEAAwE;QACxE,oEAAoE;QACpE,yEAAyE;QACzE,qCAAqC;QACrC,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,kDAAkD;QAClD,gEAAgE;QAChE,+EAA+E;QAC/E,yEAAyE;QACzE,2DAA2D;QAC3D,wEAAwE;QACxE,0EAA0E;QAC1E,sEAAsE;QACtE,oEAAoE;QACpE,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,aAAa,GAA4B;YAC7C,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;SAC9B,CAAC;QACF,IAAI,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC5C,aAAa,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;QACjD,CAAC;QACD,IAAI,OAAO,QAAQ,CAAC,yBAAyB,KAAK,QAAQ,EAAE,CAAC;YAC3D,aAAa,CAAC,yBAAyB,GAAG,QAAQ,CAAC,yBAAyB,CAAC;QAC/E,CAAC;QACD,IAAI,OAAO,QAAQ,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;YAClD,aAAa,CAAC,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC;QAC7D,CAAC;QACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAClE,MAAM,qBAAqB,GAAG,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ;YACrE,CAAC,CAAC,QAAQ,CAAC,YAAY;YACvB,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACK,KAAK,CAAC,oBAAoB,CAAC,GAAY,EAAE,GAAa;QAC5D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAI,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAwB,IAAI,SAAS,CAAC;QAE/F,uEAAuE;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAEhF,MAAM,yBAAyB,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAuB,CAAC;QAC3G,mFAAmF;QACnF,iFAAiF;QACjF,4EAA4E;QAC5E,mFAAmF;QACnF,qFAAqF;QACrF,6EAA6E;QAC7E,gCAAgC;QAChC,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;QAEhE,qEAAqE;QACrE,qEAAqE;QACrE,mEAAmE;QACnE,kEAAkE;QAClE,mEAAmE;QACnE,kEAAkE;QAClE,iEAAiE;QACjE,gEAAgE;QAChE,0DAA0D;QAC1D,2DAA2D;QAC3D,yDAAyD;QACzD,EAAE;QACF,kEAAkE;QAClE,gEAAgE;QAChE,yDAAyD;QACzD,iEAAiE;QACjE,EAAE;QACF,mEAAmE;QACnE,iEAAiE;QACjE,gEAAgE;QAChE,iEAAiE;QACjE,8DAA8D;QAC9D,iEAAiE;QACjE,8DAA8D;QAC9D,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,4CAA4C,EAC5C,SAAS,EACT,GAAG,MAAM,CAAC,MAAM,IAAI,yBAAyB,IAAI,SAAS,EAAE,CAC7D,CAAC;QAEF,MAAM,IAAI,GAAG,iCAAiC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAErE,2EAA2E;QAC3E,wFAAwF;QACxF,0EAA0E;QAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAC/C,MAAM,mBAAmB,GAAG,SAAS,EAAE,gBAAgB,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACjF,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE;oBACP,IAAI,EAAE,6BAA6B,CAAC,uBAAuB;oBAC3D,OAAO,EAAE,oCAAoC,IAAI,CAAC,gBAAgB,mDAAmD;oBACrH,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;iBACxC;aACF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,kBAAkB,GAAI,mBAAkD,CAAC,YAAY,CAAC;QAC5F,IACE,kBAAkB,KAAK,eAAe,CAAC,QAAQ;YAC/C,kBAAkB,KAAK,eAAe,CAAC,QAAQ,EAC/C,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE;oBACP,IAAI,EAAE,6BAA6B,CAAC,yCAAyC;oBAC7E,OAAO,EACL,oBAAoB,IAAI,CAAC,gBAAgB,iDAAiD;wBAC1F,sEAAsE;oBACxE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;oBACvC,YAAY,EAAE,OAAO,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;iBACtF;aACF,CAAC,CAAC;QACL,CAAC;QAED,yDAAyD;QACzD,4EAA4E;QAC5E,6EAA6E;QAC7E,wEAAwE;QACxE,uEAAuE;QACvE,0EAA0E;QAC1E,UAAU;QACV,MAAM,eAAe,GAAG,mBAAmB,CAAC,uBAAuB,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACtG,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE;oBACP,IAAI,EAAE,6BAA6B,CAAC,mCAAmC;oBACvE,OAAO,EACL,oBAAoB,IAAI,CAAC,gBAAgB,uCAAuC,IAAI,CAAC,gBAAgB,aAAa;wBAClH,4GAA4G;oBAC9G,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;iBACxC;aACF,CAAC,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,+EAA+E;QAC/E,+EAA+E;QAC/E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE;YACjF,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;SACnD,CAAC,CAAC;QAEH,+EAA+E;QAC/E,yFAAyF;QACzF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;YAClE,SAAS,EAAE,wBAAwB,CAAC,kBAAkB;YACtD,eAAe,EAAE,+BAA+B,CAAC,UAAU;YAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;YACpD,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;YAC1C,QAAQ,EAAE;gBACR,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,oEAAoE;gBACpE,wEAAwE;gBACxE,sEAAsE;gBACtE,kCAAkC;gBAClC,GAAG,CAAC,yBAAyB,KAAK,SAAS,IAAI,EAAE,yBAAyB,EAAE,CAAC;gBAC7E,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,2EAA2E;gBAC3E,6EAA6E;gBAC7E,qEAAqE;gBACrE,0EAA0E;gBAC1E,sEAAsE;gBACtE,sEAAsE;gBACtE,kEAAkE;gBAClE,8CAA8C;gBAC9C,6CAA6C;gBAC7C,kDAAkD;gBAClD,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B;SACF,CAAC,CAAC;QAEH,wEAAwE;QACxE,oEAAoE;QACpE,wCAAwC;QACxC,MAAM,WAAW,GAAG,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,GAAG,eAAe,uBAAuB,WAAW,WAAW,aAAa,EAAE,CAAC;QAElG,6FAA6F;QAC7F,IAAI,CAAC;YACH,oFAAoF;YACpF,iFAAiF;YACjF,0DAA0D;YAC1D,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/F,MAAM,IAAI,CAAC,gBAAgB,CAAC,iCAAiC,CAAC;gBAC5D,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,yBAAyB;gBACzB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,iBAAiB,EAAE,aAAa,CAAC,GAAG;gBACpC,SAAS;gBACT,SAAS;aACV,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;gBACvE,KAAK;gBACL,iBAAiB,EAAE,aAAa,CAAC,GAAG;aACrC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,+BAA+B,EAAE;YAC7C,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,yBAAyB;YACzB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,iBAAiB,EAAE,aAAa,CAAC,GAAG;SACrC,CAAC,CAAC;QAEH,2EAA2E;QAC3E,iFAAiF;QACjF,8EAA8E;QAC9E,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,aAAa,CAAC,SAAqC,CAAC,CAAC,WAAW,EAAE,CAAC;QACjG,MAAM,QAAQ,GAAG,kCAAkC,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;QACnG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,KAAK,CAAC,MAAM,CAAC,GAAY,EAAE,GAAa;QAC9C,8DAA8D;QAC9D,oEAAoE;QACpE,iDAAiD;QACjD,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACzC,mEAAmE;QACnE,oEAAoE;QACpE,8DAA8D;QAC9D,2BAA2B;QAC3B,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,YAAY,GAAG,mBAAmB,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;QAE5E,6GAA6G;QAC7G,IAAI,YAAgC,CAAC;QACrC,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;gBACvE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACpD,MAAM,OAAO,GAAG,OAAkC,CAAC;oBACnD,YAAY,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;gBACjF,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAC,wCAAwC,CAAC,CAAC;YAEpD,qEAAqE;YACrE,2FAA2F;YAC3F,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,eAAe,EAAE,CAAC;gBACzB,iEAAiE;gBACjE,iEAAiE;gBACjE,IAAI,CAAC,QAAQ,CAAC,sEAAsE,EAAE;oBACpF,MAAM,EAAE,YAAY,IAAI,SAAS;oBACjC,KAAK,EAAE,mBAAmB,CAAC,eAAe,CAAC;iBAC5C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,CAAC,8EAA8E,CAAC,CAAC;QAChG,CAAC;QAED,kEAAkE;QAClE,mEAAmE;QACnE,kEAAkE;QAClE,qCAAqC;QACrC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAE9B,mBAAmB;QACnB,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;YAClC,MAAM,EAAE,YAAY,IAAI,SAAS;YACjC,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;YACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;SAChE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB;QAEtC,IAAI,CAAC,QAAQ,CAAC,2DAA2D,CAAC,CAAC;QAE3E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,SAAS,CAAC,GAAY,EAAE,GAAa;QACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACtG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACzC,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEvC,MAAM,YAAY,GAAG,mBAAmB,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;QAC5E,IAAI,MAA0B,CAAC;QAC/B,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;gBACvE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACpD,MAAM,OAAO,GAAG,OAAkC,CAAC;oBACnD,MAAM,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC3E,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,qCAAqC;aAC1F,CAAC,CAAC;QACL,CAAC;QAED,mGAAmG;QACnG,MAAM,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAE9B,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;YAClC,MAAM;YACN,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;YACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;SAChE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB;QAEtC,IAAI,CAAC,QAAQ,CAAC,yEAAyE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACrG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,kEAAkE;IAClE,yCAAyC;IACzC,kEAAkE;IAElE;;OAEG;IACK,KAAK,CAAC,oBAAoB,CAAC,GAAY,EAAE,GAAa;QAC5D,qEAAqE;QACrE,gEAAgE;QAChE,8DAA8D;QAC9D,+DAA+D;QAC/D,8DAA8D;QAC9D,6DAA6D;QAC7D,4DAA4D;QAC5D,mBAAmB;QACnB,MAAM,EAAE,KAAK,EAAE,GAAG,6BAA6B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEtE,+DAA+D;QAC/D,gEAAgE;QAChE,gEAAgE;QAChE,mEAAmE;QACnE,EAAE;QACF,8DAA8D;QAC9D,+DAA+D;QAC/D,iEAAiE;QACjE,2DAA2D;QAC3D,+DAA+D;QAC/D,iCAAiC;QACjC,EAAE;QACF,yDAAyD;QACzD,0DAA0D;QAC1D,2DAA2D;QAC3D,8DAA8D;QAC9D,mEAAmE;QACnE,0DAA0D;QAC1D,0DAA0D;QAC1D,2DAA2D;QAC3D,iBAAiB;QACjB,EAAE;QACF,kEAAkE;QAClE,6DAA6D;QAC7D,0DAA0D;QAC1D,EAAE;QACF,kEAAkE;QAClE,gEAAgE;QAChE,8DAA8D;QAC9D,iEAAiE;QACjE,2DAA2D;QAC3D,gEAAgE;QAChE,kEAAkE;QAClE,uDAAuD;QACvD,6DAA6D;QAC7D,4DAA4D;QAC5D,8BAA8B;QAC9B,EAAE;QACF,oEAAoE;QACpE,iEAAiE;QACjE,uDAAuD;QACvD,0DAA0D;QAC1D,4CAA4C;QAC5C,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,eAAe,EAAE,CAAC,EAAE,EACtB,sCAAsC,EACtC,SAAS,EACT,KAAK,CAAC,WAAW,EAAE,CACpB,CAAC;QACF,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,eAAe,EAAE,CAAC,EAAE,EACtB,mCAAmC,CACpC,CAAC;QAEF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,EAAE,EAAE;YACtE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;SAC/F,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,qBAAqB,CAAC,GAAY,EAAE,GAAa;QAC7D;;;;;;;;;;;;;;;;WAgBG;QACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,oCAAoC,CACrC,CAAC;QAEF,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,8BAA8B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACpF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,qBAAqB,CAAC,EAAE,EAAE;YACvE,KAAK,EAAE,WAAW;YAClB,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;YACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;SAChE,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,kEAAkE;IAClE,iEAAiE;IACjE,kEAAkE;IAElE;;OAEG;IACK,KAAK,CAAC,QAAQ,CAAC,GAAY,EAAE,GAAa;QAChD,oEAAoE;QACpE,8CAA8C;QAC9C,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,wBAAwB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1H,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAE9C,oEAAoE;QACpE,qFAAqF;QACrF,kEAAkE;QAClE,+DAA+D;QAC/D,8DAA8D;QAC9D,8DAA8D;QAC9D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,6DAA6D;QAC7D,oEAAoE;QACpE,kEAAkE;QAClE,uDAAuD;QACvD,0DAA0D;QAC1D,EAAE;QACF,iEAAiE;QACjE,kEAAkE;QAClE,sDAAsD;QACtD,kEAAkE;QAClE,0DAA0D;QAC1D,uCAAuC;QACvC,EAAE;QACF,iEAAiE;QACjE,8DAA8D;QAC9D,+DAA+D;QAC/D,6DAA6D;QAC7D,6DAA6D;QAC7D,2DAA2D;QAC3D,4DAA4D;QAC5D,+DAA+D;QAC/D,iEAAiE;QACjE,4DAA4D;QAC5D,+DAA+D;QAC/D,mEAAmE;QACnE,gEAAgE;QAChE,EAAE;QACF,+DAA+D;QAC/D,iEAAiE;QACjE,6DAA6D;QAC7D,0DAA0D;QAC1D,gEAAgE;QAChE,4DAA4D;QAC5D,6DAA6D;QAC7D,eAAe;QACf,EAAE;QACF,kEAAkE;QAClE,kDAAkD;QAClD,iEAAiE;QACjE,0BAA0B;QAC1B,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,eAAe,EAAE,CAAC,EAAE,EACtB,wBAAwB,EACxB,SAAS,EACT,KAAK,CAAC,WAAW,EAAE,CACpB,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACvD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,eAAe,EAAE,EAAE,EAAE,EACvB,yBAAyB,EACzB,SAAS,EACT,WAAW,CACZ,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,CAAC,EAAE,EACxB,qBAAqB,CACtB,CAAC;QAEF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;QAE1D,mEAAmE;QACnE,6FAA6F;QAC7F,+FAA+F;QAC/F,qGAAqG;QACrG,MAAM,sBAAsB,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAuB,CAAC;QACxG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;QAC7D,MAAM,iBAAiB,GAAG,sBAAsB;YAC9C,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,sCAAsC,CAAC,sBAAsB,CAAC,IAAI,SAAS;YACnG,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE;QAC3D,+FAA+F;QAC/F,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAClE,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAC5K,CAAC;QAEF,oEAAoE;QACpE,4EAA4E;QAC5E,0EAA0E;QAC1E,qEAAqE;QACrE,wEAAwE;QACxE,6DAA6D;QAC7D,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,4CAA4C,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACnF,CAAC;QAED,gEAAgE;QAChE,+DAA+D;QAC/D,iEAAiE;QACjE,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;QAC7C,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACzD,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,4BAA4B,CAC7B,CAAC;QAEF,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;QACrF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAAC,GAAY,EAAE,GAAa;QACxD,iEAAiE;QACjE,gEAAgE;QAChE,0DAA0D;QAC1D,6DAA6D;QAC7D,+DAA+D;QAC/D,yDAAyD;QACzD,4DAA4D;QAC5D,oCAAoC;QACpC,EAAE;QACF,6DAA6D;QAC7D,6DAA6D;QAC7D,gEAAgE;QAChE,2DAA2D;QAC3D,yBAAyB;QACzB,EAAE;QACF,iEAAiE;QACjE,6CAA6C;QAC7C,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,8BAA8B,CAC/B,CAAC;QAEF,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,0BAA0B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9H,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,EAAE,EAAE;YACjE,eAAe;YACf,SAAS;YACT,QAAQ;YACR,QAAQ;YACR,gBAAgB;YAChB,SAAS;YACT,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;SAChE,CAAC,CAAC;QAEH,iGAAiG;QACjG,iGAAiG;QACjG,8CAA8C;QAC9C,IAAI,MAAM,CAAC,OAAO,KAAK,uBAAuB,CAAC,eAAe,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC9D,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC,CAAC;YACvG,OAAO;QACT,CAAC;QAED,0FAA0F;QAC1F,+FAA+F;QAC/F,2FAA2F;QAC3F,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,4CAA4C,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACnF,CAAC;QAED,4FAA4F;QAC5F,+EAA+E;QAC/E,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;QAChE,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAAC,GAAY,EAAE,GAAa;QACxD,qDAAqD;QACrD,mEAAmE;QACnE,8DAA8D;QAC9D,6DAA6D;QAC7D,2DAA2D;QAC3D,gEAAgE;QAChE,4DAA4D;QAC5D,4DAA4D;QAC5D,EAAE;QACF,iEAAiE;QACjE,+CAA+C;QAC/C,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,8BAA8B,CAC/B,CAAC;QAEF,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,GAAG,gCAAgC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACpG,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,EAAE,EAAE;YACjE,eAAe;YACf,eAAe;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACzD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAC3D,yFAAyF;QACzF,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,6BAA6B,CAAC,CAAC;QAC5G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAEhF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,wBAAwB,CAAC,SAAS,EAAE;YACrF,YAAY,EAAE,MAAM,CAAC,MAAM;SAC5B,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IACzC,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,kBAAkB,CAAC,GAAY,EAAE,GAAa;QAC1D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAC3D,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,oCAAoC,CAAC,CAAC;QACnH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAChF,oFAAoF;QACpF,qCAAqC;QACrC,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAE7F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,EAAE;YAC1E,YAAY,EAAE,MAAM,CAAC,MAAM;YAC3B,YAAY;SACb,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,kBAAkB,CAAC,GAAY,EAAE,GAAa;QAC1D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAC3D,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,oCAAoC,CAAC,CAAC;QACnH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAChF,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;YACjD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;SAChD,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,EAAE;YAC1E,YAAY,EAAE,MAAM,CAAC,MAAM;YAC3B,YAAY;YACZ,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW,CAAC,GAAY,EAAE,GAAa;QACnD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,EAAE;YAC5D,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;YACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;SAChE,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,4CAA4C,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACnF,CAAC;QAED,2EAA2E;QAC3E,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;QAC7C,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,uBAAuB,CAAC,GAAY,EAAE,GAAa;QAC/D,oEAAoE;QACpE,8CAA8C;QAC9C,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;YACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;SAC1B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEzB,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,mEAAmE;QACnE,kEAAkE;QAClE,iEAAiE;QACjE,iEAAiE;QACjE,0DAA0D;QAC1D,kEAAkE;QAClE,oBAAoB;QACpB,EAAE;QACF,gEAAgE;QAChE,+DAA+D;QAC/D,6DAA6D;QAC7D,0DAA0D;QAC1D,+DAA+D;QAC/D,kCAAkC;QAClC,EAAE;QACF,yDAAyD;QACzD,8DAA8D;QAC9D,4DAA4D;QAC5D,gEAAgE;QAChE,0DAA0D;QAC1D,qDAAqD;QACrD,6DAA6D;QAC7D,oBAAoB;QACpB,EAAE;QACF,iEAAiE;QACjE,oEAAoE;QACpE,wCAAwC;QACxC,EAAE;QACF,4DAA4D;QAC5D,iDAAiD;QACjD,4DAA4D;QAC5D,6DAA6D;QAC7D,sDAAsD;QACtD,8BAA8B;QAC9B,EAAE;QACF,+CAA+C;QAC/C,mEAAmE;QACnE,0BAA0B;QAC1B,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,aAAa,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE,EACjE,4BAA4B,EAC5B,SAAS,EACT,KAAK,CAAC,WAAW,EAAE,CACpB,CAAC;QACF,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,aAAa,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE,EACjE,yBAAyB,CAC1B,CAAC;QAEF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,EAAE,EAAE;YACxE,KAAK,EAAE,WAAW,EAAE,SAAS;YAC7B,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;SAChE,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,qBAAqB,CAAC,GAAY,EAAE,GAAa;QAC7D,8DAA8D;QAC9D,+DAA+D;QAC/D,0DAA0D;QAC1D,gEAAgE;QAChE,4DAA4D;QAC5D,sDAAsD;QACtD,2DAA2D;QAC3D,oDAAoD;QACpD,EAAE;QACF,+DAA+D;QAC/D,gEAAgE;QAChE,+DAA+D;QAC/D,gEAAgE;QAChE,yDAAyD;QACzD,0DAA0D;QAC1D,sBAAsB;QACtB,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,EACzB,oCAAoC,CACrC,CAAC;QAEF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;YAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;iBACzC,KAAK,CAAC,oBAAoB,EAAE,kDAAkD,CAAC;SACnF,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,qBAAqB,CAAC,EAAE,EAAE;YACtE,SAAS;YACT,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,EAAE;SAC1C,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,kEAAkE;IAClE,0CAA0C;IAC1C,kEAAkE;IAElE;;;;;;;OAOG;IACK,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa;QACvD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAE9E,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAE7E,qFAAqF;QACrF,yEAAyE;QACzE,MAAM,EACJ,QAAQ,EACR,YAAY,EACZ,KAAK,EACL,aAAa,GACd,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAE5D,qBAAqB;QACrB,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC;YAC7D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;gBAC/C,YAAY;gBACZ,WAAW,EAAE,sBAAsB,CAAC,SAAS;gBAC7C,MAAM,EAAE,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBAClE,IAAI,EAAE,iBAAiB,CAAC,aAAa;gBACrC,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,aAAa,EAAE,EAAE,KAAK,EAAE;oBACxB,aAAa,EAAE;wBACb,mBAAmB,EAAE;4BACnB,OAAO,EAAE,WAAW,CAAC,OAAO;4BAC5B,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,aAAa;4BAClD,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;gCACzD,WAAW,EAAE,qBAAqB,CAAC,MAAM;gCACzC,OAAO,EAAE,iBAAiB,CAAC,KAAK;6BACjC,CAAC,IAAI,SAAS;yBAChB;qBACF;oBACD,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,qEAAqE;oBACzG,iBAAiB,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAE;iBAC1E;aACF,CAAC,CAAC;YACH,aAAa;gBACX,WAAW,CAAC,OAAO;uBAChB,WAAW,CAAC,OAAO,KAAK,sBAAsB,CAAC,iBAAiB,CAAC;YACtE,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC,QAAQ,CAAC,4CAA4C,EAAE;oBAC1D,KAAK;oBACL,YAAY,EAAE,WAAW,CAAC,YAAY;oBACtC,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;iBACnD,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE;oBACrE,KAAK;oBACL,YAAY,EAAE,WAAW,CAAC,YAAY;oBACtC,OAAO,EAAE,WAAW,CAAC,OAAO;oBAC5B,KAAK,EAAE,WAAW,CAAC,KAAK;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;gBAChD,GAAG,2BAA2B,CAAC,UAAU,CAAC;aAC3C,CAAC,CAAC;YACH,2DAA2D;YAC3D,kDAAkD;QACpD,CAAC;QAED,mEAAmE;QACnE,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;gBAC3C,KAAK;gBACL,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;gBACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;aAChE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC5G,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACzD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC;YACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;SACnE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEzB,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAE/E,8EAA8E;QAC9E,kEAAkE;QAClE,MAAM,WAAW,GAAG;YAClB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,UAAU,CAAC,SAAkB;YACrC,WAAW,EAAE,eAAe,CAAC,MAAe;YAC5C,KAAK,EAAE,IAAI,CAAC,IAAI;YAChB,UAAU,EAAE,KAAK;YACjB,qBAAqB,EAAE,EAAE;SAC1B,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QACpE,yEAAyE;QACzE,6EAA6E;QAC7E,6EAA6E;QAC7E,0EAA0E;QAC1E,6EAA6E;QAC7E,6EAA6E;QAC7E,yEAAyE;QACzE,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,IAAI,CAAC,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC1D,iEAAiE;QACjE,4CAA4C;QAC5C,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;QAC7C,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,kEAAkE;IAClE,qCAAqC;IACrC,kEAAkE;IAElE;;;;;;;;;;OAUG;IACK,KAAK,CAAC,YAAY,CAAC,GAAY,EAAE,GAAa;QACpD,4DAA4D;QAC5D,oEAAoE;QACpE,8DAA8D;QAC9D,4DAA4D;QAC5D,6DAA6D;QAC7D,+DAA+D;QAC/D,2DAA2D;QAC3D,6DAA6D;QAC7D,2DAA2D;QAC3D,8DAA8D;QAC9D,6DAA6D;QAC7D,+BAA+B;QAC/B,EAAE;QACF,gEAAgE;QAChE,+DAA+D;QAC/D,8DAA8D;QAC9D,+DAA+D;QAC/D,yDAAyD;QACzD,8DAA8D;QAC9D,+DAA+D;QAC/D,gEAAgE;QAChE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACnF,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,eAAe,EAAE,CAAC,EAAE,EACtB,6BAA6B,EAC7B,SAAS,EACT,MAAM,CACP,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE;YACjD,MAAM;YACN,KAAK;YACL,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;YACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;SAChE,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,kBAAkB,CAAC,GAAY,EAAE,GAAa;QAC1D,4DAA4D;QAC5D,+DAA+D;QAC/D,4DAA4D;QAC5D,6DAA6D;QAC7D,mBAAmB;QACnB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,eAAe,EAAE,CAAC,EAAE,EACtB,6BAA6B,EAC7B,SAAS,EACT,MAAM,CACP,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;SACrF,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,EAAE;YACvD,MAAM;YACN,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;YACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;SAChE,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CAAC,GAAY,EAAE,GAAa;QACrD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC;YACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;SAC5D,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEzB,IAAI,CAAC,QAAQ,CAAC,2BAA2B,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAE1E,MAAM,WAAW,GAAG;YAClB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,UAAU,CAAC,IAAa;YAChC,WAAW,EAAE,eAAe,CAAC,MAAe;YAC5C,KAAK,EAAE,IAAI,CAAC,IAAI;YAChB,UAAU,EAAE,KAAK;YACjB,qBAAqB,EAAE,EAAE;SAC1B,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QACpE,wEAAwE;QACxE,6EAA6E;QAC7E,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,IAAI,CAAC,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC1D,oEAAoE;QACpE,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;QAC7C,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,kEAAkE;IAClE,6CAA6C;IAC7C,kEAAkE;IAElE;;;;;;;;;OASG;IACK,KAAK,CAAC,4BAA4B,CAAC,GAAY,EAAE,GAAa;QACpE,IAAI,CAAC;YACH,gEAAgE;YAChE,0DAA0D;YAC1D,sEAAsE;YACtE,kEAAkE;YAClE,8DAA8D;YAC9D,+DAA+D;YAC/D,+DAA+D;YAC/D,8DAA8D;YAC9D,2DAA2D;YAC3D,6DAA6D;YAC7D,+DAA+D;YAC/D,4DAA4D;YAC5D,2DAA2D;YAC3D,sBAAsB;YACtB,EAAE;YACF,0DAA0D;YAC1D,yDAAyD;YACzD,2CAA2C;YAC3C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACpD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACnF,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,eAAe,EAAE,EAAE,EAAE,EACvB,mCAAmC,EACnC,SAAS,EACT,MAAM,CACP,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,2BAA2B,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YAC1F,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,wBAAwB,EAAE;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,2BAA2B,CAAC,GAAY,EAAE,GAAa;QACnE,IAAI,CAAC;YACH,mEAAmE;YACnE,+DAA+D;YAC/D,iEAAiE;YACjE,sDAAsD;YACtD,4CAA4C;YAC5C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACpD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACnF,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,eAAe,EAAE,EAAE,EAAE,EACvB,mCAAmC,EACnC,SAAS,EACT,MAAM,CACP,CAAC;YACF,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;gBAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;oBACjB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;oBACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;oBACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;wBACjB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;qBAC3B,CAAC;oBACF,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,UAAU,CAAU,CAAC,CAAC,QAAQ,EAAE;oBACnF,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;oBACjE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;iBAC9B,CAAC;gBACF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;aACrC,CAAC,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,+BAA+B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YACjF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAErG,iFAAiF;YACjF,4DAA4D;YAC5D,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;YACxF,MAAM,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC;gBACnD,MAAM,EAAE,MAAM;gBACd,KAAK;gBACL,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,cAAc,EAAE,UAAU,CAAC,IAAI;gBAC/B,oBAAoB,EAAE,UAAU,CAAC,oBAAoB;gBACrD,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;gBACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;aAChE,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;YAEtB,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;gBACpB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE;oBACV,YAAY,EAAE,UAAU,CAAC,YAAY;oBACrC,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,SAAS,EAAE,UAAU,CAAC,SAAS;iBAChC;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,uBAAuB,EAAE;aAC/D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,wBAAwB,CAAC,GAAY,EAAE,GAAa;QAChE,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACpD,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;YAC/B,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE;iBAC7C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,6BAA6B,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACpF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;oBAClF,OAAO,EAAE,EAAE,SAAS,EAAE;iBACvB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;gBACxC,0BAA0B,CAAC,UAAU;gBACrC,0BAA0B,CAAC,wBAAwB;gBACnD,0BAA0B,CAAC,sBAAsB;gBACjD,0BAA0B,CAAC,YAAY;aACxC,CAAC,CAAC;YACH,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAmC,CAAC,EAAE,CAAC;gBAChF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kDAAkD,EAAE;iBACxE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,iCAAiC,EAAE;iBACvD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,6BAA6B,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrF,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,oBAAoB,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,uBAAuB,CAAC,GAAY,EAAE,GAAa;QAC/D,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACpD,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;gBAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;oBACjB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;oBACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;oBACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;wBACjB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;wBACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;qBAClC,CAAC;oBACF,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,UAAU,CAAU,CAAC,CAAC,QAAQ,EAAE;oBACnF,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;oBACjE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;iBAC9B,CAAC;gBACF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;aACnC,CAAC,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAE/F,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE;gBAC3D,SAAS;gBACT,MAAM,EAAE,UAAU,CAAC,OAAO;gBAC1B,WAAW,EAAG,WAA+B,IAAI,eAAe,CAAC,KAAK;gBACtE,QAAQ;gBACR,UAAU,EAAE,KAAK;gBACjB,qBAAqB,EAAE,EAAE;aAC1B,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;YAChE,oEAAoE;YACpE,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,YAAY,CAAC;YACnD,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,mBAAmB,EAAE;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACzD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;YAC3D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACpF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC,CAAC;YAChE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAE1E,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9C,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,oBAAoB,EAAE,CAAC,CAAC,oBAAoB;gBAC5C,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;aACzC,CAAC,CAAC,CAAC;YACJ,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,YAAY,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,mBAAmB,CAAC,GAAY,EAAE,GAAa;QAC3D,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;YAC3D,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAC3F,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC,CAAC;YAChE,MAAM,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;YAClC,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE;iBAChD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,CAAC,uBAAuB,CAAC,+BAA+B,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAE/E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC1E,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;YAExE,8DAA8D;YAC9D,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACzF,IAAI,gBAAgB,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;YAEtE,iFAAiF;YACjF,2BAA2B;YAC3B,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;YACxF,MAAM,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC;gBAChD,MAAM,EAAE,MAAM;gBACd,KAAK;gBACL,YAAY;gBACZ,cAAc,EAAE,MAAM,EAAE,IAAI,IAAI,SAAS;gBACzC,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;gBACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;aAChE,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;YAEtB,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,cAAc,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,mBAAmB,CAAC,GAAY,EAAE,GAAa;QAC3D,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;YAC3D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACpF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC,CAAC;YAChE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;YACxC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,oCAAoC,EAAE;iBAC1D,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;YAC5E,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,cAAc,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAGD,kEAAkE;IAClE,6DAA6D;IAC7D,kEAAkE;IAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACK,6BAA6B,CACnC,GAAa,EACb,IAAa,EACb,YAAgC,EAChC,aAAqB,GAAG;QAExB,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,mBAAmB,CAAC,gBAAgB,CAClC,GAAG,EACH,YAAY,EACZ,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,EAC3D,IAAI,CAAC,gBAAgB,CAAC,cAAc,CACrC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;OAKG;IACK,mBAAmB,CAAC,GAAa;QACvC,mBAAmB,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;IACpF,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,2BAA2B;QACvC,OAAO,IAAI,CAAC,aAAa,CAAC,yBAAyB,CAAC,IAAI,CAAC,aAAa,CAAC,yBAAyB,EAAE,CAAC,CAAC;IACtG,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,iCAAiC,CAAC,MAAc;QAC5D,OAAO,IAAI,CAAC,aAAa,CAAC,mCAAmC,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,yBAAyB,EAAE,CAAC,CAAC;IACxH,CAAC;IAED,kEAAkE;IAClE,qCAAqC;IACrC,kEAAkE;IAElE;;;;;;OAMG;IACK,0BAA0B,CAChC,GAAa,EACb,YAAoB,EACpB,WAAoB,EACpB,SAAkB;QAElB,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;gBAChE,OAAO,EAAE,EAAE,OAAO,EAAE,iHAAiH,EAAE;aACxI,CAAC,CAAC;QACL,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC;YACvC,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;QACH,IAAI,SAAS,EAAE,CAAC;YACd,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,WAAW,GAAG,GAAG,WAAW,kBAAkB,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC9E,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;;OAUG;IACK,2BAA2B,CACjC,GAAa,EACb,KAAa,EACb,WAAmB,EACnB,WAAoB,EACpB,SAAkB;QAElB,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC;YACvC,KAAK;YACL,MAAM,EAAE,WAAW;SACpB,CAAC,CAAC;QACH,IAAI,SAAS,EAAE,CAAC;YACd,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,WAAW,GAAG,GAAG,WAAW,UAAU,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC;QACtE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACjC,CAAC;IAEO,yBAAyB,CAAC,SAAiB,EAAE,WAAmB;QACtE,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QACzC,IAAI,CAAC;YACH,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;QAED,KAAK,MAAM,mBAAmB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,EAAE,CAAC;YACnG,MAAM,SAAS,GAAG,mBAAmB,CAAC,uBAAuB,CAC3D,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAC5B,mBAAmB,CACpB,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,SAAS;YACX,CAAC;YACD,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YAClC,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;YAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;YAC9D,OAAO,EAAE;gBACP,OAAO,EAAE,0EAA0E;gBACnF,SAAS;aACV;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACK,2BAA2B,CAAC,GAAY;QAC9C,MAAM,mBAAmB,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAuB,CAAC;QAErG,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,gCAAgC;gBACpF,OAAO,EAAE;oBACP,wBAAwB;oBACxB,MAAM,EAAE,eAAe,CAAC,qBAAqB;iBAC9C;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACK,kDAAkD,CAAC,mBAA2B;QACpF,OAAO,IAAI,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACK,wBAAwB,CAAC,mBAA2B;QAC1D,MAAM,GAAG,GAAG,mBAAmB,CAAC,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;QAC3G,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;gBAChE,OAAO,EAAE;oBACP,OAAO,EAAE,kDAAkD,mBAAmB,IAAI;oBAClF,mBAAmB;iBACpB;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,0BAA0B,CAAC,GAAY,EAAE,0BAA8C;QAC7F,IAAI,CAAC,0BAA0B;YAAE,OAAO;QAExC,MAAM,aAAa,GAAG,mBAAmB,CAAC,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;QAC5H,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,iDAAiD,0BAA0B,KAAK;wBAChF,oEAAoE,0BAA0B,wCAAwC;oBACxI,mBAAmB,EAAE,0BAA0B;iBAChD;aACF,CAAC,CAAC;QACL,CAAC;QAED,oFAAoF;QACpF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAuB,CAAC;QACzE,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,IAAI,gBAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,gBAAgB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,+BAA+B,0BAA0B,cAAc;wBACvE,+EAA+E;oBACjF,mBAAmB,EAAE,0BAA0B;oBAC/C,SAAS,EAAE,aAAa;iBACzB;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,CAAC,gFAAgF,EAAE;gBAC9F,0BAA0B;gBAC1B,aAAa,EAAE,MAAM;gBACrB,gBAAgB;aACjB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE,EAAE,OAAO,EAAE,sEAAsE,EAAE;aAC7F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,mCAAmC,CACzC,GAAY,EACZ,QAAwC;QAExC,IAAI,OAAO,QAAQ,CAAC,gBAAgB,KAAK,QAAQ;YAAE,OAAO;QAE1D,MAAM,0BAA0B,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAuB,CAAC;QAC5G,IAAI,CAAC,0BAA0B,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,gCAAgC;gBACpF,OAAO,EAAE;oBACP,wBAAwB;oBACxB,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;iBAC5C;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,0BAA0B,KAAK,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,kFAAkF;oBAC3F,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;oBAC3C,0BAA0B;iBAC3B;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IACnE,CAAC;IAED,kEAAkE;IAClE,uCAAuC;IACvC,kEAAkE;IAElE;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CAAC,GAAY,EAAE,GAAa;QACrD,gEAAgE;QAChE,yDAAyD;QACzD,8DAA8D;QAC9D,sDAAsD;QACtD,MAAM,IAAI,GAAG,0BAA0B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAE9D,2DAA2D;QAC3D,2DAA2D;QAC3D,gEAAgE;QAChE,4CAA4C;QAC5C,4DAA4D;QAC5D,4DAA4D;QAC5D,6DAA6D;QAC7D,8DAA8D;QAC9D,iEAAiE;QACjE,8DAA8D;QAC9D,+DAA+D;QAC/D,iCAAiC;QACjC,4DAA4D;QAC5D,qDAAqD;QACrD,0DAA0D;QAC1D,8DAA8D;QAC9D,EAAE;QACF,6DAA6D;QAC7D,6DAA6D;QAC7D,+DAA+D;QAC/D,iEAAiE;QACjE,8DAA8D;QAC9D,gEAAgE;QAChE,8DAA8D;QAC9D,kEAAkE;QAClE,WAAW;QACX,EAAE;QACF,iEAAiE;QACjE,gEAAgE;QAChE,2DAA2D;QAC3D,iEAAiE;QACjE,4DAA4D;QAC5D,4DAA4D;QAC5D,EAAE;QACF,qEAAqE;QACrE,+DAA+D;QAC/D,6DAA6D;QAC7D,6DAA6D;QAC7D,8DAA8D;QAC9D,6DAA6D;QAC7D,6DAA6D;QAC7D,6CAA6C;QAC7C,8DAA8D;QAC9D,6DAA6D;QAC7D,sCAAsC;QACtC,+DAA+D;QAC/D,+DAA+D;QAC/D,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC;QAC/E,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,eAAe,CAAC,kBAAkB,EAAE,eAAe,EAAE,eAAe,CAAC,gBAAgB,EAAE,EAC5G,+BAA+B,EAC/B,SAAS,EACT,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CACzB,CAAC;QACF,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,EAAE,4BAA4B,CAAC,CAAC;QAEzG,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;QAEvE,IAAI,CAAC,QAAQ,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAElE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QAExF,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAE5C,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC,CAAC;IACzG,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,mBAAmB,CAC/B,GAAY,EACZ,QAMC;QAED,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK;YAAE,OAAO;QAC/C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;YAC1D,MAAM,YAAY,GAAG,GAAG,WAAW,iCAAiC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAErJ,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC;YAC7D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;gBAC/C,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,WAAW,EAAE,sBAAsB,CAAC,UAAU;gBAC9C,MAAM,EAAE,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBAClE,IAAI,EAAE,iBAAiB,CAAC,aAAa;gBACrC,EAAE,EAAE,QAAQ,CAAC,KAAK;gBAClB,OAAO,EAAE;oBACP,aAAa,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;oBACxC,aAAa,EAAE;wBACb,mBAAmB,EAAE;4BACnB,OAAO,EAAE,WAAW,CAAC,OAAO;4BAC5B,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,aAAa;yBACnD;qBACF;oBACD,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;oBAC5E,iBAAiB,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE;iBAC7G;aACF,CAAC,CAAC;YACH,IACE,CAAC,WAAW,CAAC,OAAO;mBACjB,WAAW,CAAC,OAAO,KAAK,sBAAsB,CAAC,iBAAiB,EACnE,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sDAAsD,EAAE;oBACxE,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,YAAY,EAAE,WAAW,CAAC,YAAY;oBACtC,OAAO,EAAE,WAAW,CAAC,OAAO;oBAC5B,KAAK,EAAE,WAAW,CAAC,KAAK;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;gBACnD,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,yDAAyD;QAC3D,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa;QACvD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,4BAA4B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;QAEvE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,wBAAwB,CAAC,CAAC;QAEvG,IAAI,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC;QAE7C,wGAAwG;QACxG,uGAAuG;QACvG,sGAAsG;QACtG,qGAAqG;QACrG,qEAAqE;QACrE,EAAE;QACF,qGAAqG;QACrG,kGAAkG;QAClG,wGAAwG;QACxG,sGAAsG;QACtG,MAAM,4BAA4B,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAuB,CAAC;QAC9G,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;QACnE,MAAM,uBAAuB,GAAG,4BAA4B;YAC1D,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,sCAAsC,CAAC,4BAA4B,CAAC,IAAI,SAAS;YACzG,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,uBAAuB,CAAC,CAAC;QAEzH,MAAM,IAAI,CAAC,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;QAChE,oEAAoE;QACpE,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,YAAY,CAAC;QACnD,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,kEAAkE;IAClE,oCAAoC;IACpC,kEAAkE;IAElE;;;;;;;OAOG;IACK,KAAK,CAAC,UAAU,CAAC,GAAY,EAAE,GAAa;QAClD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC;YACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC,QAAQ,EAAE;SAClG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEzB,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAEvE,sEAAsE;QACtE,mEAAmE;QACnE,kEAAkE;QAClE,iEAAiE;QACjE,kEAAkE;QAClE,6DAA6D;QAC7D,+DAA+D;QAC/D,0DAA0D;QAC1D,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAE/F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAEvF,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAC1C,MAAM,CAAC,WAAW,EAClB,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,oBAAoB,CAAC,qBAAqB,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CACxI,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE;gBAC3C,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,KAAK,EAAE,SAAS,CAAC,KAAK;aACvB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,EAAE;aACzG,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAClH,CAAC;IAED,kEAAkE;IAClE,+CAA+C;IAC/C,kEAAkE;IAElE;;;;;;;OAOG;IACK,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa;QACvD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,4BAA4B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAChE,oEAAoE;QACpE,kEAAkE;QAClE,mEAAmE;QACnE,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAE9C,qEAAqE;QACrE,iEAAiE;QACjE,iEAAiE;QACjE,EAAE;QACF,kEAAkE;QAClE,mEAAmE;QACnE,oEAAoE;QACpE,6DAA6D;QAC7D,mEAAmE;QACnE,mEAAmE;QACnE,iEAAiE;QACjE,kEAAkE;QAClE,0DAA0D;QAC1D,kEAAkE;QAClE,gEAAgE;QAChE,gEAAgE;QAChE,gEAAgE;QAChE,kBAAkB;QAClB,EAAE;QACF,gEAAgE;QAChE,mEAAmE;QACnE,kEAAkE;QAClE,yCAAyC;QACzC,EAAE;QACF,2DAA2D;QAC3D,0DAA0D;QAC1D,8DAA8D;QAC9D,gCAAgC;QAChC,EAAE;QACF,kEAAkE;QAClE,qDAAqD;QACrD,gEAAgE;QAChE,4DAA4D;QAC5D,uDAAuD;QACvD,8DAA8D;QAC9D,qBAAqB;QACrB,EAAE;QACF,mEAAmE;QACnE,kEAAkE;QAClE,wEAAwE;QACxE,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,aAAa,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE,EACjE,iCAAiC,EACjC,SAAS,EACT,mBAAmB,CAAC,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,CAC9D,CAAC;QACF,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,eAAe,EAAE,CAAC,EAAE,EACtB,8BAA8B,CAC/B,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAEzD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,EAAE;YACjF,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS;SACV,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAC1C,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,oBAAoB,CAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CACjJ,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;YACvH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,EAAE;aACzG,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;IACxH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,kBAAkB,CAAC,GAAY,EAAE,GAAa;QAC1D,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,+BAA+B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEnE,oEAAoE;QACpE,gEAAgE;QAChE,kEAAkE;QAClE,kEAAkE;QAClE,iEAAiE;QACjE,qCAAqC;QACrC,kEAAkE;QAClE,2DAA2D;QAC3D,4DAA4D;QAC5D,+DAA+D;QAC/D,+DAA+D;QAC/D,qDAAqD;QACrD,EAAE;QACF,mEAAmE;QACnE,mEAAmE;QACnE,oDAAoD;QACpD,EAAE;QACF,mEAAmE;QACnE,6DAA6D;QAC7D,6DAA6D;QAC7D,iEAAiE;QACjE,gEAAgE;QAChE,+DAA+D;QAC/D,4CAA4C;QAC5C,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,aAAa,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE,EACjE,oCAAoC,EACpC,SAAS,EACT,mBAAmB,CAAC,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,CAC9D,CAAC;QACF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,EAAE;YACzE,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM;YACN,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;YACtC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;SAChE,CAAC,CAAC;QAEH,0EAA0E;QAC1E,kEAAkE;QAClE,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,6EAA6E;QAC7E,0EAA0E;QAC1E,qEAAqE;QACrE,iEAAiE;QACjE,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,4CAA4C,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5E,CAAC;QAED,mEAAmE;QACnE,mEAAmE;QACnE,6DAA6D;QAC7D,kEAAkE;QAClE,mDAAmD;QACnD,IAAI,CAAC,6BAA6B,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7D,CAAC;IAED,kEAAkE;IAClE,wCAAwC;IACxC,kEAAkE;IAE1D,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACzD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAC3D,8DAA8D;QAC9D,qEAAqE;QACrE,gEAAgE;QAChE,oEAAoE;QACpE,oEAAoE;QACpE,gEAAgE;QAChE,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAEpG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAChF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,8BAA8B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAElE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;aACjC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;gBAClF,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;aACjC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB;aAC3D,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAC/C,MAAM,cAAc,GAAG,SAAS,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;YAChD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;gBACzE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,wBAAwB;aAChD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM,UAAU,GACd,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,GAAG,IAAI;YAC1D,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,GAAG,IAAI,GAAG,IAAI;gBAC5D,CAAC,CAAC,SAAS,CAAC,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;QAEnC,uGAAuG;QACvG,uGAAuG;QACvG,0GAA0G;QAC1G,uGAAuG;QACvG,wFAAwF;QACxF,MAAM,kBAAkB,GAAG,IAAI,CAAC,GAAG,CACjC,cAAc,CAAC,IAAI,CAAC,+BAA+B,IAAI,oCAAoC,EAC3F,oCAAoC,CACrC,CAAC;QACF,IAAI,UAAU,GAAG,kBAAkB,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;gBACxF,OAAO,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,EAAE,UAAU,EAAE,kBAAkB,EAAE,EAAE,wBAAwB;aACxH,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,cAAoC,CAAC;QACvE,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,aAAmC,CAAC;QAErE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;YAChE,SAAS,EAAE,IAAI,CAAC,SAAmB;YACnC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,CAAC,YAAY,EAAE;YACjE,cAAc;YACd,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YAC3E,KAAK,EAAE,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC9C,KAAK,EAAE,CAAC,IAAI,CAAC;gBACb,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;aACtD,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,oBAAoB,EAAE,IAAI;YAC1B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;gBAC1C,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,cAAc;gBACd,SAAS,EAAE,0BAA0B,CAAC,MAAM;gBAC5C,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;gBACvD,SAAS,EAAE;oBACT,OAAO,EAAE,WAAW,CAAC,GAAG;oBACxB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,YAAY,EAAE,IAAI,CAAC,MAAM;oBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,YAAY,EAAE,MAAM,CAAC,MAAM;oBAC3B,SAAS;oBACT,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;iBAChE;aACF,EAAE,EAAE,CAAC,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;YACpB,UAAU,EAAE,WAAW,CAAC,KAAK;YAC7B,OAAO,EAAE,WAAW,CAAC,GAAG;YACxB,SAAS,EAAE,WAAW,CAAC,SAAS;SACjC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,GAAY,EAAE,GAAa;QAC3D,oEAAoE;QACpE,qEAAqE;QACrE,oEAAoE;QACpE,mEAAmE;QACnE,mEAAmE;QACnE,oEAAoE;QACpE,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,EAC/C,uBAAuB,CACxB,CAAC;QAEF,MAAM,IAAI,GAAG,+BAA+B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEnE,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEpF,IAAI,CAAC,eAAe,CAAC,oBAAoB,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;aACnF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;aACtF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;QAClF,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;gBAClF,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAC/C,MAAM,cAAc,GAAG,SAAS,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;YAChD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;gBACzE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,wBAAwB;aAChD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,oBAAwC,CAAC;QAC7C,IAAI,eAAe,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,oBAAoB,GAAG,IAAI,CAAC,KAAK,CAAC;QACpC,CAAC;QAED,sGAAsG;QACtG,yGAAyG;QACzG,2GAA2G;QAC3G,0GAA0G;QAC1G,6FAA6F;QAC7F,MAAM,gBAAgB,GAAG,6BAA6B,CAAC,eAAe,EAAE,IAAI,IAAI,EAAE,EAAE,oCAAoC,CAAC,CAAC;QAC1H,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CACtD,eAAe,CAAC,MAAM,EACtB,SAAS,EACT,EAAE,WAAW,EAAE,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,EAC9D;YACE,mBAAmB,EAAE,IAAI;YACzB,qBAAqB,EAAE,gBAAgB;SACxC,CACF,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;gBAC1C,MAAM,EAAE,eAAe,CAAC,MAAM;gBAC9B,cAAc,EAAE,eAAe,CAAC,cAAc;gBAC9C,SAAS,EAAE,0BAA0B,CAAC,MAAM;gBAC5C,SAAS,EAAE,sBAAsB,CAAC,uBAAuB;gBACzD,SAAS,EAAE;oBACT,OAAO,EAAE,eAAe,CAAC,GAAG;oBAC5B,SAAS,EAAE,eAAe,CAAC,SAAS;oBACpC,SAAS,EAAE,eAAe,CAAC,SAAS;oBACpC,QAAQ,EAAE,eAAe,CAAC,SAAS,KAAK,UAAU;oBAClD,SAAS;oBACT,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;iBAChE;aACF,EAAE,EAAE,CAAC,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,4DAA4D;QAC5D,iEAAiE;QACjE,8DAA8D;QAC9D,kEAAkE;QAClE,8DAA8D;QAC9D,kEAAkE;QAClE,iEAAiE;QACjE,gEAAgE;QAChE,gEAAgE;QAChE,0DAA0D;QAC1D,IAAI,CAAC,6BAA6B,CAChC,GAAG,EACH;YACE,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,WAAW,EAAE,WAAW,CAAC,OAAO;YAChC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;gBACzB,oBAAoB;gBACpB,cAAc,EAAE,eAAe,CAAC,SAAS,CAAC,WAAW,EAAE;aACxD,CAAC,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,EAAE;gBACP,OAAO,EAAE,eAAe,CAAC,GAAG;gBAC5B,SAAS,EAAE,eAAe,CAAC,SAAS;gBACpC,SAAS,EAAE,eAAe,CAAC,SAAS;gBACpC,cAAc,EAAE,eAAe,CAAC,cAAc;gBAC9C,aAAa,EAAG,eAAe,CAAC,QAAgD,EAAE,aAAmC;gBACrH,MAAM,EAAE,eAAe,CAAC,MAAM;aAC/B;SACF,EACD,MAAM,CAAC,YAAY,CACpB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACzD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAC3D,kFAAkF;QAClF,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAEpG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAChF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAEvE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAiB,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAEvE,sGAAsG;QACtG,uGAAuG;QACvG,gFAAgF;QAChF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;gBAC9E,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,wBAAwB;aAC/C,CAAC,CAAC;QACL,CAAC;QAED,iGAAiG;QACjG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,yGAAyG;QACzG,kHAAkH;QAClH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAEzE,wGAAwG;QACxG,0GAA0G;QAC1G,gHAAgH;QAChH,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;oBAC1C,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,SAAS,EAAE,sBAAsB,CAAC,qBAAqB;oBACvD,SAAS,EAAE;wBACT,OAAO,EAAE,KAAK,CAAC,GAAG;wBAClB,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,YAAY,EAAE,KAAK,CAAC,MAAM;wBAC1B,YAAY,EAAE,MAAM,CAAC,MAAM;wBAC3B,SAAS;wBACT,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;qBAChE;iBACF,EAAE,EAAE,CAAC,CAAC;YACT,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,kEAAkE;IAClE,2DAA2D;IAC3D,kEAAkE;IAElE;;;;;;;;;;;;;;;;;OAiBG;IACK,kCAAkC,CAAC,GAAY;QACrD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC;QACnE,MAAM,eAAe,GAAG;YACtB,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW;YACzD,mBAAmB,CAAC,iCAAiC,CAAC,GAAG,CAAC;SAC3D,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEpF,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC;YAChF,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;gBACnE,wCAAwC;YAC1C,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,4BAA4B,CAAC,GAAY,EAAE,GAAa,EAAE,UAAkC;QACxG,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG;YAAE,OAAO;QAEzD,MAAM,eAAe,GAAG,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,CAAC;QACrE,IAAI,CAAC,eAAe;YAAE,OAAO;QAE7B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC;mBAChD,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;mBAC9B,SAAS,CAAC;YAEf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAClE,eAAe,EACf,UAAU,CAAC,IAAI,CAAC,GAAG,EACnB,QAAQ,CACT,CAAC;YAEF,mEAAmE;YACnE,yEAAyE;YACzE,uEAAuE;YACvE,mEAAmE;YACnE,yDAAyD;YACzD,IAAI,MAAM,CAAC,MAAM,KAAK,gCAAgC,CAAC,OAAO,EAAE,CAAC;gBAC/D,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACvD,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,2CAA2C,EAAE;gBACzD,eAAe;gBACf,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG;gBAC3B,QAAQ;gBACR,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,sFAAsF;gBACtF,yFAAyF;gBACzF,yEAAyE;gBACzE,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM;aACvC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE;gBACxE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG;gBAC3B,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,4CAA4C,CAAC,GAAY,EAAE,GAAa,EAAE,MAAc;QACpG,MAAM,eAAe,GAAG,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,CAAC;QACrE,IAAI,CAAC,eAAe;YAAE,OAAO;QAE7B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;YAEnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAExG,yEAAyE;YACzE,6EAA6E;YAC7E,IAAI,MAAM,CAAC,MAAM,KAAK,gCAAgC,CAAC,OAAO,EAAE,CAAC;gBAC/D,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACvD,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,4DAA4D,EAAE;gBAC1E,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM;gBACxD,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc;gBAC9E,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM;aACvC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE;gBAC1F,MAAM,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,0BAA0B,CAAC,GAAY;QAC7C,MAAM,mBAAmB,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAuB,CAAC;QACrG,IAAI,CAAC,mBAAmB;YAAE,OAAO,SAAS,CAAC;QAC3C,OAAO,IAAI,CAAC,gBAAgB,CAAC,sCAAsC,CAAC,mBAAmB,CAAC,IAAI,SAAS,CAAC;IACxG,CAAC;CACF,CAAA;AAhtIY,sCAAsC;IADlD,UAAU,EAAE;IA4BR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,CAAA;IAC5D,WAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAC1C,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,+BAA+B,CAAC,CAAA;IAC1D,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAC5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,YAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,YAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,YAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,YAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAClD,YAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAC1C,YAAA,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAA;IACrC,YAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,YAAA,MAAM,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAA;IACpD,YAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAA;IACpD,YAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,YAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAClD,YAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IACzC,YAAA,MAAM,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,CAAA;IACvD,YAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,YAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAClD,YAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAGhD,YAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAG9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;qCAjCrB,aAAa;QACM,0BAA0B;QAC1B,mBAAmB;QACN,wCAAwC;QAC1D,6BAA6B;QACf,kCAAkC;QAC7B,sCAAsC;QACvC,6BAA6B;QAC9C,iBAAiB;QACpB,mBAAmB;QACc,yCAAyC;QAClE,uBAAuB;QACvB,uBAAuB;QAChB,uBAAuB;QAChC,sBAAsB;QAChC,iBAAiB;QACI,+BAA+B;QAChC,gCAAgC;QAClC,0BAA0B;QACrB,gCAAgC;QAC5C,0BAA0B;QACb,+BAA+B;QACjC,8BAA8B;QAChD,qBAAqB;QACO,mCAAmC;QACrC,kCAAkC;QACtC,8BAA8B;QAC7C,4BAA4B;GAtDjF,sCAAsC,CAgtIlD","sourcesContent":["import 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport express, { Request, Response, NextFunction } from 'express';\nimport { AbstractControllerBackendService } from '~wildo-backend-lib/base-classes/services/controllers/abstract-controller.backend.service';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ErrorHandlerService } from '~wildo-backend-lib/errors/services/error-handler.backend.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport {\n AuthenticationOrchestratorBackendService,\n type AuthenticationServiceResult,\n} from '~wildo-backend-lib/security/authentications/services/authentication-orchestrator.backend.service';\nimport { AuthTokenIssuerBackendService, extractRefreshTokenReuseSignal } from '~wildo-backend-lib/security/authentications/services/auth-token-issuer.backend.service';\nimport { OAuth2AuthenticationBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/oauth2-authentication.backend.service';\nimport { OAuth2ConnectionResolverBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/oauth2-connection-resolver.backend.service';\nimport { ConsumableTokenBackendService, ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport { computeOneOffSessionExpiresAt } from '~wildo-backend-lib/security/authentications/utils/one-off-session-lifetime.backend.utils';\nimport { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport { WebAuthnBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/webauthn.backend.service';\nimport { DomainToOrgLookupBackendService } from '~wildo-backend-lib/security/authentications/services/admin-config/domain-to-org-lookup.backend.service';\nimport { SAMLAuthenticationBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/saml-authentication.backend.service';\nimport { SAMLMetadataBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/saml-metadata.backend.service';\nimport {\n EmailBackendService,\n EmailSubmissionOutcome,\n} from '~wildo-backend-lib/notifications/email/services/email.backend.service';\nimport { SMSBackendService } from '~wildo-backend-lib/notifications/sms/services/sms.backend.service';\nimport { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { AUTH_OPERATION, AuthSource } from '~wildo-backend-lib/security/authentications/models/auth-constants.backend';\nimport { AuthControllerUtils } from '~wildo-backend-lib/security/authentications/services/utils/auth-controller.utils';\nimport { getClientIpFromRequest } from '~wildo-backend-lib/runtime/utils/request-client-ip.utils';\nimport { getConfiguredPrimaryLanguage } from '~wildo-backend-lib/config/services/app-configuration.backend.utils';\nimport {\n getApplicationIdFromEnterpriseScope,\n getOrganizationIdFromEnterpriseScope,\n} from '~wildo-backend-lib/security/authentications/models/sso-connection.backend.schemas';\nimport { AuthResponseHelperBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-response-helper.backend.service';\nimport { AuthJwtGuardBackendService } from '~wildo-backend-lib/security/jwt/services/auth-jwt-guard.backend.service';\nimport { AuthPasswordResetBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/auth-password-reset.backend.service';\nimport { AuthRegistrationBackendService, AcceptInvitationOutcome } from '~wildo-backend-lib/security/authentications/services/auth-methods/auth-registration.backend.service';\nimport { AuthMfaBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/auth-mfa.backend.service';\nimport { AuthPhoneVerificationBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/auth-phone-verification.backend.service';\nimport { AuthMethodManagementBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/auth-method-management.backend.service';\nimport { AnonymousSessionBackendService } from '~wildo-backend-lib/security/authentications/services/anonymous-session.backend.service';\nimport { AuthUserLookupBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-user-lookup.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\n// Type-only (resolved via symbol): loads the SSO config that owns\n// `sessionSettings.singleLogoutEnabled` so the public SP-metadata endpoint can gate\n// SLO-endpoint advertising on it.\nimport type { AuthOrganizationConfigurationService } from '~wildo-backend-lib/security/authentications/services/admin-config/auth-organization-configuration.service';\nimport { resolveActiveMemberOrgIds } from '~wildo-backend-lib/security/authentications/services/resolve-active-member-orgs.backend.utils';\nimport { RateLimitBackendService } from '~wildo-backend-lib/errors/services/rate-limit.backend.service';\nimport { z } from 'zod';\nimport {\n AppFrontendType,\n CrossFrontendHandoffErrorCode,\n CrossFrontendHandoffRequestSchema,\n CrossFrontendHandoffResponseSchema,\n TokenExchangeRequestSchema,\n TokenExchangeResponseSchema,\n} from '@wildo-ai/saas-models/public-runtime';\nimport {\n AuthIdentificationRequestSchema,\n AuthenticationRequestSchema,\n AuthLoginFormDtoSchema,\n PasswordResetRequestDtoSchema,\n PasswordResetCompleteDtoSchema,\n UserRegisterApiDtoSchema,\n UserInvitationApiDtoSchema,\n UserInvitationRejectApiDtoSchema,\n EmailVerifyDtoSchema,\n AuthMethod,\n AuthFactorLevel,\n AuthenticationSessionState,\n CoreConsumableTokenTypes,\n ConsumableToken_ConsumptionMode,\n ConsumableTokenTypesSchema,\n CoreResourceType,\n CoreResourceOperation,\n CoreAuditableEventType,\n ResourceOperationVariantType,\n ResourceOperationRiskLevel,\n ResourcePrimaryScope,\n CORE_APP_ROLES,\n UserStatus,\n SsoConnectionType,\n EmailTemplateType,\n SystemEmailTemplateRef,\n ErrorType,\n ErrorCustomMessageReference,\n isWildoBackendError,\n MANUAL_CONTROLLER_ROUTES_URLS,\n ManualControllerRouteKey,\n AuthRedirectErrorCode,\n AuthScopeType,\n SessionType,\n AnonymousUserTranspositionStatus,\n WildoHeaderKeys,\n} from '@wildo-ai/saas-models';\nimport { BrandAssetComposition, BrandAssetPurpose } from '@wildo-ai/saas-models';\nimport { DurationUnit } from '@wildo-ai/zod-decorators';\nimport type { AuthIdentificationResponse, AuthenticationRequest, AuthenticationResponse, User } from '@wildo-ai/saas-models';\nimport { MagicLinkSendRequestSchema, MagicLinkVerifyRequestSchema, PhoneVerifySendRequestSchema, PhoneVerifyConfirmRequestSchema } from '@wildo-ai/saas-models';\nimport { AvailableLanguage, AuthResponseMessageRef, BackendSmsMessageRef } from '@wildo-ai/presets-components-models';\n\n\n// Password auth body extends the shared login form DTO with session/method/factor fields\n// that are added programmatically by the frontend service layer.\nconst PasswordAuthBodySchema = AuthLoginFormDtoSchema.extend({\n sessionId: z.string(),\n method: z.literal(AuthMethod.PASSWORD),\n factorLevel: z.literal(AuthFactorLevel.FIRST),\n});\n\n/**\n * Refresh-token body schema — **strict-empty** post Auth-hardening\n * Slice A Step 6 (2026-04-13). The handler reads the refresh token\n * EXCLUSIVELY from the `__wildo_refresh` cookie via\n * `AuthControllerUtils.extractRefreshTokenFromCookie()` and raises a\n * 400 when the cookie is absent.\n *\n * Why `z.strictObject({})` instead of \"schema dropped\":\n * - **Defense-in-depth**: a client mistakenly serializing\n * `{ refreshToken: '…' }` in the body is rejected with a clear\n * validation error, NOT silently ignored. Silent ignore would mask\n * a regression where a client thinks it sent the token (and trusts\n * the response) but the server never saw it.\n * - **Migration loudness**: a stale legacy client (pre-A-Step-3)\n * still sending the body field gets a 400 → forced re-login. This\n * is the explicit migration cost A-Step 6 trades for the cleaner\n * threat model (the body channel can no longer be used as an\n * exfiltration target by JS-resident attackers).\n *\n * Pre-Slice-A this schema accepted `refreshToken: z.string().min(1)`;\n * the A-K-5 transitional window made it `.optional()`; A-Step 6 drops\n * the field entirely.\n */\nconst RefreshTokenBodySchema = z.strictObject({});\n\n/** Body of `POST /auth/saml/logout` (SP-initiated SLO kickoff) — the SAML connection the caller is logging out of. */\nconst SAMLSPLogoutRequestSchema = z.strictObject({ connectionId: z.string().min(1) });\n\n/**\n * Logout body schema — **strict-empty** post Auth-hardening Slice A\n * Step 6 (2026-04-13). `logout()` reads the refresh token EXCLUSIVELY\n * from the `__wildo_refresh` cookie via\n * `AuthControllerUtils.extractRefreshTokenFromCookie()`.\n *\n * Even when no refresh token is present (cookie absent / already\n * cleared), the handler still emits `Set-Cookie: __wildo_refresh=…;\n * Max-Age=0` — clearing is the user-visible action and a stale cookie\n * with no JS-side state must still be revoked client-side. Redis-side\n * blacklist runs only when a token IS present (best-effort).\n */\nconst LogoutBodySchema = z.strictObject({});\n\nconst CreateOneOffTokenRequestSchema = z.object({\n userId: z.string().min(1),\n tokenType: ConsumableTokenTypesSchema,\n consumeAt: z.enum(['EXCHANGE', 'TARGET_OPERATION']),\n consumptionMode: z.enum(ConsumableToken_ConsumptionMode).optional().default(ConsumableToken_ConsumptionMode.SINGLE_USE),\n maxUses: z.number().int().min(1).optional(),\n expiresIn: z.object({\n value: z.number().int().min(1),\n unit: z.enum(['minutes', 'hours', 'days']),\n }).optional().default({ value: 1, unit: 'hours' }),\n resourceIdentifier: z.string().optional(),\n relatedId: z.string().optional(),\n metadata: z.record(z.string(), z.any()).optional(),\n targeting: z.object({\n initiatorIds: z.record(z.string(), z.string()).optional(),\n }).optional(),\n});\n\nconst OneOffSessionExchangeBodySchema = z.object({\n token: z.string().min(1),\n});\n\n@injectable()\nexport class AuthenticationControllerBackendService extends AbstractControllerBackendService {\n private readonly authService: AuthenticationOrchestratorBackendService;\n private readonly tokenIssuer: AuthTokenIssuerBackendService;\n private readonly oauth2Service: OAuth2AuthenticationBackendService;\n private readonly oauth2Resolver: OAuth2ConnectionResolverBackendService;\n private readonly consumableTokenService: ConsumableTokenBackendService;\n private readonly jwtService: JwtBackendService;\n private readonly emailService: EmailBackendService;\n private readonly appConfigService: AppConfigurationService;\n private readonly auditLogsService: AuditLogsBackendService;\n private readonly rateLimitService: RateLimitBackendService;\n private readonly webAuthnService: WebAuthnBackendService;\n private readonly smsService: SMSBackendService;\n private readonly domainToOrgLookup: DomainToOrgLookupBackendService;\n private readonly samlAuthService: SAMLAuthenticationBackendService;\n private readonly samlMetadataService: SAMLMetadataBackendService;\n private readonly authResponseHelper: AuthResponseHelperBackendService;\n private readonly authJwtGuard: AuthJwtGuardBackendService;\n private readonly passwordResetService: AuthPasswordResetBackendService;\n private readonly registrationService: AuthRegistrationBackendService;\n private readonly mfaService: AuthMfaBackendService;\n private readonly phoneVerificationService: AuthPhoneVerificationBackendService;\n private readonly methodManagementService: AuthMethodManagementBackendService;\n private readonly anonymousSessionService: AnonymousSessionBackendService;\n private readonly userLookup: AuthUserLookupBackendService;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ErrorHandlerService) errorHandler: ErrorHandlerService,\n @inject(SAAS_SERVICE_TYPES.AuthenticationOrchestratorService) authService: AuthenticationOrchestratorBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthTokenIssuer) tokenIssuer: AuthTokenIssuerBackendService,\n @inject(SAAS_SERVICE_TYPES.OAuth2AuthenticationService) oauth2Service: OAuth2AuthenticationBackendService,\n @inject(SAAS_SERVICE_TYPES.OAuth2ConnectionResolverService) oauth2Resolver: OAuth2ConnectionResolverBackendService,\n @inject(SAAS_SERVICE_TYPES.ConsumableTokenService) consumableTokenService: ConsumableTokenBackendService,\n @inject(SAAS_SERVICE_TYPES.JwtBackendService) jwtService: JwtBackendService,\n @inject(SAAS_SERVICE_TYPES.EmailService) emailService: EmailBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory) private readonly authEcFactory: AuthExecutionContextFactoryBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) auditLogsService: AuditLogsBackendService,\n @inject(SAAS_SERVICE_TYPES.RateLimitBackendService) rateLimitService: RateLimitBackendService,\n @inject(SAAS_SERVICE_TYPES.WebAuthnService) webAuthnService: WebAuthnBackendService,\n @inject(SAAS_SERVICE_TYPES.SMSService) smsService: SMSBackendService,\n @inject(SAAS_SERVICE_TYPES.DomainToOrgLookupService) domainToOrgLookup: DomainToOrgLookupBackendService,\n @inject(SAAS_SERVICE_TYPES.SAMLAuthenticationService) samlAuthService: SAMLAuthenticationBackendService,\n @inject(SAAS_SERVICE_TYPES.SAMLMetadataService) samlMetadataService: SAMLMetadataBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthResponseHelperService) authResponseHelper: AuthResponseHelperBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthJwtGuardService) authJwtGuard: AuthJwtGuardBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthPasswordResetService) passwordResetService: AuthPasswordResetBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthRegistrationService) registrationService: AuthRegistrationBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthMfaService) mfaService: AuthMfaBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthPhoneVerificationService) phoneVerificationService: AuthPhoneVerificationBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthMethodManagementService) methodManagementService: AuthMethodManagementBackendService,\n @inject(SAAS_SERVICE_TYPES.AnonymousSessionService) anonymousSessionService: AnonymousSessionBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthUserLookupService) userLookup: AuthUserLookupBackendService,\n // F4 per-org SIEM routing — resolves a user's VERIFIED ACTIVE member orgs for auth-event\n // dispatch (`resolveActiveMemberOrgIds`). Appended LAST to keep positional construction stable.\n @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n // SLO metadata gating — reads `sessionSettings.singleLogoutEnabled` for the SP\n // metadata endpoint. Appended LAST to keep positional construction stable.\n @inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService) private readonly orgConfigService: AuthOrganizationConfigurationService,\n ) {\n super(logger, errorBuilder, errorHandler, 'AuthenticationController');\n this.authService = authService;\n this.tokenIssuer = tokenIssuer;\n this.oauth2Service = oauth2Service;\n this.oauth2Resolver = oauth2Resolver;\n this.consumableTokenService = consumableTokenService;\n this.jwtService = jwtService;\n this.emailService = emailService;\n this.appConfigService = appConfigService;\n this.auditLogsService = auditLogsService;\n this.rateLimitService = rateLimitService;\n this.webAuthnService = webAuthnService;\n this.smsService = smsService;\n this.domainToOrgLookup = domainToOrgLookup;\n this.samlAuthService = samlAuthService;\n this.samlMetadataService = samlMetadataService;\n this.authResponseHelper = authResponseHelper;\n this.authJwtGuard = authJwtGuard;\n this.passwordResetService = passwordResetService;\n this.registrationService = registrationService;\n this.mfaService = mfaService;\n this.phoneVerificationService = phoneVerificationService;\n this.methodManagementService = methodManagementService;\n this.anonymousSessionService = anonymousSessionService;\n this.userLookup = userLookup;\n }\n\n protected setupRoutes(): void {\n // ─── Existing Authentication Routes ───\n\n // User/Customer identification\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_IDENTIFY], this.asyncHandler(this.identify.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_IDENTIFY], 'Identify user/customer and get available methods');\n\n // Authentication methods\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_AUTHENTICATE_PASSWORD], this.asyncHandler(this.authenticatePassword.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_AUTHENTICATE_PASSWORD], 'Authenticate with password');\n\n // Generic authentication endpoint for all methods\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_AUTHENTICATE], this.asyncHandler(this.authenticate.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_AUTHENTICATE], 'Universal authentication endpoint (all methods)');\n\n // Token refresh (TRAP 11: NOT behind JWT auth — user's access token may be expired)\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_TOKEN_REFRESH], this.asyncHandler(this.refreshToken.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_TOKEN_REFRESH], 'Refresh access token using refresh token');\n\n // Session management\n this.router.get(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SESSION_STATE], this.asyncHandler(this.getSessionState.bind(this)));\n this.logRouteRegistration('GET', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SESSION_STATE], 'Get authentication session state');\n\n // ─── OAuth2 Routes (Step 5) ───\n // Browser-only routes — the framework targets web stacks exclusively\n // (`AppFrontendType` ∈ { SAAS_APP, STATIC_WEBSITE, TECH_DOC }):\n // - oauth2Authorize: returns authorizationUrl — frontend uses window.location.href.\n // - oauth2Callback: IdP redirects here (server-to-server).\n // - tokenExchange: frontend exchanges the one-time code for JWT.\n // No native-SDK / Capacitor / Electron variants exist; all OAuth2 flows\n // go through the standard web authorization-code path.\n\n // OAuth2 authorize — returns authorization URL for frontend to redirect\n this.router.get(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_OAUTH2_AUTHORIZE], this.asyncHandler(this.oauth2Authorize.bind(this)));\n this.logRouteRegistration('GET', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_OAUTH2_AUTHORIZE], 'OAuth2 authorize — get IdP authorization URL');\n\n // OAuth2 callback — accepts GET and POST only (L7 fix: was router.all(), narrowed to reduce attack surface)\n // GET: standard OAuth2 authorization code flow\n // POST: Apple uses response_mode=form_post (TRAP 5)\n const oauth2CallbackHandler = this.asyncHandler(this.oauth2Callback.bind(this));\n const oauth2CallbackUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_OAUTH2_CALLBACK];\n this.router.get(oauth2CallbackUrl, oauth2CallbackHandler);\n this.router.post(oauth2CallbackUrl, oauth2CallbackHandler);\n this.logRouteRegistration('GET+POST', oauth2CallbackUrl, 'OAuth2 callback — handle IdP redirect (GET+POST for Apple form_post)');\n\n // Token exchange — frontend exchanges one-time code for JWT tokens (Decision 7)\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_TOKEN_EXCHANGE], this.asyncHandler(this.tokenExchange.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_TOKEN_EXCHANGE], 'Exchange one-time code for JWT tokens');\n\n // Cross-frontend session handoff (cross-app-jwt-propagation Step 2).\n // Authenticated user requests a one-time AUTH_CODE_EXCHANGE token bound to a\n // target frontend service, then redirects the browser to the target's\n // /auth/exchange page with the code. Bearer-only (no cookies / withCredentials);\n // CORS for callers is auto-allowed via the existing deriveCorsOrigins() seam,\n // which iterates every declared frontendService.\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_CROSS_FRONTEND_HANDOFF], this.asyncHandler(this.crossFrontendHandoff.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_CROSS_FRONTEND_HANDOFF], 'Issue one-time code for cross-frontend session handoff');\n\n // Logout — revoke refresh token\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_LOGOUT], this.asyncHandler(this.logout.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_LOGOUT], 'Logout — revoke refresh token');\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_LOGOUT_ALL], this.asyncHandler(this.logoutAll.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_LOGOUT_ALL], 'Logout-all — sign out everywhere (fence the whole user)');\n\n // ─── Password Reset Routes (Step 7) ───\n\n // Request password reset — sends email with reset link\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSWORD_RESET_REQUEST], this.asyncHandler(this.passwordResetRequest.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSWORD_RESET_REQUEST], 'Request password reset — send email with reset link');\n\n // Complete password reset — validate token and update password\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSWORD_RESET_COMPLETE], this.asyncHandler(this.passwordResetComplete.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSWORD_RESET_COMPLETE], 'Complete password reset — validate token and set new password');\n\n // ─── Registration Routes (Step 8) ───\n\n // Register — create account with email verification\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REGISTER], this.asyncHandler(this.register.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REGISTER], 'Register — create user account with email verification');\n\n // Accept invitation — public token-driven invitation completion\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ACCEPT_INVITATION], this.asyncHandler(this.acceptInvitation.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ACCEPT_INVITATION], 'Accept invitation — create/link account and continue auth flow');\n\n // Invitation info — public, NON-consuming discovery of the invited org's auth\n // methods + SSO/SCIM mode (drives the multi-method accept chooser). Read-only.\n this.router.get(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_INVITATION_INFO], this.asyncHandler(this.getInvitationInfo.bind(this)));\n this.logRouteRegistration('GET', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_INVITATION_INFO], 'Invitation info — available auth methods + SSO/SCIM mode for the invited org (non-consuming)');\n\n // Reject invitation — public token-driven invitation decline\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REJECT_INVITATION], this.asyncHandler(this.rejectInvitation.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REJECT_INVITATION], 'Reject invitation — mark invitee decline explicitly');\n\n // In-app authenticated invitation management (Approach P) — a signed-in user lists +\n // accepts/rejects THEIR OWN pending invitations (email-ownership), no token, no new session.\n this.router.get(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_LIST_MY_INVITATIONS], this.asyncHandler(this.listMyInvitations.bind(this)));\n this.logRouteRegistration('GET', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_LIST_MY_INVITATIONS], 'List my pending invitations — authenticated, email-owned');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ACCEPT_MY_INVITATION], this.asyncHandler(this.acceptMyInvitation.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ACCEPT_MY_INVITATION], 'Accept my invitation — authenticated in-app accept (no token, no new session)');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REJECT_MY_INVITATION], this.asyncHandler(this.rejectMyInvitation.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REJECT_MY_INVITATION], 'Reject my invitation — authenticated in-app reject');\n\n // Verify email — confirm email and auto-login\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_VERIFY_EMAIL], this.asyncHandler(this.verifyEmail.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_VERIFY_EMAIL], 'Verify email — confirm email address and issue tokens');\n\n // Resend verification email (F5)\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_RESEND_VERIFICATION], this.asyncHandler(this.resendVerificationEmail.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_RESEND_VERIFICATION], 'Resend verification email — re-send email verification link');\n\n // W5.7: Complete org onboarding (deferred org creation)\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_COMPLETE_ORG_ONBOARDING], this.asyncHandler(this.completeOrgOnboarding.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_COMPLETE_ORG_ONBOARDING], 'Complete org onboarding — create deferred organization');\n\n // ─── MFA: Email OTP Routes (Step 10) ───\n\n // Send email OTP — generates OTP and sends via email\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_SEND], this.asyncHandler(this.mfaEmailOTPSend.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_SEND], 'Send email OTP for MFA second factor');\n\n // Verify email OTP — validates the submitted OTP code\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_VERIFY], this.asyncHandler(this.mfaEmailOTPVerify.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_VERIFY], 'Verify email OTP for MFA second factor');\n\n // ─── MFA: TOTP Routes (Step 11) ───\n\n // TOTP setup — generate secret + QR URI for enrollment\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_SETUP], this.asyncHandler(this.mfaTOTPSetup.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_SETUP], 'Setup TOTP — generate secret and QR code URI');\n\n // TOTP verify setup — confirm enrollment with a code from the authenticator app\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY_SETUP], this.asyncHandler(this.mfaTOTPVerifySetup.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY_SETUP], 'Verify TOTP setup — confirm enrollment with code');\n\n // TOTP verify — validate TOTP code during login MFA\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY], this.asyncHandler(this.mfaTOTPVerify.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY], 'Verify TOTP code for MFA second factor');\n\n // ─── Enterprise SSO Routes (Step 15) ───\n // Enterprise OIDC authorize — initiate SSO flow for an org's OIDC connection\n // Callback reuses the same /auth/oauth2/callback/:providerRef route — state token carries enterprise context\n this.router.get(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ENTERPRISE_SSO_AUTHORIZE], this.asyncHandler(this.enterpriseSSOAuthorize.bind(this)));\n this.logRouteRegistration('GET', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ENTERPRISE_SSO_AUTHORIZE], 'Enterprise SSO authorize — get IdP authorization URL for org OIDC connection');\n\n // App-enterprise OIDC authorize — initiate SSO flow for an APPLICATION-scoped connection\n this.router.get(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_APP_ENTERPRISE_AUTHORIZE], this.asyncHandler(this.appEnterpriseSSOAuthorize.bind(this)));\n this.logRouteRegistration('GET', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_APP_ENTERPRISE_AUTHORIZE], 'App-enterprise SSO authorize — get IdP authorization URL for app OIDC connection');\n\n // ─── SAML Routes (AUTH-2) ───\n this.router.get(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_LOGIN], this.asyncHandler(this.handleSAMLLogin.bind(this)));\n this.logRouteRegistration('GET', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_LOGIN], 'SAML login — initiate SP-initiated SSO');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_ACS],\n express.urlencoded({ extended: false, limit: '2mb' }),\n this.asyncHandler(this.handleSAMLACS.bind(this)),\n );\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_ACS], 'SAML ACS — process IdP response (SC-30: 2mb urlencoded)');\n\n this.router.get(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_METADATA], this.asyncHandler(this.handleSAMLMetadata.bind(this)));\n this.logRouteRegistration('GET', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_METADATA], 'SAML SP metadata — public XML endpoint (10/min/IP)');\n\n this.router.get(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_SLO], this.asyncHandler(this.handleSAMLSLO_GET.bind(this)));\n this.logRouteRegistration('GET', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_SLO], 'SAML SLO — IdP-initiated via HTTP-Redirect or SP-initiated LogoutResponse');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_SLO],\n express.urlencoded({ extended: false, limit: '2mb' }),\n this.asyncHandler(this.handleSAMLSLO_POST.bind(this)),\n );\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_SLO], 'SAML SLO — IdP-initiated via HTTP-POST');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_SP_LOGOUT], this.asyncHandler(this.handleSAMLSPLogout.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SAML_SP_LOGOUT], 'SAML SLO — SP-initiated kickoff');\n\n // ─── WebAuthn/Passkey Routes (Phase G1) ───\n // Registration (JWT-authenticated)\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_OPTIONS], this.asyncHandler(this.handlePasskeyRegisterOptions.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_OPTIONS], 'Passkey register options — generate registration challenge');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_VERIFY], this.asyncHandler(this.handlePasskeyRegisterVerify.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_VERIFY], 'Passkey register verify — verify and store credential');\n\n // Authentication (unauthenticated — part of login flow)\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_AUTH_OPTIONS], this.asyncHandler(this.handlePasskeyAuthOptions.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_AUTH_OPTIONS], 'Passkey auth options — generate authentication challenge');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_AUTH_VERIFY], this.asyncHandler(this.handlePasskeyAuthVerify.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_AUTH_VERIFY], 'Passkey auth verify — verify assertion and complete login');\n\n // Management (JWT-authenticated)\n this.router.get(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_LIST], this.asyncHandler(this.handlePasskeyList.bind(this)));\n this.logRouteRegistration('GET', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_LIST], 'Passkey list — list registered passkeys');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_REMOVE], this.asyncHandler(this.handlePasskeyRemove.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_REMOVE], 'Passkey remove — remove a passkey');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_RENAME], this.asyncHandler(this.handlePasskeyRename.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_RENAME], 'Passkey rename — rename a passkey');\n\n // ─── Magic Link Routes (Phase G2) ───\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MAGIC_LINK_SEND], this.asyncHandler(this.magicLinkSend.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MAGIC_LINK_SEND], 'Magic link send — send passwordless login link via email');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MAGIC_LINK_VERIFY], this.asyncHandler(this.magicLinkVerify.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MAGIC_LINK_VERIFY], 'Magic link verify — verify token and issue auth tokens');\n\n // ─── SMS OTP Routes (Phase G2) ───\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SMS_OTP_SEND], this.asyncHandler(this.smsOTPSend.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SMS_OTP_SEND], 'SMS OTP send — send OTP code via SMS');\n\n // Note: SMS OTP verify goes through the generic /auth/authenticate endpoint via SMS_OTP method\n\n // ─── Phone Verification Routes (Phase G2) ───\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PHONE_VERIFY_SEND], this.asyncHandler(this.phoneVerifySend.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PHONE_VERIFY_SEND], 'Phone verify send — send verification code via SMS');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PHONE_VERIFY_CONFIRM], this.asyncHandler(this.phoneVerifyConfirm.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PHONE_VERIFY_CONFIRM], 'Phone verify confirm — confirm phone ownership with code');\n\n // ─── One-Off Session Routes (W7.3b) ───\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE], this.asyncHandler(this.createOneOffToken.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE], 'Create one-off session token (app-scoped)');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE_ORG], this.asyncHandler(this.createOneOffToken.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE_ORG], 'Create one-off session token (org+app-scoped)');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_EXCHANGE], this.asyncHandler(this.exchangeOneOffToken.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_EXCHANGE], 'Exchange one-off token for JWT session');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE], this.asyncHandler(this.revokeOneOffToken.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE], 'Revoke an un-exchanged one-off session token (app-scoped)');\n\n this.router.post(MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE_ORG], this.asyncHandler(this.revokeOneOffToken.bind(this)));\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE_ORG], 'Revoke an un-exchanged one-off session token (org+app-scoped)');\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Existing Authentication Route Handlers\n // ═══════════════════════════════════════════════════════════════\n\n private async identify(req: Request, res: Response): Promise<void> {\n // PR-7b-fixes F-22 fail-fast ordering generalized: body parse →\n // rate-limit → ec. Same victim-protective ranking as the\n // account-lifecycle family (named-account FIRST, source-noise\n // LAST) — see `register` for the full F-20 rationale.\n const body = AuthIdentificationRequestSchema.parse(req.body || {});\n\n // PR 8c (rate-limit unification, Step 5 — Option D, third\n // service-layer lift). The dual rate-limit\n // (formerly `${AUTH_REDIS_KEYS.IDENTIFY_IP}${ip}` 10/60 per-IP\n // + `${AUTH_REDIS_KEYS.IDENTIFY_EMAIL}${email.toLowerCase()}`\n // 10/60 per-email, both raw `checkRateLimit` inside\n // `AuthenticationOrchestratorBackendService.identify`) now\n // lives at the controller as TWO declarative `checkPolicy`\n // companions. Pre-PR-8c the controller had ZERO local rate-limit\n // cap of its own at this seam — the orchestrator was the SOLE\n // protection layer. The lift simultaneously closes a latent\n // unknown-IP bypass: the orchestrator wrapped its IP check in\n // `if (deviceInfo?.ipAddress)`, which would have skipped\n // rate-limiting entirely if `deviceInfo` were undefined; the\n // unified path uses `getClientIpFromRequest` which returns\n // the `'unknown'` sentinel and co-buckets unknown-IP callers\n // (same net-upgrade pattern PR 7b applied to 6 account-\n // lifecycle sites).\n //\n // `body.email` is ALREADY lowercased by\n // `AuthIdentificationRequestSchema` (`.email().toLowerCase()`\n // on the schema), so the explicit `.toLowerCase()` here is\n // a defense-in-depth no-op that keeps the bucket-key\n // normalization invariant readable at the call site (matches\n // every other email-keyed bucket in the family — `register`,\n // `passwordResetRequest`, `resendVerificationEmail`,\n // `magicLinkSend`). D-4 baseline only (plus-tail and Gmail-dot\n // tricks NOT collapsed).\n //\n // Order — VICTIM-PROTECTIVE bucket FIRST per F-20 (named-account\n // before loud-source): per-email THEN per-IP. When both buckets\n // would trip on the same request, the per-email 429 short-\n // circuits and the per-IP increment never happens.\n /** @wildo_source:part:start example.rate-limit.custom-controller-surface facet:kind:usage-example facet:audience:app-developer */\n // Dual-bucket at the controller seam: per-email FIRST (victim-protective\n // ordering — the named account is decremented before the loud source),\n // then per-IP. Distinct scope keys prevent collision; both run before\n // execution-context creation so the limit fails fast.\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10 },\n 'auth:identify:by-email',\n undefined,\n body.email.toLowerCase(),\n );\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10 },\n 'auth:identify:by-ip',\n );\n /** @wildo_source:part:end example.rate-limit.custom-controller-surface */\n\n const ec = await this._getPreAuthExecutionContext();\n\n // Capture device information from request headers (consistent IP extraction)\n const deviceInfo = {\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n ipAddress: getClientIpFromRequest(req),\n };\n\n const identificationRequest = {\n ...body,\n deviceInfo\n };\n\n // W3.5 + W3.11: Resolve activeUserType hint from X-Frontend-Service-Name header.\n // AUTH-10: This is only a hint for pre-identification flows (unknown users).\n // For known users, the orchestrator overrides with the DB-stored userTypes[0].\n // AUTH-10: Cross-validate Origin against claimed frontend service identity (defense-in-depth).\n const frontendServiceName = req.headers[WildoHeaderKeys.FRONTEND_SERVICE_NAME] as string | undefined;\n this._validateFrontendAppOrigin(req, frontendServiceName);\n const activeUserType = frontendServiceName\n ? this.appConfigService.resolveUserTypeFromFrontendServiceName(frontendServiceName) ?? undefined\n : undefined;\n\n const result: AuthIdentificationResponse = await this.authService.identify(\n ec,\n identificationRequest,\n activeUserType,\n frontendServiceName,\n );\n this.jsonSuccess(res, result);\n }\n\n private async authenticatePassword(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const body = PasswordAuthBodySchema.parse(req.body || {});\n const passwordRequest = {\n sessionId: body.sessionId,\n method: body.method,\n factorLevel: body.factorLevel,\n password: body.password,\n email: body.email, // Email should be available from session, but included for compatibility\n rememberMe: false,\n requestedIntegrations: []\n };\n const result: AuthenticationServiceResult = await this.authService.authenticatePassword(ec, passwordRequest);\n await this.handleAnonymousTransposition(req, res, result);\n // Auth-hardening A-Step 6 (2026-04-13): destructure the cookie-only\n // `refreshToken` out of the orchestrator's internal result shape so\n // the wire body (`AuthenticationResponse`) physically cannot carry\n // it. The wrapper sets `Set-Cookie` from the third arg.\n const { refreshToken, ...wireBody } = result;\n this._jsonSuccessWithRefreshCookie(res, wireBody, refreshToken);\n }\n\n // Generic authenticate endpoint for future extensibility (SSO/MFA/etc.)\n private async authenticate(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const request = AuthenticationRequestSchema.parse(req.body || {}) as AuthenticationRequest;\n const result: AuthenticationServiceResult = await this.authService.authenticate(ec, request);\n await this.handleAnonymousTransposition(req, res, result);\n // Auth-hardening A-Step 6 — see `authenticatePassword()` for the\n // destructure-and-pass-explicitly contract. Same pattern is used at\n // every wire-leaving auth seam in this controller.\n const { refreshToken, ...wireBody } = result;\n this._jsonSuccessWithRefreshCookie(res, wireBody, refreshToken);\n }\n\n /**\n * Refresh access token using a valid refresh token.\n * POST /auth/token/refresh\n *\n * **Cookie-only contract** (Auth-hardening Slice A Step 6, 2026-04-13).\n * The refresh token is read EXCLUSIVELY from the `__wildo_refresh`\n * `HttpOnly` cookie via\n * `AuthControllerUtils.extractRefreshTokenFromCookie()`. The body\n * schema (`RefreshTokenBodySchema`) is `z.strictObject({})`, so a\n * stale legacy client still sending `{ refreshToken: '…' }` in the\n * body fails validation BEFORE reaching this handler — surfaced as\n * a 400 rather than silently ignored (defense-in-depth).\n *\n * Response body: `{ accessToken, expiresIn }` (NO `refreshToken` —\n * the rotated refresh token reaches the browser exclusively via\n * `Set-Cookie: __wildo_refresh=<rotated>` set by\n * `_jsonSuccessWithRefreshCookie`).\n *\n * Pre-A-Step-6 history (preserved for chronological context):\n * - A-K-3 (2026-04-13) added the `Set-Cookie` channel as a\n * parallel emit to the body field.\n * - A-K-5 (2026-04-13) added a transitional dual-read so legacy\n * body-only clients could still rotate during the migration.\n * - A-Step 3 (2026-04-13) made the SaaS frontend stop persisting\n * the body field.\n * - A-Step 6 (THIS step) drops the body channel entirely.\n *\n * TRAP 11: This endpoint is NOT behind JWT auth middleware.\n * The user's access token is expired — that's why they're calling refresh.\n */\n private async refreshToken(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n // Validate body shape (strict-empty post A-Step 6 — see\n // `RefreshTokenBodySchema` JSDoc). Throws on `{ refreshToken: '…' }`.\n RefreshTokenBodySchema.parse(req.body || {});\n const refreshTokenValue = AuthControllerUtils.extractRefreshTokenFromCookie(req);\n if (!refreshTokenValue) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_REFRESH_TOKEN_REQUIRED,\n });\n }\n let tokens;\n try {\n tokens = await this.tokenIssuer.refreshAccessToken(refreshTokenValue);\n } catch (refreshError) {\n // A-9: the issuer performs the family-wide revoke but does NOT audit (TRAP 13); it TAGS a reuse\n // rejection with the theft signal. Emit `USER_REFRESH_TOKEN_REUSE_DETECTED` for the theft case ONLY\n // (a routine expired/revoked/invalid refresh carries no signal ⇒ no event — deliberate anti-flood).\n // Fire-and-forget, OFF the response path; F4 per-org routing to the victim's VERIFIED member orgs.\n // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — credential-theft detection + response.\n const reuseSignal = extractRefreshTokenReuseSignal(refreshError);\n if (reuseSignal) {\n void (async () => {\n const routingOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, reuseSignal.userId);\n await this.auditLogsService.logUserRefreshTokenReuseDetected({\n userId: reuseSignal.userId,\n reusedJti: reuseSignal.reusedJti,\n sessionId: reuseSignal.sessionId,\n familyRevoked: reuseSignal.familyRevoked,\n ipAddress: getClientIpFromRequest(req),\n }, ec, routingOrgIds);\n })().catch(() => {});\n }\n throw refreshError;\n }\n\n // H5: Audit token refresh\n try {\n const decoded = await this.jwtService.verify(tokens.accessToken);\n if (typeof decoded === 'object' && decoded !== null) {\n const payload = decoded as Record<string, unknown>;\n const refreshUserId = typeof payload.userId === 'string' ? payload.userId : undefined;\n const sessionId = typeof payload.sessionId === 'string' ? payload.sessionId : 'unknown';\n if (refreshUserId) {\n // Fire-and-forget (token-refresh is HIGH frequency + latency-sensitive). Resolve the\n // user's VERIFIED ACTIVE member orgs (F4 routing) and emit inside an async IIFE kept OFF\n // the response critical path so a membership-read failure can never block the refresh.\n // `refreshUserId` is the verified refresh-token subject (server-resolved).\n void (async () => {\n const routingOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, refreshUserId);\n await this.auditLogsService.logUserTokenRefreshed({\n userId: refreshUserId,\n sessionId,\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n }, ec, routingOrgIds);\n })().catch(() => {});\n }\n }\n } catch { /* token decode failure — don't block the response */ }\n\n // Cookie-only: extract `refreshToken` from the issuer's typed\n // result so the wire body carries ONLY `{ accessToken, expiresIn }`.\n const { refreshToken: rotatedRefreshToken, ...wireBody } = tokens;\n this._jsonSuccessWithRefreshCookie(res, wireBody, rotatedRefreshToken);\n }\n\n // Get current authentication session state\n private async getSessionState(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const sessionId = req.params.sessionId as string | undefined;\n\n if (!sessionId) {\n return this.jsonError(res, 'Session ID is required');\n }\n\n const sessionState = await this.authService.getAuthenticationSessionState(ec, sessionId);\n\n if (!sessionState) {\n return this.jsonError(res, 'Session not found or expired');\n }\n\n // H2 fix: Strip sensitive fields from public endpoint to prevent enumeration.\n // Removed: email, userExists, userId (H2), remainingAttempts, lockedUntil (review fix #5).\n // Frontend uses error responses (customMessageReference, authResponse) for retry/lockout UI.\n const publicSessionState = {\n sessionId: sessionState.sessionId,\n state: sessionState.state,\n completedFactors: sessionState.completedFactors,\n currentFactor: sessionState.currentFactor,\n availableFirstFactorMethods: sessionState.availableFirstFactorMethods,\n availableSecondFactorMethods: sessionState.availableSecondFactorMethods,\n enrolledSecondFactorMethods: sessionState.enrolledSecondFactorMethods,\n usableSecondFactorMethods: sessionState.usableSecondFactorMethods,\n requiresMFA: sessionState.requiresMFA,\n requireStrongMFA: sessionState.requireStrongMFA,\n mfaMethodsRequired: sessionState.mfaMethodsRequired,\n expiresAt: sessionState.expiresAt,\n };\n\n this.jsonSuccess(res, publicSessionState);\n }\n\n // ═══════════════════════════════════════════════════════════════\n // OAuth2 Route Handlers (Step 5)\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * GET /auth/oauth2/authorize/:providerRef\n *\n * Initiates an OAuth2 authorization flow for an application-level social OAuth2 provider.\n * Returns the IdP authorization URL for the frontend to redirect to.\n * Enterprise OIDC/SAML entrypoints are handled by the dedicated\n * `enterpriseSSOAuthorize` / `appEnterpriseSSOAuthorize` routes below.\n */\n private async oauth2Authorize(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const providerRef = req.params.providerRef as string | undefined;\n\n if (!providerRef) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { message: 'providerRef parameter is required' },\n });\n }\n\n // G3 + P3: Determine scope context from email hint before resolving credentials.\n // Used for both provider restriction checks (G3) and social credential overrides (P3).\n const emailHint = req.query.email as string | undefined;\n let scopeContext: { scopeType: AuthScopeType; scopeId: string } | undefined;\n\n if (emailHint) {\n const emailDomain = emailHint.split('@')[1]?.toLowerCase();\n if (emailDomain) {\n const orgLookup = await this.domainToOrgLookup.findOrgByDomain(ec, emailDomain);\n if (orgLookup) {\n scopeContext = { scopeType: orgLookup.scopeType, scopeId: orgLookup.scopeId };\n\n // G3: Check org-level provider restrictions (UX optimization — hard enforcement in callback G3-M5)\n const { allowed, reason } = await this.oauth2Resolver.isProviderAllowed(\n ec, orgLookup.scopeType, orgLookup.scopeId, providerRef,\n );\n if (!allowed) {\n await this.auditLogsService.logOAuth2ProviderBlocked({\n email: emailHint,\n providerRef,\n scopeType: orgLookup.scopeType,\n organizationId: orgLookup.scopeType === AuthScopeType.ORGANIZATION\n ? orgLookup.scopeId\n : undefined,\n applicationId: orgLookup.scopeType === AuthScopeType.APPLICATION\n ? orgLookup.scopeId\n : undefined,\n reason: reason || 'Organization policy',\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { message: reason || 'This login provider is not allowed for your organization.' },\n });\n }\n }\n }\n }\n\n // Resolve connection config from catalog + app config + secrets + scope overrides (P3)\n const connection = await this.oauth2Resolver.resolveSocialConnection(\n providerRef,\n scopeContext ? { ec, ...scopeContext } : undefined,\n );\n\n // Validate the frontend originator early — fail now with a clear error instead of\n // silently storing undefined in the state token and getting a confusing error on callback.\n // resolveFrontendAppPublicUrl throws if the header is missing or the frontend service is unknown.\n const frontendUrl = this.resolveFrontendAppPublicUrl(req);\n const frontendServiceName = req.headers[WildoHeaderKeys.FRONTEND_SERVICE_NAME] as string;\n const returnUrl = typeof req.query.returnUrl === 'string' ? req.query.returnUrl : undefined;\n void frontendUrl; // validated and discarded — the URL is resolved again on callback from the state token\n if (returnUrl) {\n this.validateFrontendReturnUrl(returnUrl, frontendUrl);\n }\n\n // Build the authorization URL with PKCE + state token (includes frontendServiceName + scope in state)\n const { authorizationUrl } = await this.oauth2Service.buildAuthorizationUrl(connection, {\n frontendServiceName,\n scopeType: scopeContext?.scopeType,\n scopeId: scopeContext?.scopeId,\n returnUrl,\n });\n\n this.logDebug('OAuth2 authorize URL generated', {\n providerRef,\n connectionType: connection.connectionType,\n });\n\n this.jsonSuccess(res, { authorizationUrl });\n }\n\n /**\n * GET /auth/enterprise/authorize/:orgId/:connectionId\n *\n * Initiates an enterprise SSO OIDC flow for an organization's connection.\n * Uses the same OAuth2 engine — only the resolver path is different.\n * The callback reuses /auth/oauth2/callback/:providerRef — the state token\n * carries `connectionType: SsoConnectionType.ENTERPRISE`, organizationId,\n * and connectionId.\n *\n * Step 15: Enterprise SSO authorize route.\n */\n private async enterpriseSSOAuthorize(req: Request, res: Response): Promise<void> {\n const orgId = req.params.orgId as string | undefined;\n const connectionId = req.params.connectionId as string | undefined;\n\n if (!orgId || !connectionId) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { message: 'orgId and connectionId parameters are required' },\n });\n }\n\n // Resolve enterprise connection from org config\n const connection = await this.oauth2Resolver.resolveEnterpriseConnection(AuthScopeType.ORGANIZATION, orgId, connectionId);\n\n // Validate the frontend originator\n const frontendUrl = this.resolveFrontendAppPublicUrl(req);\n const frontendServiceName = req.headers[WildoHeaderKeys.FRONTEND_SERVICE_NAME] as string;\n const returnUrl = typeof req.query.returnUrl === 'string' ? req.query.returnUrl : undefined;\n void frontendUrl;\n if (returnUrl) {\n this.validateFrontendReturnUrl(returnUrl, frontendUrl);\n }\n\n // Build the authorization URL using the same OAuth2 engine\n const { authorizationUrl } = await this.oauth2Service.buildAuthorizationUrl(connection, {\n frontendServiceName,\n returnUrl,\n });\n\n this.logDebug('Enterprise SSO authorize URL generated', {\n orgId,\n connectionId,\n connectionType: connection.connectionType,\n providerRef: connection.providerRef,\n });\n\n this.jsonSuccess(res, { authorizationUrl });\n }\n\n /**\n * GET /auth/app-enterprise/authorize/:connectionId\n *\n * Application-scoped enterprise SSO authorize route.\n * Same flow as org-scoped enterpriseSSOAuthorize but resolves from APPLICATION scope.\n */\n private async appEnterpriseSSOAuthorize(req: Request, res: Response): Promise<void> {\n const connectionId = req.params.connectionId as string | undefined;\n\n if (!connectionId) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { message: 'connectionId parameter is required' },\n });\n }\n\n const appId = req.headers[WildoHeaderKeys.APPLICATION_ID] as string | undefined;\n if (!appId) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { message: 'Application ID header is required for app-enterprise SSO' },\n });\n }\n\n const connection = await this.oauth2Resolver.resolveEnterpriseConnection(AuthScopeType.APPLICATION, appId, connectionId);\n\n // Validate the frontend originator early so OAuth state always carries\n // a usable frontendServiceName for callback redirection.\n const frontendUrl = this.resolveFrontendAppPublicUrl(req);\n const frontendServiceName = req.headers[WildoHeaderKeys.FRONTEND_SERVICE_NAME] as string;\n const returnUrl = typeof req.query.returnUrl === 'string' ? req.query.returnUrl : undefined;\n void frontendUrl;\n if (returnUrl) {\n this.validateFrontendReturnUrl(returnUrl, frontendUrl);\n }\n const { authorizationUrl } = await this.oauth2Service.buildAuthorizationUrl(connection, {\n frontendServiceName,\n returnUrl,\n });\n\n this.logDebug('App-enterprise SSO authorize URL generated', {\n appId,\n connectionId,\n connectionType: connection.connectionType,\n providerRef: connection.providerRef,\n });\n\n this.jsonSuccess(res, { authorizationUrl });\n }\n\n /**\n * GET /auth/saml/login/:connectionId\n *\n * Initiate SP-initiated SAML SSO. Generates an AuthnRequest,\n * creates a state token, and redirects the browser to the IdP SSO URL.\n *\n * Rate limit: SC-38 — 10 req/min per IP.\n */\n private async handleSAMLLogin(req: Request, res: Response): Promise<void> {\n // PR 7c — SAML login migration. 10/min/IP, pre-auth, IP-keyed by\n // default. Per the SC-38 cap design, this is the cheapest SAML\n // amplification target (synthetic AuthnRequest generation + state-\n // token Redis write per call); the per-IP cap is the right defense\n // because no userId exists yet (login is INITIATED here, not\n // verified). Local `clientIp` extraction dropped — sole-consumed\n // by the rate-limit; `checkPolicy` re-derives via the same\n // `getClientIpFromRequest` helper. F-22 fail-fast preserved\n // (rate-limit before EC creation, body-parse-free endpoint).\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10 },\n 'auth:saml:login:by-ip',\n );\n\n const ec = await this._getPreAuthExecutionContext();\n const connectionId = req.params.connectionId as string;\n const returnUrl = (req.query.returnUrl as string) || '/';\n\n try {\n const { redirectUrl } = await this.samlAuthService.initiateLogin(ec, connectionId, returnUrl);\n res.redirect(302, redirectUrl);\n } catch (error) {\n if (isWildoBackendError(error)) {\n this.logger.warn('SAML login initiation failed', { connectionId });\n } else {\n this.logger.error('SAML login initiation failed with unexpected error', {\n connectionId,\n ...projectCaughtErrorLogFields(error),\n });\n }\n const frontendUrl = this._resolveSAMLRedirectUrl();\n return this.redirectToFrontendWithError(res, AuthRedirectErrorCode.SAML_LOGIN_FAILED, 'Authentication failed. Please try again.', frontendUrl);\n }\n }\n\n /**\n * POST /auth/saml/acs\n *\n * Assertion Consumer Service — processes the SAML Response from the IdP.\n * Route-specific body parser: `express.urlencoded({ extended: false, limit: '2mb' })` (SC-30).\n *\n * Rate limit: SC-39 — 20 req/min per IP (higher because IdPs may retry).\n * E16: POST-only (enforced by route registration).\n * E19: RelayState size check — accept up to 1024 bytes, warn if >80.\n */\n private async handleSAMLACS(req: Request, res: Response): Promise<void> {\n // PR 7c — SAML ACS migration. 20/min/IP, pre-auth, IP-keyed by\n // default. Higher cap than `handleSAMLLogin` per SC-39 because\n // IdPs may legitimately retry (network timeout / Assertion not\n // yet ready). `clientIp` extraction PRESERVED — threaded into\n // `samlAuthService.handleACS` via `clientContext` for the\n // post-auth audit trail (single-source-of-truth pattern: same\n // helper `checkPolicy` re-derives for the bucket key, so bucket\n // and audit row always agree on the IP). F-22 fail-fast: rate-\n // limit precedes the bounded body extraction (only `req.body?.\n // SAMLResponse` access, no parse) AND precedes EC creation.\n const clientIp = getClientIpFromRequest(req);\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 20 },\n 'auth:saml:acs:by-ip',\n );\n\n const samlResponse: string | undefined = req.body?.SAMLResponse;\n const relayState: string | undefined = req.body?.RelayState;\n\n if (!samlResponse) {\n const frontendUrl = this._resolveSAMLRedirectUrl();\n return this.redirectToFrontendWithError(res, AuthRedirectErrorCode.SAML_AUTH_FAILED, 'Authentication failed.', frontendUrl);\n }\n\n if (relayState && relayState.length > 1024) {\n this.logger.warn('SAML RelayState exceeds 1024 bytes, rejecting', { length: relayState.length });\n const frontendUrl = this._resolveSAMLRedirectUrl();\n return this.redirectToFrontendWithError(res, AuthRedirectErrorCode.SAML_AUTH_FAILED, 'Authentication failed.', frontendUrl);\n }\n if (relayState && relayState.length > 80) {\n this.logger.warn('SAML RelayState exceeds 80-byte spec limit (accepted)', { length: relayState.length });\n }\n\n const ec = await this._getPreAuthExecutionContext();\n\n try {\n const clientContext = {\n ipAddress: clientIp,\n userAgent: (req.headers[WildoHeaderKeys.USER_AGENT] as string) || 'unknown',\n };\n const result = await this.samlAuthService.handleACS(ec, samlResponse, relayState, clientContext);\n res.redirect(302, result.redirectUrl);\n } catch (error) {\n if (isWildoBackendError(error)) {\n this.logger.warn('SAML ACS processing failed', {\n errorRef: (error as any).customMessageReference || 'unknown',\n });\n } else {\n this.logger.error('SAML ACS failed with unexpected error', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n const frontendUrl = this._resolveSAMLRedirectUrl();\n return this.redirectToFrontendWithError(res, AuthRedirectErrorCode.SAML_AUTH_FAILED, 'Authentication failed. Please try again.', frontendUrl);\n }\n }\n\n /**\n * GET /auth/saml/metadata/:scopeType/:scopeId\n *\n * Public endpoint — returns SP metadata XML for IdP admins to configure their IdP.\n * No auth middleware required (D16).\n * Content-Type: application/samlmetadata+xml\n *\n * Rate limit: 10 req/min per IP (matches the SAML login / SLO GET convention). This\n * is an unauthenticated GET that runs samlify metadata generation + a system read of\n * the SSO config on every hit — cap it so it can't be used as an amplification vector.\n */\n private async handleSAMLMetadata(req: Request, res: Response): Promise<void> {\n // 10/min/IP. `checkPolicy` throws `ErrorType.RATE_LIMIT` when exceeded (the\n // asyncHandler turns it into a 429), so nothing below runs for a tripped caller.\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10 },\n 'auth:saml:metadata:by-ip',\n );\n\n const scopeTypeParam = req.params.scopeType;\n if (\n scopeTypeParam !== AuthScopeType.ORGANIZATION\n && scopeTypeParam !== AuthScopeType.APPLICATION\n ) {\n res.status(400).json({ error: 'Invalid SAML metadata scope type' });\n return;\n }\n const scopeType = scopeTypeParam === AuthScopeType.ORGANIZATION\n ? AuthScopeType.ORGANIZATION\n : AuthScopeType.APPLICATION;\n const scopeId = req.params.scopeId as string;\n\n // Gate SLO-endpoint advertising on the tenant's `sessionSettings.singleLogoutEnabled`\n // so a disabled-SLO tenant's SP metadata omits the SingleLogoutService endpoints\n // (well-behaved IdPs then never send a LogoutRequest we would only no-op).\n // READ-ONLY (`readSSOConfigIfExists`, not `loadSSOConfig`): this is a PUBLIC,\n // rate-limited endpoint, so it must never attempt the read-then-CREATE that would\n // fire an ACL-rejected create + error-log per arbitrary caller-supplied scope. Absent\n // config ⇒ undefined ⇒ default (advertise).\n const ssoConfig = await this.orgConfigService.readSSOConfigIfExists(scopeType, scopeId);\n const singleLogoutEnabled =\n ssoConfig?.sessionSettings?.singleLogoutEnabled ?? true;\n\n const metadataXml = this.samlMetadataService.generateSPMetadata(scopeType, scopeId, { singleLogoutEnabled });\n res.set(WildoHeaderKeys.CONTENT_TYPE, 'application/samlmetadata+xml');\n res.status(200).send(metadataXml);\n }\n\n /**\n * GET /auth/saml/slo\n *\n * Handles two distinct cases via query params:\n * - `SAMLRequest` present → IdP-initiated SLO (HTTP-Redirect binding)\n * - `SAMLResponse` present → IdP's response to our SP-initiated SLO\n *\n * Rate limit: SC-40 — 10 req/min per IP.\n */\n private async handleSAMLSLO_GET(req: Request, res: Response): Promise<void> {\n // PR 7c — SAML SLO (HTTP-Redirect binding) migration. 10/min/IP\n // per SC-40. CRITICAL: scope key DELIBERATELY shared with\n // `handleSAMLSLO_POST` (`auth:saml:slo:by-ip`, NOT `:slo-get:by-ip`).\n // Pre-PR-7c the same Redis prefix `SAML_SLO_IP` was reused\n // verbatim by both methods — the two SLO methods are functionally\n // ONE logical SLO endpoint with two SAML transport bindings\n // (HTTP-Redirect via GET vs HTTP-POST per the SAML SLO spec).\n // Splitting them into separate scope keys would let an IdP\n // alternate bindings to extract 2x the cap — an unintended\n // weakening of SC-40. The K-3 escape-hatch (custom controller\n // surface owning its own scope-key composition) is the framework-\n // blessed way to express \"two methods, one bucket\" — single\n // string-literal slot keeps the invariant inspectable. Local\n // `clientIp` extraction dropped (sole-consumed; see SAMLLogin).\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10 },\n 'auth:saml:slo:by-ip',\n );\n\n const samlRequest: string | undefined = req.query.SAMLRequest as string | undefined;\n const samlResponse: string | undefined = req.query.SAMLResponse as string | undefined;\n const relayState: string | undefined = req.query.RelayState as string | undefined;\n\n const ec = await this._getPreAuthExecutionContext();\n\n if (samlRequest) {\n try {\n // HTTP-Redirect SLO carries a DETACHED query-string signature. Rebuild the\n // signed octet string from the RAW request query (decoded `req.query` values\n // would not byte-match what the IdP signed). `undefined` for an unsigned\n // request → samlify fails closed (`wantLogoutRequestSigned`).\n const questionMarkIdx = req.originalUrl.indexOf('?');\n const rawQuery = questionMarkIdx >= 0 ? req.originalUrl.slice(questionMarkIdx + 1) : '';\n const redirectSignature = AuthControllerUtils.buildRedirectSLOSignatureContext(rawQuery);\n const result = await this.samlAuthService.handleIdPInitiatedSLO(ec, 'redirect', samlRequest, relayState, redirectSignature);\n res.redirect(302, result.logoutResponseUrl);\n } catch (error) {\n this.logger.warn('SAML SLO (IdP-initiated GET) failed', {\n errorRef: isWildoBackendError(error) ? (error as any).customMessageReference : 'unknown',\n ...projectCaughtErrorLogFields(error),\n });\n const frontendUrl = this._resolveSAMLRedirectUrl();\n return this.redirectToFrontendWithError(res, AuthRedirectErrorCode.SAML_SLO_FAILED, 'Logout failed.', frontendUrl);\n }\n } else if (samlResponse) {\n try {\n await this.samlAuthService.handleSLOResponse(ec, 'redirect', samlResponse);\n } catch (error) {\n this.logger.warn('SAML SLO LogoutResponse processing failed (GET)', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n const frontendUrl = this._resolveSAMLRedirectUrl() || '/';\n res.redirect(302, `${frontendUrl}/auth/login?slo=success`);\n } else {\n res.status(400).json({ error: 'Missing SAMLRequest or SAMLResponse parameter' });\n }\n }\n\n /**\n * POST /auth/saml/slo\n *\n * IdP-initiated SLO via HTTP-POST binding.\n * Route-specific body parser: `express.urlencoded({ extended: false, limit: '2mb' })`.\n *\n * Rate limit: SC-40 — 10 req/min per IP.\n */\n private async handleSAMLSLO_POST(req: Request, res: Response): Promise<void> {\n // PR 7c — SAML SLO (HTTP-POST binding) migration. SAME 10/min/IP\n // bucket as `handleSAMLSLO_GET` — see that method's comment for\n // the shared-scope-key rationale (`auth:saml:slo:by-ip` is\n // intentionally identical so the SLO-spec dual-binding pair\n // shares one cap).\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10 },\n 'auth:saml:slo:by-ip',\n );\n\n const samlRequest: string | undefined = req.body?.SAMLRequest;\n const samlResponse: string | undefined = req.body?.SAMLResponse;\n const relayState: string | undefined = req.body?.RelayState;\n\n const ec = await this._getPreAuthExecutionContext();\n\n if (samlRequest) {\n try {\n const result = await this.samlAuthService.handleIdPInitiatedSLO(ec, 'post', samlRequest, relayState);\n res.redirect(302, result.logoutResponseUrl);\n } catch (error) {\n this.logger.warn('SAML SLO (IdP-initiated POST) failed', {\n errorRef: isWildoBackendError(error) ? (error as any).customMessageReference : 'unknown',\n ...projectCaughtErrorLogFields(error),\n });\n const frontendUrl = this._resolveSAMLRedirectUrl();\n return this.redirectToFrontendWithError(res, AuthRedirectErrorCode.SAML_SLO_FAILED, 'Logout failed.', frontendUrl);\n }\n } else if (samlResponse) {\n try {\n await this.samlAuthService.handleSLOResponse(ec, 'post', samlResponse);\n } catch (error) {\n this.logger.warn('SAML SLO LogoutResponse processing failed (POST)', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n const frontendUrl = this._resolveSAMLRedirectUrl() || '/';\n res.redirect(302, `${frontendUrl}/auth/login?slo=success`);\n } else {\n res.status(400).json({ error: 'Missing SAMLRequest or SAMLResponse parameter' });\n }\n }\n\n /**\n * POST /auth/saml/logout — SP-initiated SLO kickoff (SC-36/SC-37).\n *\n * The app asks us to log the caller out of their SAML session. We identify the caller from the SIGNED\n * `__wildo_refresh` cookie — robust (works even if the access token has expired, mirroring `/auth/logout`)\n * and unforgeable (the refresh token is server-signed, so the client cannot claim another user's id).\n * `initiateSPLogout` revokes the caller's Wildo session (the user-wide token-invalidation fence, via\n * `_terminateSAMLSessionByUser`) and, when the IdP advertises SLO, returns a redirect to the IdP's SLO\n * endpoint — the IdP then round-trips a LogoutResponse to the inbound `/auth/saml/slo`. The refresh cookie\n * is ALWAYS cleared, so the client is logged out even when the IdP round-trip is unavailable.\n *\n * Response: 302 to the IdP SLO URL when the IdP supports it; 204 when the logout completed locally with no\n * IdP redirect (`singleLogoutEnabled=false`, the connection has no `sloUrl`, or the connection was not\n * found). Rate limit: 10/min per IP (mirrors the inbound SLO cap).\n */\n private async handleSAMLSPLogout(req: Request, res: Response): Promise<void> {\n await this.rateLimitService.checkPolicy(req, res, { requestsPerMinute: 10 }, 'auth:saml:sp-logout:by-ip');\n\n const { connectionId } = SAMLSPLogoutRequestSchema.parse(req.body || {});\n const ec = await this._getPreAuthExecutionContext();\n\n // Identify the caller from the SIGNED refresh cookie — trusted, and the client cannot forge the userId.\n const refreshToken = AuthControllerUtils.extractRefreshTokenFromCookie(req);\n let userId: string | undefined;\n if (refreshToken) {\n try {\n const decoded = await this.jwtService.verifyRefreshToken(refreshToken);\n if (typeof decoded === 'object' && decoded !== null) {\n const payload = decoded as Record<string, unknown>;\n userId = typeof payload.userId === 'string' ? payload.userId : undefined;\n }\n } catch {\n // Invalid/expired refresh token — treated as unauthenticated below.\n }\n }\n if (!userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_REFRESH_TOKEN_REQUIRED,\n });\n }\n\n let result: { redirectUrl: string } | null = null;\n try {\n result = await this.samlAuthService.initiateSPLogout(ec, userId, connectionId);\n } catch (error) {\n // A failure building the IdP redirect must not strand the caller logged-in on the client — we still\n // clear the cookie below. (initiateSPLogout revokes the session before it can reach a redirect error.)\n this.logger.warn('SAML SP-initiated SLO failed to build the IdP redirect', { ...projectCaughtErrorLogFields(error) });\n }\n\n // Always clear the refresh cookie — the caller is logging out.\n this._clearRefreshCookie(res);\n\n if (result?.redirectUrl) {\n res.redirect(302, result.redirectUrl);\n } else {\n res.status(204).send();\n }\n }\n\n /**\n * Resolve a frontend URL for SAML redirects.\n * Uses the user-type → frontend-service reverse lookup from `frontendServices.usersManagement`.\n * When `userType` is provided (post-identification), resolves the frontend service that serves that user type.\n * Falls back to the config's default frontend service (first with any `isDefault` entry).\n */\n private _resolveSAMLRedirectUrl(userType?: string): string | undefined {\n try {\n const frontendServiceName = userType\n ? this.appConfigService.resolveFrontendServiceNameFromUserType(userType)\n : this.appConfigService.resolveDefaultFrontendServiceName();\n if (!frontendServiceName) return undefined;\n return this.resolveFrontendAppPublicUrlFromFrontendServiceName(frontendServiceName);\n } catch {\n return undefined;\n }\n }\n\n /**\n * GET+POST /auth/oauth2/callback/:providerRef\n *\n * Handles the IdP redirect after user authentication.\n * Accepts both GET and POST — TRAP 5: Apple uses response_mode=form_post.\n *\n * Flow:\n * 1. Extract code/state from query (GET) or body (POST)\n * 2. handleCallback() — validate state, exchange code, extract profile\n * 3. provisionOrLinkUser() — find/create user, create identity link\n * 4. Issue JWT tokens via AuthTokenIssuer.issueTokensForUser() (TRAP 12)\n * 5. Create AUTH_CODE_EXCHANGE consumable token containing JWT tokens\n * 6. Redirect to frontend /auth/callback?code={consumableTokenCode}\n *\n * Browser-only — the framework targets web stacks exclusively, so the\n * final redirect URL ({frontendUrl}/auth/callback?code=xxx) is always a\n * standard HTTPS navigation. No Universal Link / App Link / custom URL\n * scheme variants are needed.\n *\n * TRAP 13: Audit logging for OAuth2 logins happens HERE (not in the engine).\n */\n private async oauth2Callback(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n // M10 fix: Check for IdP error parameters FIRST, before extracting code/state.\n // If the IdP sends both error and code/state (some IdPs do this), we must handle\n // the error rather than consuming the state token and attempting a code exchange\n // that will fail with an opaque error.\n const idpError = (req.query.error as string) || req.body?.error;\n if (idpError) {\n const errorDescription = (req.query.error_description as string) || req.body?.error_description || 'Authentication denied by identity provider';\n\n // Try to peek at the state token (without consuming it) to resolve the frontendUrl\n // for a user-friendly redirect instead of a raw JSON 400 response.\n // The state token expires naturally — not consuming it is safe.\n let errorRedirectUrl: string | undefined;\n let errorReturnUrl: string | undefined;\n const stateValue = (req.query.state as string) || req.body?.state;\n if (stateValue) {\n try {\n const stateToken = await this.consumableTokenService.validateToken(stateValue);\n const stateMetadata = stateToken.metadata as Record<string, unknown> | undefined;\n const frontendServiceName = stateMetadata?.frontendServiceName as string | undefined;\n errorReturnUrl = typeof stateMetadata?.returnUrl === 'string'\n ? stateMetadata.returnUrl\n : undefined;\n if (frontendServiceName) {\n errorRedirectUrl = this.resolveFrontendAppPublicUrlFromFrontendServiceName(frontendServiceName);\n }\n } catch {\n // State token invalid/expired — fall through to JSON fallback\n }\n }\n\n return this.redirectToFrontendWithError(res, idpError, errorDescription, errorRedirectUrl, errorReturnUrl);\n }\n\n // 1. Extract code and state from query (GET) or body (POST)\n const code = (req.query.code as string) || req.body?.code;\n const state = (req.query.state as string) || req.body?.state;\n\n if (!code || !state) {\n return this.redirectToFrontendWithError(res, AuthRedirectErrorCode.MISSING_PARAMS, 'Missing code or state parameter');\n }\n\n // Hoisted so the catch block can use it for error redirects\n let frontendUrl: string | undefined;\n let callbackReturnUrl: string | undefined;\n\n try {\n // 2. Handle callback — validate state, exchange code, extract profile\n const callbackParams = {\n code,\n state,\n body: req.method === 'POST' ? req.body : undefined, // Apple form_post: body contains `user` JSON\n };\n const { normalizedProfile, connection, stateMetadata } = await this.oauth2Service.handleCallback(callbackParams);\n\n // Resolve the frontend URL from the state token's frontendServiceName field.\n // This is the frontend that initiated the OAuth2 flow — redirects must go back there.\n frontendUrl = stateMetadata.frontendServiceName\n ? this.resolveFrontendAppPublicUrlFromFrontendServiceName(stateMetadata.frontendServiceName)\n : undefined;\n callbackReturnUrl = stateMetadata.returnUrl;\n\n // 3. Provision or link user. Pass the initiating frontend service so the\n // provisioner can assign the base user type (mirroring password registration)\n // when neither an org-type grant nor a prior assignment populated `userTypes` —\n // otherwise the session-issuance gate below rejects the empty-userType user.\n const frontendServiceName = stateMetadata.frontendServiceName;\n const { userId, isNewUser } = await this.oauth2Service.provisionOrLinkUser(normalizedProfile, connection, frontendServiceName);\n\n if (frontendServiceName) {\n const authenticatedUser = await this.userLookup.findUserById(ec, userId);\n const authenticatedUserType = authenticatedUser?.userTypes?.[0];\n const userManagement = authenticatedUserType\n ? this.appConfigService.getFrontendServiceUserManagementEntry(frontendServiceName, authenticatedUserType)\n : null;\n\n if (!authenticatedUserType || !userManagement?.auth) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,\n context: {\n message:\n `Authentication is disabled for frontend service \"${frontendServiceName}\"` +\n (authenticatedUserType ? ` and user type \"${authenticatedUserType}\"` : ''),\n frontendServiceName,\n activeUserType: authenticatedUserType,\n },\n });\n }\n }\n\n const tokens = await this.tokenIssuer.issueTokensForUser(userId, undefined, {\n lastAuthenticatedAt: Math.floor(Date.now() / 1000),\n });\n\n // 5. Create AUTH_CODE_EXCHANGE consumable token with JWT tokens as metadata\n const exchangeToken = await this.consumableTokenService.createToken({\n tokenType: CoreConsumableTokenTypes.AUTH_CODE_EXCHANGE,\n consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n expiresIn: { value: 5, unit: DurationUnit.MINUTES },\n userId: userId,\n resourceIdentifier: CoreResourceType.USERS,\n metadata: {\n accessToken: tokens.accessToken,\n refreshToken: tokens.refreshToken,\n expiresIn: tokens.expiresIn,\n providerRef: connection.providerRef,\n isNewUser: isNewUser,\n },\n });\n\n // TRAP 13: Audit log OAuth2 login (audit stays in the route handler, not engine)\n const deviceInfo = {\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n };\n\n await this.auditLogsService.logUserSSOLogin({\n userId: userId,\n email: normalizedProfile.email,\n providerRef: connection.providerRef,\n connectionType: connection.connectionType,\n authSource: AuthSource.OIDC,\n scopeType: connection.connectionType === SsoConnectionType.ENTERPRISE\n ? connection.scope?.scopeType\n : undefined,\n organizationId: getOrganizationIdFromEnterpriseScope(connection.scope),\n applicationId: getApplicationIdFromEnterpriseScope(connection.scope),\n ipAddress: deviceInfo.ipAddress,\n userAgent: deviceInfo.userAgent,\n sessionId: `oauth2:${connection.providerRef}:${userId}`,\n }, await this.authEcFactory.createForAuditRoutingOrFallback(\n ec,\n getOrganizationIdFromEnterpriseScope(connection.scope),\n userId,\n ));\n\n this.logDebug('OAuth2 callback processed successfully', {\n providerRef: connection.providerRef,\n userId,\n isNewUser,\n });\n\n // 6. Redirect to frontend with the one-time exchange code (Decision 7)\n this.redirectToFrontendWithCode(res, exchangeToken.token, frontendUrl, stateMetadata.returnUrl);\n\n } catch (error) {\n // Redirect to frontend with error instead of returning JSON.\n // frontendUrl may be set if handleCallback succeeded but a later step failed.\n // If handleCallback itself failed, frontendUrl is undefined → JSON fallback.\n //\n // Observability: WildoBackendErrors are structured PLAIN OBJECTS, not `Error`\n // instances (see `isWildoBackendError`), so `error instanceof Error` is false for\n // them. Reading `error.message` therefore silently dropped the real\n // `customMessageReference` + `context.message`, collapsing every OIDC/SSO callback\n // abort (token-exchange, profile-extraction, provisioning) into a generic string in\n // the log. Log the FULL structured detail at WARN level (matching the SAML ACS\n // failure path above) so a callback abort is diagnosable end-to-end. The user-facing\n // redirect keeps a STABLE generic reason — structured detail (raw `customMessageReference`\n // enum names, internal service/config strings) belongs in the server log, not the\n // browser URL. Same posture as the SAML redirect sibling.\n this.logger.warn('OAuth2 callback failed', {\n error: isWildoBackendError(error)\n ? error.context?.message ?? error.customMessageReference\n : error instanceof Error\n ? error.message\n : String(error),\n ...(isWildoBackendError(error)\n ? {\n customMessageReference: error.customMessageReference,\n errorType: error.type,\n statusCode: error.statusCode,\n context: error.context,\n }\n : { stack: error instanceof Error ? error.stack : undefined }),\n });\n return this.redirectToFrontendWithError(\n res,\n AuthRedirectErrorCode.OAUTH_FAILED,\n 'Authentication failed. Please try again.',\n frontendUrl,\n callbackReturnUrl,\n );\n }\n }\n\n /**\n * POST /auth/token/exchange\n * Body: { code: string }\n * Response: { accessToken, expiresIn, returnPath?, sourceFrontendServiceName?, targetServiceKey? }\n * + `Set-Cookie: __wildo_refresh=<rotated>` header.\n *\n * The frontend calls this after receiving the one-time code from\n * either the OAuth2 callback redirect or a cross-frontend handoff.\n * Validates and consumes the AUTH_CODE_EXCHANGE consumable token,\n * returns the access token in the body and the rotated refresh\n * token in the `__wildo_refresh` cookie.\n *\n * Decision 7: Tokens never appear in URL — only a one-time code.\n *\n * Auth-hardening A-Step 6 (2026-04-13): the `refreshToken` field is\n * NO LONGER in the wire body — `TokenExchangeResponseSchema` is a\n * strict-object that would reject the key. The refresh token still\n * lives on `metadata.refreshToken` (issuer-side consumable-token\n * store), and the controller routes it to the cookie. See the\n * `_jsonSuccessWithRefreshCookie` JSDoc for the cookie-emission\n * contract.\n */\n private async tokenExchange(req: Request, res: Response): Promise<void> {\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 60 },\n 'auth:token-exchange:by-ip',\n );\n\n const { code } = TokenExchangeRequestSchema.parse(req.body || {});\n\n // Validate target binding BEFORE the destructive consume. `consumeToken()`\n // remains the atomic replay barrier, but a request from the wrong frontend\n // must not burn the user's one-time handoff code.\n let validatedToken;\n try {\n validatedToken = await this.consumableTokenService.validateToken(code, [CoreConsumableTokenTypes.AUTH_CODE_EXCHANGE]);\n } catch (cause: unknown) {\n const customMessageReference =\n (cause as { customMessageReference?: unknown } | undefined)?.customMessageReference;\n if (\n (isWildoBackendError(cause) &&\n cause.customMessageReference === ErrorCustomMessageReference.CONSUMABLE_TOKEN_TYPE_MISMATCH) ||\n customMessageReference === ErrorCustomMessageReference.CONSUMABLE_TOKEN_TYPE_MISMATCH\n ) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n });\n }\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n });\n }\n this._validateTokenExchangeTargetBinding(req, validatedToken.metadata as Record<string, unknown>);\n\n // Consume the token atomically (prevents race conditions vs separate validate+consume)\n let consumedToken;\n try {\n consumedToken = await this.consumableTokenService.consumeToken(code);\n } catch {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n });\n }\n\n // Defense-in-depth: verify the token type is AUTH_CODE_EXCHANGE (same pattern as Step 4 OAUTH2_STATE check)\n if (consumedToken.tokenType !== CoreConsumableTokenTypes.AUTH_CODE_EXCHANGE) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n });\n }\n\n const metadata = consumedToken.metadata as Record<string, unknown>;\n\n if (consumedToken.userId) {\n await this.handleAnonymousTranspositionForTokenExchange(req, res, consumedToken.userId);\n }\n\n // Surface the cross-frontend-handoff metadata fields (`returnPath`,\n // `sourceFrontendServiceName`, `targetServiceKey`) when present. They are\n // populated only by the cross-frontend-handoff issuer (Step 2 / Step 5);\n // OAuth2-callback codes do not carry them, so the receiving frontend can\n // detect \"this came from a handoff\" by simply checking\n // `typeof returnPath === 'string'`. The response shape is pinned by\n // `TokenExchangeResponseSchema` (saas-models, public-runtime-safe), with\n // these three fields all `.optional()` precisely to preserve OAuth2-callback\n // backward compatibility — adding them as required would break every\n // existing OAuth2 receiver. We use `omit-when-absent` (NOT explicit `null`)\n // to mirror the metadata-write convention in `crossFrontendHandoff()` and\n // to keep `strictObject` consumers happy.\n //\n // Defense-in-depth: pipe the response object through\n // `TokenExchangeResponseSchema.parse()` BEFORE shipping. Three reasons:\n // 1. Locks the wire shape — a future regression that adds a stray\n // metadata field cannot accidentally leak into the response (strict\n // object rejects unknown keys).\n // 2. Re-runs the `RETURN_PATH_REFINES` guard set on `returnPath` so a\n // hand-tampered consumable-token row in the store cannot smuggle an\n // open-redirect / path-traversal payload past the issuer schema by\n // bypassing the issuance code path entirely.\n // 3. Ensures `tokenExchange()` callers (Auth_OneOffSession in\n // cross-frontend-handoff mode, AuthSessionContext.handleAuthCodeExchange,\n // docs-site `beginExchange`) and the controller share ONE source of\n // truth — the schema is no longer documentation-only.\n // Auth-hardening A-Step 6 (2026-04-13): `refreshToken` is intentionally\n // OMITTED from the wire response (`TokenExchangeResponseSchema` no longer\n // declares it — strict-object would reject it as an unknown key). The\n // refresh token still lives on `metadata.refreshToken` (issuer-side\n // consumable-token store carries it), but the controller routes it to\n // `Set-Cookie` via the wrapper's third argument instead of the body.\n const responseDraft: Record<string, unknown> = {\n accessToken: metadata.accessToken,\n expiresIn: metadata.expiresIn,\n };\n if (typeof metadata.returnPath === 'string') {\n responseDraft.returnPath = metadata.returnPath;\n }\n if (typeof metadata.sourceFrontendServiceName === 'string') {\n responseDraft.sourceFrontendServiceName = metadata.sourceFrontendServiceName;\n }\n if (typeof metadata.targetServiceKey === 'string') {\n responseDraft.targetServiceKey = metadata.targetServiceKey;\n }\n const response = TokenExchangeResponseSchema.parse(responseDraft);\n const refreshTokenForCookie = typeof metadata.refreshToken === 'string'\n ? metadata.refreshToken\n : undefined;\n this._jsonSuccessWithRefreshCookie(res, response, refreshTokenForCookie);\n }\n\n /**\n * POST /auth/cross-frontend-handoff (cross-app-jwt-propagation Step 2).\n *\n * Issues a one-time AUTH_CODE_EXCHANGE consumable token bound to a target\n * frontend service so the user can transfer their authenticated session to\n * a sibling frontend (e.g. app → docs) WITHOUT re-authenticating and WITHOUT\n * the source frontend ever seeing the target frontend's URL space directly\n * (defense-in-depth: the target's `/auth/exchange` page consumes the code via\n * the existing `tokenExchange()` flow, so all the JWT validation,\n * anonymous-transposition, and audit hooks remain unchanged).\n *\n * Bearer-only — caller MUST send `Authorization: Bearer <accessToken>` from the\n * source frontend's session. CORS auto-allows every declared frontendService\n * via `deriveCorsOrigins()`, so callers do NOT need `credentials: 'include'`\n * (cookies are out of scope for Step 2 — auth-hardening Slice A handles cookies).\n *\n * Failure modes (HTTP 400, stable codes in `error.details.code` so the\n * docs-site `docsAuthClient` can branch on them):\n * - `UNKNOWN_TARGET_FRONTEND` — `targetServiceKey` is not declared.\n * - `TARGET_FRONTEND_HOST_NOT_CONFIGURED` — declared but no\n * `runtime.endPoints[targetServiceKey].publicUrl` for the current env\n * (fail-closed; we never auto-derive a guessed host).\n *\n * Audit: emits `USER_CROSS_FRONTEND_HANDOFF_ISSUED` with a SHA-256 hash of the\n * validated `returnPath` (NEVER the raw path — deep links can carry org IDs,\n * draft IDs, or one-off tokens that must not appear in audit logs).\n */\n private async crossFrontendHandoff(req: Request, res: Response): Promise<void> {\n const preAuthEc = await this._getPreAuthExecutionContext();\n const ipAddress = getClientIpFromRequest(req);\n const userAgent = (req.headers[WildoHeaderKeys.USER_AGENT] as string | undefined) || 'unknown';\n\n // Authenticate first (bearer-only). Must come BEFORE rate-limit so the\n // rate-limit key can be scoped to (userId, sourceFrontend) — keying on IP\n // alone would let a shared-NAT client get throttled by an unrelated user.\n const caller = await this.authJwtGuard.extractAuthenticatedUser(preAuthEc, req);\n\n const sourceFrontendServiceName = req.headers[WildoHeaderKeys.FRONTEND_SERVICE_NAME] as string | undefined;\n // AUTH-10 cross-validation: reject browser callers whose `X-Frontend-Service-Name`\n // disagrees with the browser-enforced `Origin` header. Without this, a logged-in\n // user could spoof the source-frontend header to (a) poison the audit row's\n // `sourceFrontendServiceName` (forensic correlation broken) and (b) multiply their\n // rate-limit budget by N declared frontends (each `<userId>:<sourceFrontend>` bucket\n // is independent). No-op when the header is absent (server-to-server callers\n // preserve existing behaviour).\n this._validateFrontendAppOrigin(req, sourceFrontendServiceName);\n\n // PR 7b — cross-frontend handoff migration (account lifecycle wave).\n // 30 issuances / 60 s per (user, source-frontend). Matches docs-chat\n // contract C-7. Composite identifier `${userId}:${sourceFrontend}`\n // is passed as `clientIdOverride` so the bucket reflects BOTH the\n // authenticated user AND the source frontend dimension — keying on\n // userId alone would merge per-frontend budgets (a docs-app abuse\n // path would consume the app-shell's budget); keying on IP would\n // throttle a shared-NAT user pool by an unrelated user's burst.\n // Composite-clientId is the framework-blessed pattern for\n // multi-dimensional buckets (same shape PR 5 used for SCIM\n // per-token, generalized to N dimensions joined by `:`).\n //\n // Scope-key uses the F-15 `:by-user-source` suffix to reserve the\n // namespace slot for any future per-IP companion (e.g. a global\n // per-IP cap on cross-frontend handoffs would slot in as\n // `auth:cross-frontend-handoff:by-ip` without prefix collision).\n //\n // Rate-limit STAYS AFTER `extractAuthenticatedUser` — neither F-18\n // (rate-limit before JWT extract) NOR F-22 (rate-limit before EC\n // creation) apply here because the bucket key REQUIRES `userId`\n // from the verified JWT, and `extractAuthenticatedUser` REQUIRES\n // `preAuthEc`. The pre-bucket auth verify cost is bounded and\n // necessary; the alternative (bucket on IP, then bucket again on\n // user post-auth) doubles bookkeeping for no meaningful gain.\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 30 },\n 'auth:cross-frontend-handoff:by-user-source',\n undefined,\n `${caller.userId}:${sourceFrontendServiceName ?? 'unknown'}`,\n );\n\n const body = CrossFrontendHandoffRequestSchema.parse(req.body || {});\n\n // Resolve target service. Differentiate \"unknown\" vs \"host not configured\"\n // ourselves rather than collapsing into AuthControllerUtils.lookupFrontendPublicUrl()'s\n // single null — callers branch on the stable code, not the error message.\n const appConfig = this.appConfigService.config;\n const targetServiceConfig = appConfig?.frontendServices?.[body.targetServiceKey];\n if (!targetServiceConfig) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: {\n code: CrossFrontendHandoffErrorCode.UNKNOWN_TARGET_FRONTEND,\n message: `Unknown target frontend service \"${body.targetServiceKey}\". Declare it in wildo.saas.config.ts → services.`,\n targetServiceKey: body.targetServiceKey,\n },\n });\n }\n const targetFrontendType = (targetServiceConfig as { frontendType?: unknown }).frontendType;\n if (\n targetFrontendType !== AppFrontendType.SAAS_APP &&\n targetFrontendType !== AppFrontendType.TECH_DOC\n ) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: {\n code: CrossFrontendHandoffErrorCode.TARGET_FRONTEND_AUTH_EXCHANGE_UNSUPPORTED,\n message:\n `Target frontend \"${body.targetServiceKey}\" does not support AUTH_CODE_EXCHANGE handoff. ` +\n `Only SAAS_APP and TECH_DOC frontends mount /auth/exchange receivers.`,\n targetServiceKey: body.targetServiceKey,\n frontendType: typeof targetFrontendType === 'string' ? targetFrontendType : 'unknown',\n },\n });\n }\n\n // Browser handoff URL composition. Canonical URL seam is\n // runtime.endPoints[targetServiceKey].publicUrl. We deliberately do NOT use\n // infra.serviceHosts directly — that's the future authoring seam, propagated\n // to runtime.endPoints by the (deferred) apps-manager refactor. Reading\n // runtime.endPoints keeps URL composition consistent with CORS, OAuth2\n // callbacks, resolveFrontendAppPublicUrl, and every other consumer in the\n // system.\n const targetPublicUrl = AuthControllerUtils.lookupFrontendPublicUrl(appConfig, body.targetServiceKey);\n if (!targetPublicUrl) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: {\n code: CrossFrontendHandoffErrorCode.TARGET_FRONTEND_HOST_NOT_CONFIGURED,\n message:\n `Target frontend \"${body.targetServiceKey}\" is declared but runtime.endPoints.${body.targetServiceKey}.publicUrl ` +\n `is missing for the current environment. Configure it via the env-resolution chain (no auto-derived guess).`,\n targetServiceKey: body.targetServiceKey,\n },\n });\n }\n\n // Re-issue a fresh JWT pair so the target frontend receives its own session\n // (avoids leaking the source frontend's accessToken via the consumable token's\n // metadata, and ensures the target's session has a fresh `iat` / refresh JTI).\n const tokens = await this.tokenIssuer.issueTokensForUser(caller.userId, undefined, {\n lastAuthenticatedAt: Math.floor(Date.now() / 1000),\n });\n\n // 60 s TTL — caller is mid-redirect, NOT waiting on a third-party IdP. Shorter\n // than OAuth2's 5 min reduces the replay window. SINGLE_USE matches Step 4 OAUTH2_STATE.\n const exchangeToken = await this.consumableTokenService.createToken({\n tokenType: CoreConsumableTokenTypes.AUTH_CODE_EXCHANGE,\n consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n expiresIn: { value: 60, unit: DurationUnit.SECONDS },\n userId: caller.userId,\n resourceIdentifier: CoreResourceType.USERS,\n metadata: {\n accessToken: tokens.accessToken,\n refreshToken: tokens.refreshToken,\n expiresIn: tokens.expiresIn,\n // Omit-when-absent (NOT explicit null) — Zod `.optional()` produces\n // `undefined`, never `null`. Storing `null` would diverge from the rest\n // of the metadata convention and trip `strictObject` consumers in any\n // future schema-validated reader.\n ...(sourceFrontendServiceName !== undefined && { sourceFrontendServiceName }),\n targetServiceKey: body.targetServiceKey,\n // Step 5 — surface `returnPath` from the metadata so `tokenExchange()` can\n // round-trip it back to the receiving frontend. The URL query string carries\n // the same value (defense-in-depth duplication); the metadata is the\n // canonical source. Receiver consumers MUST still sanitize the value (the\n // issuance schema's refines do not survive a round-trip through Mongo\n // serialization in case of future schema drift). Empty-string default\n // ('/') is preserved verbatim — the schema rewrites missing/empty\n // `returnPath` to '/' before we get here, see\n // `CrossFrontendHandoff_ReturnPathSchema` in\n // `cross-frontend-handoff.shared.dto.schemas.ts`.\n returnPath: body.returnPath,\n },\n });\n\n // Compose the handoff URL: `<publicUrl>/auth/exchange?code=…&return=…`.\n // Receiver is the existing exchange page on every frontend — Step 2\n // introduced NO new client route there.\n const encodedCode = encodeURIComponent(exchangeToken.token);\n const encodedReturn = encodeURIComponent(body.returnPath);\n const handoffUrl = `${targetPublicUrl}/auth/exchange?code=${encodedCode}&return=${encodedReturn}`;\n\n // Audit issuance (helper SHA-256-hashes returnPath internally; never persists the raw path).\n try {\n // F4 per-org SIEM routing — route ONLY on the caller's VERIFIED ACTIVE member orgs.\n // `caller.userId` is the verified-JWT user id; the surrounding try/catch keeps a\n // membership-read failure from breaking handoff issuance.\n const routingOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, caller.userId);\n await this.auditLogsService.logUserCrossFrontendHandoffIssued({\n userId: caller.userId,\n sourceFrontendServiceName,\n targetServiceKey: body.targetServiceKey,\n returnPath: body.returnPath,\n consumableTokenId: exchangeToken._id,\n ipAddress,\n userAgent,\n }, preAuthEc, routingOrgIds);\n } catch (error) {\n this.logger.warn('Audit log failed for cross-frontend handoff issuance', {\n error,\n consumableTokenId: exchangeToken._id,\n });\n }\n\n this.logDebug('Cross-frontend handoff issued', {\n userId: caller.userId,\n sourceFrontendServiceName,\n targetServiceKey: body.targetServiceKey,\n consumableTokenId: exchangeToken._id,\n });\n\n // Schema: CrossFrontendHandoffResponseSchema requires `expiresAt: string`.\n // ConsumableToken.expiresAt is a Date in-memory (createToken stores it as Date);\n // wrap in `new Date()` for resilience against any future serialization drift.\n const expiresAtIso = new Date(exchangeToken.expiresAt as unknown as Date | string).toISOString();\n const response = CrossFrontendHandoffResponseSchema.parse({ handoffUrl, expiresAt: expiresAtIso });\n this.jsonSuccess(res, response);\n }\n\n /**\n * POST /auth/logout\n *\n * **Cookie-only contract** (Auth-hardening Slice A Step 6, 2026-04-13).\n * Reads the refresh token EXCLUSIVELY from the `__wildo_refresh`\n * cookie via `AuthControllerUtils.extractRefreshTokenFromCookie()`.\n * The body schema (`LogoutBodySchema`) is `z.strictObject({})`, so a\n * stale legacy client still sending `{ refreshToken: '…' }` fails\n * validation BEFORE reaching this handler (defense-in-depth).\n *\n * When no cookie is present, the cookie-clear is STILL emitted\n * (defensive — covers the \"stale cookie + lost JS state\" case where\n * the browser still holds the cookie but the JS context lost the\n * access token). The Redis JTI-blacklist revocation is best-effort\n * and skipped when there's no token to revoke.\n *\n * Pre-A-Step-6 history: A-K-3 added the cookie channel; A-K-5 added\n * the transitional dual-read; A-Step 6 (this) drops the body channel.\n *\n * Response: 200 OK + `Set-Cookie: __wildo_refresh=; Max-Age=0`.\n *\n * Accessible both with and without a valid JWT (user's access token\n * may be expired when they logout).\n */\n private async logout(req: Request, res: Response): Promise<void> {\n // ec discarded intentionally — logout doesn't read EC, but we\n // honour the same pre-auth bootstrap that every public handler does\n // for consistency with audit-trail expectations.\n await this._getPreAuthExecutionContext();\n // Validate body shape (strict-empty post Auth-hardening A-Step 6 —\n // see `LogoutBodySchema` JSDoc). Throws on `{ refreshToken: '…' }`,\n // surfacing stale-client misuse as a 400 rather than silently\n // ignoring the body field.\n LogoutBodySchema.parse(req.body || {});\n const refreshToken = AuthControllerUtils.extractRefreshTokenFromCookie(req);\n\n // Try to decode the refresh token to get identity for audit (best-effort, don't fail logout if decode fails)\n let logoutUserId: string | undefined;\n if (refreshToken) {\n try {\n const decoded = await this.jwtService.verifyRefreshToken(refreshToken);\n if (typeof decoded === 'object' && decoded !== null) {\n const payload = decoded as Record<string, unknown>;\n logoutUserId = typeof payload.userId === 'string' ? payload.userId : undefined;\n }\n } catch { /* token may be expired — that's fine */ }\n\n // Revoke the refresh token by adding its JTI to the Redis blacklist.\n // The token issuer's refreshAccessToken() checks this blacklist before issuing new tokens.\n try {\n await this.tokenIssuer.revokeRefreshToken(refreshToken);\n } catch (revocationError) {\n // Don't block logout on a stale/already-revoked token — clearing\n // the cookie is the user-visible action and must always succeed.\n this.logDebug('Refresh-token revocation failed during logout (likely stale/expired)', {\n userId: logoutUserId || 'unknown',\n error: describeCaughtError(revocationError),\n });\n }\n } else {\n this.logDebug('Logout called without `__wildo_refresh` cookie — clearing cookie defensively');\n }\n\n // ALWAYS clear the cookie, even when no token was supplied — this\n // covers the \"stale cookie + lost JS state\" case where the browser\n // still holds the cookie but the JS context lost the access token\n // (page crash, storage clear, etc.).\n this._clearRefreshCookie(res);\n\n // H5: Audit logout\n this.auditLogsService.logUserLogout({\n userId: logoutUserId || 'unknown',\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n }).catch(() => {}); // fire-and-forget\n\n this.logDebug('Logout completed — refresh token revoked + cookie cleared');\n\n res.status(204).send();\n }\n\n /**\n * POST /auth/logout-all — sign out EVERYWHERE (every device / session).\n *\n * Where `/auth/logout` revokes only the presented session's refresh chain (leaving other devices, and this\n * session's short-lived access token, alive until expiry), this fences the WHOLE user via\n * `invalidateAllTokensForUser` — writing the `TOKEN_INVALID_BEFORE:<userId>` timestamp that EVERY auth front\n * (HTTP guard, refresh, socket handshake, delegated A2A/MCP) checks — so every access AND refresh token the\n * user holds, on every device, is revoked immediately. This is the immediate-full-revocation path industry\n * best practice recommends pairing with short-lived access tokens (OWASP JWT Cheat Sheet); the per-user fence\n * is the denylist-equivalent, already on the token-verification hot path.\n *\n * The caller is identified from the SIGNED `__wildo_refresh` cookie — proof of an active session, and\n * unforgeable — mirroring `/auth/logout` and the SAML SP-logout. No valid cookie ⇒ 401. Unlike single logout,\n * the revocation is AWAITED and NOT swallowed: a \"signed out everywhere\" that silently failed to revoke would\n * be a security lie, so a revocation failure fails the request rather than returning a false success.\n *\n * Response: 204 + cleared cookie. Rate limit: 10/min per IP.\n */\n private async logoutAll(req: Request, res: Response): Promise<void> {\n await this.rateLimitService.checkPolicy(req, res, { requestsPerMinute: 10 }, 'auth:logout-all:by-ip');\n await this._getPreAuthExecutionContext();\n LogoutBodySchema.parse(req.body || {});\n\n const refreshToken = AuthControllerUtils.extractRefreshTokenFromCookie(req);\n let userId: string | undefined;\n if (refreshToken) {\n try {\n const decoded = await this.jwtService.verifyRefreshToken(refreshToken);\n if (typeof decoded === 'object' && decoded !== null) {\n const payload = decoded as Record<string, unknown>;\n userId = typeof payload.userId === 'string' ? payload.userId : undefined;\n }\n } catch {\n // Invalid/expired refresh token — treated as unauthenticated below.\n }\n }\n if (!userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_REFRESH_TOKEN_REQUIRED,\n });\n }\n\n // Fence the WHOLE user — awaited, NOT swallowed (see JSDoc): a failure here must fail the request.\n await this.tokenIssuer.invalidateAllTokensForUser(userId);\n this._clearRefreshCookie(res);\n\n this.auditLogsService.logUserLogout({\n userId,\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n }).catch(() => {}); // fire-and-forget\n\n this.logDebug('Logout-all completed — every token fenced for the user + cookie cleared', { userId });\n res.status(204).send();\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Password Reset Route Handlers (Step 7)\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * POST /auth/password-reset/request → AuthPasswordResetService.requestPasswordReset\n */\n private async passwordResetRequest(req: Request, res: Response): Promise<void> {\n // PR-7b-fixes F-22 fail-fast ordering: body parse → rate-limit → ec.\n // Body parse is required input for the per-email bucket key; ec\n // creation is needed only for the downstream service call and\n // moves AFTER the rate-limit gate so over-budget callers don't\n // pay the EC-construction cost (cosmetic for perf, materially\n // better for the fail-fast invariant PR-7-D-3 established at\n // F-18 for JWT extraction — generalized here to all bounded\n // pre-auth setup).\n const { email } = PasswordResetRequestDtoSchema.parse(req.body || {});\n\n // PR 7b — password-reset migration. Two policies AND-ed at the\n // same seam, with DIFFERENT identifiers (separate `checkPolicy`\n // calls because the bucket suffix can't be both email and IP at\n // once — same pattern PR 7-D-3 established for `phoneVerifySend`):\n //\n // 1) Per-email 3/hour. Defense against an attacker spamming a\n // single victim's inbox with reset emails (cost-bearing for\n // the SMTP egress AND a deliverability/reputation hit for our\n // sending domain). Email-keyed via `clientIdOverride` —\n // IP-keying would let a botnet sidestep the cap by rotating\n // sources against one victim.\n //\n // Email normalization is `email.toLowerCase()` only —\n // matching the previous shape exactly. Plus-addressing\n // (`foo+a@x.com` vs `foo+b@x.com`) and Gmail-dot tricks\n // (`f.oo@gmail.com` vs `foo@gmail.com`) are NOT normalized\n // here: the local-part semantics vary by provider, and treating\n // them as one bucket could merge legitimately distinct\n // accounts. Tracked as D-4 in the plan for a follow-up\n // decision if the plus-addressing bypass becomes a real\n // abuse path.\n //\n // 2) Per-IP 5/hour. Defense against a single source pumping reset\n // requests across many email addresses (account-discovery\n // probe). IP-keyed by default (no `clientIdOverride`).\n //\n // Drop the `if (ipAddress !== 'unknown')` guard from the previous\n // shape: per the `getClientIpFromRequest` contract, `'unknown'`\n // is a sentinel that the bucket MUST treat as a single shared\n // bucket — co-bucketing all unknown-IP callers is the documented\n // \"over-throttle one shared bucket rather than under-count\n // distinct clients\" rule. The previous guard SKIPPED rate-limit\n // entirely on unknown-IP requests, which let a caller suppressing\n // proxy headers bypass the per-IP cap. Net upgrade for\n // security; minor behavior change for legitimate `'unknown'`\n // scenarios (which are rare and now share one bucket as the\n // helper's contract intends).\n //\n // Both calls run BEFORE `passwordResetService.requestPasswordReset`\n // — the cost-bearing service call (DB lookup, SMTP send) doesn't\n // run for over-budget callers. Body parse precedes the\n // rate-limit by necessity (need `email` for the per-email\n // bucket); body parse is cheap and bounded.\n const ipAddress = getClientIpFromRequest(req);\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerHour: 3 },\n 'auth:password-reset:request:by-email',\n undefined,\n email.toLowerCase(),\n );\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerHour: 5 },\n 'auth:password-reset:request:by-ip',\n );\n\n const ec = await this._getPreAuthExecutionContext();\n const frontendUrl = this.resolveFrontendAppPublicUrl(req);\n const result = await this.passwordResetService.requestPasswordReset(ec, {\n email, frontendUrl, ipAddress, userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n });\n this.jsonSuccess(res, result);\n }\n\n /**\n * POST /auth/password-reset/complete → AuthPasswordResetService.completePasswordReset\n */\n private async passwordResetComplete(req: Request, res: Response): Promise<void> {\n /*\n * The REQUEST leg carries two policies and this leg carried none, so the half of the flow that\n * consumes a token and WRITES A CREDENTIAL was the unlimited one.\n *\n * IP-keyed and single-bucket, unlike the request leg's email+IP pair, because the caller supplies\n * no email here — only a token. Keying on the token would defeat the defence it exists for: the\n * bucket would reset on every guess, which is exactly the note `magicLinkVerify` already makes\n * for the same reason.\n *\n * 10/min matches `auth:invitation:accept:by-ip`, the nearest peer in shape — a one-off token\n * that sets a password. The cost being bounded is not only the token lookup: every attempt runs\n * an argon2 hash of the submitted password, which is deliberately expensive, so an unlimited\n * endpoint is a CPU-exhaustion surface as much as a token-guessing one.\n *\n * Ordering follows `passwordResetRequest` and `acceptInvitation`: limit BEFORE the body parse and\n * before EC construction, so an over-budget caller pays for neither.\n */\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10 },\n 'auth:password-reset:complete:by-ip',\n );\n\n const { token, newPassword } = PasswordResetCompleteDtoSchema.parse(req.body || {});\n const ec = await this._getPreAuthExecutionContext();\n\n const result = await this.passwordResetService.completePasswordReset(ec, {\n token, newPassword,\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n });\n this.jsonSuccess(res, result);\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Registration Route Handlers (Step 8) → AuthRegistrationService\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * POST /auth/register → AuthRegistrationService.registerUser\n */\n private async register(req: Request, res: Response): Promise<void> {\n // PR-7b-fixes F-22 fail-fast ordering: body parse → rate-limit → ec\n // (see `passwordResetRequest` for rationale).\n const { email, firstName, lastName, password, organizationName, method } = UserRegisterApiDtoSchema.parse(req.body || {});\n const ipAddress = getClientIpFromRequest(req);\n\n // PR 7b — register migration. THREE policies AND-ed (PR 8a Option D\n // lifted the per-email-domain bucket UP from `auth-registration.backend.service.ts`;\n // see plan body for the architectural rationale — rate limits are\n // intrinsically HTTP concerns and the service layer should not\n // reach for `req`/`res`-equivalent state). Order standardized\n // VICTIM-PROTECTIVE first → SOURCE-NOISE last per PR-7b-fixes\n // F-20: when multiple buckets would trip on the same request, the\n // FIRST one short-circuits and the LATER ones never increment, so\n // the binding constraint surfaced to the client (and to operators\n // tailing 429s) reflects the most-relevant defensive intent.\n // Generalized victim-protective ranking for register: named-account\n // (per-email) → named-tenant (per-domain) → loud-source (per-IP).\n // Same email-first ordering as `passwordResetRequest`,\n // `resendVerificationEmail`, `phoneVerifySend`/`Confirm`.\n //\n // 1) Per-email 3/hour. Defense against an attacker re-attempting\n // registration on a known email (e.g. to brute-force collision\n // against an existing account or to re-trigger the\n // \"email already registered\" enumeration channel). Email-keyed\n // via `clientIdOverride` (`email.toLowerCase()` only —\n // plus-addressing punted, see D-4).\n //\n // 2) Per-domain 50/hour. Defense against an attacker fanning out\n // registrations across many local-parts on the same domain\n // (a single-org targeted enrolment-spam attack — would burn\n // the org's verification-email reputation and pollute its\n // user table). Domain-keyed via `clientIdOverride` on the\n // `email.split('@')[1]?.toLowerCase()` — same lowercase\n // normalization the now-deleted service-layer call used.\n // Empty-domain case (no `@` in submitted email) is filtered\n // The `if (emailDomain)` guard is preserved verbatim from the\n // pre-PR-8a service-layer shape: the upstream `.email()`\n // schema refinement should make the empty case unreachable,\n // but the guard is defense-in-depth (and a no-op for legitimate\n // callers — keeps the migration purely behavior-preserving).\n //\n // 3) Per-IP 3/min. Defense against a single source spinning up\n // accounts in bulk (account-creation amplification — DB rows,\n // org provisioning, verification email cost). IP-keyed by\n // default. The `if (ipAddress !== 'unknown')` guard is\n // dropped (same rationale as `passwordResetRequest`: per the\n // helper's contract, unknown-IP callers SHARE one bucket\n // rather than bypassing the limit entirely — net security\n // upgrade).\n //\n // `ipAddress` extraction stays — threaded into `registerUser` for\n // audit/anti-fraud (single IP source of truth via\n // `getClientIpFromRequest`, same helper `checkPolicy` re-derives\n // for the per-IP bucket).\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerHour: 3 },\n 'auth:register:by-email',\n undefined,\n email.toLowerCase(),\n );\n const emailDomain = email.split('@')[1]?.toLowerCase();\n if (emailDomain) {\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerHour: 50 },\n 'auth:register:by-domain',\n undefined,\n emailDomain,\n );\n }\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 3 },\n 'auth:register:by-ip',\n );\n\n const ec = await this._getPreAuthExecutionContext();\n const frontendUrl = this.resolveFrontendAppPublicUrl(req);\n\n // W3.4 + AUTH-10: Resolve activeUserType for registration context.\n // For registration, the header is the authoritative source since the user doesn't exist yet.\n // The registration service validates the resolved type allows registration (mode != disabled).\n // AUTH-10: Cross-validate Origin against the claimed frontend service to prevent user-type spoofing.\n const frontendServiceNameReg = req.headers[WildoHeaderKeys.FRONTEND_SERVICE_NAME] as string | undefined;\n this._validateFrontendAppOrigin(req, frontendServiceNameReg);\n const activeUserTypeReg = frontendServiceNameReg\n ? this.appConfigService.resolveUserTypeFromFrontendServiceName(frontendServiceNameReg) ?? undefined\n : undefined;\n\n const result = await this.registrationService.registerUser(ec,\n // `method` absent ⇒ the service defaults to PASSWORD, so a client predating #463 is unchanged.\n { email, firstName, lastName, password, organizationName, method },\n { frontendUrl, ipAddress, userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown', frontendServiceName: frontendServiceNameReg, activeUserType: activeUserTypeReg },\n );\n\n // Deferred-verification registration issues tokens immediately (see\n // `registerUser`), so this is the anonymous→authenticated conversion moment\n // for direct-register users. Transpose the anonymous website capture onto\n // the new account — guarded on token issuance + a resolved `userId`,\n // identical to `verifyEmail()` / `acceptInvitation()`. The non-deferred\n // branch returns no `accessToken`, so this is a no-op there.\n if (result.accessToken && result.userId) {\n await this.handleAnonymousTranspositionForTokenExchange(req, res, result.userId);\n }\n\n // Auth-hardening A-Step 6 (2026-04-13): destructure cookie-only\n // `refreshToken` out of the registration result. The wire body\n // (`{ messageRef, message, ssoRedirectHint?, sessionId?, state?,\n // purpose?, nextStep?, userId?, accessToken?, expiresIn? }`) carries no\n // refresh token; the wrapper sets `Set-Cookie` from the third arg.\n const { refreshToken, ...wireBody } = result;\n this._jsonSuccessWithRefreshCookie(res, wireBody, refreshToken);\n }\n\n /**\n * GET /auth/invitation/info?token=… → AuthRegistrationService.getInvitationInfo\n *\n * Public, NON-consuming discovery for the multi-method accept screen: returns the\n * invited org's available auth methods + SSO/SCIM management mode. Per-IP rate\n * limited to blunt invitation-token probing (the token is the only credential).\n */\n private async getInvitationInfo(req: Request, res: Response): Promise<void> {\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 30 },\n 'auth:invitation:info:by-ip',\n );\n\n const invitationToken = String(req.query.token ?? '');\n const ec = await this._getPreAuthExecutionContext();\n const result = await this.registrationService.getInvitationInfo(ec, invitationToken);\n res.status(200).json(result);\n }\n\n /**\n * POST /auth/invitation/accept → AuthRegistrationService.acceptInvitation\n */\n private async acceptInvitation(req: Request, res: Response): Promise<void> {\n // PR 7b — invitation accept migration. Per-IP 10/min cap defends\n // against invitation-token bruteforce. NOT per-token-keyed: the\n // bucket would reset every new token tried, defeating the\n // bruteforce defense (same anti-pattern PR 7a documented for\n // `magicLinkVerify`). The `if (ipAddress !== 'unknown')` guard\n // is dropped (same rationale as `passwordResetRequest` /\n // `register` above: per-helper contract, unknown-IP callers\n // co-bucket; net security upgrade).\n //\n // PR-7b-fixes F-22 fail-fast ordering: rate-limit FIRST (the\n // bucket key is per-IP only — body parse is NOT a rate-limit\n // input here, unlike the dual-key sites). Then body parse, then\n // ec creation. Over-budget callers don't pay body-parse OR\n // ec-construction costs.\n //\n // `ipAddress` is also threaded into `acceptInvitation` below for\n // the audit row — single IP source of truth.\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10 },\n 'auth:invitation:accept:by-ip',\n );\n\n const { invitationToken, firstName, lastName, password, credentialMethod } = UserInvitationApiDtoSchema.parse(req.body || {});\n const ipAddress = getClientIpFromRequest(req);\n const ec = await this._getPreAuthExecutionContext();\n\n const result = await this.registrationService.acceptInvitation(ec, {\n invitationToken,\n firstName,\n lastName,\n password,\n credentialMethod,\n ipAddress,\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n });\n\n // MAGIC_LINK-at-accept issues NO session: dispatch the link email (shared helper) and return the\n // generic \"check your email\" message. The minted token never touches the wire (anti-enumeration,\n // identical to `POST /auth/magic-link/send`).\n if (result.outcome === AcceptInvitationOutcome.MAGIC_LINK_SENT) {\n await this._sendMagicLinkEmail(req, result.magicLinkDelivery);\n this.jsonSuccess(res, this.authResponseHelper.getAuthResponse(AuthResponseMessageRef.MAGIC_LINK_SENT));\n return;\n }\n\n // SESSION outcome (password / no-password / passkey). The invitation token bootstrapped a\n // session; `passkeyRegistrationOptions`, when present, rides the wire body so the frontend can\n // complete the WebAuthn ceremony against the existing authenticated register-verify route.\n if (result.accessToken && result.userId) {\n await this.handleAnonymousTranspositionForTokenExchange(req, res, result.userId);\n }\n\n // Auth-hardening A-Step 6 — see `register()` for the cookie-only contract. `outcome` is the\n // internal service↔controller discriminant and is stripped from the wire body.\n const { refreshToken, outcome: _outcome, ...wireBody } = result;\n this._jsonSuccessWithRefreshCookie(res, wireBody, refreshToken);\n }\n\n /**\n * POST /auth/invitation/reject → AuthRegistrationService.rejectInvitation\n */\n private async rejectInvitation(req: Request, res: Response): Promise<void> {\n // PR 7b — invitation reject migration. Same shape as\n // `acceptInvitation` above (per-IP 10/min, no per-token keying for\n // the same bruteforce-defense reason). The `if (ipAddress !==\n // 'unknown')` guard and the local `ipAddress` extraction are\n // dropped together — the variable was sole-consumed by the\n // dropped guard (unlike `acceptInvitation` where `ipAddress` is\n // still threaded into the service for audit). `checkPolicy`\n // re-derives the IP via the same helper for the bucket key.\n //\n // PR-7b-fixes F-22 fail-fast ordering: rate-limit → body parse →\n // ec (same shape as `acceptInvitation` above).\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10 },\n 'auth:invitation:reject:by-ip',\n );\n\n const { invitationToken, rejectionReason } = UserInvitationRejectApiDtoSchema.parse(req.body || {});\n const ec = await this._getPreAuthExecutionContext();\n\n const result = await this.registrationService.rejectInvitation(ec, {\n invitationToken,\n rejectionReason,\n });\n\n this.jsonSuccess(res, result);\n }\n\n /**\n * GET /auth/invitations/mine → AuthRegistrationService.listMyPendingInvitations\n *\n * Authenticated (Approach P). Returns the caller's OWN pending invitations across\n * all organizations, matched by their primary email. No token — the caller is\n * identified by their JWT. The cross-org reads run under a system context inside the\n * service; the pre-auth EC carries the cross-org-capable context for the caller lookup.\n */\n private async listMyInvitations(req: Request, res: Response): Promise<void> {\n const preAuthEc = await this._getPreAuthExecutionContext();\n // IP-keyed rate-limit before JWT extraction (fail-fast, same shape as the token routes).\n await this.rateLimitService.checkPolicy(req, res, { requestsPerMinute: 30 }, 'auth:invitations:mine:by-ip');\n const caller = await this.authJwtGuard.extractAuthenticatedUser(preAuthEc, req);\n\n const invitations = await this.registrationService.listMyPendingInvitations(preAuthEc, {\n callerUserId: caller.userId,\n });\n this.jsonSuccess(res, { invitations });\n }\n\n /**\n * POST /auth/invitations/accept → AuthRegistrationService.acceptMyInvitation\n *\n * Authenticated in-app accept (Approach P) of one of the caller's OWN pending\n * invitations (email-ownership). No token, no new session — the caller is already\n * signed in; the shared acceptance core creates the membership + marks it accepted.\n */\n private async acceptMyInvitation(req: Request, res: Response): Promise<void> {\n const preAuthEc = await this._getPreAuthExecutionContext();\n await this.rateLimitService.checkPolicy(req, res, { requestsPerMinute: 10 }, 'auth:invitations:accept-mine:by-ip');\n const caller = await this.authJwtGuard.extractAuthenticatedUser(preAuthEc, req);\n // `membershipId` = the INVITED membership row the invitee accepts (junction model —\n // the invitation IS the membership).\n const { membershipId } = z.object({ membershipId: z.string().min(1) }).parse(req.body || {});\n\n const result = await this.registrationService.acceptMyInvitation(preAuthEc, {\n callerUserId: caller.userId,\n membershipId,\n });\n this.jsonSuccess(res, result);\n }\n\n /**\n * POST /auth/invitations/reject → AuthRegistrationService.rejectMyInvitation\n *\n * Authenticated in-app decline (Approach P) of one of the caller's OWN pending\n * invitations (userId-ownership of the INVITED membership row). Decline DELETEs the\n * pending membership (which revokes its accept token via the membership DELETE prefix).\n */\n private async rejectMyInvitation(req: Request, res: Response): Promise<void> {\n const preAuthEc = await this._getPreAuthExecutionContext();\n await this.rateLimitService.checkPolicy(req, res, { requestsPerMinute: 10 }, 'auth:invitations:reject-mine:by-ip');\n const caller = await this.authJwtGuard.extractAuthenticatedUser(preAuthEc, req);\n const { membershipId, rejectionReason } = z.object({\n membershipId: z.string().min(1),\n rejectionReason: z.string().max(500).optional(),\n }).parse(req.body || {});\n\n const result = await this.registrationService.rejectMyInvitation(preAuthEc, {\n callerUserId: caller.userId,\n membershipId,\n rejectionReason,\n });\n this.jsonSuccess(res, result);\n }\n\n /**\n * POST /auth/verify-email → AuthRegistrationService.verifyEmail\n */\n private async verifyEmail(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const { token, email } = EmailVerifyDtoSchema.parse(req.body || {});\n\n const result = await this.registrationService.verifyEmail(ec, {\n token, email,\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n });\n\n if (result.accessToken && result.userId) {\n await this.handleAnonymousTranspositionForTokenExchange(req, res, result.userId);\n }\n\n // Auth-hardening A-Step 6 — see `register()` for the cookie-only contract.\n const { refreshToken, ...wireBody } = result;\n this._jsonSuccessWithRefreshCookie(res, wireBody, refreshToken);\n }\n\n /**\n * POST /auth/resend-verification → AuthRegistrationService.resendVerificationEmail\n */\n private async resendVerificationEmail(req: Request, res: Response): Promise<void> {\n // PR-7b-fixes F-22 fail-fast ordering: body parse → rate-limit → ec\n // (see `passwordResetRequest` for rationale).\n const { email } = z.object({\n email: z.string().email(),\n }).parse(req.body || {});\n\n const ipAddress = getClientIpFromRequest(req);\n // PR 7b — resend-verification-email migration. Two policies AND-ed\n // (same pattern as `passwordResetRequest` / `register`), but BOTH\n // use the same 600-second (10-minute) window — which doesn't fit\n // the canonical `requestsPerMinute / Hour / Day` schema. This is\n // the SECOND consumer of `customWindows` (D-3, Option A —\n // phone-verify was the first, end-of-PR-7-D-3). Rationale for the\n // 10-minute window:\n //\n // - 60s (round to `requestsPerMinute: 3`): 5x looser — 3 emails\n // per minute is generous enough to amplify victim-inbox spam\n // meaningfully (180/hour vs the current 18/hour hard cap).\n // - 3600s (round to `requestsPerHour: 3`): 6x looser at a\n // different point — would let an attacker burst all 3 in the\n // first 10 seconds of the hour.\n //\n // Neither rounding preserves the original UX-and-defense\n // intersection (~3 emails per ~3-minute spacing, matching how\n // long users typically wait before re-checking inbox). Same\n // shape as phone-verify's 300s decision: when the window length\n // encodes a domain-meaningful interval (here, the typical\n // inbox-check cycle; for phone-verify, the OTP TTL),\n // `customWindows` is the right escape hatch — NOT a knob for\n // arbitrary tuning.\n //\n // 1) Per-email 3/600s. Defense against pumping a single victim's\n // inbox. Email-keyed via `clientIdOverride: email.toLowerCase()`\n // (plus-addressing punted, see D-4).\n //\n // 2) Per-IP 5/600s. Defense against a single source pumping\n // resend requests across many email addresses\n // (account-discovery probe / SMTP egress amplification).\n // IP-keyed by default. The `if (ipAddress !== 'unknown')`\n // guard is dropped (same rationale as `register` /\n // `passwordResetRequest`).\n //\n // `ipAddress` extraction stays — threaded into\n // `resendVerificationEmail` for audit (same single-source-of-truth\n // pattern as `register`).\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { customWindows: [{ requestsPerWindow: 3, windowSeconds: 600 }] },\n 'auth:resend-verif:by-email',\n undefined,\n email.toLowerCase(),\n );\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { customWindows: [{ requestsPerWindow: 5, windowSeconds: 600 }] },\n 'auth:resend-verif:by-ip',\n );\n\n const ec = await this._getPreAuthExecutionContext();\n const frontendUrl = this.resolveFrontendAppPublicUrl(req);\n const result = await this.registrationService.resendVerificationEmail(ec, {\n email, frontendUrl, ipAddress,\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n });\n this.jsonSuccess(res, result);\n }\n\n /**\n * POST /auth/onboarding/complete-org → AuthRegistrationService.completeOrgOnboarding\n */\n private async completeOrgOnboarding(req: Request, res: Response): Promise<void> {\n // PR 7b — org-onboarding migration. Per-IP 10/min cap defends\n // against bulk org-completion (each successful call provisions\n // an organization row + membership + tenant scaffolding —\n // cost-bearing). IP-keyed by default. No prior unknown-IP guard\n // to drop (this site already rate-limited unconditionally —\n // pre-existing correct behavior). Rate-limit precedes\n // `_getPreAuthExecutionContext` AND body parse — strictest\n // fail-fast among the PR 7b sites, preserved as-is.\n //\n // Local `clientIp` extraction REMOVED: it was sole-consumed by\n // the `checkRateLimit` key suffix; `checkPolicy` re-derives via\n // `getClientIpFromRequest` internally, so the local extraction\n // becomes dead code. (Compare `register` / `acceptInvitation` /\n // `resendVerificationEmail` which keep their `ipAddress`\n // extractions because the value is also threaded into the\n // service for audit.)\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10 },\n 'auth:onboarding:complete-org:by-ip',\n );\n\n const ec = await this._getPreAuthExecutionContext();\n const { sessionId, organizationName } = z.object({\n sessionId: z.string(),\n organizationName: z.string().min(1).max(200)\n .regex(/^[^<>\"'`;{}()\\\\]+$/, 'Organization name contains disallowed characters'),\n }).parse(req.body || {});\n\n const result = await this.registrationService.completeOrgOnboarding(ec, {\n sessionId,\n organizationName: organizationName.trim(),\n });\n this.jsonSuccess(res, result);\n }\n\n // ═══════════════════════════════════════════════════════════════\n // MFA: Email OTP Route Handlers (Step 10)\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * POST /auth/mfa/email-otp/send\n * Body: { sessionId: string }\n * Response: { message: string }\n *\n * Generates a 6-digit OTP, stores as consumable token, sends email to user.\n * Must be called after first factor completion (session state = FIRST_FACTOR_COMPLETED).\n */\n private async mfaEmailOTPSend(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const body = z.object({ sessionId: z.string().min(1) }).parse(req.body || {});\n\n this.logDebug('MFA Email OTP send requested', { sessionId: body.sessionId });\n\n // Orchestrator handles validation, rate limiting, OTP generation, and token storage.\n // It returns the OTP code and the user's email — we send the email here.\n const {\n otpToken,\n submissionId,\n email,\n expiryMinutes,\n } = await this.authService.sendEmailOTP(ec, body.sessionId);\n\n // Send the OTP email\n let emailAccepted = false;\n try {\n const appIdentity = this.appConfigService.config.appIdentity;\n const emailResult = await this.emailService.send({\n submissionId,\n templateRef: SystemEmailTemplateRef.EMAIL_OTP,\n locale: getConfiguredPrimaryLanguage(this.appConfigService.config),\n type: EmailTemplateType.TRANSACTIONAL,\n to: email,\n context: {\n currentObject: { email },\n objectContext: {\n primaryScopeContext: {\n appName: appIdentity.appName,\n applicationId: this.appConfigService.applicationId,\n logoUrl: this.appConfigService.resolveBrandLogoAbsoluteUrl({\n composition: BrandAssetComposition.LOCKUP,\n purpose: BrandAssetPurpose.EMAIL,\n }) ?? undefined,\n },\n },\n userContext: { userId: '', email }, // userId not available in pre-auth flow; email is the key identifier\n additionalContext: { otpCode: otpToken, expiresInMinutes: expiryMinutes },\n },\n });\n emailAccepted =\n emailResult.success\n && emailResult.outcome === EmailSubmissionOutcome.PROVIDER_ACCEPTED;\n if (emailAccepted) {\n this.logDebug('MFA Email OTP provider accepted submission', {\n email,\n submissionId: emailResult.submissionId,\n providerMessageIds: emailResult.providerMessageIds,\n });\n } else {\n this.logger.error('MFA email OTP provider did not confirm acceptance', {\n email,\n submissionId: emailResult.submissionId,\n outcome: emailResult.outcome,\n error: emailResult.error,\n });\n }\n } catch (emailError) {\n this.logger.error('Failed to send MFA email OTP', {\n ...projectCaughtErrorLogFields(emailError),\n });\n // Still return success — the OTP was generated and stored.\n // User can retry sending if email delivery fails.\n }\n\n // A \"sent\" audit event is acceptance evidence, not an attempt log.\n if (emailAccepted) {\n this.auditLogsService.logUserMFAEmailOTPSent({\n email,\n sessionId: body.sessionId,\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n }).catch(() => {});\n }\n\n this.jsonSuccess(res, this.authResponseHelper.getAuthResponse(AuthResponseMessageRef.MFA_EMAIL_OTP_SENT));\n }\n\n /**\n * POST /auth/mfa/email-otp/verify\n * Body: { sessionId: string, code: string }\n * Response: AuthenticationResponse (from orchestrator)\n *\n * Verifies the submitted OTP code against stored consumable tokens.\n * On success, returns authentication result (may complete auth or require more factors).\n */\n private async mfaEmailOTPVerify(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const body = z.object({\n sessionId: z.string().min(1),\n code: z.string().regex(/^\\d{4,8}$/, { error: 'Invalid OTP code' }),\n }).parse(req.body || {});\n\n this.logDebug('MFA Email OTP verify requested', { sessionId: body.sessionId });\n\n // Build an EmailOTPAuthRequest and route through the main authenticate method\n // so that completion logic (token issuance) is handled uniformly.\n const authRequest = {\n sessionId: body.sessionId,\n method: AuthMethod.EMAIL_OTP as const,\n factorLevel: AuthFactorLevel.SECOND as const,\n token: body.code,\n rememberMe: false,\n requestedIntegrations: [],\n };\n\n const result = await this.authService.authenticate(ec, authRequest);\n // Anonymous→authenticated transposition. The MFA *first* factor returned\n // MFA_REQUIRED, at which point `handleAnonymousTransposition` early-returned\n // on `!success` (no tokens issued yet), so the anonymous website capture was\n // never consumed. This SECOND-factor completion is the real token-issuing\n // moment for MFA-enabled users — transpose here, before the wire response is\n // sent (the trigger may `Set-Cookie` to clear the anon-session cookie, which\n // must precede `res.json`). Guarded internally on `success` + a resolved\n // `user._id`, so an incomplete multi-factor step (success, no tokens, no\n // user) is a safe no-op. Mirrors the sibling `authenticate()` site.\n await this.handleAnonymousTransposition(req, res, result);\n // Auth-hardening A-Step 6 — see `authenticatePassword()` for the\n // destructure-and-pass-explicitly contract.\n const { refreshToken, ...wireBody } = result;\n this._jsonSuccessWithRefreshCookie(res, wireBody, refreshToken);\n }\n\n // ═══════════════════════════════════════════════════════════════\n // MFA: TOTP Route Handlers (Step 11)\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * POST /auth/mfa/totp/setup\n * Headers: Authorization: Bearer <accessToken>\n * Response: { secret: string, qrCodeUri: string, backupCodes: string[] }\n *\n * Uses `extractFromSessionOrJwt` — the caller may be fully authenticated (JWT)\n * or partially authenticated (MFA_REQUIRED / MFA_ENROLLMENT_REQUIRED session).\n * In the partial-auth path, identity is not yet fully proven, so we intentionally\n * use a pre-auth EC (no userId attribution). Security relies on the JWT guard /\n * session state validation in `extractFromSessionOrJwt`, not on the EC's role.\n */\n private async mfaTOTPSetup(req: Request, res: Response): Promise<void> {\n // PR 7c — TOTP setup migration. 5/hour per-user, post-auth.\n // CRITICAL: scope key DELIBERATELY shared with `mfaTOTPVerifySetup`\n // (`auth:mfa:totp:setup:by-user`, NOT `:setup-init:by-user` /\n // `:setup-verify:by-user`). Pre-PR-7c the same Redis prefix\n // `TOTP_SETUP` was reused verbatim by both methods — setup +\n // verify-setup form ONE enrollment ceremony (generate-secret →\n // user-enters-6-digits-from-authenticator → verify), and a\n // legitimate user retry alternates between the two endpoints\n // when their first code attempt fails. Splitting them into\n // separate scope keys would let an attacker run setup-verify-\n // setup-verify-... to extract 2x the cap (10 ceremonies/hour\n // instead of the SC-spec'd 5).\n //\n // Rate-limit STAYS AFTER `extractFromSessionOrJwt` — the bucket\n // key REQUIRES the verified `userId`, so neither F-18 nor F-22\n // fail-fast applies (same situation as `crossFrontendHandoff`\n // and the upcoming Passkey sites; bucket-on-IP-then-bucket-on-\n // user would double bookkeeping for no meaningful gain).\n // `clientIdOverride: userId` is the framework-blessed pattern\n // for per-authenticated-subject buckets (PR 5 SCIM established\n // this for per-token; same shape generalized to per-user here).\n const ec = await this._getPreAuthExecutionContext();\n const { userId, email } = await this.authJwtGuard.extractFromSessionOrJwt(ec, req);\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerHour: 5 },\n 'auth:mfa:totp:setup:by-user',\n undefined,\n userId,\n );\n\n const result = await this.mfaService.setupTOTP(ec, {\n userId,\n email,\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n });\n\n this.jsonSuccess(res, result);\n }\n\n /**\n * POST /auth/mfa/totp/verify-setup\n * Headers: Authorization: Bearer <accessToken>\n * Body: { code: string }\n * Response: { verified: boolean }\n *\n * Uses `extractFromSessionOrJwt` — caller may be partially authenticated\n * (mid-MFA enrollment). Pre-auth EC used intentionally: identity is not\n * fully proven until MFA setup completes. See mfaTOTPSetup JSDoc.\n */\n private async mfaTOTPVerifySetup(req: Request, res: Response): Promise<void> {\n // PR 7c — TOTP verify-setup migration. SAME 5/hour per-user\n // bucket as `mfaTOTPSetup` — see that method's comment for the\n // shared-scope-key rationale (`auth:mfa:totp:setup:by-user`\n // is intentionally identical so the enrollment-ceremony pair\n // shares one cap).\n const ec = await this._getPreAuthExecutionContext();\n const { userId } = await this.authJwtGuard.extractFromSessionOrJwt(ec, req);\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerHour: 5 },\n 'auth:mfa:totp:setup:by-user',\n undefined,\n userId,\n );\n const body = z.object({\n code: z.string().regex(/^\\d{6}$/, { error: 'Invalid TOTP code — must be 6 digits' }),\n }).parse(req.body || {});\n\n const result = await this.mfaService.verifyTOTPSetup(ec, {\n userId,\n code: body.code,\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n });\n\n this.jsonSuccess(res, result);\n }\n\n /**\n * POST /auth/mfa/totp/verify\n * Body: { sessionId: string, code: string }\n * Response: AuthenticationResponse (from orchestrator)\n *\n * Verifies a TOTP code during login MFA flow.\n * Routes through the main authenticate method for uniform completion logic.\n */\n private async mfaTOTPVerify(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const body = z.object({\n sessionId: z.string().min(1),\n code: z.string().min(1, { error: 'TOTP code is required' }),\n }).parse(req.body || {});\n\n this.logDebug('MFA TOTP verify requested', { sessionId: body.sessionId });\n\n const authRequest = {\n sessionId: body.sessionId,\n method: AuthMethod.TOTP as const,\n factorLevel: AuthFactorLevel.SECOND as const,\n token: body.code,\n rememberMe: false,\n requestedIntegrations: [],\n };\n\n const result = await this.authService.authenticate(ec, authRequest);\n // Anonymous→authenticated transposition — MFA second-factor completion.\n // See `mfaEmailOTPVerify()` for why the first-factor MFA_REQUIRED path could\n // not transpose; this is the token-issuing moment for TOTP users (affects\n // every MFA-enabled account). Safe no-op if the step is not yet complete.\n await this.handleAnonymousTransposition(req, res, result);\n // Auth-hardening A-Step 6 — destructure cookie-only `refreshToken`.\n const { refreshToken, ...wireBody } = result;\n this._jsonSuccessWithRefreshCookie(res, wireBody, refreshToken);\n }\n\n // ═══════════════════════════════════════════════════════════════\n // WebAuthn/Passkey Route Handlers (Phase G1)\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * POST /auth/passkey/register/options\n * Headers: Authorization: Bearer <accessToken>\n * Response: PublicKeyCredentialCreationOptionsJSON\n *\n * Uses `extractFromSessionOrJwt` — caller may be partially authenticated\n * (mid-MFA enrollment, registering a passkey as their MFA method).\n * Pre-auth EC used intentionally: identity not fully proven until\n * MFA enrollment completes. See mfaTOTPSetup JSDoc.\n */\n private async handlePasskeyRegisterOptions(req: Request, res: Response): Promise<void> {\n try {\n // PR 7c — passkey register-options migration. 10/hour per-user,\n // post-auth. CRITICAL: scope key DELIBERATELY shared with\n // `handlePasskeyRegisterVerify` (`auth:mfa:passkey:register:by-user`,\n // NOT `:options:by-user` / `:verify:by-user`). Pre-PR-7c the same\n // Redis prefix `PASSKEY_REGISTER` was reused verbatim by both\n // methods — same enrollment-ceremony rationale as TOTP setup +\n // verify-setup above. Splitting them would let an attacker run\n // options-verify-options-verify-... to extract 2x the cap (20\n // ceremonies/hour instead of the spec'd 10), defeating the\n // per-user enrollment cap that exists to bound CBOR-decode +\n // attestation-verify cost (passkey verify is meaningfully more\n // CPU than TOTP verify; the looser 10/hour vs TOTP's 5/hour\n // reflects passkey UX needing more retries on cross-device\n // attestation flows).\n //\n // Rate-limit STAYS AFTER `extractFromSessionOrJwt` — same\n // F-18/F-22 exception as TOTP and `crossFrontendHandoff`\n // (bucket key requires verified `userId`).\n const ec = await this._getPreAuthExecutionContext();\n const { userId, email } = await this.authJwtGuard.extractFromSessionOrJwt(ec, req);\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerHour: 10 },\n 'auth:mfa:passkey:register:by-user',\n undefined,\n userId,\n );\n const options = await this.webAuthnService.generateRegistrationOptions(ec, userId, email);\n this.jsonSuccess(res, options);\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { operation: AUTH_OPERATION.PASSKEY_REGISTER_OPTIONS },\n });\n }\n }\n\n /**\n * POST /auth/passkey/register/verify\n * Headers: Authorization: Bearer <accessToken>\n * Body: { response: RegistrationResponseJSON, name?: string }\n * Response: { registered: boolean, credential: { credentialId, name, createdAt } }\n *\n * Uses `extractFromSessionOrJwt` — caller may be partially authenticated\n * (mid-MFA enrollment). Pre-auth EC used intentionally: identity not fully\n * proven until MFA enrollment completes. See mfaTOTPSetup JSDoc.\n */\n private async handlePasskeyRegisterVerify(req: Request, res: Response): Promise<void> {\n try {\n // PR 7c — passkey register-verify migration. SAME 10/hour per-user\n // bucket as `handlePasskeyRegisterOptions` — see that method's\n // comment for the shared-scope-key rationale (`auth:mfa:passkey:\n // register:by-user` is intentionally identical so the\n // enrollment-ceremony pair shares one cap).\n const ec = await this._getPreAuthExecutionContext();\n const { userId, email } = await this.authJwtGuard.extractFromSessionOrJwt(ec, req);\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerHour: 10 },\n 'auth:mfa:passkey:register:by-user',\n undefined,\n userId,\n );\n const PasskeyRegisterVerifyBodySchema = z.object({\n response: z.object({\n id: z.string(),\n rawId: z.string(),\n response: z.object({\n attestationObject: z.string(),\n clientDataJSON: z.string(),\n }),\n authenticatorAttachment: z.enum(['cross-platform', 'platform'] as const).optional(),\n clientExtensionResults: z.record(z.string(), z.any()).default({}),\n type: z.literal('public-key'),\n }),\n name: z.string().max(100).optional(),\n });\n const { response, name } = PasskeyRegisterVerifyBodySchema.parse(req.body || {});\n const credential = await this.webAuthnService.verifyRegistrationResponse(ec, userId, response, name);\n\n // F4 per-org SIEM routing — route ONLY on the user's VERIFIED ACTIVE member orgs\n // (server-resolved, ≥ first-factor authenticated `userId`).\n const routingOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, userId);\n await this.auditLogsService.logUserPasskeyRegistered({\n userId: userId,\n email,\n credentialId: credential.credentialId,\n credentialName: credential.name,\n credentialDeviceType: credential.credentialDeviceType,\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n }, ec, routingOrgIds);\n\n this.jsonSuccess(res, {\n registered: true,\n credential: {\n credentialId: credential.credentialId,\n name: credential.name,\n createdAt: credential.createdAt,\n },\n });\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { operation: AUTH_OPERATION.PASSKEY_REGISTER_VERIFY },\n });\n }\n }\n\n /**\n * POST /auth/passkey/authenticate/options\n * Body: { sessionId: string }\n * Response: PublicKeyCredentialRequestOptionsJSON\n *\n * Unauthenticated. Part of login flow. Generates authentication options for the session's user.\n */\n private async handlePasskeyAuthOptions(req: Request, res: Response): Promise<void> {\n try {\n const ec = await this._getPreAuthExecutionContext();\n const { sessionId } = req.body;\n if (!sessionId) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: 'sessionId is required' },\n });\n }\n\n const session = await this.authService.getAuthenticationSessionState(ec, sessionId);\n if (!session) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,\n context: { sessionId },\n });\n }\n\n const validStatesForPasskeyAuth = new Set([\n AuthenticationSessionState.IDENTIFIED,\n AuthenticationSessionState.FIRST_FACTOR_IN_PROGRESS,\n AuthenticationSessionState.FIRST_FACTOR_COMPLETED,\n AuthenticationSessionState.MFA_REQUIRED,\n ]);\n if (!validStatesForPasskeyAuth.has(session.state as AuthenticationSessionState)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'Invalid session state for passkey authentication' },\n });\n }\n\n const userId = session.userId;\n if (!userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'No user associated with session' },\n });\n }\n\n const options = await this.webAuthnService.generateAuthenticationOptions(ec, userId);\n this.jsonSuccess(res, options);\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { operation: AUTH_OPERATION.PASSKEY_AUTH_OPTIONS },\n });\n }\n }\n\n /**\n * POST /auth/passkey/authenticate/verify\n * Body: { sessionId: string, response: AuthenticationResponseJSON, factorLevel?: AuthFactorLevel }\n * Response: AuthenticationResponse (from orchestrator)\n *\n * Unauthenticated. Routes through authService.authenticate() for uniform completion logic.\n */\n private async handlePasskeyAuthVerify(req: Request, res: Response): Promise<void> {\n try {\n const ec = await this._getPreAuthExecutionContext();\n const PasskeyAuthVerifyBodySchema = z.object({\n sessionId: z.string().min(1),\n response: z.object({\n id: z.string(),\n rawId: z.string(),\n response: z.object({\n authenticatorData: z.string(),\n clientDataJSON: z.string(),\n signature: z.string(),\n userHandle: z.string().optional(),\n }),\n authenticatorAttachment: z.enum(['cross-platform', 'platform'] as const).optional(),\n clientExtensionResults: z.record(z.string(), z.any()).default({}),\n type: z.literal('public-key'),\n }),\n factorLevel: z.string().optional(),\n });\n const { sessionId, response, factorLevel } = PasskeyAuthVerifyBodySchema.parse(req.body || {});\n\n const authResponse = await this.authService.authenticate(ec, {\n sessionId,\n method: AuthMethod.PASSKEY,\n factorLevel: (factorLevel as AuthFactorLevel) || AuthFactorLevel.FIRST,\n response,\n rememberMe: false,\n requestedIntegrations: [],\n });\n await this.handleAnonymousTransposition(req, res, authResponse);\n // Auth-hardening A-Step 6 — destructure cookie-only `refreshToken`.\n const { refreshToken, ...wireBody } = authResponse;\n this._jsonSuccessWithRefreshCookie(res, wireBody, refreshToken);\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { operation: AUTH_OPERATION.PASSKEY_AUTH_VERIFY },\n });\n }\n }\n\n /**\n * GET /auth/passkey/list\n * Headers: Authorization: Bearer <accessToken>\n * Response: { credentials: PasskeyCredentialEntry[] } (safe fields only)\n *\n * JWT-authenticated. Lists registered passkeys for the authenticated user.\n */\n private async handlePasskeyList(req: Request, res: Response): Promise<void> {\n try {\n const preAuthEc = await this._getPreAuthExecutionContext();\n const { userId } = await this.authJwtGuard.extractAuthenticatedUser(preAuthEc, req);\n const ec = await this._getAuthenticatedExecutionContext(userId);\n const credentials = await this.webAuthnService.getCredentials(ec, userId);\n\n const safeCredentials = credentials.map((c) => ({\n credentialId: c.credentialId,\n name: c.name,\n createdAt: c.createdAt,\n lastUsedAt: c.lastUsedAt,\n credentialDeviceType: c.credentialDeviceType,\n credentialBackedUp: c.credentialBackedUp,\n }));\n this.jsonSuccess(res, { credentials: safeCredentials });\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { operation: AUTH_OPERATION.PASSKEY_LIST },\n });\n }\n }\n\n /**\n * POST /auth/passkey/remove\n * Headers: Authorization: Bearer <accessToken>\n * Body: { credentialId: string }\n * Response: { removed: boolean }\n *\n * JWT-authenticated. Removes a passkey from the authenticated user.\n */\n private async handlePasskeyRemove(req: Request, res: Response): Promise<void> {\n try {\n const preAuthEc = await this._getPreAuthExecutionContext();\n const { userId, email } = await this.authJwtGuard.extractAuthenticatedUser(preAuthEc, req);\n const ec = await this._getAuthenticatedExecutionContext(userId);\n const { credentialId } = req.body;\n if (!credentialId) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: 'credentialId is required' },\n });\n }\n await this.methodManagementService.enforceUserMethodRemovalAllowed(ec, userId);\n\n const credentials = await this.webAuthnService.getCredentials(ec, userId);\n const target = credentials.find((c) => c.credentialId === credentialId);\n\n // D9 safety check: count password + passkeys + identity links\n const authMethodCounts = await this.methodManagementService.countAuthMethods(ec, userId);\n if (authMethodCounts.total <= 1) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: 'Cannot remove your only authentication method' },\n });\n }\n\n await this.webAuthnService.removeCredential(ec, userId, credentialId);\n\n // F4 per-org SIEM routing — route ONLY on the user's VERIFIED ACTIVE member orgs\n // (verified-JWT `userId`).\n const routingOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, userId);\n await this.auditLogsService.logUserPasskeyRemoved({\n userId: userId,\n email,\n credentialId,\n credentialName: target?.name || 'Unknown',\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n }, ec, routingOrgIds);\n\n this.jsonSuccess(res, { removed: true });\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { operation: AUTH_OPERATION.PASSKEY_REMOVE },\n });\n }\n }\n\n /**\n * POST /auth/passkey/rename\n * Headers: Authorization: Bearer <accessToken>\n * Body: { credentialId: string, name: string }\n * Response: { renamed: boolean }\n *\n * JWT-authenticated. Renames a passkey for the authenticated user.\n */\n private async handlePasskeyRename(req: Request, res: Response): Promise<void> {\n try {\n const preAuthEc = await this._getPreAuthExecutionContext();\n const { userId } = await this.authJwtGuard.extractAuthenticatedUser(preAuthEc, req);\n const ec = await this._getAuthenticatedExecutionContext(userId);\n const { credentialId, name } = req.body;\n if (!credentialId || !name) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: 'credentialId and name are required' },\n });\n }\n await this.webAuthnService.renameCredential(ec, userId, credentialId, name);\n this.jsonSuccess(res, { renamed: true });\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { operation: AUTH_OPERATION.PASSKEY_RENAME },\n });\n }\n }\n\n\n // ═══════════════════════════════════════════════════════════════\n // Refresh-token cookie seam (auth-hardening Slice A — A-K-3)\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * Drop-in replacement for `this.jsonSuccess(res, body)` that ALSO\n * emits `Set-Cookie: __wildo_refresh=<refreshToken>` when the caller\n * passes a non-empty `refreshToken` string as the third argument.\n *\n * **Cookie-only contract** (Auth-hardening Slice A Step 6, 2026-04-13).\n * Pre-A-Step-6 this wrapper auto-discovered `body.refreshToken` and\n * emitted both the cookie AND the body field (transitional dual-\n * write per A-K-5 so legacy clients could still read the field\n * during the migration window). A-Step 6 removed `refreshToken`\n * from the wire schemas entirely; the wrapper now requires the\n * caller to pass the refresh-token VALUE explicitly so the wire\n * payload (`body`) physically cannot contain the field anymore.\n *\n * Why an explicit argument rather than implicit body inspection:\n * - **Honest contract**: every auth seam that hands a refresh\n * token to the wire is now visible at the call site\n * (`this._jsonSuccessWithRefreshCookie(res, body, refreshToken)`).\n * A future handler that issues a refresh token and forgets to\n * pass it through this argument silently fails to set the\n * cookie — caught by the schema-pin tests, NOT by accidental\n * body-key collision.\n * - **No accidental leakage**: with implicit body inspection, a\n * caller serialising a `refreshToken` field by mistake would\n * emit it on the wire (the bug A-Step 6 closes). Explicit\n * argument means the body cannot carry the token even by\n * accident — it's not in the schema and it's not where the\n * wrapper looks.\n *\n * Why a wrapper rather than touching `jsonSuccess` in the abstract\n * base controller (unchanged from pre-A-Step-6):\n * - `jsonSuccess` is shared by every controller in the platform;\n * the cookie semantics are auth-specific.\n * - Centralising the cookie write at the wire-leaving seam means\n * ANY future auth handler gets the same `Set-Cookie` shape via\n * a single function — no chance of attribute drift.\n * - The wrapper is a no-op when `refreshToken` is undefined (or\n * an empty string), so it's safe to use as the default\n * replacement for `jsonSuccess` in this controller — non-token\n * payloads (session-state, OAuth authorize URL, etc.) call it\n * with `refreshToken: undefined` and pass through unchanged.\n */\n private _jsonSuccessWithRefreshCookie(\n res: Response,\n body: unknown,\n refreshToken: string | undefined,\n statusCode: number = 200,\n ): void {\n if (typeof refreshToken === 'string' && refreshToken.length > 0) {\n AuthControllerUtils.setRefreshCookie(\n res,\n refreshToken,\n this.appConfigService.config.jwt.refreshTokenExpirationDays,\n this.appConfigService.applicationEnv,\n );\n }\n this.jsonSuccess(res, body, statusCode);\n }\n\n /**\n * Clear the refresh cookie on logout / session invalidation. Reads\n * the runtime env from `appConfigService` so the same `Secure`\n * attribute that was set at issuance is used at clearance — the\n * browser only honours deletion when the attributes match.\n */\n private _clearRefreshCookie(res: Response): void {\n AuthControllerUtils.clearRefreshCookie(res, this.appConfigService.applicationEnv);\n }\n\n /**\n * Pre-auth EC for operations where the caller is not yet authenticated.\n * Uses PUBLIC_EXECUTION with APP_PUBLIC (minimal privilege, no initiator).\n * Primary intent: user identification/lookup across auth handlers.\n *\n * Also used as the bootstrap EC for JWT/session extraction calls\n * (`extractAuthenticatedUser`, `extractFromSessionOrJwt`) since identity\n * is unknown at that point.\n */\n private async _getPreAuthExecutionContext() {\n return this.authEcFactory.createForPreAuthOperation(this.authEcFactory.getUsersReadOperationPath());\n }\n\n /**\n * Authenticated EC for operations where the caller's identity has been\n * confirmed via JWT. Carries userId attribution for audit trail and\n * uses APP_USER role.\n *\n * Endpoints that call `extractAuthenticatedUser` (requiring a valid JWT)\n * should use this for all downstream service calls after extraction.\n */\n private async _getAuthenticatedExecutionContext(userId: string) {\n return this.authEcFactory.createForAuthenticatedAuthOperation(userId, this.authEcFactory.getUsersReadOperationPath());\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Private: Frontend Redirect Helpers\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * Redirect to the frontend callback page with the one-time exchange code.\n * URL: {frontendUrl}/auth/callback?code={exchangeCode}\n *\n * @param frontendUrl - The resolved frontend publicUrl from the OAuth2 state token.\n * If undefined (state token didn't carry frontendServiceName — legacy flows), throws.\n */\n private redirectToFrontendWithCode(\n res: Response,\n exchangeCode: string,\n frontendUrl?: string,\n returnUrl?: string,\n ): void {\n if (!frontendUrl) {\n throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {\n context: { message: 'Cannot redirect: frontendServiceName was not stored in OAuth2 state token. The originating frontend is unknown.' },\n });\n }\n const searchParams = new URLSearchParams({\n code: exchangeCode,\n });\n if (returnUrl) {\n searchParams.set('redirect', returnUrl);\n }\n const redirectUrl = `${frontendUrl}/auth/callback?${searchParams.toString()}`;\n res.redirect(302, redirectUrl);\n }\n\n /**\n * Redirect to the frontend login page with an error.\n * URL: {frontendUrl}/login?error={error}&reason={description}\n *\n * TRAP 6: Error redirect goes to login page (not generic error page)\n * so the user can retry.\n *\n * If frontendUrl is undefined (state token didn't carry frontendServiceName, or error\n * occurred before state could be read), falls back to a plain JSON error\n * since we can't redirect to an unknown frontend.\n */\n private redirectToFrontendWithError(\n res: Response,\n error: string,\n description: string,\n frontendUrl?: string,\n returnUrl?: string,\n ): void {\n if (!frontendUrl) {\n res.status(400).json({ error, error_description: description });\n return;\n }\n const searchParams = new URLSearchParams({\n error,\n reason: description,\n });\n if (returnUrl) {\n searchParams.set('redirect', returnUrl);\n }\n const redirectUrl = `${frontendUrl}/login?${searchParams.toString()}`;\n res.redirect(302, redirectUrl);\n }\n\n private validateFrontendReturnUrl(returnUrl: string, frontendUrl: string): void {\n if (returnUrl.startsWith('/') && !returnUrl.startsWith('//')) {\n return;\n }\n\n const allowedOrigins = new Set<string>();\n try {\n allowedOrigins.add(new URL(frontendUrl).origin);\n } catch {\n // frontendUrl comes from validated config, but keep the helper defensive.\n }\n\n for (const frontendServiceName of Object.keys(this.appConfigService.config.frontendServices ?? {})) {\n const publicUrl = AuthControllerUtils.lookupFrontendPublicUrl(\n this.appConfigService.config,\n frontendServiceName,\n );\n if (!publicUrl) {\n continue;\n }\n allowedOrigins.add(new URL(publicUrl).origin);\n }\n\n try {\n const parsed = new URL(returnUrl);\n if (allowedOrigins.has(parsed.origin)) {\n return;\n }\n } catch {\n // Invalid absolute URL — reject below.\n }\n\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: {\n message: 'Invalid returnUrl: must be a relative path or an allowed frontend origin',\n returnUrl,\n },\n });\n }\n\n /**\n * Resolve the public URL of the frontend app that initiated this request.\n *\n * Reads the X-Frontend-Service-Name header (a configured frontend service identity),\n * then looks up the\n * corresponding publicUrl from the configured runtime endpoints.\n *\n * Fail-fast: throws if the header is missing, the frontend service is unknown,\n * or no publicUrl is configured for that frontend service.\n */\n private resolveFrontendAppPublicUrl(req: Request): string {\n const frontendServiceName = req.headers[WildoHeaderKeys.FRONTEND_SERVICE_NAME] as string | undefined;\n\n if (!frontendServiceName) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.FRONTEND_SERVICE_HEADER_REQUIRED,\n context: {\n // diagnostic (log-only)\n header: WildoHeaderKeys.FRONTEND_SERVICE_NAME,\n },\n });\n }\n\n return this._lookupFrontendPublicUrl(frontendServiceName);\n }\n\n /**\n * Resolve the frontend service identity from a raw string (e.g., from state token metadata).\n * Returns the publicUrl for that frontend service. Throws if invalid or not configured.\n */\n private resolveFrontendAppPublicUrlFromFrontendServiceName(frontendServiceName: string): string {\n return this._lookupFrontendPublicUrl(frontendServiceName);\n }\n\n /**\n * Core lookup: delegates to AuthControllerUtils.lookupFrontendPublicUrl (returns null on failure),\n * then throws if null. Preserves the original fail-fast behavior in the controller.\n */\n private _lookupFrontendPublicUrl(frontendServiceName: string): string {\n const url = AuthControllerUtils.lookupFrontendPublicUrl(this.appConfigService.config, frontendServiceName);\n if (!url) {\n throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {\n context: {\n message: `Cannot resolve publicUrl for frontend service \"${frontendServiceName}\".`,\n frontendServiceName,\n },\n });\n }\n return url;\n }\n\n /**\n * AUTH-10: Cross-validate X-Frontend-Service-Name header against the browser Origin header.\n *\n * The Origin header is browser-enforced (forbidden header per Fetch spec) and cannot\n * be spoofed by client-side JavaScript. If the Origin doesn't match the configured\n * publicUrl for the claimed frontend service, the request is rejected.\n *\n * Non-browser clients (curl, Postman, mobile SDKs) do not send the Origin header,\n * so this validation is skipped for them. This is acceptable because:\n * - Rate limiting gates all registration/identify endpoints\n * - Registration policy enforcement (mode, password policy) applies regardless\n * - The DB override in the orchestrator protects known users independently\n * If non-browser registration restriction is needed, use invitation tokens or API keys.\n */\n private _validateFrontendAppOrigin(req: Request, claimedFrontendServiceName: string | undefined): void {\n if (!claimedFrontendServiceName) return;\n\n const configuredUrl = AuthControllerUtils.lookupFrontendPublicUrl(this.appConfigService.config, claimedFrontendServiceName);\n if (!configuredUrl) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,\n context: {\n message:\n `Unknown or unbound frontend service identity \"${claimedFrontendServiceName}\". ` +\n `Declare it in frontendServices and materialize runtime.endPoints.${claimedFrontendServiceName}.publicUrl before using it at runtime.`,\n frontendServiceName: claimedFrontendServiceName,\n },\n });\n }\n\n // Origin absent → non-browser client or same-origin; skip (see JSDoc for rationale)\n const origin = req.headers[WildoHeaderKeys.ORIGIN] as string | undefined;\n if (!origin) return;\n\n let configuredOrigin: string;\n try {\n configuredOrigin = new URL(configuredUrl).origin;\n } catch {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Malformed runtime.endPoints.${claimedFrontendServiceName}.publicUrl; ` +\n `cannot validate request Origin against the claimed frontend service identity.`,\n frontendServiceName: claimedFrontendServiceName,\n publicUrl: configuredUrl,\n },\n });\n }\n\n if (origin !== configuredOrigin) {\n this.logDebug('Origin mismatch — X-Frontend-Service-Name header does not match request Origin', {\n claimedFrontendServiceName,\n requestOrigin: origin,\n configuredOrigin,\n });\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,\n context: { message: 'Request origin does not match the claimed frontend service identity.' },\n });\n }\n }\n\n /**\n * Redeem-time binding for cross-frontend handoff codes.\n *\n * Handoff issuance stores the intended `targetServiceKey` in the\n * consumable-token metadata. A leaked code should not be redeemable from a\n * different configured frontend during its short lifetime. OAuth2 callback\n * codes do not carry `targetServiceKey`, so they intentionally bypass this\n * check and keep their existing `/auth/token/exchange` behavior.\n */\n private _validateTokenExchangeTargetBinding(\n req: Request,\n metadata: { targetServiceKey?: unknown },\n ): void {\n if (typeof metadata.targetServiceKey !== 'string') return;\n\n const claimedFrontendServiceName = req.headers[WildoHeaderKeys.FRONTEND_SERVICE_NAME] as string | undefined;\n if (!claimedFrontendServiceName) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.FRONTEND_SERVICE_HEADER_REQUIRED,\n context: {\n // diagnostic (log-only)\n targetServiceKey: metadata.targetServiceKey,\n },\n });\n }\n\n if (claimedFrontendServiceName !== metadata.targetServiceKey) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,\n context: {\n message: 'AUTH_CODE_EXCHANGE handoff redemption attempted from the wrong frontend service.',\n targetServiceKey: metadata.targetServiceKey,\n claimedFrontendServiceName,\n },\n });\n }\n\n this._validateFrontendAppOrigin(req, claimedFrontendServiceName);\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Magic Link Route Handlers (Phase G2)\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * POST /auth/magic-link/send\n * Body: { email: string }\n * Response: { message: string }\n *\n * Generates a magic link token and sends an email containing the link.\n * Always returns success to prevent email enumeration.\n */\n private async magicLinkSend(req: Request, res: Response): Promise<void> {\n // PR-7b-fixes F-22 fail-fast ordering generalized: body parse →\n // rate-limit → ec. Same victim-protective ranking as the\n // account-lifecycle family (named-account FIRST, source-noise\n // LAST) — see `register` for the full F-20 rationale.\n const body = MagicLinkSendRequestSchema.parse(req.body || {});\n\n // PR 8b (rate-limit unification, Step 5 — Option D, second\n // service-layer lift). The dual-window per-email burst cap\n // (formerly `${AUTH_REDIS_KEYS.MAGIC_LINK_MIN}${email}:min` AND\n // `:hour`, both raw `checkRateLimit` inside\n // `AuthenticationOrchestratorBackendService.sendMagicLink`)\n // moved UP to `AuthenticationController.magicLinkSend` as a\n // SINGLE multi-window declarative `checkPolicy` companion to\n // the existing per-IP cap (PR 7a). The two raw calls collapse\n // into ONE `checkPolicy` because the rate-limit service composes\n // both windows via `deriveWindows`, and F-9's compare-and-set\n // guard surfaces the TIGHTEST active window in `X-RateLimit-*`\n // headers. Caps are sourced from\n // `appConfigService.config.auth.magicLinkOperational` (same\n // configuration the orchestrator previously read via\n // `this.magicLinkConfig`) — no behavior change beyond the\n // header surfacing and the F-15 `:by-<dim>` namespace rename.\n //\n // Rationale for the lift: rate limits are intrinsically HTTP\n // concerns — bucket keys (email, IP) live at the HTTP layer,\n // 429 feedback is HTTP-only, and service contracts must remain\n // HTTP-type-free. Unlike `authenticatePassword` (PR 8e Option K)\n // and `sendSMSOTP` (PR 8d Option K), `sendMagicLink`'s bucket\n // key IS an HTTP-layer artefact (`request.email` from the body,\n // not session-stored or DB-resolved state) so the K-3 escape-\n // hatch does NOT apply here — the lift is the framework-canonical\n // outcome.\n //\n // Order — VICTIM-PROTECTIVE bucket FIRST per F-20 (named-account\n // before loud-source): per-email THEN per-IP. When both buckets\n // would trip on the same request, the per-email 429 short-\n // circuits and the per-IP increment never happens — surfaces the\n // most-relevant defensive intent (an attacker hammering one\n // victim email gets the per-email cap, not the per-IP cap).\n //\n // `body.email` is ALREADY lowercased by `MagicLinkSendRequestSchema`\n // (`.email().toLowerCase()`), so the explicit `.toLowerCase()`\n // here is a defense-in-depth no-op kept verbatim to preserve\n // the intent-revealing call-site invariant shared with every\n // other email-keyed bucket in the family (D-4 baseline; plus-\n // tail and Gmail-dot tricks NOT collapsed). F-15 `:by-email`\n // and `:by-ip` scope suffixes (the per-IP bucket's PR-7a-era\n // `auth:magic-link:send` scope is renamed to\n // `auth:magic-link:send:by-ip` for namespace consistency with\n // the new per-email companion — Redis key shape changes from\n // `auth:magic-link:send:<ip>:hour` to\n // `auth:magic-link:send:by-ip:<ip>:hour`; rolling-window reset\n // of in-flight per-IP buckets is acceptable, max 1-hour blip).\n const magicLinkConfig = this.appConfigService.config.auth.magicLinkOperational;\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: magicLinkConfig.rateLimitPerMinute, requestsPerHour: magicLinkConfig.rateLimitPerHour },\n 'auth:magic-link:send:by-email',\n undefined,\n body.email.toLowerCase(),\n );\n await this.rateLimitService.checkPolicy(req, res, { requestsPerHour: 10 }, 'auth:magic-link:send:by-ip');\n\n const ec = await this._getPreAuthExecutionContext();\n const ipAddress = getClientIpFromRequest(req);\n const userAgent = req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown';\n\n this.logDebug('Magic link send requested', { email: body.email });\n\n const result = await this.authService.sendMagicLink(ec, body, { ipAddress, userAgent });\n\n await this._sendMagicLinkEmail(req, result);\n\n this.jsonSuccess(res, this.authResponseHelper.getAuthResponse(AuthResponseMessageRef.MAGIC_LINK_SENT));\n }\n\n /**\n * Build the magic-link URL and dispatch the delivery email. Shared by `magicLinkSend` (the\n * standalone magic-link login) and `acceptInvitation` (magic-link-at-accept) so the URL shape,\n * template, and anti-enumeration error-swallowing live in ONE place. The frontend origin comes\n * from the request (`resolveFrontendAppPublicUrl`), which is why this lives at the HTTP layer and\n * the service only mints the token. A no-op when no token was minted (anti-enumeration).\n */\n private async _sendMagicLinkEmail(\n req: Request,\n delivery: {\n token?: string;\n submissionId?: string;\n email?: string;\n userId?: string;\n expiresInMinutes?: number;\n },\n ): Promise<void> {\n if (!delivery.token || !delivery.email) return;\n try {\n const frontendUrl = this.resolveFrontendAppPublicUrl(req);\n const magicLinkUrl = `${frontendUrl}/auth/magic-link/verify?token=${encodeURIComponent(delivery.token)}&email=${encodeURIComponent(delivery.email)}`;\n\n const appIdentity = this.appConfigService.config.appIdentity;\n const emailResult = await this.emailService.send({\n submissionId: delivery.submissionId,\n templateRef: SystemEmailTemplateRef.MAGIC_LINK,\n locale: getConfiguredPrimaryLanguage(this.appConfigService.config),\n type: EmailTemplateType.TRANSACTIONAL,\n to: delivery.email,\n context: {\n currentObject: { email: delivery.email },\n objectContext: {\n primaryScopeContext: {\n appName: appIdentity.appName,\n applicationId: this.appConfigService.applicationId,\n },\n },\n userContext: { userId: delivery.userId || 'unknown', email: delivery.email },\n additionalContext: { magicLinkUrl, tokenValue: delivery.token, expiresInMinutes: delivery.expiresInMinutes },\n },\n });\n if (\n !emailResult.success\n || emailResult.outcome !== EmailSubmissionOutcome.PROVIDER_ACCEPTED\n ) {\n this.logger.error('Magic link email provider did not confirm acceptance', {\n email: delivery.email,\n submissionId: emailResult.submissionId,\n outcome: emailResult.outcome,\n error: emailResult.error,\n });\n }\n } catch (error) {\n this.logger.error('Failed to send magic link email', {\n email: delivery.email,\n ...projectCaughtErrorLogFields(error),\n });\n // Don't reveal email delivery failure (anti-enumeration)\n }\n }\n\n /**\n * POST /auth/magic-link/verify\n * Body: { token: string, email: string }\n * Response: AuthenticationResponse\n *\n * Validates a magic link token and returns auth tokens on success.\n * Email is included for defense-in-depth constant-time comparison against token metadata.\n * This is a standalone auth endpoint (not dispatched through authenticate()).\n */\n private async magicLinkVerify(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const body = MagicLinkVerifyRequestSchema.parse(req.body || {});\n const ipAddress = getClientIpFromRequest(req);\n const userAgent = req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown';\n\n // IP-based rate limit for resource protection. PR 7a — same passwordless\n // wave as `magicLinkSend` above. 20/min/IP, IP-keyed (per-token keying\n // would defeat the very token-bruteforce defense this is meant to catch\n // — the bucket would reset every time the attacker tries a new token).\n await this.rateLimitService.checkPolicy(req, res, { requestsPerMinute: 20 }, 'auth:magic-link:verify');\n\n this.logDebug('Magic link verify requested');\n\n // W3.5 + W3.11: resolve the `activeUserType` hint from `X-Frontend-Service-Name`, exactly as `identify`\n // and `register` do (including the AUTH-10 Origin cross-validation). This call site previously omitted\n // the argument entirely, which left the session created by `verifyMagicLink` with NO `activeUserType`\n // and — before the service was made to resolve the type from the user itself — made every magic-link\n // login fail the AUTH-24 policy gate against `FALLBACK_AUTH_POLICY`.\n //\n // The service no longer DEPENDS on this hint for the policy decision (it prefers the resolved user's\n // `userTypes[0]`), so this is not the fix for that bug on its own. It matters because the hint is\n // stamped onto the created session, and the MFA-after-magic-link continuation reads it back — a session\n // with no `activeUserType` degrades that leg's policy resolution and skips the W3.1b user-type check.\n const magicLinkFrontendServiceName = req.headers[WildoHeaderKeys.FRONTEND_SERVICE_NAME] as string | undefined;\n this._validateFrontendAppOrigin(req, magicLinkFrontendServiceName);\n const magicLinkActiveUserType = magicLinkFrontendServiceName\n ? this.appConfigService.resolveUserTypeFromFrontendServiceName(magicLinkFrontendServiceName) ?? undefined\n : undefined;\n\n const authResponse = await this.authService.verifyMagicLink(ec, body, { ipAddress, userAgent }, magicLinkActiveUserType);\n\n await this.handleAnonymousTransposition(req, res, authResponse);\n // Auth-hardening A-Step 6 — destructure cookie-only `refreshToken`.\n const { refreshToken, ...wireBody } = authResponse;\n this._jsonSuccessWithRefreshCookie(res, wireBody, refreshToken);\n }\n\n // ═══════════════════════════════════════════════════════════════\n // SMS OTP Route Handlers (Phase G2)\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * POST /auth/sms-otp/send\n * Body: { sessionId: string, phoneNumber?: string }\n * Response: { message: string }\n *\n * Generates an OTP code and sends it via SMS.\n * Requires an active auth session. Can be used for first or second factor.\n */\n private async smsOTPSend(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const body = z.object({\n sessionId: z.string().min(1),\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/, { error: 'Invalid phone number' }).optional(),\n }).parse(req.body || {});\n\n this.logDebug('SMS OTP send requested', { sessionId: body.sessionId });\n\n // IP-based rate limit to prevent SMS pump fraud from a single source.\n // PR 7a — passwordless wave. 5/hour/IP, IP-keyed (sessionId-keying\n // would let an attacker rotate sessions to amplify; the IP cap is\n // the right defense against SMS pump fraud — actual cost-bearing\n // resource is the SMS spend per source IP). `checkPolicy` derives\n // the IP internally — the local `ipAddress` extraction is no\n // longer needed here (was previously the only consumer at this\n // seam; the SMS-send call itself doesn't take ipAddress).\n await this.rateLimitService.checkPolicy(req, res, { requestsPerHour: 5 }, 'auth:sms-otp:send');\n\n const result = await this.authService.sendSMSOTP(ec, body.sessionId, body.phoneNumber);\n\n const appIdentity = this.appConfigService.config.appIdentity;\n const smsResult = await this.smsService.send(\n result.targetPhone,\n this.authResponseHelper.getSmsLabel(BackendSmsMessageRef.OTP_VERIFICATION_CODE, { appName: appIdentity.appName, code: result.otpCode }),\n );\n if (!smsResult.success) {\n this.logger.error('SMS OTP delivery failed', {\n sessionId: body.sessionId,\n error: smsResult.error,\n });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { message: this.authResponseHelper.getSmsLabel(BackendSmsMessageRef.VERIFICATION_SEND_FAILED) },\n });\n }\n\n this.jsonSuccess(res, { message: this.authResponseHelper.getSmsLabel(BackendSmsMessageRef.VERIFICATION_SENT) });\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Phone Verification Route Handlers (Phase G2)\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * POST /auth/phone/verify/send\n * Body: { phoneNumber: string, sessionId?: string }\n * Response: { message: string }\n *\n * Sends a verification code to prove phone number ownership.\n * Used during account setup, not authentication.\n */\n private async phoneVerifySend(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const body = PhoneVerifySendRequestSchema.parse(req.body || {});\n // `ipAddress` MUST stay extracted locally — it's threaded down into\n // `phoneVerificationService.createVerificationCode` below for the\n // audit/anti-fraud trail. `checkPolicy` re-derives the same IP via\n // `getClientIpFromRequest` for the per-IP bucket — the two derivations\n // agree by construction (same helper, single source of truth — F-3).\n const ipAddress = getClientIpFromRequest(req);\n\n // PR 7-D-3 — phone-verify migration. Two policies AND-ed at the same\n // seam, with DIFFERENT identifiers (separate `checkPolicy` calls\n // because the bucket suffix can't be both phone and IP at once):\n //\n // 1) Per-phone-number 3/5min throttle. The 5-minute (300s) window\n // matches the OTP TTL that `createVerificationCode` issues — an\n // attacker can't spam SMS to a single victim faster than the OTP\n // they'd be racing against. This is the FIRST consumer of\n // `customWindows` (D-3, Option A — chosen because rounding 300s\n // to 60s would let an attacker burst 12x the intended rate, and\n // rounding to 3600s would silently relax victim protection by\n // 12x). Phone-keyed via `clientIdOverride` — must be per-phone\n // (not IP) so a botnet can't sidestep it. The phone is\n // NORMALIZED via `AuthControllerUtils.phoneRateLimitBucketKey`\n // so `+33...` and `33...` (and a future-permitted `0033...`)\n // share one bucket — without normalization an attacker could\n // double the cap by alternating prefix forms (F-14, PR 7-D-3\n // review fix).\n //\n // 2) Per-IP 5/hour cap. Defense against a single source pumping\n // SMS spend across many victim phone numbers (cost defense, not\n // victim defense — the per-phone limit handles that). IP-keyed\n // by default (no `clientIdOverride`).\n //\n // Scope-key naming follows the F-15 `:by-phone` / `:by-ip`\n // convention so the two scope namespaces never overlap as\n // prefixes (`auth:phone-verify:send` is no longer a prefix of\n // `auth:phone-verify:send:ip`).\n //\n // BOTH calls run BEFORE `extractFromSessionOrJwt` (F-18 fail-fast\n // pattern, mirroring PR 6's `handlePasswordChange` /\n // `handleReauth`). Abusive callers exceeding either bucket fail\n // before the JWT-verify round trip — important because this\n // endpoint is the cheapest amplification target in the\n // phone-verify family (the orchestrator-level OTP issuance is\n // SMS-cost-bearing).\n //\n // F-9 compare-and-set: the response advertises the tightest active\n // window across both checks, and on 429 `Retry-After` reports the\n // latest tripped window's recovery because declared windows are AND-ed.\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { customWindows: [{ requestsPerWindow: 3, windowSeconds: 300 }] },\n 'auth:phone-verify:send:by-phone',\n undefined,\n AuthControllerUtils.phoneRateLimitBucketKey(body.phoneNumber),\n );\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerHour: 5 },\n 'auth:phone-verify:send:by-ip',\n );\n\n await this.authJwtGuard.extractFromSessionOrJwt(ec, req);\n\n const { otpCode } = await this.phoneVerificationService.createVerificationCode(ec, {\n phoneNumber: body.phoneNumber,\n ipAddress,\n });\n\n const appIdentity = this.appConfigService.config.appIdentity;\n const smsResult = await this.smsService.send(\n body.phoneNumber,\n this.authResponseHelper.getSmsLabel(BackendSmsMessageRef.PHONE_VERIFICATION_CODE, { appName: appIdentity.appName, code: otpCode, expiry: '10' }),\n );\n if (!smsResult.success) {\n this.logger.error('Phone verification SMS delivery failed', { phoneNumber: body.phoneNumber, error: smsResult.error });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { message: this.authResponseHelper.getSmsLabel(BackendSmsMessageRef.VERIFICATION_SEND_FAILED) },\n });\n }\n\n this.jsonSuccess(res, { message: this.authResponseHelper.getSmsLabel(BackendSmsMessageRef.PHONE_VERIFICATION_SENT) });\n }\n\n /**\n * POST /auth/phone/verify/confirm\n * Body: { phoneNumber: string, code: string }\n * Response: { verified: boolean }\n *\n * Confirms phone ownership by validating the submitted code.\n * On success, marks the phone as verified on the user's credentials.\n */\n private async phoneVerifyConfirm(req: Request, res: Response): Promise<void> {\n const ec = await this._getPreAuthExecutionContext();\n const body = PhoneVerifyConfirmRequestSchema.parse(req.body || {});\n\n // PR 7-D-3 — phone-verify migration. 5/5min/phone — defense against\n // OTP brute-force on a known target phone number. Same 5-minute\n // (300s) window-of-protection as `phoneVerifySend` above and same\n // `customWindows` rationale: the window length is dictated by the\n // OTP TTL, not by an arbitrary minute/hour grid. Phone-keyed via\n // `clientIdOverride` (NORMALIZED via\n // `AuthControllerUtils.phoneRateLimitBucketKey` — see F-14) — IP-\n // keying would be wrong here (an attacker bruteforcing one\n // victim's OTP from a botnet would each get fresh 5-attempt\n // buckets). No per-IP companion limit at this seam: the global\n // HTTP limiter (1000/min/IP) catches IP-level pumping, and the\n // per-phone cap is the right defense-in-depth layer.\n //\n // Scope-key uses the `:by-phone` suffix (F-15 — same convention as\n // `phoneVerifySend` above; reserves space for a future `:by-ip` or\n // `:by-userId` companion without prefix collision).\n //\n // Rate-limit runs BEFORE `extractFromSessionOrJwt` (F-18 fail-fast\n // — same rationale as `phoneVerifySend` above). The endpoint\n // requires authentication on the success path, but having to\n // verify a JWT or session for every bruteforce attempt would let\n // an attacker amplify our verification cost; the bucket trip is\n // cheap and identifies the attack surface (`body.phoneNumber`)\n // independently of the caller's auth state.\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { customWindows: [{ requestsPerWindow: 5, windowSeconds: 300 }] },\n 'auth:phone-verify:confirm:by-phone',\n undefined,\n AuthControllerUtils.phoneRateLimitBucketKey(body.phoneNumber),\n );\n const { userId } = await this.authJwtGuard.extractFromSessionOrJwt(ec, req);\n\n const result = await this.phoneVerificationService.confirmVerification(ec, {\n phoneNumber: body.phoneNumber,\n code: body.code,\n userId,\n ipAddress: getClientIpFromRequest(req),\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n });\n\n // Defensive anonymous→authenticated transposition (feature-owner opt-in).\n // Unlike the login/registration seams, the caller here is ALREADY\n // authenticated (`extractFromSessionOrJwt`), so a website capture normally\n // transposed at their real login. This is a belt-and-braces catch-all for\n // the edge case where a still-attached `__wildo_anon_session` (header or\n // cookie) was never consumed. Gated on a SUCCESSFUL verification so a failed\n // OTP attempt never triggers it; the trigger is idempotent + non-blocking\n // (swallows errors, keeps the cookie on PENDING) and runs before the\n // response so any cookie-clear `Set-Cookie` precedes `res.json`.\n if (result.verified && userId) {\n await this.handleAnonymousTranspositionForTokenExchange(req, res, userId);\n }\n\n // Phone verify-confirm does NOT issue a refresh token (the service\n // returns `{ verified, messageRef?, message? }`); pass `undefined`\n // for the cookie arg so the wrapper is a clean no-op for the\n // cookie path. Wrapper still routes through `jsonSuccess` for the\n // body — uniform call shape across the controller.\n this._jsonSuccessWithRefreshCookie(res, result, undefined);\n }\n\n // ═══════════════════════════════════════════════════════════════\n // W7.3b: One-Off Session Token Handlers\n // ═══════════════════════════════════════════════════════════════\n\n private async createOneOffToken(req: Request, res: Response): Promise<void> {\n const preAuthEc = await this._getPreAuthExecutionContext();\n // PR 7a — passwordless / one-off wave. 30/min/IP, kept BEFORE\n // `extractAuthenticatedUser` (deliberate fail-fast — abusive callers\n // shouldn't consume a JWT-verification round trip per attempt).\n // IP-keyed by construction at this point. Per-userId quota could be\n // layered post-auth in a follow-up (super-admin rate is the natural\n // upper bound — 30/min is generous for any single super-admin).\n const ipAddress = getClientIpFromRequest(req);\n await this.rateLimitService.checkPolicy(req, res, { requestsPerMinute: 30 }, 'auth:one-off:create');\n\n const caller = await this.authJwtGuard.extractAuthenticatedUser(preAuthEc, req);\n const ec = await this._getAuthenticatedExecutionContext(caller.userId);\n const body = CreateOneOffTokenRequestSchema.parse(req.body || {});\n\n const callerUser = await this.userLookup.findUserById(ec, caller.userId);\n const callerRoles = callerUser?.appRoles || [];\n const isAdmin = callerRoles.includes(CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN);\n if (!isAdmin) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED,\n });\n }\n\n if (caller.userId === body.userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED,\n });\n }\n\n const targetUser = await this.userLookup.findUserById(ec, body.userId);\n if (!targetUser) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_FOUND,\n context: { userId: body.userId },\n });\n }\n if (targetUser.status !== UserStatus.ACTIVE) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_ACTIVE,\n context: { userId: body.userId },\n });\n }\n\n const userType = targetUser.userTypes?.[0];\n if (!userType) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_TYPE_MISMATCH,\n context: { userId: body.userId }, // diagnostic (log-only)\n });\n }\n\n const appConfig = this.appConfigService.config;\n const userTypeConfig = appConfig?.userTypes?.[userType];\n if (!userTypeConfig?.auth?.oneOffSessionAllowed) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.FEATURE_NOT_AVAILABLE,\n context: { userType }, // diagnostic (log-only)\n });\n }\n\n const expiresIn = body.expiresIn;\n const durationMs =\n expiresIn.unit === 'minutes' ? expiresIn.value * 60 * 1000\n : expiresIn.unit === 'hours' ? expiresIn.value * 3600 * 1000\n : expiresIn.value * 86400 * 1000;\n\n // revocation-B1: cap the requested lifetime at the per-user-type policy, which itself can only TIGHTEN\n // below the framework-wide one-off SESSION ceiling (ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES, ~12h per AWS\n // STS / GCP / OWASP). This is the request-path (super-admin) tightening; the absolute ceiling is enforced\n // for EVERY mint path at the `createToken` chokepoint, so a config-declared mint is bounded there too.\n // `userTypeConfig.auth` is narrowed non-null by the `oneOffSessionAllowed` guard above.\n const maxDurationMinutes = Math.min(\n userTypeConfig.auth.oneOffSessionMaxDurationMinutes ?? ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES,\n ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES,\n );\n if (durationMs > maxDurationMinutes * 60 * 1000) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.ONE_OFF_SESSION_DURATION_EXCEEDS_MAX,\n context: { requestedMinutes: Math.round(durationMs / 60000), maxMinutes: maxDurationMinutes }, // diagnostic (log-only)\n });\n }\n\n const organizationId = req.params.organizationId as string | undefined;\n const applicationId = req.params.applicationId as string | undefined;\n\n const tokenResult = await this.consumableTokenService.createToken({\n tokenType: body.tokenType as string,\n consumptionMode: body.consumptionMode,\n expiresIn: { value: durationMs, unit: DurationUnit.MILLISECONDS },\n organizationId,\n userId: body.userId,\n resourceIdentifier: body.resourceIdentifier,\n relatedId: body.relatedId,\n metadata: { ...body.metadata, ...(applicationId ? { applicationId } : {}) },\n roles: (targetUser.appRoles || []).map(role => ({\n roles: [role],\n relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n })),\n maxUses: body.maxUses,\n createsOneOffSession: true,\n consumeAt: body.consumeAt,\n targeting: body.targeting,\n });\n\n try {\n await this.auditLogsService.logGenericEvent({\n userId: caller.userId,\n organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.ONE_OFF_TOKEN_CREATED,\n eventData: {\n tokenId: tokenResult._id,\n tokenType: body.tokenType,\n targetUserId: body.userId,\n consumeAt: body.consumeAt,\n callerUserId: caller.userId,\n ipAddress,\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n },\n }, ec);\n } catch (error) {\n this.logger.warn('Audit log failed for one-off token creation', { error, tokenId: tokenResult._id });\n }\n\n this.jsonSuccess(res, {\n tokenValue: tokenResult.token,\n tokenId: tokenResult._id,\n expiresAt: tokenResult.expiresAt,\n });\n }\n\n private async exchangeOneOffToken(req: Request, res: Response): Promise<void> {\n // PR 7a — passwordless / one-off wave. The two raw `checkRateLimit`\n // calls (10/min/IP + 100/hour/IP) collapse into a single declarative\n // `checkPolicy` with multi-window AND-semantics. Net code reduction\n // (2 calls → 1) AND consolidation: F-9's compare-and-set guard now\n // automatically reports the TIGHTEST active window in the response\n // headers (the binding constraint), not whichever check fired last.\n const ipAddress = getClientIpFromRequest(req);\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10, requestsPerHour: 100 },\n 'auth:one-off:exchange',\n );\n\n const body = OneOffSessionExchangeBodySchema.parse(req.body || {});\n\n const consumableToken = await this.consumableTokenService.validateToken(body.token);\n\n if (!consumableToken.createsOneOffSession) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_TYPE_MISMATCH,\n });\n }\n\n if (!consumableToken.userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_CONTEXT_MISMATCH,\n });\n }\n\n const ec = await this._getPreAuthExecutionContext();\n\n const targetUser = await this.userLookup.findUserById(ec, consumableToken.userId);\n if (!targetUser || targetUser.status !== UserStatus.ACTIVE) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_ACTIVE,\n context: { userId: consumableToken.userId },\n });\n }\n\n const userType = targetUser.userTypes?.[0];\n if (!userType) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_TYPE_MISMATCH,\n context: { userId: consumableToken.userId },\n });\n }\n\n const appConfig = this.appConfigService.config;\n const userTypeConfig = appConfig?.userTypes?.[userType];\n if (!userTypeConfig?.auth?.oneOffSessionAllowed) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.FEATURE_NOT_AVAILABLE,\n context: { userType }, // diagnostic (log-only)\n });\n }\n\n let consumableTokenValue: string | undefined;\n if (consumableToken.consumeAt === 'EXCHANGE') {\n await this.consumableTokenService.consumeToken(body.token);\n } else {\n consumableTokenValue = body.token;\n }\n\n // The one-off SESSION's absolute lifetime is anchored at CONSUMPTION (this exchange), not at when the\n // token was produced. Pinning it to the token's `expiresAt` (production + authored duration) understated\n // a late exchange and conflated the LINK window with the SESSION lifetime; `computeOneOffSessionExpiresAt`\n // re-anchors the authored duration to `now` and clamps to the ceiling (OWASP absolute timeout is measured\n // from session creation; AWS STS / GCP measure a delegated credential's life from issuance).\n const sessionExpiresAt = computeOneOffSessionExpiresAt(consumableToken, new Date(), ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES);\n const tokens = await this.tokenIssuer.issueTokensForUser(\n consumableToken.userId,\n undefined,\n { sessionType: SessionType.ONE_OFF, activeUserType: userType },\n {\n skipSessionTracking: true,\n refreshTokenExpiresAt: sessionExpiresAt,\n },\n );\n\n try {\n await this.auditLogsService.logGenericEvent({\n userId: consumableToken.userId,\n organizationId: consumableToken.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.ONE_OFF_TOKEN_EXCHANGED,\n eventData: {\n tokenId: consumableToken._id,\n tokenType: consumableToken.tokenType,\n consumeAt: consumableToken.consumeAt,\n consumed: consumableToken.consumeAt === 'EXCHANGE',\n ipAddress,\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n },\n }, ec);\n } catch (error) {\n this.logger.warn('Audit log failed for one-off token exchange', { error, tokenId: consumableToken._id });\n }\n\n // Auth-hardening A-Step 6 (2026-04-13): the one-off-session\n // exchange response no longer carries `refreshToken` in the body\n // (`OneOffTokenExchangeResponseSchema` strips the field). The\n // refresh token is set as `Set-Cookie: __wildo_refresh=…` via the\n // wrapper's third argument so the receiving frontend (one-off\n // session entry pages) can rotate transparently if they share the\n // origin; non-cookie consumers (out-of-band one-off-session deep\n // links into a different origin) get NO refresh capability — by\n // design, since `Path=/api/v1/auth` + `SameSite=Strict` prevent\n // cross-origin cookie attachment on the rotation request.\n this._jsonSuccessWithRefreshCookie(\n res,\n {\n accessToken: tokens.accessToken,\n sessionType: SessionType.ONE_OFF,\n ...(consumableTokenValue ? {\n consumableTokenValue,\n tokenExpiresAt: consumableToken.expiresAt.toISOString(),\n } : {}),\n context: {\n tokenId: consumableToken._id,\n tokenType: consumableToken.tokenType,\n targeting: consumableToken.targeting,\n organizationId: consumableToken.organizationId,\n applicationId: (consumableToken.metadata as Record<string, unknown> | undefined)?.applicationId as string | undefined,\n userId: consumableToken.userId,\n },\n },\n tokens.refreshToken,\n );\n }\n\n /**\n * revocation-B1: cancel an un-exchanged one-off session token.\n *\n * A super-admin mints a one-off (impersonation) session token for another user via\n * `createOneOffToken`; until now there was no way to CANCEL one before it was exchanged — the\n * soft-revoke primitive `ConsumableTokenBackendService.revokeToken` existed with zero callers. This is\n * that door, and the tail of issue #15 (\"every logout/revocation revokes the app session\").\n *\n * Semantics:\n * - Super-admin only (mirrors the mint gate) — an operator action, never self-service.\n * - Reads the token by id and refuses anything that is NOT a one-off session token: this route must\n * never revoke a password-reset / invitation / magic-link token by id. A missing id and a non-one-off\n * id collapse to the SAME 404 (anti-enumeration; and we never touch a foreign token through this door).\n * - Idempotent: revoking an already-revoked token returns success WITHOUT re-stamping `revokedAt` (the\n * first revocation's timestamp is the truthful one) and WITHOUT emitting a duplicate audit.\n * - Revoking only prevents a token that has not yet been EXCHANGED from establishing a session. An\n * already-exchanged one-off session is reachable by the subject's `/auth/logout-all` (its JWT carries\n * the subject userId + iat), which is deliberately out of scope here (deferred per-session JTI kill).\n */\n private async revokeOneOffToken(req: Request, res: Response): Promise<void> {\n const preAuthEc = await this._getPreAuthExecutionContext();\n // Mirror the mint's IP-keyed fail-fast rate limit (kept BEFORE JWT verification).\n const ipAddress = getClientIpFromRequest(req);\n await this.rateLimitService.checkPolicy(req, res, { requestsPerMinute: 30 }, 'auth:one-off:revoke');\n\n const caller = await this.authJwtGuard.extractAuthenticatedUser(preAuthEc, req);\n const ec = await this._getAuthenticatedExecutionContext(caller.userId);\n\n const callerUser = await this.userLookup.findUserById(ec, caller.userId);\n const callerRoles = callerUser?.appRoles || [];\n if (!callerRoles.includes(CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED,\n });\n }\n\n const tokenId = req.params.tokenId as string;\n const token = await this.consumableTokenService.findTokenById(tokenId);\n\n // Missing id OR a non-one-off token id → the same 404. This door owns ONE-OFF tokens only; disclosing\n // that an id belongs to another token kind (or acting on it) would be both an enumeration oracle and a\n // cross-purpose write against a password-reset / invitation / magic-link token.\n if (!token || !token.createsOneOffSession) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_NOT_FOUND,\n context: { tokenId }, // diagnostic (log-only)\n });\n }\n\n // Idempotent: an already-revoked token succeeds without a second write or a duplicate audit row.\n if (token.revokedAt) {\n this.jsonSuccess(res, { tokenId, alreadyRevoked: true });\n return;\n }\n\n // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revoking a one-off session token terminates a\n // session-establishing credential minted for another user; the ONE_OFF_TOKEN_REVOKED audit below is the evidence.\n const didRevoke = await this.consumableTokenService.revokeToken(tokenId);\n\n // Emit the audit ONLY on the real transition. `revokeToken` is conditional on the row not already being\n // revoked, so under a concurrent double-revoke exactly one caller sees `didRevoke === true` and the trail\n // records one revocation, not two. The token ends revoked either way, so the response is unconditional success.\n if (didRevoke) {\n try {\n await this.auditLogsService.logGenericEvent({\n userId: caller.userId,\n organizationId: token.organizationId,\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n eventType: CoreAuditableEventType.ONE_OFF_TOKEN_REVOKED,\n eventData: {\n tokenId: token._id,\n tokenType: token.tokenType,\n targetUserId: token.userId,\n callerUserId: caller.userId,\n ipAddress,\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown',\n },\n }, ec);\n } catch (error) {\n this.logger.warn('Audit log failed for one-off token revocation', { error, tokenId: token._id });\n }\n }\n\n this.jsonSuccess(res, { tokenId, revoked: true });\n }\n\n // ═══════════════════════════════════════════════════════════════\n // W7.3a: Anonymous Session Transposition on Login/Register\n // ═══════════════════════════════════════════════════════════════\n\n /**\n * Resolve the anonymous userId to transpose, trying BOTH the\n * `x-anonymous-session` header (same-origin app flow) AND the parent-domain\n * `__wildo_anon_session` cookie (cross-origin website capture) through JWT\n * verification, returning the FIRST that validates.\n *\n * Why verify both rather than `header ?? cookie`: the app fans its\n * `localStorage` anonymous session onto auth requests, so the header is\n * frequently PRESENT but may hold a STALE/expired token. A naive\n * header-first `??` would let that dead header preempt a fresh website-capture\n * cookie, silently orphaning the captured lead / draft (then reaped by\n * `cleanupExpiredSessions`). Verifying each candidate and skipping the ones\n * that throw lets a valid cookie win when the header token is unusable. The\n * header is tried first so a live same-origin session keeps priority. A\n * duplicated header (`string[]`) is normalised to its first value.\n *\n * Returns `undefined` when neither candidate is present or verifiable.\n */\n private resolveTransposableAnonymousUserId(req: Request): string | undefined {\n const headerValue = req.headers[WildoHeaderKeys.ANONYMOUS_SESSION];\n const candidateTokens = [\n Array.isArray(headerValue) ? headerValue[0] : headerValue,\n AuthControllerUtils.extractAnonymousSessionFromCookie(req),\n ].filter((token): token is string => typeof token === 'string' && token.length > 0);\n\n for (const token of candidateTokens) {\n try {\n return this.anonymousSessionService.verifySessionToken(token).anonymousUserId;\n } catch {\n // Stale / invalid candidate — try the next (a dead header must not\n // preempt a valid cross-origin cookie).\n }\n }\n return undefined;\n }\n\n /**\n * Called after a successful authentication. If the request carries an\n * anonymous session (header or cross-origin cookie), transposes ownership of\n * anonymous resources to the newly authenticated user.\n *\n * Errors are swallowed to avoid blocking the auth response.\n */\n private async handleAnonymousTransposition(req: Request, res: Response, authResult: AuthenticationResponse): Promise<void> {\n if (!authResult.success || !authResult.user?._id) return;\n\n const anonymousUserId = this.resolveTransposableAnonymousUserId(req);\n if (!anonymousUserId) return;\n\n try {\n const userType = this.resolveUserTypeFromRequest(req)\n ?? authResult.user.userTypes?.[0]\n ?? 'default';\n\n const result = await this.anonymousSessionService.transposeOwnership(\n anonymousUserId,\n authResult.user._id,\n userType,\n );\n\n // Clear the cross-origin cookie only when the session was actually\n // processed (COMPLETE / PARTIAL). On PENDING — a userType with anonymous\n // sessions disabled, or an all-failed transpose — KEEP the cookie so a\n // later login (into an anon-enabled userType, or after a transient\n // failure clears) can still consume the website capture.\n if (result.status !== AnonymousUserTranspositionStatus.PENDING) {\n this.anonymousSessionService.clearSessionCookie(res);\n }\n\n this.logDebug('Anonymous session transposition completed', {\n anonymousUserId,\n userId: authResult.user._id,\n userType,\n status: result.status,\n transposedTypes: result.transposedTypes,\n // Reported beside `transposedTypes`, never merged into it: a DISCARD type's rows were\n // DELETED, not carried over. A support answer built from the transposed list alone would\n // say \"nothing happened\" about data the conversion destroyed on purpose.\n discardedTypes: result.discardedTypes,\n failedCount: result.failedTypes.length,\n });\n } catch (error) {\n this.logger.warn('Anonymous session transposition failed (non-blocking)', {\n userId: authResult.user._id,\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n /**\n * Simplified transposition for OAuth2 token exchange, where we have a userId\n * but no AuthenticationResponse. Uses header-resolved userType.\n */\n private async handleAnonymousTranspositionForTokenExchange(req: Request, res: Response, userId: string): Promise<void> {\n const anonymousUserId = this.resolveTransposableAnonymousUserId(req);\n if (!anonymousUserId) return;\n\n try {\n const userType = this.resolveUserTypeFromRequest(req) ?? 'default';\n\n const result = await this.anonymousSessionService.transposeOwnership(anonymousUserId, userId, userType);\n\n // Clear the cross-origin cookie only when actually processed (COMPLETE /\n // PARTIAL) — see the sibling trigger for the PENDING-keeps-cookie rationale.\n if (result.status !== AnonymousUserTranspositionStatus.PENDING) {\n this.anonymousSessionService.clearSessionCookie(res);\n }\n\n this.logDebug('Anonymous session transposition completed (token exchange)', {\n anonymousUserId, userId, userType, status: result.status,\n transposedTypes: result.transposedTypes, discardedTypes: result.discardedTypes,\n failedCount: result.failedTypes.length,\n });\n } catch (error) {\n this.logger.warn('Anonymous session transposition failed in token exchange (non-blocking)', {\n userId, ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n private resolveUserTypeFromRequest(req: Request): string | undefined {\n const frontendServiceName = req.headers[WildoHeaderKeys.FRONTEND_SERVICE_NAME] as string | undefined;\n if (!frontendServiceName) return undefined;\n return this.appConfigService.resolveUserTypeFromFrontendServiceName(frontendServiceName) ?? undefined;\n }\n}\n"]}