npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.1 → 1.1.3 - Mend

@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (972) hide show

package/dist/esm/security/authentications/services/anonymous-session.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"anonymous-session.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/anonymous-session.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;;;;;;;;;;;;;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAMhJ,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,gCAAgC,EAChC,oCAAoC,EACpC,gCAAgC,EAChC,qBAAqB,EACrB,gBAAgB,EAChB,cAAc,EACd,2BAA2B,EAC3B,SAAS,EACT,oBAAoB,EACpB,2BAA2B,EAC3B,eAAe,GAGhB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAClG,OAAO,EAAE,mBAAmB,EAAE,MAAM,kFAAkF,CAAC;AAUhH,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;IAKa;IACa;IACH;IACc;IACP;IACc;IACd;IASJ;IAlBlD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EAC3C,aAAsC,EACxB,uBAA8D,EACrE,iBAAkD,EACpC,uBAA8D,EAC5E,gBAAyC,EAS7C,mBAA+C;QAf5D,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC3C,kBAAa,GAAb,aAAa,CAAyB;QACxB,4BAAuB,GAAvB,uBAAuB,CAAuC;QACrE,sBAAiB,GAAjB,iBAAiB,CAAiC;QACpC,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC5E,qBAAgB,GAAhB,gBAAgB,CAAyB;QAS7C,wBAAmB,GAAnB,mBAAmB,CAA4B;QAEhH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,gCAAgC,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CAAC,mBAAmB,CAAC,eAAuB,EAAE,GAAY,EAAE,GAAa;QAC5E,qEAAqE;QACrE,sEAAsE;QACtE,uEAAuE;QACvE,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAE7C,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,EAC/C,wBAAwB,CACzB,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAErC,IAAI,CAAC;YACH,iEAAiE;YACjE,gEAAgE;YAChE,gEAAgE;YAChE,gEAAgE;YAChE,MAAM,iBAAiB,GAAG,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,CAAC;YAEvE,6EAA6E;YAC7E,0EAA0E;YAC1E,gFAAgF;YAChF,iFAAiF;YACjF,8DAA8D;YAC9D,EAAE;YACF,8EAA8E;YAC9E,2EAA2E;YAC3E,uEAAuE;YACvE,2EAA2E;YAC3E,6EAA6E;YAC7E,oFAAoF;YACpF,kFAAkF;YAClF,6CAA6C;YAC7C,EAAE;YACF,6EAA6E;YAC7E,6EAA6E;YAC7E,mEAAmE;YACnE,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,eAAe,EAAE;gBAC9E,OAAO,EAAE,eAAe;gBACxB,OAAO,EAAE,EAAE,gBAAgB,EAAE,IAAI,IAAI,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE;gBAC9D,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;gBACrE,MAAM;gBACN,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE;gBACrC,eAAe;gBACf,oBAAoB,EAAE,iBAAiB,KAAK,SAAS;aACtD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,EAAE,IAAI,KAAK,KAAK,IAAI,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,eAAe,CAAC,IAAI,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7G,IAAI,CAAC,QAAQ,CAAC,qEAAqE,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;gBAC1G,OAAO;YACT,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;YAChF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,gBAAgB,CAAC,eAAuB;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAClE,OAAO,GAAG,CAAC,IAAI,CACb,EAAE,eAAe,EAAE,EACnB,MAAM,EACN,EAAE,SAAS,EAAE,4BAA4B,CAAC,SAAS,EAAE,SAAS,EAAE,mCAAmC,EAAE,CACtG,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAa;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE;gBACxC,UAAU,EAAE,CAAC,4BAA4B,CAAC,SAAS,CAAC;gBACpD,cAAc,EAAE,EAAE;aACnB,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,gCAAgC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAEhE,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,GAAG,CAAC,iBAAiB,EAAE,CAAC;gBAC3C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B,EAAE,CACvF,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B,EAAE,CACvF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,KAAK,CAAC,+BAA+B,CAAC,eAAuB;QAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,eAAe,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACvI,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YACvE,SAAS,EAAE,UAAU;YACrB,+BAA+B,EAAE,IAAI,GAAG,EAAE;YAC1C,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;SAC3H,CAAC,CAAC;QAEH,mGAAmG;QACnG,2GAA2G;QAC3G,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACxD,gBAAgB,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAC1F,CAAC;QACF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QACtE,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAEtB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,iFAAiF,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;YACtH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;aACnF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC;YAC1B,IAAI,CAAC,QAAQ,CAAC,iFAAiF,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;YACtH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;aACnF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gBAAgB,CAAC,GAAa,EAAE,KAAa;QAC3C,mBAAmB,CAAC,yBAAyB,CAC3C,GAAG,EACH,KAAK,EACL,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAC3D,IAAI,CAAC,aAAa,CAAC,cAAc,EACjC,4BAA4B,CAAC,aAAa,CAC3C,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,GAAa;QAC9B,mBAAmB,CAAC,2BAA2B,CAC7C,GAAG,EACH,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAC3D,IAAI,CAAC,aAAa,CAAC,cAAc,CAClC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CACtB,eAAuB,EACvB,mBAA2B,EAC3B,QAAgB;QAEhB,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC1E,IAAI,CAAC,cAAc,EAAE,wBAAwB,EAAE,CAAC;YAC9C,IAAI,CAAC,QAAQ,CAAC,0EAA0E,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;YACzH,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,gCAAgC,CAAC,OAAO,EAAE,CAAC;QACpG,CAAC;QAED,MAAM,eAAe,GAAmB,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAoD,EAAE,CAAC;QAExE,MAAM,iBAAiB,GAAG,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAE9D,KAAK,MAAM,YAAY,IAAI,iBAAiB,EAAE,CAAC;YAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;YACrF,MAAM,MAAM,GAAG,cAAc,EAAE,mBAAmB,IAAI,2BAA2B,CAAC,GAAG,CAAC;YAEtF,IAAI,MAAM,KAAK,2BAA2B,CAAC,OAAO,EAAE,CAAC;gBACnD,IAAI,CAAC,QAAQ,CAAC,yCAAyC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;gBAC3E,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;gBAE/E,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAE/C,IAAI,MAAM,KAAK,2BAA2B,CAAC,OAAO,EAAE,CAAC;oBACnD,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;gBAC1E,CAAC;gBAED,IAAI,MAAM,KAAK,2BAA2B,CAAC,KAAK,EAAE,CAAC;oBACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yEAAyE,EACzE,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,CACvD,CAAC;gBACJ,CAAC;gBAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC3C,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;gBAErE,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACnC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE;oBACpC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,mBAAmB;iBAC9E,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBAC5C,WAAW,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACpD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE;oBAC1D,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ;iBAC5E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,EAAE;QACF,uEAAuE;QACvE,oEAAoE;QACpE,8DAA8D;QAC9D,EAAE;QACF,gEAAgE;QAChE,kEAAkE;QAClE,kEAAkE;QAClE,8DAA8D;QAC9D,yDAAyD;QACzD,EAAE;QACF,+DAA+D;QAC/D,gEAAgE;QAChE,kEAAkE;QAClE,+BAA+B;QAC/B,IAAI,CAAC;YACH,MAAM,8BAA8B,GAAG,MAAM,IAAI,CAAC,iCAAiC,CACjF,eAAe,EACf,mBAAmB,CACpB,CAAC;YACF,IAAI,8BAA8B,GAAG,CAAC,EAAE,CAAC;gBACvC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;gBACxD,IAAI,CAAC,QAAQ,CAAC,6BAA6B,EAAE;oBAC3C,eAAe,EAAE,mBAAmB,EAAE,KAAK,EAAE,8BAA8B;iBAC5E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC5C,WAAW,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,gBAAgB,CAAC,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YACvF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE;gBACxD,eAAe,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ;aACtD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,KAAK,CAAC;YACrC,CAAC,CAAC,gCAAgC,CAAC,QAAQ;YAC3C,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;gBAC1B,CAAC,CAAC,gCAAgC,CAAC,OAAO;gBAC1C,CAAC,CAAC,gCAAgC,CAAC,OAAO,CAAC;QAE/C,IAAI,CAAC;YACH,yEAAyE;YACzE,2EAA2E;YAC3E,6EAA6E;YAC7E,yEAAyE;YACzE,4EAA4E;YAC5E,yEAAyE;YACzE,uEAAuE;YACvE,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,eAAe,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;YAC3I,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;gBACpF,SAAS,EAAE,YAAY;gBACvB,+BAA+B,EAAE,IAAI,GAAG,EAAE;gBAC1C,YAAY,EAAE,IAAI;gBAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;aAC3H,CAAC,CAAC;YAEH,+EAA+E;YAC/E,4EAA4E;YAC5E,oFAAoF;YACpF,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CACvC,gBAAgB,CAAC,eAAe,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,EAC/E,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,EAAE,CACxE,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAClD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACK,KAAK,CAAC,iCAAiC,CAC7C,eAAuB,EACvB,mBAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC7C,gBAAgB,CAAC,gBAAgB,EACjC,eAAe,CAChB,CAAC;QAEF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAE/C,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,mEAAmE;YACnE,8DAA8D;YAC9D,2EAA2E;YAC3E,wCAAwC;YACxC,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC3C,gBAAgB,CAAC,gBAAgB,EACjC,MAAM,CAAC,GAAa,EACpB,EAAE,MAAM,EAAE,mBAAmB,EAAE,eAAe,EAAE,IAAI,EAAE,CACvD,CAAC;YACF,eAAe,EAAE,CAAC;QACpB,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,KAAK,CAAC,oBAAoB,CAAC,YAA0B,EAAE,eAAuB;QACpF,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACnH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAC3E,SAAS,EAAE,UAAU;YACrB,+BAA+B,EAAE,IAAI,GAAG,EAAE;YAC1C,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;SAC3H,CAAC,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC5C,YAAY,EACZ,MAAM,EACN,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,EACjC,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAC3C,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,YAA0B,EAAE,GAAa,EAAE,mBAA2B;QACpG,0EAA0E;QAC1E,6EAA6E;QAC7E,6EAA6E;QAC7E,gFAAgF;QAChF,wEAAwE;QACxE,uEAAuE;QACvE,8DAA8D;QAC9D,yEAAyE;QACzE,6EAA6E;QAC7E,8CAA8C;QAC9C,MAAM,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/H,CAAC;IAEO,KAAK,CAAC,yBAAyB,CAAC,YAA0B,EAAE,MAAc;QAChF,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACnH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAC3E,SAAS,EAAE,UAAU;YACrB,+BAA+B,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YAC9D,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;SAC3H,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAM,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAU,CAAC;QACzI,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;YAC5H,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;gBAC7E,SAAS,EAAE,YAAY;gBACvB,+BAA+B,EAAE,IAAI,GAAG,EAAE;gBAC1C,YAAY,EAAE,IAAI;gBAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;aAC3H,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC3E,IAAI,CAAC,QAAQ,CAAC,gDAAgD,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,sBAAsB,CAAC,OAK5B;QACC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACjD,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAChD,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,oBAAoB,CAAC;QACnE,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,GAAG,CAAC;QAC5C,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,GAAG,CAAC;QACpD,MAAM,oBAAoB,GAAG,OAAO,EAAE,oBAAoB,IAAI,cAAc,CAAC;QAC7E,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC;QAEnD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,wBAAwB,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,mDAAmD,CAAC,CAAC;YACnE,OAAO,EAAE,iBAAiB,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,qBAAqB,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAC9G,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAC9D,IAAI,sBAAsB,GAAG,CAAC,CAAC;QAC/B,IAAI,gBAAgB,GAAG,CAAC,CAAC;QACzB,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,SAAS,GAAG,CAAC,CAAC;QAElB,mEAAmE;QACnE,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,OAAO,OAAO,IAAI,SAAS,GAAG,aAAa,EAAE,CAAC;YAC5C,SAAS,EAAE,CAAC;YAEZ,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,eAAe,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;YACvI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;gBAC3E,SAAS,EAAE,UAAU;gBACrB,+BAA+B,EAAE,IAAI,GAAG,EAAE;gBAC1C,YAAY,EAAE,IAAI;gBAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;aAC3H,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACxD,gBAAgB,CAAC,eAAe,EAChC,MAAM,EACN,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EACvD,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAC9B,CAAC;YACF,MAAM,YAAY,GAAU,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YACrF,sBAAsB,IAAI,YAAY,CAAC,MAAM,CAAC;YAE9C,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAAC,OAAO,GAAG,KAAK,CAAC;gBAAC,MAAM;YAAC,CAAC;YAE1D,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;gBACpC,0EAA0E;gBAC1E,gFAAgF;gBAChF,iFAAiF;gBACjF,gDAAgD;gBAChD,MAAM,eAAe,GAAG,QAAQ,CAAC,GAAa,CAAC;gBAC/C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAiB,CAAC;gBAEpD,IAAI,CAAC;oBACH,KAAK,MAAM,YAAY,IAAI,iBAAiB,EAAE,CAAC;wBAC7C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;wBAChF,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;4BAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;4BAC5H,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;gCAC7E,SAAS,EAAE,YAAY;gCACvB,+BAA+B,EAAE,IAAI,GAAG,EAAE;gCAC1C,YAAY,EAAE,IAAI;gCAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;6BAC3H,CAAC,CAAC;4BACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;4BAC3E,gBAAgB,IAAI,GAAG,CAAC,MAAM,CAAC;wBACjC,CAAC;oBACH,CAAC;oBAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,eAAe,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;oBAC/I,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;wBACjF,SAAS,EAAE,gBAAgB;wBAC3B,+BAA+B,EAAE,IAAI,GAAG,EAAE;wBAC1C,YAAY,EAAE,IAAI;wBAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;qBAC3H,CAAC,CAAC;oBACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,eAAe,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;oBAC3G,aAAa,EAAE,CAAC;gBAClB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,EAAE,CAAC;oBACT,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE;wBAC/D,eAAe;wBACf,GAAG,2BAA2B,CAAC,KAAK,CAAC;qBACtC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,OAAO,GAAG,YAAY,CAAC,MAAM,IAAI,SAAS,CAAC;QAC7C,CAAC;QAED,wFAAwF;QACxF,IAAI,qBAAqB,GAAG,CAAC,CAAC;QAC9B,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,mBAAmB,GAAG,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,eAAe,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAChJ,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;gBACpF,SAAS,EAAE,mBAAmB;gBAC9B,+BAA+B,EAAE,IAAI,GAAG,EAAE;gBAC1C,YAAY,EAAE,IAAI;gBAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;aAC3H,CAAC,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC7D,gBAAgB,CAAC,eAAe,EAChC,eAAe,EACf,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE,EACzE,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAC9B,CAAC;YACF,MAAM,cAAc,GAAU,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC;YAEtG,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;gBAC3C,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,eAAe,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;oBAC3I,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;wBAC7E,SAAS,EAAE,YAAY;wBACvB,+BAA+B,EAAE,IAAI,GAAG,EAAE;wBAC1C,YAAY,EAAE,IAAI;wBAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;qBAC3H,CAAC,CAAC;oBACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,eAAe,EAAE,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC;oBACzG,qBAAqB,EAAE,CAAC;gBAC1B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,EAAE,CAAC;gBACX,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE;gBAC/D,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE;YACjC,iBAAiB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,aAAa;YAC1E,qBAAqB,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS;YACpD,iBAAiB,EAAE,iBAAiB,CAAC,MAAM;SAC5C,CAAC,CAAC;QAEH,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC;IACvH,CAAC;IAEO,4BAA4B;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAmB,EAAE,CAAC;QAClC,KAAK,MAAM,YAAY,IAAI,QAAQ,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;YAC7E,IAAI,MAAM,EAAE,cAAc,KAAK,IAAI,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,EAAU;QACvB,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,kCAAkC,CAAC,GAAY;QACrD,MAAM,YAAY,GAAG,CAAC,GAAW,EAAsB,EAAE;YACvD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC;YAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ;gBAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;YACtF,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,MAAM,WAAW,GAAG,CAAC,GAAW,EAAsB,EAAE;YACtD,MAAM,GAAG,GAAI,GAAG,CAAC,KAA6C,EAAE,CAAC,GAAG,CAAC,CAAC;YACtE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC;YAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ;gBAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;YACtF,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QAEF,MAAM,YAAY,GAAG;YACnB,MAAM,EAAK,WAAW,CAAC,YAAY,CAAC;YACpC,MAAM,EAAK,WAAW,CAAC,YAAY,CAAC;YACpC,QAAQ,EAAG,WAAW,CAAC,cAAc,CAAC;YACtC,IAAI,EAAO,WAAW,CAAC,UAAU,CAAC;YAClC,OAAO,EAAI,WAAW,CAAC,aAAa,CAAC;SACtC,CAAC;QACF,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QAEhF,MAAM,SAAS,GAA4B,EAAE,CAAC;QAC9C,IAAI,cAAc;YAAE,SAAS,CAAC,GAAG,GAAG,YAAY,CAAC;QACjD,MAAM,QAAQ,GAAS,YAAY,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAM,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QAClE,MAAM,cAAc,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;QACvD,IAAI,QAAQ,KAAW,SAAS;YAAE,SAAS,CAAC,QAAQ,GAAS,QAAQ,CAAC;QACtE,IAAI,WAAW,KAAQ,SAAS;YAAE,SAAS,CAAC,WAAW,GAAM,WAAW,CAAC;QACzE,IAAI,cAAc,KAAK,SAAS;YAAE,SAAS,CAAC,cAAc,GAAG,cAAc,CAAC;QAE5E,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAE1D,MAAM,MAAM,GAAG,oCAAoC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE;gBACtE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;aACnF,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;CACF,CAAA;AA5vBY,8BAA8B;IAD1C,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAClD,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAChE,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IASlD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;yDAb8B,uBAAuB;GAP3F,8BAA8B,CA4vB1C","sourcesContent":["/*\n AnonymousSessionBackendService (W7.3a)\n \n Manages anonymous session lifecycle: user creation (upsert),\n * JWT signing/verification, and ownership transposition on registration.\n /\n\nimport crypto from 'crypto';\nimport { inject, injectable } from 'inversify';\nimport jwt from 'jsonwebtoken';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport {\n ANONYMOUS_SESSION_JWT_EXPIRY_STRING,\n ANONYMOUS_SESSION_JWT_FORMAT,\n AnonymousSessionJwtPayloadSchema,\n AnonymousUserMarketingMetadataSchema,\n AnonymousUserTranspositionStatus,\n CoreResourceOperation,\n CoreResourceType,\n CORE_APP_ROLES,\n ErrorCustomMessageReference,\n ErrorType,\n ResourcePrimaryScope,\n ResourceTranspositionPolicy,\n WildoHeaderKeys,\n type AnonymousUserMarketingMetadata,\n type ResourceType,\n} from '@wildo-ai/saas-models';\nimport type { RateLimitBackendService } from '~wildo-backend-lib/errors/services/rate-limit.backend.service';\nimport { getClientIpFromRequest } from '~wildo-backend-lib/runtime/utils/request-client-ip.utils';\nimport { AuthControllerUtils } from '~wildo-backend-lib/security/authentications/services/utils/auth-controller.utils';\nimport type { Request, Response } from 'express';\n\nexport interface TranspositionResult {\n transposedTypes: ResourceType[];\n failedTypes: { resourceType: ResourceType; error: string }[];\n status: AnonymousUserTranspositionStatus;\n}\n\n@injectable()\nexport class AnonymousSessionBackendService {\n\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly configService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.ResourceRegistryService) private readonly resourcesRegistry: ResourcesRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService) private readonly executionContextCreator: ExecutionContextCreatorBackendService,\n @inject(SAAS_SERVICE_TYPES.RateLimitBackendService) private readonly rateLimitService: RateLimitBackendService,\n // Appended LAST (positional-DI stability). The in-process session-init +\n // ownership-transposition writes carry `.isBackendOnly()` material\n // (`marketingMetadata`) and context-auto-populated FK names\n // (`userId` / `anonymousUserId`) that a plain `servicesRegistryHandler` write\n // strict-parses OUT — silent attribution loss on create, silent no-op `$set`\n // on the transposition. The trusted `createAsSystem` / `updateAsSystem` /\n // `updateManyAsSystem` primitives re-attach exactly those fields after the\n // strict parse, fail-closed behind each resource's `systemAccessPolicy`.\n @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n ) {\n this.logDebug = this.logger.debugByType('AnonymousSessionBackendService');\n }\n\n /\n Upsert an AnonymousUser record. Catches duplicate key errors to handle\n * concurrent session init from multiple tabs sending the same UUID.\n \n Rate-limit policy (PR 4 of the rate-limit unification, Step 5 — first\n * imperative-to-declarative migration wave):\n * - 10 requests/minute/IP and 100 requests/hour/IP, AND-ed.\n * - Enforced via `RateLimitBackendService.checkPolicy` (System 3) instead\n * of the previous twin `checkRateLimit` calls (System 2). The policy\n * semantics are identical; only the surface and Redis key shape change\n * (`auth:anon-session:init:<ip>:minute\|hour` instead of two custom\n * prefixes). Standard `X-RateLimit-` and `Retry-After` headers are\n now written on the 429 path — previously absent at this seam.\n * - Identifier is the client IP (no organization context at session\n * init by definition; C-2).\n \n Concurrent-tabs accounting note (F-11): the rate-limit check runs\n * BEFORE the duplicate-key fast path below, so N tabs racing the same\n * UUID will each consume a slot from the per-minute / per-hour budget\n * even though only one performs the actual MongoDB insert. This is\n * intentional — moving the check past the duplicate-key catch would\n * make the limiter trivially defeatable by spamming the same UUID. The\n * 10/min budget absorbs realistic browser tab counts comfortably.\n /\n async createAnonymousUser(anonymousUserId: string, req: Request, res: Response): Promise<void> {\n // Canonical IP extraction (F-5 of the rate-limit unification audit).\n // Still needed locally for `hashIp` (privacy-preserving audit trail);\n // `checkPolicy` re-derives the same IP internally via the same helper,\n // so the rate-limit bucket and the stored hash always agree.\n const clientIp = getClientIpFromRequest(req);\n\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10, requestsPerHour: 100 },\n 'auth:anon-session:init',\n );\n\n const ipHash = this.hashIp(clientIp);\n\n try {\n // Phase 0.5 (Q-D=β): first-touch marketing attribution. Captured\n // ONCE here at session-init and never overwritten by subsequent\n // requests — this is the anchor write site. Subsequent requests\n // hit the same anonymous user via JWT and carry no attribution.\n const marketingMetadata = this.extractFirstTouchMarketingMetadata(req);\n\n // The client-generated session UUID is persisted as `uuidRef` (the anonymous\n // user's relational identity), NOT `_id`: `_id` is a normal server-minted\n // ObjectId. So this is an ordinary create — `_id` is server-generated and never\n // in the payload, which is exactly why it no longer crashes the strict-DTO parse\n // (a client `_id` used to be a required-but-discarded field).\n //\n // `createAsSystem` (not a plain `servicesRegistryHandler.create`) is required\n // because `marketingMetadata` is `.isBackendOnly()` and would otherwise be\n // strict-parsed OUT against the client-shaped request DTO (first-touch\n // attribution silently lost); the primitive re-attaches the schema-derived\n // backend-only allowlist after the parse and synthesises its own super-admin\n // context — ANONYMOUS_USERS CREATE is INTERNAL_CALL (no HTTP surface) — fail-closed\n // behind `systemAccessPolicy.create`. `uuidRef` is an ordinary (non-backend-only)\n // field and rides the normal create payload.\n //\n // Concurrent tabs / cross-origin re-init send the SAME `uuidRef`; the unique\n // index on `uuidRef` makes the second insert an E11000 duplicate-key, caught\n // below and treated as success (the AnonymousUser already exists).\n await this.systemAccessService.createAsSystem(CoreResourceType.ANONYMOUS_USERS, {\n uuidRef: anonymousUserId,\n privacy: { consentTimestamp: new Date(), ipRetentionDays: 30 },\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT]?.substring(0, 256),\n ipHash,\n ...(marketingMetadata ? { marketingMetadata } : {}),\n });\n this.logDebug('AnonymousUser created', {\n anonymousUserId,\n hasMarketingMetadata: marketingMetadata !== undefined,\n });\n } catch (error: any) {\n if (error?.code === 11000 \|\| error?.message?.includes('duplicate key') \|\| error?.message?.includes('E11000')) {\n this.logDebug('AnonymousUser already exists (concurrent init), treating as success', { anonymousUserId });\n return;\n }\n this.logger.error('Failed to create AnonymousUser', { anonymousUserId, error });\n throw error;\n }\n }\n\n /\n Sign a session JWT using the platform session HMAC secret.\n \n Algorithm + expiry are pinned by the shared contract in\n * `@wildo-ai/saas-models` so any future client (e.g. the\n * marketing-site `WebsiteAnonymousSessionContext`) that wants to\n * peek at the JWT for diagnostic UI agrees on the bit-level shape.\n /\n signSessionToken(anonymousUserId: string): string {\n const secret = this.configService.secrets.security.session.secret;\n return jwt.sign(\n { anonymousUserId },\n secret,\n { algorithm: ANONYMOUS_SESSION_JWT_FORMAT.algorithm, expiresIn: ANONYMOUS_SESSION_JWT_EXPIRY_STRING }\n );\n }\n\n /\n Verify a session JWT. Returns the anonymousUserId or throws.\n \n The decoded payload is validated against the shared\n * `AnonymousSessionJwtPayloadSchema` (Zod) — a defensive check that\n * guards against any future drift between signer and verifier and\n * gives a structured error if a malformed payload ever reaches us.\n /\n verifySessionToken(token: string): { anonymousUserId: string } {\n const secret = this.configService.secrets.security.session.secret;\n try {\n const decoded = jwt.verify(token, secret, {\n algorithms: [ANONYMOUS_SESSION_JWT_FORMAT.algorithm],\n clockTolerance: 30,\n });\n\n const payload = AnonymousSessionJwtPayloadSchema.parse(decoded);\n\n return { anonymousUserId: payload.anonymousUserId };\n } catch (error) {\n if (error instanceof jwt.TokenExpiredError) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_EXPIRED }\n );\n }\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID }\n );\n }\n }\n\n /\n Assert the anonymous subject behind an already-cryptographically-verified session token is STILL a\n * live, un-converted anonymous identity — the server-side revocation handle the stateless anon JWT\n * otherwise lacks entirely.\n \n {@link verifySessionToken} proves only that WE signed the token and it has not expired; it says\n * NOTHING about the subject. This re-reads the `ANONYMOUS_USERS` row by its unique `uuidRef` and\n * rejects — as `AUTHENTICATION_SESSION_INVALID`, deliberately indistinguishable from a bad token so a\n * caller cannot probe whether a given `uuidRef` was converted vs. never existed — when either:\n * - the row is ABSENT: the identity was hard-deleted, swept by the cleanup batch, or erased, so a\n * retained token must die with the identity it names; or\n * - `convertedToUserId` is set: the subject upgraded to an authenticated user. A retained anon token\n * must NOT keep acting under the old pseudonymous `uuidRef` — otherwise it could mint fresh anon\n * rows that re-establish the very identity linkage conversion is meant to sever. Post-conversion\n * the client holds a real JWT and no longer needs this one (`handleAnonymousTransposition` clears\n * the anon cookie on COMPLETE/PARTIAL), so a request still bearing it is a stale/hostile replay.\n \n This is the anon-plane analogue of the USERS auth front's row re-read + version/status checks\n * (`execution-context-creator._fetchUserAndBuildRoles`). The anon token carries NO `userId` — so the\n * `TOKEN_INVALID_BEFORE:<userId>` fence structurally cannot reach it — and has NO refresh, so a\n * per-request row liveness check is the ONE place a revocation can land. Deliberately NOT\n * `readAsSystem`/`listAsSystem`: those emit a `SYSTEM_CONTEXT_READ` audit per call, which on this\n * per-request path would drown that signal — this is a routine liveness check, not a privileged data\n * access. It is one indexed lookup on the `uuidRef` unique index; the anon path is lower-QPS than the\n * authenticated USERS path, which already performs a per-request row read.\n /\n async assertAnonymousSubjectStillLive(anonymousUserId: string): Promise<void> {\n const listOpPath = this.resourcesRegistry.getServiceOperationPathDefault(CoreResourceType.ANONYMOUS_USERS, CoreResourceOperation.LIST);\n const ec = await this.executionContextCreator.createForInternalOperation({\n operation: listOpPath,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null,\n initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n });\n\n // Target by `{ uuidRef }` (the client session handle), NOT a bare id — the row's `_id` is a server\n // ObjectId, so an id arg would resolve to `{ _id: <uuidRef> }` and match nothing (cf. transposeOwnership).\n const listResult = await this.servicesRegistryHandler.list<{ convertedToUserId?: string \| null }>(\n CoreResourceType.ANONYMOUS_USERS, ec, { uuidRef: anonymousUserId }, { page: 1, limit: 1 }\n );\n const rows = Array.isArray(listResult) ? listResult : listResult.data;\n const row = rows?.[0];\n\n if (!row) {\n this.logDebug('Anonymous session rejected — subject row absent (hard-deleted / swept / erased)', { anonymousUserId });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,\n });\n }\n if (row.convertedToUserId) {\n this.logDebug('Anonymous session rejected — subject already converted to an authenticated user', { anonymousUserId });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,\n });\n }\n }\n\n /\n Set the parent-domain anonymous-session continuity cookie\n * (`__wildo_anon_session`) on the response, alongside the\n * `x-anonymous-session-token` header, when a session is minted.\n \n The cookie is what carries the anonymous session across the\n * marketing-site apex → app → API origins so a website-captured lead\n * / draft transposes on app signup with NO frontend handoff — the\n * app's login reads it as a fallback to the `x-anonymous-session`\n * header. Cookie attributes (`SameSite=Lax`, parent `Domain`,\n * `Path=/api/v1`, 24h `Max-Age`) live on\n * `AuthControllerUtils.setAnonymousSessionCookie` /\n * `ANONYMOUS_SESSION_COOKIE_NAME`.\n \n `Domain` comes from `auth.anonymousSessionCookieDomain` (unset ⇒\n * host-only, correct for localhost dev where the port-agnostic host\n * cookie already spans the dev ports); `Max-Age` matches the anon\n * JWT's `expirySeconds`.\n /\n setSessionCookie(res: Response, token: string): void {\n AuthControllerUtils.setAnonymousSessionCookie(\n res,\n token,\n this.configService.config.auth.anonymousSessionCookieDomain,\n this.configService.applicationEnv,\n ANONYMOUS_SESSION_JWT_FORMAT.expirySeconds,\n );\n }\n\n /\n Clear the anonymous-session continuity cookie. Called after a\n * successful transposition (the anonymous rows now belong to the\n * authenticated user, so the session has served its purpose) and on\n * session clear. Delegates to `AuthControllerUtils` with the SAME\n * config-resolved `Domain` the cookie was set with, so the browser\n * actually honours the deletion.\n /\n clearSessionCookie(res: Response): void {\n AuthControllerUtils.clearAnonymousSessionCookie(\n res,\n this.configService.config.auth.anonymousSessionCookieDomain,\n this.configService.applicationEnv,\n );\n }\n\n /\n Transpose ownership of all isAnonymizable resources from an anonymous user\n * to an authenticated user. Called during registration/login when the user\n * had prior anonymous activity.\n \n Checks that the target userType has anonymousSessionsEnabled before proceeding.\n * If the userType does not support anonymous sessions, returns an empty result.\n /\n async transposeOwnership(\n anonymousUserId: string,\n authenticatedUserId: string,\n userType: string\n ): Promise<TranspositionResult> {\n const userTypePolicy = this.configService.getUserTypeAuthPolicy(userType);\n if (!userTypePolicy?.anonymousSessionsEnabled) {\n this.logDebug('Skipping transposition — anonymousSessionsEnabled is false for user type', { userType, anonymousUserId });\n return { transposedTypes: [], failedTypes: [], status: AnonymousUserTranspositionStatus.PENDING };\n }\n\n const transposedTypes: ResourceType[] = [];\n const failedTypes: { resourceType: ResourceType; error: string }[] = [];\n\n const anonymizableTypes = this.getAnonymizableResourceTypes();\n\n for (const resourceType of anonymizableTypes) {\n const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType);\n const policy = resourceConfig?.transpositionPolicy ?? ResourceTranspositionPolicy.ADD;\n\n if (policy === ResourceTranspositionPolicy.DISCARD) {\n this.logDebug('Skipping transposition (DISCARD policy)', { resourceType });\n continue;\n }\n\n try {\n const records = await this.listAnonymousRecords(resourceType, anonymousUserId);\n\n if (!records \|\| records.length === 0) continue;\n\n if (policy === ResourceTranspositionPolicy.REPLACE) {\n await this.deleteExistingUserRecords(resourceType, authenticatedUserId);\n }\n\n if (policy === ResourceTranspositionPolicy.MERGE) {\n this.logger.warn(\n 'MERGE transposition policy is not yet implemented — falling back to ADD',\n { resourceType, anonymousUserId, authenticatedUserId }\n );\n }\n\n const ids = records.map((r: any) => r._id);\n await this.reassignOwnership(resourceType, ids, authenticatedUserId);\n\n transposedTypes.push(resourceType);\n this.logDebug('Transposed ownership', {\n resourceType, policy, count: ids.length, anonymousUserId, authenticatedUserId,\n });\n } catch (error) {\n const errorMsg = describeCaughtError(error);\n failedTypes.push({ resourceType, error: errorMsg });\n this.logger.error('Transposition failed for resource type', {\n resourceType, policy, anonymousUserId, authenticatedUserId, error: errorMsg,\n });\n }\n }\n\n // ── Manual transposition for INBOUND_CONTACTS (Phase 0.5, Q-E=B) ──\n //\n // INBOUND_CONTACTS is APPLICATION-scoped (not USER_SELF) and therefore\n // does NOT carry `isAnonymizable: true` — the generic transposition\n // loop above (which gates on isAnonymizable) does not see it.\n //\n // The lead-capture FK chain is `{ anonymousUserId } → { userId,\n // anonymousUserId: null }`: when the anonymous user converts, all\n // leads they submitted are reassigned to their authenticated user\n // identity, and the anonymous link is cleared so the upcoming\n // anonymous-session cleanup batch does not look at them.\n //\n // We invoke the dedicated helper after the generic loop so its\n // result rolls into the same transposedTypes/failedTypes report\n // and the AnonymousUser.transpositionStatus update below reflects\n // the full conversion outcome.\n try {\n const inboundContactsTransposedCount = await this.transposeInboundContactsOwnership(\n anonymousUserId,\n authenticatedUserId,\n );\n if (inboundContactsTransposedCount > 0) {\n transposedTypes.push(CoreResourceType.INBOUND_CONTACTS);\n this.logDebug('Transposed inbound contacts', {\n anonymousUserId, authenticatedUserId, count: inboundContactsTransposedCount,\n });\n }\n } catch (error) {\n const errorMsg = describeCaughtError(error);\n failedTypes.push({ resourceType: CoreResourceType.INBOUND_CONTACTS, error: errorMsg });\n this.logger.error('InboundContacts transposition failed', {\n anonymousUserId, authenticatedUserId, error: errorMsg,\n });\n }\n\n const status = failedTypes.length === 0\n ? AnonymousUserTranspositionStatus.COMPLETE\n : transposedTypes.length > 0\n ? AnonymousUserTranspositionStatus.PARTIAL\n : AnonymousUserTranspositionStatus.PENDING;\n\n try {\n // Deliberately NOT routed through `updateAsSystem` (unlike the ownership\n // transposition writes). `convertedToUserId` and `transpositionStatus` are\n // ordinary fields — neither `.isBackendOnly()` nor context-auto-populated FK\n // names — so they survive the strict-DTO parse; there is nothing for the\n // primitive to re-attach. Migrating would only add a fail-closed opt-in and\n // an audit row for no correctness gain, so the plain internal-EC handler\n // stays. (ANONYMOUS_USERS opts into `systemAccessPolicy.create` only.)\n const updateOpPath = this.resourcesRegistry.getServiceOperationPathDefault(CoreResourceType.ANONYMOUS_USERS, CoreResourceOperation.UPDATE);\n const anonymousUserEc = await this.executionContextCreator.createForInternalOperation({\n operation: updateOpPath,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null,\n initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n });\n\n // Target the row by `{ uuidRef }`, NOT the session id directly: the session id\n // (from the JWT) is the client `uuidRef`, while the row's `_id` is a server\n // ObjectId — a bare id arg would resolve to `{ _id: <uuidRef> }` and match nothing.\n await this.servicesRegistryHandler.update(\n CoreResourceType.ANONYMOUS_USERS, anonymousUserEc, { uuidRef: anonymousUserId },\n { convertedToUserId: authenticatedUserId, transpositionStatus: status }\n );\n } catch (error) {\n this.logger.error('Failed to update AnonymousUser transposition status', { anonymousUserId, error });\n }\n\n return { transposedTypes, failedTypes, status };\n }\n\n /\n Transpose ownership of `INBOUND_CONTACTS` rows owned by the given\n * anonymous user to the now-authenticated user (Phase 0.5, Q-E=B).\n \n Why this lives outside the generic isAnonymizable loop:\n * `INBOUND_CONTACTS` is APPLICATION-scoped (org-owned admin\n * resource), not USER_SELF-scoped, and therefore cannot carry\n * `isAnonymizable: true` (the factory enforces USER_SELF for that\n * flag). The conversion semantics are the same — flip\n * `{ anonymousUserId } → { userId, anonymousUserId: null }` — but\n * they are wired manually here.\n \n Implementation notes:\n * - Lists by FK `anonymousUserId` (matches the registry edge\n * `ANONYMOUS_USERS → INBOUND_CONTACTS` declared in\n * `resources-registry.shared.core.definitions.ts`).\n * - Uses INTERNAL_CALL UPDATE (declared in\n * `inbound-contacts.shared.resources-config.schemas.ts`) — no\n * public admin-edit surface in Phase 0.5.\n * - Per-row UPDATE (not UPDATE_MANY) because conversion volume is\n * low (one anonymous session typically submits 0–1 leads) and\n * this avoids surfacing UPDATE_MANY just for transposition.\n \n @returns the number of leads transposed (0 if none).\n /\n private async transposeInboundContactsOwnership(\n anonymousUserId: string,\n authenticatedUserId: string,\n ): Promise<number> {\n const records = await this.listAnonymousRecords(\n CoreResourceType.INBOUND_CONTACTS,\n anonymousUserId,\n );\n\n if (!records \|\| records.length === 0) return 0;\n\n let transposedCount = 0;\n for (const record of records) {\n // `{ userId, anonymousUserId }` are context-auto-populated FK names the\n // client-shaped request DTO strips, so a plain `servicesRegistryHandler\n // .update` was a silent no-op `$set` (the lead's ownership never moved).\n // `updateAsSystem` re-attaches both FKs after the strict parse and\n // synthesises its own super-admin context, fail-closed behind\n // INBOUND_CONTACTS' `systemAccessPolicy.update`. Per-row (not UPDATE_MANY)\n // by design — see the method doc above.\n await this.systemAccessService.updateAsSystem(\n CoreResourceType.INBOUND_CONTACTS,\n record._id as string,\n { userId: authenticatedUserId, anonymousUserId: null },\n );\n transposedCount++;\n }\n return transposedCount;\n }\n\n /\n List the not-yet-converted rows an anonymous user owns, across BOTH the\n * generic `isAnonymizable` resources (USER_SELF-scoped, e.g. `draftNotes`) and\n * the manually-wired APPLICATION-scoped ones (`inboundContacts`).\n \n Scope by `anonymousUserId` as a DIRECT field filter — NOT via the EC\n * `contextResourcesFieldIdentifier` map. Putting the FK on the context map is\n * FATAL at EC-CREATION time for an APPLICATION-scoped resource: because\n * `INBOUND_CONTACTS`' LIST is APPLICATION-scoped, `createExecutionContext` runs\n * `populateApplicationIdIfNeeded`, which reads the singleton `applications`\n * record with THIS same EC. `applications` does not model `anonymousUserId`, so\n * its `buildContextualFilter` iterates the context map, hits the unknown field\n * and fails closed — `configuration` / `reason: 'context_filter'` /\n * resource `'applications'`. The throw happens INSIDE the creator (before\n * `list()` runs), so `excludeContextualFilter` on the `list()` call alone cannot\n * suppress it; the FK must stay off the context map.\n \n With the FK supplied explicitly, the caller owns the authoritative scope, so\n * the ambient contextual filter is skipped (`excludeContextualFilter: true`) —\n * the canonical explicit-scope repository-options pattern (cf. the\n * milestone/lifecycle evaluators and `NotificationBadgeBackendService`).\n * USER_SELF-scoped anonymizable resources never triggered the crash but are\n * filtered identically (`userId: null` keeps it to still-anonymous rows).\n /\n private async listAnonymousRecords(resourceType: ResourceType, anonymousUserId: string): Promise<any[]> {\n const listOpPath = this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.LIST);\n const listEc = await this.executionContextCreator.createForInternalOperation({\n operation: listOpPath,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null,\n initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n });\n return await this.servicesRegistryHandler.list<any>(\n resourceType,\n listEc,\n { anonymousUserId, userId: null },\n undefined,\n { paginated: false, excludeContextualFilter: true },\n ) as any[];\n }\n\n private async reassignOwnership(resourceType: ResourceType, ids: string[], authenticatedUserId: string): Promise<void> {\n // THE transposition write. The patch `{ userId, anonymousUserId }` is two\n // context-auto-populated FK names the client-shaped request DTO strips, so a\n // plain `servicesRegistryHandler.updateMany` was a silent no-op `$set` — the\n // anon→user ownership move never landed, and the rows were later deleted by the\n // expired-session cleanup batch (user-visible data loss on conversion).\n // `updateManyAsSystem` re-attaches both FKs after the strict parse and\n // synthesises its own super-admin context, fail-closed behind\n // `systemAccessPolicy.updateMany` — auto-granted by the factory to every\n // `isAnonymizable` resource (the only resources this dynamic loop iterates),\n // so no per-resource opt-in is required here.\n await this.systemAccessService.updateManyAsSystem(resourceType, ids, { userId: authenticatedUserId, anonymousUserId: null });\n }\n\n private async deleteExistingUserRecords(resourceType: ResourceType, userId: string): Promise<void> {\n const listOpPath = this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.LIST);\n const listEc = await this.executionContextCreator.createForInternalOperation({\n operation: listOpPath,\n contextResourcesFieldIdentifier: new Map([['userId', userId]]),\n initiatorIds: null,\n initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n });\n const existing = await this.servicesRegistryHandler.list<any>(resourceType, listEc, undefined, undefined, { paginated: false }) as any[];\n if (existing && existing.length > 0) {\n const deleteOpPath = this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.DELETE_MANY);\n const deleteEc = await this.executionContextCreator.createForInternalOperation({\n operation: deleteOpPath,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null,\n initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n });\n const ids = existing.map((r: any) => r._id);\n await this.servicesRegistryHandler.deleteMany(resourceType, deleteEc, ids);\n this.logDebug('Deleted existing user records (REPLACE policy)', { resourceType, userId, count: ids.length });\n }\n }\n\n /\n Cleanup expired, unconverted anonymous sessions and their owned resources.\n * Called by the anonymous-session-cleanup batch job.\n /\n async cleanupExpiredSessions(options?: {\n sessionTtlMs?: number;\n batchSize?: number;\n maxIterations?: number;\n convertedRetentionMs?: number;\n }): Promise<{ expiredUsersFound: number; resourcesDeleted: number; usersArchived: number; convertedUsersCleaned: number; errors: number }> {\n const FORTY_EIGHT_HOURS_MS = 48 60 * 60 * 1000;\n const NINETY_DAYS_MS = 90 * 24 * 60 * 60 * 1000;\n const sessionTtlMs = options?.sessionTtlMs ?? FORTY_EIGHT_HOURS_MS;\n const batchSize = options?.batchSize ?? 100;\n const maxIterations = options?.maxIterations ?? 100;\n const convertedRetentionMs = options?.convertedRetentionMs ?? NINETY_DAYS_MS;\n const cutoff = new Date(Date.now() - sessionTtlMs);\n\n if (!this.configService.anonymousSessionsEnabled) {\n this.logDebug('Anonymous sessions not enabled — skipping cleanup');\n return { expiredUsersFound: 0, resourcesDeleted: 0, usersArchived: 0, convertedUsersCleaned: 0, errors: 0 };\n }\n\n const anonymizableTypes = this.getAnonymizableResourceTypes();\n let totalExpiredUsersFound = 0;\n let resourcesDeleted = 0;\n let usersArchived = 0;\n let errors = 0;\n let iteration = 0;\n\n // Phase 1: Clean up expired unconverted sessions (pagination loop)\n let hasMore = true;\n while (hasMore && iteration < maxIterations) {\n iteration++;\n\n const listOpPath = this.resourcesRegistry.getServiceOperationPathDefault(CoreResourceType.ANONYMOUS_USERS, CoreResourceOperation.LIST);\n const listEc = await this.executionContextCreator.createForInternalOperation({\n operation: listOpPath,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null,\n initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n });\n\n const listResult = await this.servicesRegistryHandler.list<any>(\n CoreResourceType.ANONYMOUS_USERS,\n listEc,\n { convertedToUserId: null, createdAt: { $lt: cutoff } },\n { page: 1, limit: batchSize }\n );\n const expiredUsers: any[] = Array.isArray(listResult) ? listResult : listResult.data;\n totalExpiredUsersFound += expiredUsers.length;\n\n if (expiredUsers.length === 0) { hasMore = false; break; }\n\n for (const anonUser of expiredUsers) {\n // `_id` (server ObjectId) deletes the AnonymousUser row itself; `uuidRef`\n // (the client session handle) is what children carry in their `anonymousUserId`\n // FK, so it is what lists/deletes the owned records. Filtering children by `_id`\n // would match nothing and silently orphan them.\n const anonymousUserId = anonUser._id as string;\n const anonymousUserRef = anonUser.uuidRef as string;\n\n try {\n for (const resourceType of anonymizableTypes) {\n const records = await this.listAnonymousRecords(resourceType, anonymousUserRef);\n if (records && records.length > 0) {\n const ids = records.map((r: any) => r._id);\n const deleteOpPath = this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.DELETE_MANY);\n const deleteEc = await this.executionContextCreator.createForInternalOperation({\n operation: deleteOpPath,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null,\n initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n });\n await this.servicesRegistryHandler.deleteMany(resourceType, deleteEc, ids);\n resourcesDeleted += ids.length;\n }\n }\n\n const deleteAnonOpPath = this.resourcesRegistry.getServiceOperationPathDefault(CoreResourceType.ANONYMOUS_USERS, CoreResourceOperation.DELETE);\n const deleteAnonEc = await this.executionContextCreator.createForInternalOperation({\n operation: deleteAnonOpPath,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null,\n initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n });\n await this.servicesRegistryHandler.delete(CoreResourceType.ANONYMOUS_USERS, deleteAnonEc, anonymousUserId);\n usersArchived++;\n } catch (error) {\n errors++;\n this.logger.warn('Failed to clean up expired anonymous session', {\n anonymousUserId,\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n hasMore = expiredUsers.length >= batchSize;\n }\n\n // Phase 2: Clean up converted AnonymousUser records past retention period (audit trail)\n let convertedUsersCleaned = 0;\n const convertedCutoff = new Date(Date.now() - convertedRetentionMs);\n try {\n const convertedListOpPath = this.resourcesRegistry.getServiceOperationPathDefault(CoreResourceType.ANONYMOUS_USERS, CoreResourceOperation.LIST);\n const convertedListEc = await this.executionContextCreator.createForInternalOperation({\n operation: convertedListOpPath,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null,\n initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n });\n const convertedResult = await this.servicesRegistryHandler.list<any>(\n CoreResourceType.ANONYMOUS_USERS,\n convertedListEc,\n { convertedToUserId: { $ne: null }, createdAt: { $lt: convertedCutoff } },\n { page: 1, limit: batchSize }\n );\n const convertedUsers: any[] = Array.isArray(convertedResult) ? convertedResult : convertedResult.data;\n\n for (const convertedUser of convertedUsers) {\n try {\n const deleteOpPath = this.resourcesRegistry.getServiceOperationPathDefault(CoreResourceType.ANONYMOUS_USERS, CoreResourceOperation.DELETE);\n const deleteEc = await this.executionContextCreator.createForInternalOperation({\n operation: deleteOpPath,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null,\n initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n });\n await this.servicesRegistryHandler.delete(CoreResourceType.ANONYMOUS_USERS, deleteEc, convertedUser._id);\n convertedUsersCleaned++;\n } catch (error) {\n errors++;\n }\n }\n } catch (error) {\n this.logger.warn('Failed to clean up converted anonymous users', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n\n this.logDebug('Cleanup completed', {\n expiredUsersFound: totalExpiredUsersFound, resourcesDeleted, usersArchived,\n convertedUsersCleaned, errors, iterations: iteration,\n anonymizableTypes: anonymizableTypes.length,\n });\n\n return { expiredUsersFound: totalExpiredUsersFound, resourcesDeleted, usersArchived, convertedUsersCleaned, errors };\n }\n\n private getAnonymizableResourceTypes(): ResourceType[] {\n const allTypes = this.resourcesRegistry.getResourceTypes();\n const result: ResourceType[] = [];\n for (const resourceType of allTypes) {\n const config = this.resourcesRegistry.getResourceConfiguration(resourceType);\n if (config?.isAnonymizable === true) {\n result.push(resourceType);\n }\n }\n return result;\n }\n\n private hashIp(ip: string): string {\n return crypto.createHash('sha256').update(ip).digest('hex').substring(0, 16);\n }\n\n /*\n Extract first-touch marketing attribution from the inbound request\n * (Phase 0.5, Q-D=β). Returns `undefined` if no signal is present so\n * the caller can omit the field entirely from the create payload.\n \n Sources:\n * - `utm_` query string parameters → `utm.{source,medium,campaign,term,content}`\n - `Referer` HTTP header → `referrer`\n * - `x-landing-path` HTTP header → `landingPath`\n * (framework header registered in `WildoHeaderKeys.LANDING_PATH`, sent by\n * the marketing-site bootstrap ON the session-init request; carried in the\n * engine CORS `allowedHeaders` floor alongside `x-anonymous-session-init`\n * — see `engineAllowedHeaders` in `http-server.backend.service.ts`).\n * - `Accept-Language` HTTP header → `acceptLanguage`\n \n The result is parsed against `AnonymousUserMarketingMetadataSchema`\n * to apply the field-level length caps (256 / 2048) and to strip\n * unknown keys defensively. If parsing fails (e.g. malformed\n * over-length values from a hostile client), we log and return\n * `undefined` rather than fail session-init — attribution is a\n * best-effort marketing signal, not a security-critical field.\n */\n private extractFirstTouchMarketingMetadata(req: Request): AnonymousUserMarketingMetadata \| undefined {\n const headerString = (key: string): string \| undefined => {\n const raw = req.headers[key];\n if (typeof raw === 'string' && raw.length > 0) return raw;\n if (Array.isArray(raw) && raw.length > 0 && typeof raw[0] === 'string') return raw[0];\n return undefined;\n };\n const queryString = (key: string): string \| undefined => {\n const raw = (req.query as Record<string, unknown> \| undefined)?.[key];\n if (typeof raw === 'string' && raw.length > 0) return raw;\n if (Array.isArray(raw) && raw.length > 0 && typeof raw[0] === 'string') return raw[0];\n return undefined;\n };\n\n const utmCandidate = {\n source : queryString('utm_source'),\n medium : queryString('utm_medium'),\n campaign : queryString('utm_campaign'),\n term : queryString('utm_term'),\n content : queryString('utm_content'),\n };\n const utmHasAnyValue = Object.values(utmCandidate).some((v) => v !== undefined);\n\n const candidate: Record<string, unknown> = {};\n if (utmHasAnyValue) candidate.utm = utmCandidate;\n const referrer = headerString('referer');\n const landingPath = headerString(WildoHeaderKeys.LANDING_PATH);\n const acceptLanguage = headerString('accept-language');\n if (referrer !== undefined) candidate.referrer = referrer;\n if (landingPath !== undefined) candidate.landingPath = landingPath;\n if (acceptLanguage !== undefined) candidate.acceptLanguage = acceptLanguage;\n\n if (Object.keys(candidate).length === 0) return undefined;\n\n const parsed = AnonymousUserMarketingMetadataSchema.safeParse(candidate);\n if (!parsed.success) {\n this.logger.warn('Discarding malformed first-touch marketing metadata', {\n issues: parsed.error.issues.map((i) => ({ path: i.path.join('.'), code: i.code })),\n });\n return undefined;\n }\n return parsed.data;\n }\n}\n"]}
1	+ {"version":3,"file":"anonymous-session.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/anonymous-session.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;;;;;;;;;;;;;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAMhJ,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,gCAAgC,EAChC,oCAAoC,EACpC,gCAAgC,EAChC,qBAAqB,EACrB,gBAAgB,EAChB,cAAc,EACd,2BAA2B,EAC3B,SAAS,EACT,oBAAoB,EACpB,2BAA2B,EAC3B,eAAe,EACf,mCAAmC,GAGpC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAClG,OAAO,EAAE,mBAAmB,EAAE,MAAM,kFAAkF,CAAC;AAuChH,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;IAKa;IACa;IACH;IACc;IACP;IACc;IACd;IASJ;IAlBlD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EAC3C,aAAsC,EACxB,uBAA8D,EACrE,iBAAkD,EACpC,uBAA8D,EAC5E,gBAAyC,EAS7C,mBAA+C;QAf5D,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC3C,kBAAa,GAAb,aAAa,CAAyB;QACxB,4BAAuB,GAAvB,uBAAuB,CAAuC;QACrE,sBAAiB,GAAjB,iBAAiB,CAAiC;QACpC,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC5E,qBAAgB,GAAhB,gBAAgB,CAAyB;QAS7C,wBAAmB,GAAnB,mBAAmB,CAA4B;QAEhH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,gCAAgC,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CAAC,mBAAmB,CAAC,eAAuB,EAAE,GAAY,EAAE,GAAa;QAC5E,qEAAqE;QACrE,sEAAsE;QACtE,uEAAuE;QACvE,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAE7C,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,EAC/C,wBAAwB,CACzB,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAErC,IAAI,CAAC;YACH,iEAAiE;YACjE,gEAAgE;YAChE,gEAAgE;YAChE,gEAAgE;YAChE,MAAM,iBAAiB,GAAG,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,CAAC;YAEvE,6EAA6E;YAC7E,0EAA0E;YAC1E,gFAAgF;YAChF,iFAAiF;YACjF,8DAA8D;YAC9D,EAAE;YACF,8EAA8E;YAC9E,2EAA2E;YAC3E,uEAAuE;YACvE,2EAA2E;YAC3E,6EAA6E;YAC7E,oFAAoF;YACpF,kFAAkF;YAClF,6CAA6C;YAC7C,EAAE;YACF,6EAA6E;YAC7E,6EAA6E;YAC7E,mEAAmE;YACnE,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,eAAe,EAAE;gBAC9E,OAAO,EAAE,eAAe;gBACxB,OAAO,EAAE,EAAE,gBAAgB,EAAE,IAAI,IAAI,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE;gBAC9D,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;gBACrE,MAAM;gBACN,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE;gBACrC,eAAe;gBACf,oBAAoB,EAAE,iBAAiB,KAAK,SAAS;aACtD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,EAAE,IAAI,KAAK,KAAK,IAAI,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,eAAe,CAAC,IAAI,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7G,IAAI,CAAC,QAAQ,CAAC,qEAAqE,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;gBAC1G,OAAO;YACT,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;YAChF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,gBAAgB,CAAC,eAAuB;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAClE,OAAO,GAAG,CAAC,IAAI,CACb,EAAE,eAAe,EAAE,EACnB,MAAM,EACN,EAAE,SAAS,EAAE,4BAA4B,CAAC,SAAS,EAAE,SAAS,EAAE,mCAAmC,EAAE,CACtG,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAa;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE;gBACxC,UAAU,EAAE,CAAC,4BAA4B,CAAC,SAAS,CAAC;gBACpD,cAAc,EAAE,EAAE;aACnB,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,gCAAgC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAEhE,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,GAAG,CAAC,iBAAiB,EAAE,CAAC;gBAC3C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B,EAAE,CACvF,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B,EAAE,CACvF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,KAAK,CAAC,+BAA+B,CAAC,eAAuB;QAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,eAAe,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACvI,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YACvE,SAAS,EAAE,UAAU;YACrB,+BAA+B,EAAE,IAAI,GAAG,EAAE;YAC1C,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;SAC3H,CAAC,CAAC;QAEH,mGAAmG;QACnG,2GAA2G;QAC3G,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACxD,gBAAgB,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAC1F,CAAC;QACF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QACtE,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAEtB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,iFAAiF,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;YACtH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;aACnF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC;YAC1B,IAAI,CAAC,QAAQ,CAAC,iFAAiF,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;YACtH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;aACnF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,gBAAgB,CAAC,GAAa,EAAE,KAAa;QAC3C,mBAAmB,CAAC,yBAAyB,CAC3C,GAAG,EACH,KAAK,EACL,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAC3D,IAAI,CAAC,aAAa,CAAC,cAAc,EACjC,4BAA4B,CAAC,aAAa,CAC3C,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,GAAa;QAC9B,mBAAmB,CAAC,2BAA2B,CAC7C,GAAG,EACH,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAC3D,IAAI,CAAC,aAAa,CAAC,cAAc,CAClC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CACtB,eAAuB,EACvB,mBAA2B,EAC3B,QAAgB;QAEhB,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC1E,IAAI,CAAC,cAAc,EAAE,wBAAwB,EAAE,CAAC;YAC9C,IAAI,CAAC,QAAQ,CAAC,0EAA0E,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;YACzH,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,gCAAgC,CAAC,OAAO,EAAE,CAAC;QACxH,CAAC;QAED,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAC7F,eAAe,EACf,mBAAmB;QACnB,4FAA4F;QAC5F,oFAAoF;QACpF,4CAA4C;QAC5C,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAC7B,CAAC;QAEF,gGAAgG;QAChG,8FAA8F;QAC9F,iGAAiG;QACjG,kCAAkC;QAClC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,KAAK,CAAC;YACrC,CAAC,CAAC,gCAAgC,CAAC,QAAQ;YAC3C,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC;gBAClD,CAAC,CAAC,gCAAgC,CAAC,OAAO;gBAC1C,CAAC,CAAC,gCAAgC,CAAC,OAAO,CAAC;QAE/C,MAAM,IAAI,CAAC,0BAA0B,CAAC,eAAe,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAC;QAEpF,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAClE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+DG;IACK,KAAK,CAAC,2BAA2B,CACvC,eAAuB,EACvB,mBAA2B,EAC3B,EAAE,kBAAkB,EAAmC;QAMvD,MAAM,eAAe,GAAmB,EAAE,CAAC;QAC3C,MAAM,cAAc,GAAmB,EAAE,CAAC;QAC1C,MAAM,WAAW,GAAoD,EAAE,CAAC;QAExE,MAAM,iBAAiB,GAAG,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAE9D,KAAK,MAAM,YAAY,IAAI,iBAAiB,EAAE,CAAC;YAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;YACrF,MAAM,MAAM,GAAG,cAAc,EAAE,mBAAmB,IAAI,2BAA2B,CAAC,GAAG,CAAC;YAEtF,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;gBAE/E,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAE/C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAE3C,IAAI,MAAM,KAAK,2BAA2B,CAAC,OAAO,EAAE,CAAC;oBACnD,0EAA0E;oBAC1E,0FAA0F;oBAC1F,wDAAwD;oBACxD,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;oBACjD,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;oBAClC,IAAI,CAAC,QAAQ,CAAC,8CAA8C,EAAE;wBAC5D,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,mBAAmB;qBACtE,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBAED,IAAI,MAAM,KAAK,2BAA2B,CAAC,OAAO,IAAI,kBAAkB,EAAE,CAAC;oBACzE,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;gBAC1E,CAAC;gBAED;;;;;mBAKG;gBACH,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;gBAErE,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACnC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE;oBACpC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,mBAAmB;iBAC9E,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBAC5C,WAAW,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACpD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE;oBAC1D,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ;iBAC5E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,EAAE;QACF,uEAAuE;QACvE,oEAAoE;QACpE,8DAA8D;QAC9D,EAAE;QACF,gEAAgE;QAChE,kEAAkE;QAClE,kEAAkE;QAClE,8DAA8D;QAC9D,yDAAyD;QACzD,EAAE;QACF,+DAA+D;QAC/D,gEAAgE;QAChE,kEAAkE;QAClE,+BAA+B;QAC/B,EAAE;QACF,+FAA+F;QAC/F,wFAAwF;QACxF,4FAA4F;QAC5F,+FAA+F;QAC/F,sCAAsC;QACtC,IAAI,CAAC;YACH,MAAM,8BAA8B,GAAG,MAAM,IAAI,CAAC,iCAAiC,CACjF,eAAe,EACf,mBAAmB,CACpB,CAAC;YACF,IAAI,8BAA8B,GAAG,CAAC,EAAE,CAAC;gBACvC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;gBACxD,IAAI,CAAC,QAAQ,CAAC,6BAA6B,EAAE;oBAC3C,eAAe,EAAE,mBAAmB,EAAE,KAAK,EAAE,8BAA8B;iBAC5E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC5C,WAAW,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,gBAAgB,CAAC,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YACvF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE;gBACxD,eAAe,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ;aACtD,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;IAC1D,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACK,KAAK,CAAC,0BAA0B,CACtC,eAAuB,EACvB,mBAA2B,EAC3B,MAAwC;QAExC,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,eAAe,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC3I,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YACpF,SAAS,EAAE,YAAY;YACvB,+BAA+B,EAAE,IAAI,GAAG,EAAE;YAC1C,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;SAC3H,CAAC,CAAC;QAEH,+EAA+E;QAC/E,4EAA4E;QAC5E,oFAAoF;QACpF,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CACvC,gBAAgB,CAAC,eAAe,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,EAC/E,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,EAAE,CACxE,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,iCAAiC,CAAC,OAGvC;QACC,MAAM,MAAM,GAAsC;YAChD,kBAAkB,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,uBAAuB,EAAE,CAAC;YACtE,uBAAuB,EAAE,CAAC,EAAE,sBAAsB,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;SACjE,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,wBAAwB,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,wEAAwE,CAAC,CAAC;YACxF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,GAAG,CAAC;QAC5C,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,GAAG,CAAC;QAEpD,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,eAAe,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAEvI,gGAAgG;QAChG,gGAAgG;QAChG,+FAA+F;QAC/F,gGAAgG;QAChG,6EAA6E;QAC7E,EAAE;QACF,gGAAgG;QAChG,+FAA+F;QAC/F,2FAA2F;QAC3F,qEAAqE;QACrE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,OAAO,SAAS,GAAG,aAAa,EAAE,CAAC;YACjC,SAAS,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAEpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;gBAC3E,SAAS,EAAE,UAAU;gBACrB,+BAA+B,EAAE,IAAI,GAAG,EAAE;gBAC1C,YAAY,EAAE,IAAI;gBAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;aAC3H,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACxD,gBAAgB,CAAC,eAAe,EAChC,MAAM,EACN,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,mBAAmB,EAAE,EAAE,GAAG,EAAE,gCAAgC,CAAC,QAAQ,EAAE,EAAE,EAC7G,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAC3B,CAAC;YACF,MAAM,UAAU,GAAU,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YACnF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM;YAEnC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,4FAA4F;gBAC5F,0FAA0F;gBAC1F,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC;oBAAE,SAAS;gBACpF,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAC5B,0FAA0F;gBAC1F,6FAA6F;gBAC7F,6FAA6F;gBAC7F,MAAM,gBAAgB,GAAG,SAAS,CAAC,OAAiB,CAAC;gBACrD,MAAM,mBAAmB,GAAG,SAAS,CAAC,iBAA2B,CAAC;gBAClE,IAAI,CAAC,gBAAgB,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBAC9C,0FAA0F;oBAC1F,oDAAoD;oBACpD,MAAM,CAAC,MAAM,EAAE,CAAC;oBAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uFAAuF,EAAE;wBACxG,kBAAkB,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,CAAC,CAAC,mBAAmB;qBAC/G,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAC7F,gBAAgB,EAChB,mBAAmB;oBACnB,4FAA4F;oBAC5F,yFAAyF;oBACzF,gFAAgF;oBAChF,qFAAqF;oBACrF,iCAAiC;oBACjC,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAC9B,CAAC;oBACF,MAAM,CAAC,uBAAuB,IAAI,eAAe,CAAC,MAAM,CAAC;oBACzD,MAAM,CAAC,sBAAsB,IAAI,cAAc,CAAC,MAAM,CAAC;oBAEvD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC3B,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;wBAC5B,yFAAyF;wBACzF,0FAA0F;wBAC1F,wFAAwF;wBACxF,+BAA+B;wBAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+DAA+D,EAAE;4BACjF,gBAAgB,EAAE,mBAAmB;4BACrC,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;yBACxF,CAAC,CAAC;wBACH,SAAS;oBACX,CAAC;oBAED,2FAA2F;oBAC3F,2FAA2F;oBAC3F,MAAM,IAAI,CAAC,0BAA0B,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,gCAAgC,CAAC,QAAQ,CAAC,CAAC;oBACxH,MAAM,CAAC,gBAAgB,EAAE,CAAC;oBAC1B,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE;wBAClD,gBAAgB,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc;wBACtE,WAAW,EAAE,SAAS,CAAC,mBAAmB,IAAI,IAAI;qBACnD,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,4FAA4F;oBAC5F,yFAAyF;oBACzF,wDAAwD;oBACxD,MAAM,CAAC,MAAM,EAAE,CAAC;oBAChB,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;oBAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE;wBAC/E,gBAAgB,EAAE,mBAAmB,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC;qBAC7E,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,IAAI,UAAU,CAAC,MAAM,GAAG,SAAS;gBAAE,MAAM;QAC3C,CAAC;QAED,MAAM,CAAC,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC;QAC5C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACK,KAAK,CAAC,iCAAiC,CAC7C,eAAuB,EACvB,mBAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC7C,gBAAgB,CAAC,gBAAgB,EACjC,eAAe,CAChB,CAAC;QAEF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAE/C,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,mEAAmE;YACnE,8DAA8D;YAC9D,2EAA2E;YAC3E,wCAAwC;YACxC,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC3C,gBAAgB,CAAC,gBAAgB,EACjC,MAAM,CAAC,GAAa,EACpB,EAAE,MAAM,EAAE,mBAAmB,EAAE,eAAe,EAAE,IAAI,EAAE,CACvD,CAAC;YACF,eAAe,EAAE,CAAC;QACpB,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,KAAK,CAAC,oBAAoB,CAAC,YAA0B,EAAE,eAAuB;QACpF,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACnH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAC3E,SAAS,EAAE,UAAU;YACrB,+BAA+B,EAAE,IAAI,GAAG,EAAE;YAC1C,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;SAC3H,CAAC,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC5C,YAAY,EACZ,MAAM,EACN,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,EACjC,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAC3C,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,YAA0B,EAAE,GAAa,EAAE,mBAA2B;QACpG,0EAA0E;QAC1E,6EAA6E;QAC7E,6EAA6E;QAC7E,gFAAgF;QAChF,wEAAwE;QACxE,uEAAuE;QACvE,8DAA8D;QAC9D,yEAAyE;QACzE,6EAA6E;QAC7E,8CAA8C;QAC9C,MAAM,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/H,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACK,KAAK,CAAC,kBAAkB,CAAC,YAA0B,EAAE,GAAa;QACxE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE7B,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;QACnG,MAAM,kBAAkB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAc,EAAE,EAAE,CAC5D,mCAAmC,CAAC,SAAS,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC;QAErF,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,CAAC,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC;QAClH,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;QAC9G,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAC7E,SAAS,EAAE,YAAY;YACvB,+BAA+B,EAAE,IAAI,GAAG,EAAE;YAC1C,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;SAC3H,CAAC,CAAC;QAEH,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,yBAAyB,CAAC,YAA0B,EAAE,MAAc;QAChF,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACnH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;YAC3E,SAAS,EAAE,UAAU;YACrB,+BAA+B,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YAC9D,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;SAC3H,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAM,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAU,CAAC;QACzI,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,gDAAgD,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,sBAAsB,CAAC,OAK5B;QAQC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACjD,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAChD,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,oBAAoB,CAAC;QACnE,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,GAAG,CAAC;QAC5C,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,GAAG,CAAC;QACpD,MAAM,oBAAoB,GAAG,OAAO,EAAE,oBAAoB,IAAI,cAAc,CAAC;QAC7E,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC;QAEnD,MAAM,mBAAmB,GAAsC;YAC7D,kBAAkB,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,uBAAuB,EAAE,CAAC;YACtE,uBAAuB,EAAE,CAAC,EAAE,sBAAsB,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;SACjE,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,wBAAwB,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,mDAAmD,CAAC,CAAC;YACnE,OAAO;gBACL,iBAAiB,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,qBAAqB,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;gBAChG,wBAAwB,EAAE,mBAAmB;aAC9C,CAAC;QACJ,CAAC;QAED,iEAAiE;QACjE,EAAE;QACF,+FAA+F;QAC/F,gGAAgG;QAChG,gGAAgG;QAChG,+FAA+F;QAC/F,4DAA4D;QAC5D,EAAE;QACF,yFAAyF;QACzF,+EAA+E;QAC/E,IAAI,wBAAwB,GAAG,mBAAmB,CAAC;QACnD,IAAI,CAAC;YACH,wBAAwB,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAAC;gBACtE,SAAS,EAAE,OAAO,EAAE,SAAS;gBAC7B,aAAa,EAAE,OAAO,EAAE,aAAa;aACtC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8FAA8F;YAC9F,8FAA8F;YAC9F,4FAA4F;YAC5F,+FAA+F;YAC/F,gDAAgD;YAChD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8EAA8E,EAAE;gBAChG,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAC9D,IAAI,sBAAsB,GAAG,CAAC,CAAC;QAC/B,IAAI,gBAAgB,GAAG,CAAC,CAAC;QACzB,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,SAAS,GAAG,CAAC,CAAC;QAElB,mEAAmE;QACnE,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,OAAO,OAAO,IAAI,SAAS,GAAG,aAAa,EAAE,CAAC;YAC5C,SAAS,EAAE,CAAC;YAEZ,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,eAAe,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;YACvI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;gBAC3E,SAAS,EAAE,UAAU;gBACrB,+BAA+B,EAAE,IAAI,GAAG,EAAE;gBAC1C,YAAY,EAAE,IAAI;gBAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;aAC3H,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACxD,gBAAgB,CAAC,eAAe,EAChC,MAAM,EACN,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EACvD,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAC9B,CAAC;YACF,MAAM,YAAY,GAAU,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YACrF,sBAAsB,IAAI,YAAY,CAAC,MAAM,CAAC;YAE9C,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAAC,OAAO,GAAG,KAAK,CAAC;gBAAC,MAAM;YAAC,CAAC;YAE1D,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;gBACpC,0EAA0E;gBAC1E,gFAAgF;gBAChF,iFAAiF;gBACjF,gDAAgD;gBAChD,MAAM,eAAe,GAAG,QAAQ,CAAC,GAAa,CAAC;gBAC/C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAiB,CAAC;gBAEpD,IAAI,CAAC;oBACH,KAAK,MAAM,YAAY,IAAI,iBAAiB,EAAE,CAAC;wBAC7C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;wBAChF,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;4BAC3C,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;4BACjD,gBAAgB,IAAI,GAAG,CAAC,MAAM,CAAC;wBACjC,CAAC;oBACH,CAAC;oBAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,eAAe,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;oBAC/I,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;wBACjF,SAAS,EAAE,gBAAgB;wBAC3B,+BAA+B,EAAE,IAAI,GAAG,EAAE;wBAC1C,YAAY,EAAE,IAAI;wBAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;qBAC3H,CAAC,CAAC;oBACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,eAAe,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;oBAC3G,aAAa,EAAE,CAAC;gBAClB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,EAAE,CAAC;oBACT,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE;wBAC/D,eAAe;wBACf,GAAG,2BAA2B,CAAC,KAAK,CAAC;qBACtC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,OAAO,GAAG,YAAY,CAAC,MAAM,IAAI,SAAS,CAAC;QAC7C,CAAC;QAED,wFAAwF;QACxF,IAAI,qBAAqB,GAAG,CAAC,CAAC;QAC9B,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,mBAAmB,GAAG,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,eAAe,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAChJ,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;gBACpF,SAAS,EAAE,mBAAmB;gBAC9B,+BAA+B,EAAE,IAAI,GAAG,EAAE;gBAC1C,YAAY,EAAE,IAAI;gBAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;aAC3H,CAAC,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC7D,gBAAgB,CAAC,eAAe,EAChC,eAAe,EACf,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE,EACzE,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAC9B,CAAC;YACF,MAAM,cAAc,GAAU,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC;YAEtG,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;gBAC3C,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,eAAe,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;oBAC3I,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,0BAA0B,CAAC;wBAC7E,SAAS,EAAE,YAAY;wBACvB,+BAA+B,EAAE,IAAI,GAAG,EAAE;wBAC1C,YAAY,EAAE,IAAI;wBAClB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;qBAC3H,CAAC,CAAC;oBACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,eAAe,EAAE,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC;oBACzG,qBAAqB,EAAE,CAAC;gBAC1B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,EAAE,CAAC;gBACX,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE;gBAC/D,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE;YACjC,iBAAiB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,aAAa;YAC1E,qBAAqB,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS;YACpD,iBAAiB,EAAE,iBAAiB,CAAC,MAAM;YAC3C,wBAAwB;SACzB,CAAC,CAAC;QAEH,OAAO;YACL,iBAAiB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM;YACzG,wBAAwB;SACzB,CAAC;IACJ,CAAC;IAEO,4BAA4B;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAmB,EAAE,CAAC;QAClC,KAAK,MAAM,YAAY,IAAI,QAAQ,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;YAC7E,IAAI,MAAM,EAAE,cAAc,KAAK,IAAI,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,EAAU;QACvB,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,kCAAkC,CAAC,GAAY;QACrD,MAAM,YAAY,GAAG,CAAC,GAAW,EAAsB,EAAE;YACvD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC;YAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ;gBAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;YACtF,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,MAAM,WAAW,GAAG,CAAC,GAAW,EAAsB,EAAE;YACtD,MAAM,GAAG,GAAI,GAAG,CAAC,KAA6C,EAAE,CAAC,GAAG,CAAC,CAAC;YACtE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC;YAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ;gBAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;YACtF,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QAEF,MAAM,YAAY,GAAG;YACnB,MAAM,EAAK,WAAW,CAAC,YAAY,CAAC;YACpC,MAAM,EAAK,WAAW,CAAC,YAAY,CAAC;YACpC,QAAQ,EAAG,WAAW,CAAC,cAAc,CAAC;YACtC,IAAI,EAAO,WAAW,CAAC,UAAU,CAAC;YAClC,OAAO,EAAI,WAAW,CAAC,aAAa,CAAC;SACtC,CAAC;QACF,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QAEhF,MAAM,SAAS,GAA4B,EAAE,CAAC;QAC9C,IAAI,cAAc;YAAE,SAAS,CAAC,GAAG,GAAG,YAAY,CAAC;QACjD,MAAM,QAAQ,GAAS,YAAY,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAM,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QAClE,MAAM,cAAc,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;QACvD,IAAI,QAAQ,KAAW,SAAS;YAAE,SAAS,CAAC,QAAQ,GAAS,QAAQ,CAAC;QACtE,IAAI,WAAW,KAAQ,SAAS;YAAE,SAAS,CAAC,WAAW,GAAM,WAAW,CAAC;QACzE,IAAI,cAAc,KAAK,SAAS;YAAE,SAAS,CAAC,cAAc,GAAG,cAAc,CAAC;QAE5E,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAE1D,MAAM,MAAM,GAAG,oCAAoC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE;gBACtE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;aACnF,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;CACF,CAAA;AA/mCY,8BAA8B;IAD1C,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAClD,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAChE,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IASlD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;yDAb8B,uBAAuB;GAP3F,8BAA8B,CA+mC1C","sourcesContent":["/*\n AnonymousSessionBackendService (W7.3a)\n \n Manages anonymous session lifecycle: user creation (upsert),\n * JWT signing/verification, and ownership transposition on registration.\n /\n\nimport crypto from 'crypto';\nimport { inject, injectable } from 'inversify';\nimport jwt from 'jsonwebtoken';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport {\n ANONYMOUS_SESSION_JWT_EXPIRY_STRING,\n ANONYMOUS_SESSION_JWT_FORMAT,\n AnonymousSessionJwtPayloadSchema,\n AnonymousUserMarketingMetadataSchema,\n AnonymousUserTranspositionStatus,\n CoreResourceOperation,\n CoreResourceType,\n CORE_APP_ROLES,\n ErrorCustomMessageReference,\n ErrorType,\n ResourcePrimaryScope,\n ResourceTranspositionPolicy,\n WildoHeaderKeys,\n isServiceResolvableDefaultOperation,\n type AnonymousUserMarketingMetadata,\n type ResourceType,\n} from '@wildo-ai/saas-models';\nimport type { RateLimitBackendService } from '~wildo-backend-lib/errors/services/rate-limit.backend.service';\nimport { getClientIpFromRequest } from '~wildo-backend-lib/runtime/utils/request-client-ip.utils';\nimport { AuthControllerUtils } from '~wildo-backend-lib/security/authentications/services/utils/auth-controller.utils';\nimport type { Request, Response } from 'express';\n\nexport interface TranspositionResult {\n transposedTypes: ResourceType[];\n /\n Resource types whose anonymous rows were DELETED because the resource declares\n * `ResourceTranspositionPolicy.DISCARD` — the conversion's other terminal outcome.\n \n A separate bucket rather than a second meaning for `transposedTypes`: \"the account now owns\n * these rows\" and \"these rows no longer exist\" are opposite facts about the visitor's data, and a\n * log line or a support answer built from the merged list would be wrong for half its members.\n * Both nonetheless count as PROGRESS for the status arithmetic — see {@link\n * AnonymousSessionBackendService.transposeOwnership}.\n /\n discardedTypes: ResourceType[];\n failedTypes: { resourceType: ResourceType; error: string }[];\n status: AnonymousUserTranspositionStatus;\n}\n\n/\n What one pass of {@link AnonymousSessionBackendService.reconcileIncompleteTranspositions} did.\n \n `sessionsRepaired` counts sessions this pass MOVED something for OR whose stamp it corrected;\n * `sessionsStillIncomplete` counts sessions that still have rows the account cannot see after the\n * pass — the population a human should look at, because a repeatedly-failing type is a defect, not\n * a transient.\n /\nexport interface TranspositionReconciliationResult {\n candidatesExamined: number;\n sessionsRepaired: number;\n sessionsStillIncomplete: number;\n resourceTypesTransposed: number;\n /* Resource types whose leftover anonymous rows this pass DELETED under a `DISCARD` policy. /\n resourceTypesDiscarded: number;\n errors: number;\n}\n\n@injectable()\nexport class AnonymousSessionBackendService {\n\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly configService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.ResourceRegistryService) private readonly resourcesRegistry: ResourcesRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService) private readonly executionContextCreator: ExecutionContextCreatorBackendService,\n @inject(SAAS_SERVICE_TYPES.RateLimitBackendService) private readonly rateLimitService: RateLimitBackendService,\n // Appended LAST (positional-DI stability). The in-process session-init +\n // ownership-transposition writes carry `.isBackendOnly()` material\n // (`marketingMetadata`) and context-auto-populated FK names\n // (`userId` / `anonymousUserId`) that a plain `servicesRegistryHandler` write\n // strict-parses OUT — silent attribution loss on create, silent no-op `$set`\n // on the transposition. The trusted `createAsSystem` / `updateAsSystem` /\n // `updateManyAsSystem` primitives re-attach exactly those fields after the\n // strict parse, fail-closed behind each resource's `systemAccessPolicy`.\n @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n ) {\n this.logDebug = this.logger.debugByType('AnonymousSessionBackendService');\n }\n\n /\n Upsert an AnonymousUser record. Catches duplicate key errors to handle\n * concurrent session init from multiple tabs sending the same UUID.\n \n Rate-limit policy (PR 4 of the rate-limit unification, Step 5 — first\n * imperative-to-declarative migration wave):\n * - 10 requests/minute/IP and 100 requests/hour/IP, AND-ed.\n * - Enforced via `RateLimitBackendService.checkPolicy` (System 3) instead\n * of the previous twin `checkRateLimit` calls (System 2). The policy\n * semantics are identical; only the surface and Redis key shape change\n * (`auth:anon-session:init:<ip>:minute\|hour` instead of two custom\n * prefixes). Standard `X-RateLimit-` and `Retry-After` headers are\n now written on the 429 path — previously absent at this seam.\n * - Identifier is the client IP (no organization context at session\n * init by definition; C-2).\n \n Concurrent-tabs accounting note (F-11): the rate-limit check runs\n * BEFORE the duplicate-key fast path below, so N tabs racing the same\n * UUID will each consume a slot from the per-minute / per-hour budget\n * even though only one performs the actual MongoDB insert. This is\n * intentional — moving the check past the duplicate-key catch would\n * make the limiter trivially defeatable by spamming the same UUID. The\n * 10/min budget absorbs realistic browser tab counts comfortably.\n /\n async createAnonymousUser(anonymousUserId: string, req: Request, res: Response): Promise<void> {\n // Canonical IP extraction (F-5 of the rate-limit unification audit).\n // Still needed locally for `hashIp` (privacy-preserving audit trail);\n // `checkPolicy` re-derives the same IP internally via the same helper,\n // so the rate-limit bucket and the stored hash always agree.\n const clientIp = getClientIpFromRequest(req);\n\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 10, requestsPerHour: 100 },\n 'auth:anon-session:init',\n );\n\n const ipHash = this.hashIp(clientIp);\n\n try {\n // Phase 0.5 (Q-D=β): first-touch marketing attribution. Captured\n // ONCE here at session-init and never overwritten by subsequent\n // requests — this is the anchor write site. Subsequent requests\n // hit the same anonymous user via JWT and carry no attribution.\n const marketingMetadata = this.extractFirstTouchMarketingMetadata(req);\n\n // The client-generated session UUID is persisted as `uuidRef` (the anonymous\n // user's relational identity), NOT `_id`: `_id` is a normal server-minted\n // ObjectId. So this is an ordinary create — `_id` is server-generated and never\n // in the payload, which is exactly why it no longer crashes the strict-DTO parse\n // (a client `_id` used to be a required-but-discarded field).\n //\n // `createAsSystem` (not a plain `servicesRegistryHandler.create`) is required\n // because `marketingMetadata` is `.isBackendOnly()` and would otherwise be\n // strict-parsed OUT against the client-shaped request DTO (first-touch\n // attribution silently lost); the primitive re-attaches the schema-derived\n // backend-only allowlist after the parse and synthesises its own super-admin\n // context — ANONYMOUS_USERS CREATE is INTERNAL_CALL (no HTTP surface) — fail-closed\n // behind `systemAccessPolicy.create`. `uuidRef` is an ordinary (non-backend-only)\n // field and rides the normal create payload.\n //\n // Concurrent tabs / cross-origin re-init send the SAME `uuidRef`; the unique\n // index on `uuidRef` makes the second insert an E11000 duplicate-key, caught\n // below and treated as success (the AnonymousUser already exists).\n await this.systemAccessService.createAsSystem(CoreResourceType.ANONYMOUS_USERS, {\n uuidRef: anonymousUserId,\n privacy: { consentTimestamp: new Date(), ipRetentionDays: 30 },\n userAgent: req.headers[WildoHeaderKeys.USER_AGENT]?.substring(0, 256),\n ipHash,\n ...(marketingMetadata ? { marketingMetadata } : {}),\n });\n this.logDebug('AnonymousUser created', {\n anonymousUserId,\n hasMarketingMetadata: marketingMetadata !== undefined,\n });\n } catch (error: any) {\n if (error?.code === 11000 \|\| error?.message?.includes('duplicate key') \|\| error?.message?.includes('E11000')) {\n this.logDebug('AnonymousUser already exists (concurrent init), treating as success', { anonymousUserId });\n return;\n }\n this.logger.error('Failed to create AnonymousUser', { anonymousUserId, error });\n throw error;\n }\n }\n\n /\n Sign a session JWT using the platform session HMAC secret.\n \n Algorithm + expiry are pinned by the shared contract in\n * `@wildo-ai/saas-models` so any future client (e.g. the\n * marketing-site `WebsiteAnonymousSessionContext`) that wants to\n * peek at the JWT for diagnostic UI agrees on the bit-level shape.\n /\n signSessionToken(anonymousUserId: string): string {\n const secret = this.configService.secrets.security.session.secret;\n return jwt.sign(\n { anonymousUserId },\n secret,\n { algorithm: ANONYMOUS_SESSION_JWT_FORMAT.algorithm, expiresIn: ANONYMOUS_SESSION_JWT_EXPIRY_STRING }\n );\n }\n\n /\n Verify a session JWT. Returns the anonymousUserId or throws.\n \n The decoded payload is validated against the shared\n * `AnonymousSessionJwtPayloadSchema` (Zod) — a defensive check that\n * guards against any future drift between signer and verifier and\n * gives a structured error if a malformed payload ever reaches us.\n /\n verifySessionToken(token: string): { anonymousUserId: string } {\n const secret = this.configService.secrets.security.session.secret;\n try {\n const decoded = jwt.verify(token, secret, {\n algorithms: [ANONYMOUS_SESSION_JWT_FORMAT.algorithm],\n clockTolerance: 30,\n });\n\n const payload = AnonymousSessionJwtPayloadSchema.parse(decoded);\n\n return { anonymousUserId: payload.anonymousUserId };\n } catch (error) {\n if (error instanceof jwt.TokenExpiredError) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_EXPIRED }\n );\n }\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID }\n );\n }\n }\n\n /\n Assert the anonymous subject behind an already-cryptographically-verified session token is STILL a\n * live, un-converted anonymous identity — the server-side revocation handle the stateless anon JWT\n * otherwise lacks entirely.\n \n {@link verifySessionToken} proves only that WE signed the token and it has not expired; it says\n * NOTHING about the subject. This re-reads the `ANONYMOUS_USERS` row by its unique `uuidRef` and\n * rejects — as `AUTHENTICATION_SESSION_INVALID`, deliberately indistinguishable from a bad token so a\n * caller cannot probe whether a given `uuidRef` was converted vs. never existed — when either:\n * - the row is ABSENT: the identity was hard-deleted, swept by the cleanup batch, or erased, so a\n * retained token must die with the identity it names; or\n * - `convertedToUserId` is set: the subject upgraded to an authenticated user. A retained anon token\n * must NOT keep acting under the old pseudonymous `uuidRef` — otherwise it could mint fresh anon\n * rows that re-establish the very identity linkage conversion is meant to sever. Post-conversion\n * the client holds a real JWT and no longer needs this one (`handleAnonymousTransposition` clears\n * the anon cookie on COMPLETE/PARTIAL), so a request still bearing it is a stale/hostile replay.\n \n This is the anon-plane analogue of the USERS auth front's row re-read + version/status checks\n * (`execution-context-creator._fetchUserAndBuildRoles`). The anon token carries NO `userId` — so the\n * `TOKEN_INVALID_BEFORE:<userId>` fence structurally cannot reach it — and has NO refresh, so a\n * per-request row liveness check is the ONE place a revocation can land. Deliberately NOT\n * `readAsSystem`/`listAsSystem`: those emit a `SYSTEM_CONTEXT_READ` audit per call, which on this\n * per-request path would drown that signal — this is a routine liveness check, not a privileged data\n * access. It is one indexed lookup on the `uuidRef` unique index; the anon path is lower-QPS than the\n * authenticated USERS path, which already performs a per-request row read.\n /\n async assertAnonymousSubjectStillLive(anonymousUserId: string): Promise<void> {\n const listOpPath = this.resourcesRegistry.getServiceOperationPathDefault(CoreResourceType.ANONYMOUS_USERS, CoreResourceOperation.LIST);\n const ec = await this.executionContextCreator.createForInternalOperation({\n operation: listOpPath,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null,\n initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n });\n\n // Target by `{ uuidRef }` (the client session handle), NOT a bare id — the row's `_id` is a server\n // ObjectId, so an id arg would resolve to `{ _id: <uuidRef> }` and match nothing (cf. transposeOwnership).\n const listResult = await this.servicesRegistryHandler.list<{ convertedToUserId?: string \| null }>(\n CoreResourceType.ANONYMOUS_USERS, ec, { uuidRef: anonymousUserId }, { page: 1, limit: 1 }\n );\n const rows = Array.isArray(listResult) ? listResult : listResult.data;\n const row = rows?.[0];\n\n if (!row) {\n this.logDebug('Anonymous session rejected — subject row absent (hard-deleted / swept / erased)', { anonymousUserId });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,\n });\n }\n if (row.convertedToUserId) {\n this.logDebug('Anonymous session rejected — subject already converted to an authenticated user', { anonymousUserId });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,\n });\n }\n }\n\n /\n Set the parent-domain anonymous-session continuity cookie\n * (`__wildo_anon_session`) on the response, alongside the\n * `x-anonymous-session-token` header, when a session is minted.\n \n The cookie is what carries the anonymous session across the\n * marketing-site apex → app → API origins so a website-captured lead\n * / draft transposes on app signup with NO frontend handoff — the\n * app's login reads it as a fallback to the `x-anonymous-session`\n * header. Cookie attributes (`SameSite=Lax`, parent `Domain`,\n * `Path=/api/v1`, 24h `Max-Age`) live on\n * `AuthControllerUtils.setAnonymousSessionCookie` /\n * `ANONYMOUS_SESSION_COOKIE_NAME`.\n \n `Domain` comes from `auth.anonymousSessionCookieDomain` (unset ⇒\n * host-only, correct for localhost dev where the port-agnostic host\n * cookie already spans the dev ports); `Max-Age` matches the anon\n * JWT's `expirySeconds`.\n /\n setSessionCookie(res: Response, token: string): void {\n AuthControllerUtils.setAnonymousSessionCookie(\n res,\n token,\n this.configService.config.auth.anonymousSessionCookieDomain,\n this.configService.applicationEnv,\n ANONYMOUS_SESSION_JWT_FORMAT.expirySeconds,\n );\n }\n\n /\n Clear the anonymous-session continuity cookie. Called after a\n * successful transposition (the anonymous rows now belong to the\n * authenticated user, so the session has served its purpose) and on\n * session clear. Delegates to `AuthControllerUtils` with the SAME\n * config-resolved `Domain` the cookie was set with, so the browser\n * actually honours the deletion.\n /\n clearSessionCookie(res: Response): void {\n AuthControllerUtils.clearAnonymousSessionCookie(\n res,\n this.configService.config.auth.anonymousSessionCookieDomain,\n this.configService.applicationEnv,\n );\n }\n\n /\n Transpose ownership of all isAnonymizable resources from an anonymous user\n * to an authenticated user. Called during registration/login when the user\n * had prior anonymous activity.\n \n Checks that the target userType has anonymousSessionsEnabled before proceeding.\n * If the userType does not support anonymous sessions, returns an empty result.\n /\n async transposeOwnership(\n anonymousUserId: string,\n authenticatedUserId: string,\n userType: string\n ): Promise<TranspositionResult> {\n const userTypePolicy = this.configService.getUserTypeAuthPolicy(userType);\n if (!userTypePolicy?.anonymousSessionsEnabled) {\n this.logDebug('Skipping transposition — anonymousSessionsEnabled is false for user type', { userType, anonymousUserId });\n return { transposedTypes: [], discardedTypes: [], failedTypes: [], status: AnonymousUserTranspositionStatus.PENDING };\n }\n\n const { transposedTypes, discardedTypes, failedTypes } = await this.applyOwnershipTransposition(\n anonymousUserId,\n authenticatedUserId,\n // The CONVERSION pass is the one moment a declared REPLACE policy may be honoured — see the\n // long note on `applyOwnershipTransposition`'s `applyReplacePolicy` for why a later\n // reconciliation pass must NOT re-apply it.\n { applyReplacePolicy: true },\n );\n\n // PARTIAL means \"some of the work landed\", and a DISCARD sweep is work: those rows are gone and\n // no later pass will find them. Counting only `transposedTypes` here would stamp PENDING on a\n // session whose only successful type was a DISCARD — a status that says nothing happened about a\n // session whose data was deleted.\n const status = failedTypes.length === 0\n ? AnonymousUserTranspositionStatus.COMPLETE\n : transposedTypes.length + discardedTypes.length > 0\n ? AnonymousUserTranspositionStatus.PARTIAL\n : AnonymousUserTranspositionStatus.PENDING;\n\n await this.recordTranspositionOutcome(anonymousUserId, authenticatedUserId, status);\n\n return { transposedTypes, discardedTypes, failedTypes, status };\n }\n\n /\n Move every still-anonymous row this session owns onto the authenticated user, one resource type\n * at a time. Shared by the CONVERSION pass ({@link transposeOwnership}) and the RECONCILIATION\n * pass ({@link reconcileIncompleteTranspositions}) so the two can never drift into two different\n * notions of what a transposition is.\n \n ### The idempotency contract, and why it is STRUCTURAL rather than a flag\n * Every read goes through {@link listAnonymousRecords}, which filters `{ anonymousUserId, userId:\n * null }`. The write flips a row to `{ userId: <account>, anonymousUserId: null }`. So a row that\n * has already moved is invisible to every subsequent pass, per resource type, with no bookkeeping\n * anywhere: re-running this method can only ever act on rows that genuinely have not moved yet.\n \n That is deliberate. A \"which types have I already done?\" marker on the AnonymousUser row would\n * be a second ledger next to the data it describes, and it would be written by exactly the\n * best-effort write whose failure created the split in the first place. The data answers the\n * question; nothing else needs to.\n \n ### Why a per-type failure is still SWALLOWED here\n * One resource type failing must not lose the others — a visitor whose draft notes move but whose\n * lead capture does not is strictly better off than one where neither moved because the first\n * throw aborted the loop. That reasoning was always sound. What was missing is what happens\n * NEXT, and that is now {@link reconcileIncompleteTranspositions} rather than a status stamp\n * nobody reads.\n \n @param applyReplacePolicy honour `ResourceTranspositionPolicy.REPLACE` (delete the account's\n * existing rows of that type before moving the anonymous ones). TRUE only on the conversion\n * pass. On a reconciliation pass it MUST be false: REPLACE expresses \"the anonymous draft wins\n * over whatever the account had AT THE MOMENT OF CONVERSION\", and re-applying it hours or days\n * later would delete rows the user authored after converting — turning a repair into data\n * loss, which is far worse than the residual it would fix.\n \n The residual, stated plainly: if the REPLACE delete itself failed at conversion time, the\n * reconciliation moves the anonymous rows in ADD fashion, so the account ends up holding both\n * sets. That is visible, non-destructive and recoverable by the user; the alternative is not.\n * Rejected alternative: record \"REPLACE was applied for type T\" durably and let the reconcile\n * consult it — that is precisely the second ledger this design refuses, and it would be written\n * by the same fallible pass.\n \n ### DISCARD DELETES, and it deletes on BOTH passes — unlike REPLACE\n * `DISCARD` used to `continue` past the type entirely, which left its rows carrying\n * `{ anonymousUserId, userId: null }` FOREVER: the conversion had already set `convertedToUserId`,\n * so the cleanup batch's phase 1 (`{ convertedToUserId: null }`) could no longer see the session,\n * and phase 2 deletes only the `ANONYMOUS_USERS` anchor row. After the retention window the anchor\n * was gone and the rows remained, pointing at an identity that no longer exists — an orphan with a\n * dangling foreign key, and no population definition by which any later sweep could find it.\n \n So the delete happens HERE, at conversion time, where the anchor still exists and the population\n * is exactly \"the rows this list just returned\". The rejected alternative was a later sweep, which\n * would have to recognise the same rows AFTER phase 2 removed the only thing that names them —\n * a recognition problem that deleting at conversion makes unnecessary.\n \n It is deliberately NOT gated on `applyReplacePolicy`, and the asymmetry with REPLACE is the\n * whole reason that flag exists in the first place. REPLACE deletes the ACCOUNT's rows, so\n * re-applying it later destroys work the user did after converting. DISCARD deletes the ANONYMOUS\n * rows — rows the account has never been able to see and that the resource declared it never wants\n * carried over. Deleting them a day late is the same act, not a destructive one, so a\n * reconciliation pass may and must finish a DISCARD the conversion could not.\n \n A DISCARD failure is recorded in `failedTypes` and the loop continues — the same treatment as\n * every other per-type failure, and for the stronger reason: this runs inside a live conversion,\n * and a conversion that half-runs (the user cannot complete sign-in) is worse than a row that\n * survives until the next reconciliation pass, which will retry it before phase 2 can retire the\n * anchor.\n /\n private async applyOwnershipTransposition(\n anonymousUserId: string,\n authenticatedUserId: string,\n { applyReplacePolicy }: { applyReplacePolicy: boolean },\n ): Promise<{\n transposedTypes: ResourceType[];\n discardedTypes: ResourceType[];\n failedTypes: { resourceType: ResourceType; error: string }[];\n }> {\n const transposedTypes: ResourceType[] = [];\n const discardedTypes: ResourceType[] = [];\n const failedTypes: { resourceType: ResourceType; error: string }[] = [];\n\n const anonymizableTypes = this.getAnonymizableResourceTypes();\n\n for (const resourceType of anonymizableTypes) {\n const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType);\n const policy = resourceConfig?.transpositionPolicy ?? ResourceTranspositionPolicy.ADD;\n\n try {\n const records = await this.listAnonymousRecords(resourceType, anonymousUserId);\n\n if (!records \|\| records.length === 0) continue;\n\n const ids = records.map((r: any) => r._id);\n\n if (policy === ResourceTranspositionPolicy.DISCARD) {\n // Same structural idempotency as the reassignment below: the read filters\n // `{ anonymousUserId, userId: null }`, and a deleted row matches nothing, so a re-run can\n // only ever act on rows that are genuinely still there.\n await this.deleteOwnedRecords(resourceType, ids);\n discardedTypes.push(resourceType);\n this.logDebug('Discarded anonymous records (DISCARD policy)', {\n resourceType, count: ids.length, anonymousUserId, authenticatedUserId,\n });\n continue;\n }\n\n if (policy === ResourceTranspositionPolicy.REPLACE && applyReplacePolicy) {\n await this.deleteExistingUserRecords(resourceType, authenticatedUserId);\n }\n\n /\n * No MERGE arm: the member was removed from `ResourceTranspositionPolicy` on 2026-09-08.\n * It used to warn here and fall through to the reassignment below, which meant a resource\n * declaring MERGE silently got ADD. With the member gone this branch is unreachable, and\n * the warning would have been a claim about a state no config can author.\n /\n await this.reassignOwnership(resourceType, ids, authenticatedUserId);\n\n transposedTypes.push(resourceType);\n this.logDebug('Transposed ownership', {\n resourceType, policy, count: ids.length, anonymousUserId, authenticatedUserId,\n });\n } catch (error) {\n const errorMsg = describeCaughtError(error);\n failedTypes.push({ resourceType, error: errorMsg });\n this.logger.error('Transposition failed for resource type', {\n resourceType, policy, anonymousUserId, authenticatedUserId, error: errorMsg,\n });\n }\n }\n\n // ── Manual transposition for INBOUND_CONTACTS (Phase 0.5, Q-E=B) ──\n //\n // INBOUND_CONTACTS is APPLICATION-scoped (not USER_SELF) and therefore\n // does NOT carry `isAnonymizable: true` — the generic transposition\n // loop above (which gates on isAnonymizable) does not see it.\n //\n // The lead-capture FK chain is `{ anonymousUserId } → { userId,\n // anonymousUserId: null }`: when the anonymous user converts, all\n // leads they submitted are reassigned to their authenticated user\n // identity, and the anonymous link is cleared so the upcoming\n // anonymous-session cleanup batch does not look at them.\n //\n // We invoke the dedicated helper after the generic loop so its\n // result rolls into the same transposedTypes/failedTypes report\n // and the AnonymousUser.transpositionStatus update below reflects\n // the full conversion outcome.\n //\n // It has no DISCARD arm and needs none: `transpositionPolicy` is normalized to `undefined` for\n // any resource that is not `isAnonymizable` (`resources-config.shared.factory.ts`), and\n // `INBOUND_CONTACTS` cannot be — the flag requires USER_SELF scope. So no configuration can\n // declare DISCARD for this type; there is no silently-ADD'ed policy here, which is the failure\n // shape the removed MERGE member had.\n try {\n const inboundContactsTransposedCount = await this.transposeInboundContactsOwnership(\n anonymousUserId,\n authenticatedUserId,\n );\n if (inboundContactsTransposedCount > 0) {\n transposedTypes.push(CoreResourceType.INBOUND_CONTACTS);\n this.logDebug('Transposed inbound contacts', {\n anonymousUserId, authenticatedUserId, count: inboundContactsTransposedCount,\n });\n }\n } catch (error) {\n const errorMsg = describeCaughtError(error);\n failedTypes.push({ resourceType: CoreResourceType.INBOUND_CONTACTS, error: errorMsg });\n this.logger.error('InboundContacts transposition failed', {\n anonymousUserId, authenticatedUserId, error: errorMsg,\n });\n }\n\n return { transposedTypes, discardedTypes, failedTypes };\n }\n\n /\n Write the conversion outcome onto the AnonymousUser row: `convertedToUserId` (WHICH account the\n * session became) and `transpositionStatus` (how far the move got).\n \n ### This write REFUSES. It is the one step here that may not be best effort.\n * Every other failure in a transposition is survivable because the DATA still says what happened:\n * a row that moved carries the account's `userId`, a row that did not still carries the\n * `anonymousUserId`. `convertedToUserId` is different — it is the ONLY place the anon→account\n * mapping is ever recorded. Lose it and no later pass can know which account the leftover rows\n * were supposed to reach, so a recoverable partial becomes permanent.\n \n It is not merely unrecoverable, it is actively destructive: `cleanupExpiredSessions` selects\n * `{ convertedToUserId: null, createdAt < 48h }` and DELETES that session's remaining anonymous\n * rows. So a swallowed failure here schedules the visitor's un-moved rows for deletion two days\n * later, silently — the exact \"record that it stopped and never revisit it\" shape this method now\n * refuses to produce.\n \n Throwing costs the caller nothing it was relying on. Both triggers\n * (`handleAnonymousTransposition` / `...ForTokenExchange` in the authentication controller) already\n * wrap the call in a non-blocking catch, so the authentication response is unaffected — and\n * because their `clearSessionCookie` sits AFTER the call, a throw also KEEPS the continuity cookie,\n * which is precisely the retry channel: the next login presents the same session handle and the\n * whole transposition runs again, idempotently (see `applyOwnershipTransposition`).\n \n Deliberately NOT routed through `updateAsSystem` (unlike the ownership transposition writes).\n * `convertedToUserId` and `transpositionStatus` are ordinary fields — neither `.isBackendOnly()`\n * nor context-auto-populated FK names — so they survive the strict-DTO parse; there is nothing for\n * the primitive to re-attach. Migrating would only add a fail-closed opt-in and an audit row for\n * no correctness gain, so the plain internal-EC handler stays. (ANONYMOUS_USERS opts into\n * `systemAccessPolicy.create` only.)\n /\n private async recordTranspositionOutcome(\n anonymousUserId: string,\n authenticatedUserId: string,\n status: AnonymousUserTranspositionStatus,\n ): Promise<void> {\n const updateOpPath = this.resourcesRegistry.getServiceOperationPathDefault(CoreResourceType.ANONYMOUS_USERS, CoreResourceOperation.UPDATE);\n const anonymousUserEc = await this.executionContextCreator.createForInternalOperation({\n operation: updateOpPath,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null,\n initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n });\n\n // Target the row by `{ uuidRef }`, NOT the session id directly: the session id\n // (from the JWT) is the client `uuidRef`, while the row's `_id` is a server\n // ObjectId — a bare id arg would resolve to `{ _id: <uuidRef> }` and match nothing.\n await this.servicesRegistryHandler.update(\n CoreResourceType.ANONYMOUS_USERS, anonymousUserEc, { uuidRef: anonymousUserId },\n { convertedToUserId: authenticatedUserId, transpositionStatus: status }\n );\n }\n\n /\n Finish the transpositions that stopped part-way, instead of leaving the stamp that says they\n * did. Runs as phase 0 of the anonymous-session cleanup batch — before the deletion phases, which\n * is the whole point: the batch that would otherwise walk past these rows repairs them first.\n \n ### What it is looking for\n * A converted session whose data is still SPLIT: some rows on the account, some still carrying\n * `{ anonymousUserId, userId: null }` because a resource type threw during the conversion pass.\n * The account cannot see those rows, and nothing was ever going to come back for them.\n \n ### Why the candidate query keys on the stamp but the REPAIR keys on the data\n * The stamp is a cheap INDEX into the population, not the authority. `{ convertedToUserId != null,\n * transpositionStatus != COMPLETE }` is a superset of the genuinely-split sessions: after the\n * conversion pass, `convertedToUserId` and `transpositionStatus` are written by ONE update, so a\n * row that names an account always carries a stamp, and a stamp that is not COMPLETE means at\n * least one type failed at that time. What the stamp cannot tell us is whether the split is\n * STILL there — a transient repository error may since have cleared, and (before this method\n * existed) a fully-successful move could be left stamped PENDING by a status write that failed on\n * its own. So the stamp only selects who to LOOK at; `applyOwnershipTransposition` reads the rows\n * and decides. A session that turns out to be whole gets its stamp corrected to COMPLETE, which\n * is how the stamp-only split heals and how the candidate set stays small.\n \n ### The population this can NEVER repair, stated so nobody looks for it\n * A session whose conversion-time status write failed BEFORE this change has `convertedToUserId:\n * null`, and the account it converted into was never written down anywhere. It is indistinguishable\n * from a visitor who never signed up, and its leftover rows were deleted by the 48h cleanup. There\n * is no backfill for those; {@link recordTranspositionOutcome} refusing is what stops new ones.\n /\n async reconcileIncompleteTranspositions(options?: {\n batchSize?: number;\n maxIterations?: number;\n }): Promise<TranspositionReconciliationResult> {\n const result: TranspositionReconciliationResult = {\n candidatesExamined: 0, sessionsRepaired: 0, sessionsStillIncomplete: 0,\n resourceTypesTransposed: 0, resourceTypesDiscarded: 0, errors: 0,\n };\n\n if (!this.configService.anonymousSessionsEnabled) {\n this.logDebug('Anonymous sessions not enabled — skipping transposition reconciliation');\n return result;\n }\n\n const batchSize = options?.batchSize ?? 100;\n const maxIterations = options?.maxIterations ?? 100;\n\n const listOpPath = this.resourcesRegistry.getServiceOperationPathDefault(CoreResourceType.ANONYMOUS_USERS, CoreResourceOperation.LIST);\n\n // Pagination over a set the pass itself SHRINKS. A repaired session leaves the candidate filter\n // (its stamp becomes COMPLETE), so re-reading page 1 keeps yielding fresh work and no cursor is\n // needed for the common case. A session that stays incomplete does NOT leave the filter, so it\n // reappears on every read; `stuck` remembers those by handle so they are (a) attempted once per\n // pass and (b) skipped past by the page offset once they fill a whole batch.\n //\n // The offset MUST be derived from a SET, not a counter. A counter incremented on every sighting\n // grows each iteration for the same handful of stuck sessions, and once it crossed `batchSize`\n // the page would jump forward and silently skip a batch of genuinely repairable sessions —\n // a reconciliation that reports success while walking past the work.\n const stuck = new Set<string>();\n let iteration = 0;\n while (iteration < maxIterations) {\n iteration++;\n const page = Math.floor(stuck.size / batchSize) + 1;\n\n const listEc = await this.executionContextCreator.createForInternalOperation({\n operation: listOpPath,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null,\n initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n });\n const listResult = await this.servicesRegistryHandler.list<any>(\n CoreResourceType.ANONYMOUS_USERS,\n listEc,\n { convertedToUserId: { $ne: null }, transpositionStatus: { $ne: AnonymousUserTranspositionStatus.COMPLETE } },\n { page, limit: batchSize },\n );\n const candidates: any[] = Array.isArray(listResult) ? listResult : listResult.data;\n if (candidates.length === 0) break;\n\n for (const candidate of candidates) {\n // A session already attempted this pass is re-read but not re-attempted: retrying it inside\n // one pass would just fail again, and counting it twice is what corrupts the page offset.\n if (typeof candidate.uuidRef === 'string' && stuck.has(candidate.uuidRef)) continue;\n result.candidatesExamined++;\n // `uuidRef` is the relational handle children carry in `anonymousUserId`; `_id` is a pure\n // internal storage id that matches no child. Using `_id` here would find nothing to move and\n // report every split session as already whole — a green reconciliation over an empty search.\n const anonymousUserRef = candidate.uuidRef as string;\n const authenticatedUserId = candidate.convertedToUserId as string;\n if (!anonymousUserRef \|\| !authenticatedUserId) {\n // Cannot happen through the candidate filter, but a hand-edited row would land here and a\n // silent `continue` is how it would stay invisible.\n result.errors++;\n this.logger.warn('Skipping transposition reconciliation candidate with no session handle or target user', {\n anonymousUserRowId: candidate._id, hasUuidRef: !!anonymousUserRef, hasConvertedToUserId: !!authenticatedUserId,\n });\n continue;\n }\n\n try {\n const { transposedTypes, discardedTypes, failedTypes } = await this.applyOwnershipTransposition(\n anonymousUserRef,\n authenticatedUserId,\n // NEVER re-apply REPLACE outside the conversion moment — see `applyOwnershipTransposition`.\n // DISCARD is NOT subject to that restriction and runs here too: it deletes the ANONYMOUS\n // rows, never the account's, so finishing it late is the same act rather than a\n // destructive one. This is the only channel that can still reach a DISCARD row whose\n // conversion-time delete failed.\n { applyReplacePolicy: false },\n );\n result.resourceTypesTransposed += transposedTypes.length;\n result.resourceTypesDiscarded += discardedTypes.length;\n\n if (failedTypes.length > 0) {\n stuck.add(anonymousUserRef);\n // ERROR, not WARN: a type that failed at conversion AND fails again on a later pass is a\n // defect in that resource's write path, not a transient. Warn level is where this kind of\n // finding goes to die (a level-60 FATAL gate never sees it), so the repeated failure is\n // the thing that must be loud.\n this.logger.error('Anonymous transposition still incomplete after reconciliation', {\n anonymousUserRef, authenticatedUserId,\n failedTypes: failedTypes.map((f) => ({ resourceType: f.resourceType, error: f.error })),\n });\n continue;\n }\n\n // Nothing left un-moved for this session. Re-stamp COMPLETE — this both records the repair\n // and removes the row from the candidate set, so a converged session is never re-examined.\n await this.recordTranspositionOutcome(anonymousUserRef, authenticatedUserId, AnonymousUserTranspositionStatus.COMPLETE);\n result.sessionsRepaired++;\n this.logDebug('Reconciled anonymous transposition', {\n anonymousUserRef, authenticatedUserId, transposedTypes, discardedTypes,\n priorStatus: candidate.transpositionStatus ?? null,\n });\n } catch (error) {\n // The stamp write refused (see `recordTranspositionOutcome`), or the EC could not be built.\n // The session stays in the candidate set and is retried on the next batch run — which is\n // safe precisely because the move itself is idempotent.\n result.errors++;\n stuck.add(anonymousUserRef);\n this.logger.error('Anonymous transposition reconciliation failed for a session', {\n anonymousUserRef, authenticatedUserId, ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n if (candidates.length < batchSize) break;\n }\n\n result.sessionsStillIncomplete = stuck.size;\n return result;\n }\n\n /\n Transpose ownership of `INBOUND_CONTACTS` rows owned by the given\n * anonymous user to the now-authenticated user (Phase 0.5, Q-E=B).\n \n Why this lives outside the generic isAnonymizable loop:\n * `INBOUND_CONTACTS` is APPLICATION-scoped (org-owned admin\n * resource), not USER_SELF-scoped, and therefore cannot carry\n * `isAnonymizable: true` (the factory enforces USER_SELF for that\n * flag). The conversion semantics are the same — flip\n * `{ anonymousUserId } → { userId, anonymousUserId: null }` — but\n * they are wired manually here.\n \n Implementation notes:\n * - Lists by FK `anonymousUserId` (matches the registry edge\n * `ANONYMOUS_USERS → INBOUND_CONTACTS` declared in\n * `resources-registry.shared.core.definitions.ts`).\n * - Uses INTERNAL_CALL UPDATE (declared in\n * `inbound-contacts.shared.resources-config.schemas.ts`) — no\n * public admin-edit surface in Phase 0.5.\n * - Per-row UPDATE (not UPDATE_MANY) because conversion volume is\n * low (one anonymous session typically submits 0–1 leads) and\n * this avoids surfacing UPDATE_MANY just for transposition.\n \n @returns the number of leads transposed (0 if none).\n /\n private async transposeInboundContactsOwnership(\n anonymousUserId: string,\n authenticatedUserId: string,\n ): Promise<number> {\n const records = await this.listAnonymousRecords(\n CoreResourceType.INBOUND_CONTACTS,\n anonymousUserId,\n );\n\n if (!records \|\| records.length === 0) return 0;\n\n let transposedCount = 0;\n for (const record of records) {\n // `{ userId, anonymousUserId }` are context-auto-populated FK names the\n // client-shaped request DTO strips, so a plain `servicesRegistryHandler\n // .update` was a silent no-op `$set` (the lead's ownership never moved).\n // `updateAsSystem` re-attaches both FKs after the strict parse and\n // synthesises its own super-admin context, fail-closed behind\n // INBOUND_CONTACTS' `systemAccessPolicy.update`. Per-row (not UPDATE_MANY)\n // by design — see the method doc above.\n await this.systemAccessService.updateAsSystem(\n CoreResourceType.INBOUND_CONTACTS,\n record._id as string,\n { userId: authenticatedUserId, anonymousUserId: null },\n );\n transposedCount++;\n }\n return transposedCount;\n }\n\n /\n List the not-yet-converted rows an anonymous user owns, across BOTH the\n * generic `isAnonymizable` resources (USER_SELF-scoped, e.g. `draftNotes`) and\n * the manually-wired APPLICATION-scoped ones (`inboundContacts`).\n \n Scope by `anonymousUserId` as a DIRECT field filter — NOT via the EC\n * `contextResourcesFieldIdentifier` map. Putting the FK on the context map is\n * FATAL at EC-CREATION time for an APPLICATION-scoped resource: because\n * `INBOUND_CONTACTS`' LIST is APPLICATION-scoped, `createExecutionContext` runs\n * `populateApplicationIdIfNeeded`, which reads the singleton `applications`\n * record with THIS same EC. `applications` does not model `anonymousUserId`, so\n * its `buildContextualFilter` iterates the context map, hits the unknown field\n * and fails closed — `configuration` / `reason: 'context_filter'` /\n * resource `'applications'`. The throw happens INSIDE the creator (before\n * `list()` runs), so `excludeContextualFilter` on the `list()` call alone cannot\n * suppress it; the FK must stay off the context map.\n \n With the FK supplied explicitly, the caller owns the authoritative scope, so\n * the ambient contextual filter is skipped (`excludeContextualFilter: true`) —\n * the canonical explicit-scope repository-options pattern (cf. the\n * milestone/lifecycle evaluators and `NotificationBadgeBackendService`).\n * USER_SELF-scoped anonymizable resources never triggered the crash but are\n * filtered identically (`userId: null` keeps it to still-anonymous rows).\n /\n private async listAnonymousRecords(resourceType: ResourceType, anonymousUserId: string): Promise<any[]> {\n const listOpPath = this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.LIST);\n const listEc = await this.executionContextCreator.createForInternalOperation({\n operation: listOpPath,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null,\n initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n });\n return await this.servicesRegistryHandler.list<any>(\n resourceType,\n listEc,\n { anonymousUserId, userId: null },\n undefined,\n { paginated: false, excludeContextualFilter: true },\n ) as any[];\n }\n\n private async reassignOwnership(resourceType: ResourceType, ids: string[], authenticatedUserId: string): Promise<void> {\n // THE transposition write. The patch `{ userId, anonymousUserId }` is two\n // context-auto-populated FK names the client-shaped request DTO strips, so a\n // plain `servicesRegistryHandler.updateMany` was a silent no-op `$set` — the\n // anon→user ownership move never landed, and the rows were later deleted by the\n // expired-session cleanup batch (user-visible data loss on conversion).\n // `updateManyAsSystem` re-attaches both FKs after the strict parse and\n // synthesises its own super-admin context, fail-closed behind\n // `systemAccessPolicy.updateMany` — auto-granted by the factory to every\n // `isAnonymizable` resource (the only resources this dynamic loop iterates),\n // so no per-resource opt-in is required here.\n await this.systemAccessService.updateManyAsSystem(resourceType, ids, { userId: authenticatedUserId, anonymousUserId: null });\n }\n\n /\n Delete a known id set of a resource's rows, as the internal super-admin.\n \n THE single delete primitive of this service: the `DISCARD` transposition arm, the `REPLACE`\n * pre-delete and the expired-session cleanup all route through it, so \"how does this service\n * delete rows it owns\" has one answer and one place to fix.\n \n ### It resolves the operation it can actually serve, and that is not decoration\n * `isAnonymizable` is validated at config time to require LIST and UPDATE_MANY — the two ADD needs\n * — and says NOTHING about DELETE_MANY. Measured 2026-09-09: `draftNotes`, the only\n * `isAnonymizable` resource in this repository, declares `DELETE` and not `DELETE_MANY`. So the\n * previous unconditional `getServiceOperationPathDefault(resourceType, DELETE_MANY)` threw\n * `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` for it — which means the cleanup batch's phase 1\n * has never been able to delete an expired anonymous draft note: the per-session catch counted an\n * error, the `ANONYMOUS_USERS` row was never removed, and the same session was retried on every\n * run forever. A DISCARD sweep built on the same unconditional call would have shipped equally\n * dead.\n \n So: prefer `DELETE_MANY` when the resource declares a SERVICE-RESOLVABLE default for it, and\n * fall back to per-row `DELETE` otherwise. The probe is\n * {@link isServiceResolvableDefaultOperation} — the very predicate\n * `getServiceOperationPathDefault` admits on — so the probe and the resolver cannot disagree\n * (`try/catch` around the throwing resolver would also have \"worked\" and would have swallowed a\n * genuine registry corruption as a fallback). If NEITHER resolves, the `DELETE` lookup throws and\n * names the resource and the operation, which is the right outcome: a resource that can be\n * created anonymously and can never be deleted is a configuration defect, not a case to swallow.\n \n Per-row DELETE is the same trade `transposeInboundContactsOwnership` already documents: one\n * anonymous session owns a handful of rows, so the round trips are cheap, and requiring an\n * application to publish a bulk-delete surface it does not want is the worse price.\n /\n private async deleteOwnedRecords(resourceType: ResourceType, ids: string[]): Promise<void> {\n if (ids.length === 0) return;\n\n const operations = this.resourcesRegistry.getResourceConfiguration(resourceType)?.operations ?? [];\n const supportsDeleteMany = operations.some((operation: any) =>\n isServiceResolvableDefaultOperation(operation, CoreResourceOperation.DELETE_MANY));\n\n const operationIdentifier = supportsDeleteMany ? CoreResourceOperation.DELETE_MANY : CoreResourceOperation.DELETE;\n const deleteOpPath = this.resourcesRegistry.getServiceOperationPathDefault(resourceType, operationIdentifier);\n const deleteEc = await this.executionContextCreator.createForInternalOperation({\n operation: deleteOpPath,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null,\n initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n });\n\n if (supportsDeleteMany) {\n await this.servicesRegistryHandler.deleteMany(resourceType, deleteEc, ids);\n return;\n }\n for (const id of ids) {\n await this.servicesRegistryHandler.delete(resourceType, deleteEc, id);\n }\n }\n\n private async deleteExistingUserRecords(resourceType: ResourceType, userId: string): Promise<void> {\n const listOpPath = this.resourcesRegistry.getServiceOperationPathDefault(resourceType, CoreResourceOperation.LIST);\n const listEc = await this.executionContextCreator.createForInternalOperation({\n operation: listOpPath,\n contextResourcesFieldIdentifier: new Map([['userId', userId]]),\n initiatorIds: null,\n initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n });\n const existing = await this.servicesRegistryHandler.list<any>(resourceType, listEc, undefined, undefined, { paginated: false }) as any[];\n if (existing && existing.length > 0) {\n const ids = existing.map((r: any) => r._id);\n await this.deleteOwnedRecords(resourceType, ids);\n this.logDebug('Deleted existing user records (REPLACE policy)', { resourceType, userId, count: ids.length });\n }\n }\n\n /\n Cleanup expired, unconverted anonymous sessions and their owned resources.\n * Called by the anonymous-session-cleanup batch job.\n /\n async cleanupExpiredSessions(options?: {\n sessionTtlMs?: number;\n batchSize?: number;\n maxIterations?: number;\n convertedRetentionMs?: number;\n }): Promise<{\n expiredUsersFound: number;\n resourcesDeleted: number;\n usersArchived: number;\n convertedUsersCleaned: number;\n errors: number;\n transpositionsReconciled: TranspositionReconciliationResult;\n }> {\n const FORTY_EIGHT_HOURS_MS = 48 60 * 60 * 1000;\n const NINETY_DAYS_MS = 90 * 24 * 60 * 60 * 1000;\n const sessionTtlMs = options?.sessionTtlMs ?? FORTY_EIGHT_HOURS_MS;\n const batchSize = options?.batchSize ?? 100;\n const maxIterations = options?.maxIterations ?? 100;\n const convertedRetentionMs = options?.convertedRetentionMs ?? NINETY_DAYS_MS;\n const cutoff = new Date(Date.now() - sessionTtlMs);\n\n const emptyReconciliation: TranspositionReconciliationResult = {\n candidatesExamined: 0, sessionsRepaired: 0, sessionsStillIncomplete: 0,\n resourceTypesTransposed: 0, resourceTypesDiscarded: 0, errors: 0,\n };\n\n if (!this.configService.anonymousSessionsEnabled) {\n this.logDebug('Anonymous sessions not enabled — skipping cleanup');\n return {\n expiredUsersFound: 0, resourcesDeleted: 0, usersArchived: 0, convertedUsersCleaned: 0, errors: 0,\n transpositionsReconciled: emptyReconciliation,\n };\n }\n\n // ── Phase 0: finish the transpositions that stopped part-way ──\n //\n // BEFORE the two deletion phases, deliberately. This batch is the only recurring pass over the\n // anonymous-session population, so it is where a half-finished conversion is either repaired or\n // walked past forever — and phase 2 removes the converted AnonymousUser row (the sole record of\n // which account the leftovers belong to) once retention expires. Repairing first means the row\n // is only ever retired after its data has been asked about.\n //\n // Not gated on the deletion options: a reconciliation is a repair, not a cleanup, and an\n // operator narrowing the TTL for a cleanup run has said nothing about repairs.\n let transpositionsReconciled = emptyReconciliation;\n try {\n transpositionsReconciled = await this.reconcileIncompleteTranspositions({\n batchSize: options?.batchSize,\n maxIterations: options?.maxIterations,\n });\n } catch (error) {\n // Best effort ONLY at this seam, and for one reason: the deletion phases below must still run\n // if the repair pass cannot. A repair that did not happen is retried tomorrow; a cleanup that\n // never runs grows unbounded. Per-session failures are already surfaced at ERROR inside the\n // reconciliation, so nothing is being hidden here — this catch only sees a failure of the pass\n // as a whole (a LIST that could not be issued).\n this.logger.error('Anonymous transposition reconciliation pass failed — continuing with cleanup', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n\n const anonymizableTypes = this.getAnonymizableResourceTypes();\n let totalExpiredUsersFound = 0;\n let resourcesDeleted = 0;\n let usersArchived = 0;\n let errors = 0;\n let iteration = 0;\n\n // Phase 1: Clean up expired unconverted sessions (pagination loop)\n let hasMore = true;\n while (hasMore && iteration < maxIterations) {\n iteration++;\n\n const listOpPath = this.resourcesRegistry.getServiceOperationPathDefault(CoreResourceType.ANONYMOUS_USERS, CoreResourceOperation.LIST);\n const listEc = await this.executionContextCreator.createForInternalOperation({\n operation: listOpPath,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null,\n initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n });\n\n const listResult = await this.servicesRegistryHandler.list<any>(\n CoreResourceType.ANONYMOUS_USERS,\n listEc,\n { convertedToUserId: null, createdAt: { $lt: cutoff } },\n { page: 1, limit: batchSize }\n );\n const expiredUsers: any[] = Array.isArray(listResult) ? listResult : listResult.data;\n totalExpiredUsersFound += expiredUsers.length;\n\n if (expiredUsers.length === 0) { hasMore = false; break; }\n\n for (const anonUser of expiredUsers) {\n // `_id` (server ObjectId) deletes the AnonymousUser row itself; `uuidRef`\n // (the client session handle) is what children carry in their `anonymousUserId`\n // FK, so it is what lists/deletes the owned records. Filtering children by `_id`\n // would match nothing and silently orphan them.\n const anonymousUserId = anonUser._id as string;\n const anonymousUserRef = anonUser.uuidRef as string;\n\n try {\n for (const resourceType of anonymizableTypes) {\n const records = await this.listAnonymousRecords(resourceType, anonymousUserRef);\n if (records && records.length > 0) {\n const ids = records.map((r: any) => r._id);\n await this.deleteOwnedRecords(resourceType, ids);\n resourcesDeleted += ids.length;\n }\n }\n\n const deleteAnonOpPath = this.resourcesRegistry.getServiceOperationPathDefault(CoreResourceType.ANONYMOUS_USERS, CoreResourceOperation.DELETE);\n const deleteAnonEc = await this.executionContextCreator.createForInternalOperation({\n operation: deleteAnonOpPath,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null,\n initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n });\n await this.servicesRegistryHandler.delete(CoreResourceType.ANONYMOUS_USERS, deleteAnonEc, anonymousUserId);\n usersArchived++;\n } catch (error) {\n errors++;\n this.logger.warn('Failed to clean up expired anonymous session', {\n anonymousUserId,\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n hasMore = expiredUsers.length >= batchSize;\n }\n\n // Phase 2: Clean up converted AnonymousUser records past retention period (audit trail)\n let convertedUsersCleaned = 0;\n const convertedCutoff = new Date(Date.now() - convertedRetentionMs);\n try {\n const convertedListOpPath = this.resourcesRegistry.getServiceOperationPathDefault(CoreResourceType.ANONYMOUS_USERS, CoreResourceOperation.LIST);\n const convertedListEc = await this.executionContextCreator.createForInternalOperation({\n operation: convertedListOpPath,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null,\n initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n });\n const convertedResult = await this.servicesRegistryHandler.list<any>(\n CoreResourceType.ANONYMOUS_USERS,\n convertedListEc,\n { convertedToUserId: { $ne: null }, createdAt: { $lt: convertedCutoff } },\n { page: 1, limit: batchSize }\n );\n const convertedUsers: any[] = Array.isArray(convertedResult) ? convertedResult : convertedResult.data;\n\n for (const convertedUser of convertedUsers) {\n try {\n const deleteOpPath = this.resourcesRegistry.getServiceOperationPathDefault(CoreResourceType.ANONYMOUS_USERS, CoreResourceOperation.DELETE);\n const deleteEc = await this.executionContextCreator.createForInternalOperation({\n operation: deleteOpPath,\n contextResourcesFieldIdentifier: new Map(),\n initiatorIds: null,\n initiatorRoles: [{ roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], relatedPrimaryScope: ResourcePrimaryScope.APPLICATION }],\n });\n await this.servicesRegistryHandler.delete(CoreResourceType.ANONYMOUS_USERS, deleteEc, convertedUser._id);\n convertedUsersCleaned++;\n } catch (error) {\n errors++;\n }\n }\n } catch (error) {\n this.logger.warn('Failed to clean up converted anonymous users', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n\n this.logDebug('Cleanup completed', {\n expiredUsersFound: totalExpiredUsersFound, resourcesDeleted, usersArchived,\n convertedUsersCleaned, errors, iterations: iteration,\n anonymizableTypes: anonymizableTypes.length,\n transpositionsReconciled,\n });\n\n return {\n expiredUsersFound: totalExpiredUsersFound, resourcesDeleted, usersArchived, convertedUsersCleaned, errors,\n transpositionsReconciled,\n };\n }\n\n private getAnonymizableResourceTypes(): ResourceType[] {\n const allTypes = this.resourcesRegistry.getResourceTypes();\n const result: ResourceType[] = [];\n for (const resourceType of allTypes) {\n const config = this.resourcesRegistry.getResourceConfiguration(resourceType);\n if (config?.isAnonymizable === true) {\n result.push(resourceType);\n }\n }\n return result;\n }\n\n private hashIp(ip: string): string {\n return crypto.createHash('sha256').update(ip).digest('hex').substring(0, 16);\n }\n\n /*\n Extract first-touch marketing attribution from the inbound request\n * (Phase 0.5, Q-D=β). Returns `undefined` if no signal is present so\n * the caller can omit the field entirely from the create payload.\n \n Sources:\n * - `utm_` query string parameters → `utm.{source,medium,campaign,term,content}`\n - `Referer` HTTP header → `referrer`\n * - `x-landing-path` HTTP header → `landingPath`\n * (framework header registered in `WildoHeaderKeys.LANDING_PATH`, sent by\n * the marketing-site bootstrap ON the session-init request; carried in the\n * engine CORS `allowedHeaders` floor alongside `x-anonymous-session-init`\n * — see `engineAllowedHeaders` in `http-server.backend.service.ts`).\n * - `Accept-Language` HTTP header → `acceptLanguage`\n \n The result is parsed against `AnonymousUserMarketingMetadataSchema`\n * to apply the field-level length caps (256 / 2048) and to strip\n * unknown keys defensively. If parsing fails (e.g. malformed\n * over-length values from a hostile client), we log and return\n * `undefined` rather than fail session-init — attribution is a\n * best-effort marketing signal, not a security-critical field.\n */\n private extractFirstTouchMarketingMetadata(req: Request): AnonymousUserMarketingMetadata \| undefined {\n const headerString = (key: string): string \| undefined => {\n const raw = req.headers[key];\n if (typeof raw === 'string' && raw.length > 0) return raw;\n if (Array.isArray(raw) && raw.length > 0 && typeof raw[0] === 'string') return raw[0];\n return undefined;\n };\n const queryString = (key: string): string \| undefined => {\n const raw = (req.query as Record<string, unknown> \| undefined)?.[key];\n if (typeof raw === 'string' && raw.length > 0) return raw;\n if (Array.isArray(raw) && raw.length > 0 && typeof raw[0] === 'string') return raw[0];\n return undefined;\n };\n\n const utmCandidate = {\n source : queryString('utm_source'),\n medium : queryString('utm_medium'),\n campaign : queryString('utm_campaign'),\n term : queryString('utm_term'),\n content : queryString('utm_content'),\n };\n const utmHasAnyValue = Object.values(utmCandidate).some((v) => v !== undefined);\n\n const candidate: Record<string, unknown> = {};\n if (utmHasAnyValue) candidate.utm = utmCandidate;\n const referrer = headerString('referer');\n const landingPath = headerString(WildoHeaderKeys.LANDING_PATH);\n const acceptLanguage = headerString('accept-language');\n if (referrer !== undefined) candidate.referrer = referrer;\n if (landingPath !== undefined) candidate.landingPath = landingPath;\n if (acceptLanguage !== undefined) candidate.acceptLanguage = acceptLanguage;\n\n if (Object.keys(candidate).length === 0) return undefined;\n\n const parsed = AnonymousUserMarketingMetadataSchema.safeParse(candidate);\n if (!parsed.success) {\n this.logger.warn('Discarding malformed first-touch marketing metadata', {\n issues: parsed.error.issues.map((i) => ({ path: i.path.join('.'), code: i.code })),\n });\n return undefined;\n }\n return parsed.data;\n }\n}\n"]}

package/dist/esm/security/authentications/services/auth-methods/auth-method-management.backend.service.d.ts CHANGED Viewed

@@ -86,7 +86,15 @@ export declare class AuthMethodManagementBackendService {
      * observed during login would still be valid moments later, and step-up would authorize a
      * destructive operation on a credential the caller never freshly proved.
      *
-     * `PASSKEY` remains explicitly refused rather than silently unsupported.
+     * `PASSKEY` is SUPPORTED, through a dedicated two-legged ceremony rather than the one call
+     * password and TOTP take: `POST /auth/reauth/passkey/options` then `POST /auth/reauth` with the
+     * assertion, because WebAuthn is challenge-response. It is a re-proof rather than a possession
+     * check — the branch below verifies under `PasskeyAuthenticationCeremony.STEP_UP`, which reads a
+     * SEPARATE challenge (so an assertion minted for a login cannot be redeemed here) and demands
+     * user verification even where the app policy is `preferred`.
+     *
+     * Any other `AuthMethod` is refused explicitly by the trailing `else`, rather than silently
+     * unsupported.
      *
      * assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a
      * high-impact action, over any factor the principal actually holds.

package/dist/esm/security/authentications/services/auth-methods/auth-method-management.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-method-management.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/auth-method-management.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AACvI,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAKL,UAAU,EAGV,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAE,qBAAqB,EAAE,MAAM,4FAA4F,CAAC;AACnI,OAAO,EAAiC,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AAEnK,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,UAAU,mBAAmB;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,iBAAiB,CAAC;IAClC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,IAAI,CAAC;IACf,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,qBACa,kCAAkC;IAIR,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAChD,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAM7B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAIzC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAvB9E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC7B,uBAAuB,EAAE,qCAAqC,EACtE,kBAAkB,EAAE,oCAAoC,EAC9D,gBAAgB,EAAE,uBAAuB,EACzC,gBAAgB,EAAE,uBAAuB,EACnC,sBAAsB,EAAE,6BAA6B,EAC5D,WAAW,EAAE,6BAA6B,EACpC,UAAU,EAAE,4BAA4B,EAM1C,mBAAmB,EAAE,0BAA0B,EAIpD,cAAc,EAAE,qBAAqB,EAEpC,eAAe,EAAE,sBAAsB;IAUtG,OAAO,CAAC,SAAS;IAKjB;;;OAGG;YACW,sBAAsB;IAYvB,+BAA+B,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAezF,cAAc,CACzB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IA6CH,WAAW,CACtB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IAsCH,WAAW,CACtB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IA4EH,YAAY,CACvB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,OAAO,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,UAAU,CAAC;YAAC,QAAQ,EAAE,OAAO,CAAC;YAAC,UAAU,CAAC,EAAE,IAAI,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAmHlH,gBAAgB,CAC3B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;KAAE,CAAC;IA8B/B,kBAAkB,CAC7B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IAmDhB~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG~~;IACU,cAAc,CACzB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,QAAQ,CAAC,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,OAAO,EACzB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;~~IAsGtB~~,gBAAgB,CAC3B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAsBtG"}
1	+ {"version":3,"file":"auth-method-management.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/auth-method-management.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AACvI,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAKL,UAAU,EAGV,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAE,qBAAqB,EAAE,MAAM,4FAA4F,CAAC;AACnI,OAAO,EAAiC,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AAEnK,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,UAAU,mBAAmB;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,iBAAiB,CAAC;IAClC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,IAAI,CAAC;IACf,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,qBACa,kCAAkC;IAIR,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAChD,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAM7B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAIzC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAvB9E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC7B,uBAAuB,EAAE,qCAAqC,EACtE,kBAAkB,EAAE,oCAAoC,EAC9D,gBAAgB,EAAE,uBAAuB,EACzC,gBAAgB,EAAE,uBAAuB,EACnC,sBAAsB,EAAE,6BAA6B,EAC5D,WAAW,EAAE,6BAA6B,EACpC,UAAU,EAAE,4BAA4B,EAM1C,mBAAmB,EAAE,0BAA0B,EAIpD,cAAc,EAAE,qBAAqB,EAEpC,eAAe,EAAE,sBAAsB;IAUtG,OAAO,CAAC,SAAS;IAKjB;;;OAGG;YACW,sBAAsB;IAYvB,+BAA+B,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAezF,cAAc,CACzB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IA6CH,WAAW,CACtB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IAsCH,WAAW,CACtB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IA4EH,YAAY,CACvB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,OAAO,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,UAAU,CAAC;YAAC,QAAQ,EAAE,OAAO,CAAC;YAAC,UAAU,CAAC,EAAE,IAAI,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAmHlH,gBAAgB,CAC3B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;KAAE,CAAC;IA8B/B,kBAAkB,CAC7B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IAmDhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACU,cAAc,CACzB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,QAAQ,CAAC,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,OAAO,EACzB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IA0KtB,gBAAgB,CAC3B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAsBtG"}

package/dist/esm/security/authentications/services/auth-methods/auth-method-management.backend.service.js CHANGED Viewed

@@ -409,7 +409,15 @@ let AuthMethodManagementBackendService = class AuthMethodManagementBackendServic
      * observed during login would still be valid moments later, and step-up would authorize a
      * destructive operation on a credential the caller never freshly proved.
      *
-     * `PASSKEY` remains explicitly refused rather than silently unsupported.
+     * `PASSKEY` is SUPPORTED, through a dedicated two-legged ceremony rather than the one call
+     * password and TOTP take: `POST /auth/reauth/passkey/options` then `POST /auth/reauth` with the
+     * assertion, because WebAuthn is challenge-response. It is a re-proof rather than a possession
+     * check — the branch below verifies under `PasskeyAuthenticationCeremony.STEP_UP`, which reads a
+     * SEPARATE challenge (so an assertion minted for a login cannot be redeemed here) and demands
+     * user verification even where the app policy is `preferred`.
+     *
+     * Any other `AuthMethod` is refused explicitly by the trailing `else`, rather than silently
+     * unsupported.
      *
      * assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a
      * high-impact action, over any factor the principal actually holds.
@@ -421,6 +429,45 @@ let AuthMethodManagementBackendService = class AuthMethodManagementBackendServic
      */
     totpCode) {
         try {
+            /*
+             * The user type's step-up policy decides WHICH FACTORS may satisfy a step-up (#422).
+             *
+             * `stepUpAuth.methods` was read only by a startup warning: the gate in
+             * `services-registry-handler.backend.service.ts` consumed any `REAUTH` token whose `userId`
+             * matched, whatever produced it. So a policy naming WebAuthn was satisfied by a password
+             * re-authentication, and an operator who configured a phishing-resistant factor got a
+             * password prompt and NO error — the same shape as an OIDC `acrValues` that is never sent.
+             *
+             * Enforced at MINT rather than at the gate, deliberately:
+             *   - the factor is known here and is NOT recorded on the token, so gate-time enforcement
+             *     would need a token-payload change and a migration for tokens already in flight;
+             *   - a refusal here names the allowed factors while the person is still choosing one,
+             *     instead of accepting their proof and refusing the operation afterwards;
+             *   - it makes the wrong token UNMINTABLE rather than merely rejected, so the gate keeps its
+             *     single question ("is there a valid REAUTH token for this user?") and cannot drift from
+             *     the policy.
+             *
+             * NO ENROLMENT FALLBACK, and that is the decision rather than an oversight. A user whose only
+             * enrolled factor is outside the policy cannot mint a token and is told to enrol. Falling back
+             * to an unnamed factor would reopen exactly the hole this closes — a policy that names a
+             * factor and accepts a weaker one is what the defect was.
+             *
+             * The residual, stated: a token minted under one policy and redeemed after the policy narrows
+             * is still accepted. REAUTH tokens live five minutes and are single-use, so the window is that
+             * long; closing it entirely is the token-payload change rejected above.
+             */
+            const stepUpAuth = ec.activeUserType
+                ? this.appConfigService.getUserTypeAuthPolicy(ec.activeUserType)?.stepUpAuth
+                : undefined;
+            if (stepUpAuth?.enabled && !stepUpAuth.methods.includes(method)) {
+                throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, ec, {
+                    context: {
+                        reason: 'This factor is not accepted for step-up re-authentication by this account type',
+                        requestedMethod: method,
+                        acceptedMethods: stepUpAuth.methods,
+                    },
+                });
+            }
             if (method === AuthMethod.TOTP) {
                 if (!totpCode) {
                     throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {
@@ -469,7 +516,35 @@ let AuthMethodManagementBackendService = class AuthMethodManagementBackendServic
                 // STEP_UP ceremony, NOT login: it reads a separate challenge (so an assertion produced for a
                 // login cannot be redeemed here) and demands user verification even where the app policy is
                 // `preferred`. See `PasskeyAuthenticationCeremony`.
-                const { verified } = await this.webAuthnService.verifyAuthenticationResponse(ec, userId, passkeyResponse, PasskeyAuthenticationCeremony.STEP_UP);
+                const { verified, cloneSuspicion } = await this.webAuthnService.verifyAuthenticationResponse(ec, userId, passkeyResponse, PasskeyAuthenticationCeremony.STEP_UP);
+                /*
+                 * A verified assertion whose signature counter did not advance is the cloned-authenticator
+                 * signal, and it gets the same CRITICAL row here as at the login door — a regression met
+                 * while re-proving identity for a privileged action is if anything the more interesting of
+                 * the two. It is reachable only after signature verification, so it cannot be forged by
+                 * someone who merely knows a credential id.
+                 *
+                 * It does NOT change the refusal below: this branch already produces the deliberately
+                 * uniform `Passkey re-authentication failed`. Until 2026-09-08 a counter regression escaped
+                 * that uniformity — the library threw before the verifier returned, and the catch at the
+                 * end of this method wrapped it through `buildFromStandardError` as a generic error rather
+                 * than an AUTHENTICATION refusal. Returning `verified: false` instead of throwing is what
+                 * put it back on this path.
+                 */
+                if (cloneSuspicion) {
+                    await this.auditLogsService.logUserPasskeyCloneSuspected({
+                        userId,
+                        credentialId: cloneSuspicion.credentialId,
+                        storedCounter: cloneSuspicion.storedCounter,
+                        receivedCounter: cloneSuspicion.receivedCounter,
+                        credentialDeviceType: cloneSuspicion.credentialDeviceType,
+                        credentialBackedUp: cloneSuspicion.credentialBackedUp,
+                        ...(cloneSuspicion.aaguid ? { aaguid: cloneSuspicion.aaguid } : {}),
+                        ceremony: cloneSuspicion.ceremony,
+                        ipAddress: ipAddress || 'unknown',
+                        userAgent: userAgent || 'unknown',
+                    }, ec);
+                }
                 if (!verified) {
                     // Deliberately ONE refusal for every failure mode below the verifier — no challenge
                     // outstanding, wrong credential, absent user verification, bad signature. Distinguishing