@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/security/consumable-tokens/services/consumable-token.backend.service.js

@@ -24,7 +24,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { injectable, inject, optional } from 'inversify';
 import crypto from 'crypto';
-import { ConsumableToken_ConsumptionMode, ErrorType, ErrorCustomMessageReference, PersistenceAdapter, } from '@wildo-ai/saas-models';
+import { ConsumableToken_ConsumptionMode, ErrorType, ErrorCustomMessageReference, isWildoBackendError, FILE_UPLOAD_GRANT_ABSOLUTE_MAX_MINUTES, CoreConsumableTokenTypes, PersistenceAdapter, } from '@wildo-ai/saas-models';
 import { durationToSeconds } from '@wildo-ai/zod-decorators';
 import { SAAS_SERVICE_TYPES } from '../../../inject/models/service-types.js';
 import { ErrorBuilderBackendService } from '../../../errors/services/error-builder.backend.service.js';
@@ -103,6 +103,27 @@ let ConsumableTokenBackendService = class ConsumableTokenBackendService {
                 });
             }
         }
+        // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — a file upload grant is a bearer credential
+        // DESIGNED to leave the trust boundary (an LLM transcript, a shell history), so its lifetime is bounded
+        // HERE, at the one mint chokepoint, per type and fail-closed: an over-ceiling request is REJECTED, never
+        // clamped (issue #312, D8). Nothing else bounds a consumable token's life — measured 2026-09-05, the
+        // one-off ceiling above was the only one — which is why this cannot be left to the caller's `expiresIn`.
+        // SINGLE_USE only: a reusable upload credential is the presigned-URL defect rebuilt inside the API.
+        if (params.tokenType === CoreConsumableTokenTypes.FILE_UPLOAD_GRANT) {
+            const requestedMinutes = durationToSeconds(params.expiresIn) / 60;
+            if (requestedMinutes > FILE_UPLOAD_GRANT_ABSOLUTE_MAX_MINUTES) {
+                throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {
+                    customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_GRANT_DURATION_EXCEEDS_MAX,
+                    context: { requestedMinutes: Math.round(requestedMinutes), absoluteMaxMinutes: FILE_UPLOAD_GRANT_ABSOLUTE_MAX_MINUTES }, // diagnostic (log-only)
+                });
+            }
+            if (params.consumptionMode !== ConsumableToken_ConsumptionMode.SINGLE_USE) {
+                throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {
+                    customMessageReference: ErrorCustomMessageReference.VALIDATION,
+                    context: { message: 'A file upload grant must be SINGLE_USE', consumptionMode: params.consumptionMode }, // diagnostic (log-only)
+                });
+            }
+        }
         /**
          * Identity through the framework AUTHORITY, not `crypto.randomUUID()`.
          *
@@ -428,12 +449,24 @@ let ConsumableTokenBackendService = class ConsumableTokenBackendService {
      * `tokenId` is guarded by the same non-string check as every other primitive here (`{ _id }` reaches
      * Mongo directly, so a `{$ne}`-shaped value would otherwise match an ARBITRARY token).
      */
+    /**
+     * Read a token row by its VALUE regardless of state — expired, consumed and revoked rows included.
+     *
+     * For status surfaces that must say WHY a token is unusable (`validateToken` refuses those rows, which
+     * is right for authentication and wrong for a status read). Callers hold the value already, so this
+     * discloses nothing they could not learn by presenting it. Never logs the value (R2).
+     */
+    async findTokenByValue(tokenValue) {
+        this.assertTokenValueIsString(tokenValue);
+        const doc = await this.repositoriesRegistry.readUnscopedByKey(BackendResourceType.CONSUMABLE_TOKENS, { token: tokenValue });
+        return doc ?? null;
+    }
     async findTokenById(tokenId) {
         this.assertTokenValueIsString(tokenId);
-        // Adapter-neutral, like every other read on this service: `getTokenCollection` reaches the Mongo
-        // driver directly, so a raw `findOne` here would make this the one token-lookup door a
-        // PostgreSQL-backed application cannot open. `readUnscopedByKey` is the same primitive the
-        // token-VALUE lookups above already use; only the key differs.
+        // Adapter-neutral, like every other read on this service: the retired `getTokenCollection`
+        // accessor reached the Mongo driver directly, so a raw `findOne` here would make this the one
+        // token-lookup door a PostgreSQL-backed application cannot open. `readUnscopedByKey` is the same
+        // primitive the token-VALUE lookups above already use; only the key differs.
         const tokenDoc = await this.repositoriesRegistry.readUnscopedByKey(BackendResourceType.CONSUMABLE_TOKENS, { _id: tokenId });
         return tokenDoc ?? null;
     }
@@ -448,6 +481,26 @@ let ConsumableTokenBackendService = class ConsumableTokenBackendService {
      * and never write a duplicate row under a race. Returns whether THIS call performed the revocation
      * (`false` = the token was already revoked, or does not exist).
      */
+    /**
+     * Record, on a redeemed FILE_UPLOAD_GRANT, the file its one upload produced (issue #312, D6/D10).
+     *
+     * Written AFTER the grant is consumed and the FILES row exists, so there is exactly one writer and
+     * a plain replace of `metadata` is safe. Best-effort by contract: the upload has already succeeded
+     * when this runs, so a failure here must not fail it — the caller logs and the status read falls
+     * back to "REDEEMED, file unknown; re-read the resource". Returns whether a row was written.
+     *
+     * Replaces the whole `metadata` object rather than a dotted path so the write is adapter-neutral:
+     * the PostgreSQL arm stores `metadata` as one JSON column.
+     */
+    async recordFileUploadGrantProducedFile(tokenId, fileId) {
+        const existing = await this.findTokenById(tokenId);
+        if (!existing || existing.tokenType !== CoreConsumableTokenTypes.FILE_UPLOAD_GRANT) {
+            return false;
+        }
+        const now = new Date();
+        const written = await this.repositoriesRegistry.atomicGuardedMutation(BackendResourceType.CONSUMABLE_TOKENS, { _id: tokenId, isConsumed: true }, { set: { metadata: { ...(existing.metadata ?? {}), producedFileId: fileId }, updatedAt: now } });
+        return written !== null;
+    }
     async revokeToken(tokenId) {
         const now = new Date();
         // Adapter-neutral by construction: `atomicGuardedMutation` compiles the SAME conditional
@@ -725,25 +778,35 @@ let ConsumableTokenBackendService = class ConsumableTokenBackendService {
         return transaction.nativeSession;
     }
     /**
-     * Match only the sparse active-generation index. `createToken` also writes
-     * other unique fields (notably the raw token), and collapsing their failures
-     * into a RESEND race would hide an unrelated persistence defect.
+     * Match only the sparse active-generation index. `createToken` also writes other unique fields
+     * (notably the raw token), and collapsing their failures into a RESEND race would hide an
+     * unrelated persistence defect.
+     *
+     * ## Branches on the CLASSIFIED conflict, never on driver internals
+     *
+     * This used to require a raw MongoDB error with `code: 11000` and a `keyPattern`, and could
+     * therefore never fire. `insertRawDocument` translates the duplicate before it escapes —
+     * `throw this.handleMongoDBError(error)` on the Mongo arm, `handlePostgresError` on the
+     * PostgreSQL one — so what reaches this catch is the classified CONFLICT, carrying no `code` and
+     * no `keyPattern`. The RESEND race surfaced as a generic CONFLICT and the specific
+     * `consumable_token_active_generation_conflict` reference was unreachable through the real stack.
+     *
+     * The infrastructure tier's own comment says why detecting on driver internals was the wrong
+     * shape in the first place: without the translation "every caller would need adapter-specific
+     * detection, which is precisely what this tier exists to remove". On PostgreSQL there is no
+     * `code: 11000` to match at ALL — a unique violation is SQLSTATE `23505` — so the old predicate
+     * was not merely unreachable, it was unwritable for the adapter both example applications now run.
+     *
+     * `violatedFields` is the adapter-neutral answer both arms populate: Mongo from `keyPattern`
+     * (falling back to the message), PostgreSQL from the constraint's columns.
      */
     isActiveGenerationKeyDuplicate(error) {
-        if (error === null || typeof error !== 'object')
+        if (!isWildoBackendError(error))
             return false;
-        const mongoError = error;
-        if (mongoError.code !== 11000)
+        if (error.type !== ErrorType.CONFLICT)
             return false;
-        const hasActiveGenerationField = (value) => value !== null
-            && typeof value === 'object'
-            && Object.prototype.hasOwnProperty.call(value, 'activeGenerationKey');
-        if (hasActiveGenerationField(mongoError.keyPattern)
-            || hasActiveGenerationField(mongoError.keyValue)) {
-            return true;
-        }
-        return (typeof mongoError.message === 'string'
-            && /\bindex:\s+activeGenerationKey_1\b/.test(mongoError.message));
+        const violatedFields = error.context?.violatedFields;
+        return Array.isArray(violatedFields) && violatedFields.includes('activeGenerationKey');
     }
     /**
      * Calculate the expiration date from a relative duration.

package/dist/esm/security/consumable-tokens/services/consumable-token.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"consumable-token.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/consumable-tokens/services/consumable-token.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EACL,+BAA+B,EAE/B,SAAS,EACT,2BAA2B,EAC3B,kBAAkB,GAMnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAsB,MAAM,0BAA0B,CAAC;AAEjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AAGvF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,mBAAmB,EAAE,MAAM,qEAAqE,CAAC;AAK1G,OAAO,EACL,mCAAmC,GAEpC,MAAM,gEAAgE,CAAC;AA8CxE,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,EAAE,GAAG,EAAE,CAAC;AAGrD,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IACvB,MAAM,CAAgB;IACtB,YAAY,CAA6B;IACzC,cAAc,CAAiB;IAC/B,iBAAiB,CAA4B;IAC7C,4BAA4B,CAA6C;IAE1F,YACqC,MAAqB,EACR,YAAwC,EAC7C,cAA8B,EAGR,iBAA4C,EAQlC,oBAAgE;QAE3I,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,4BAA4B,GAAG,oBAAoB,CAAC;IAC3D,CAAC;IAGD,6EAA6E;IAC7E,wBAAwB;IACxB,6EAA6E;IAE7E;;;;;;OAMG;IACI,KAAK,CAAC,WAAW,CACtB,MAAyB,EACzB,WAAgC;QAEhC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAEjE,wFAAwF;QACxF,sGAAsG;QACtG,sGAAsG;QACtG,kGAAkG;QAClG,6GAA6G;QAC7G,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;YAChC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;YAClE,IAAI,gBAAgB,GAAG,oCAAoC,EAAE,CAAC;gBAC5D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;oBACxF,OAAO,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,EAAE,oCAAoC,EAAE,EAAE,wBAAwB;iBAChJ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD;;;;;;;;;;;;;;;;;;;WAmBG;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB;YAChC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,iBAA0B,CAAC,CAAC;YACpG,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAExB,MAAM,SAAS,GAAoB;YACjC,GAAG;YACH,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,GAAG,CAAC,MAAM,CAAC,mBAAmB,IAAI;gBAChC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;aAChD,CAAC;YACF,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACzB,SAAS;YACT,UAAU,EAAE,KAAK;YACjB,SAAS,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,oBAAoB,KAAK,SAAS,IAAI,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE,CAAC;YACvG,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;YACxD,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;YACxD,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC;QAEF,wCAAwC;QACxC,IAAI,MAAM,CAAC,eAAe,KAAK,+BAA+B,CAAC,aAAa,EAAE,CAAC;YAC7E,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,+DAA+D,EAAE;iBACrF,CAAC,CAAC;YACL,CAAC;YACD,SAAS,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACrC,CAAC;QAED,6FAA6F;QAC7F,mDAAmD;QACnD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,oBAAoB,CAAC,+BAA+B,CAC7D,mBAAmB,CAAC,iBAA0B,EAC9C,SAA+C,EAC/C,SAAS,EACT,EAAE,WAAW,EAAE,CAChB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAC1E,CAAC;gBACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;oBAChE,sBAAsB,EACpB,2BAA2B,CAAC,2BAA2B;oBACzD,OAAO,EAAE;wBACP,MAAM,EAAE,6CAA6C;wBACrD,SAAS,EAAE,MAAM,CAAC,SAAS;wBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;qBAC5B;iBACF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,uEAAuE;QACvE,uDAAuD;QACvD,MAAM,WAAW,GAAG,KAAK,IAAmB,EAAE;YAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;gBAC3C,OAAO,EAAE,GAAG;gBACZ,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;aACnC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,IAAI,WAAW,EAAE,CAAC;YAChB,mCAAmC,CAAC,WAAW,EAAE;gBAC/C,GAAG,EAAE,4BAA4B,GAAG,EAAE;gBACtC,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,EAAE,CAAC;QACtB,CAAC;QAED,OAAO,SAAgD,CAAC;IAC1D,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,aAAa,CACxB,UAAkB,EAClB,aAAsC;QAEtC,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAChE,mBAAmB,CAAC,iBAA0B,EAC9C,EAAE,KAAK,EAAE,UAAU,EAAE,CACtB,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,QAAsC,CAAC;QAErD,mBAAmB;QACnB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,wBAAwB;gBAC5E,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;QAED,eAAe;QACf,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,wBAAwB;gBAC5E,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;QAED,yCAAyC;QACzC,IAAI,KAAK,CAAC,eAAe,KAAK,+BAA+B,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YAC7F,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,eAAe,KAAK,+BAA+B,CAAC,aAAa,EAAE,CAAC;YAC5E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YAC9B,IAAI,OAAO,IAAI,KAAK,CAAC,SAAS,IAAI,OAAO,EAAE,CAAC;gBAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;oBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,eAAe,KAAK,+BAA+B,CAAC,eAAe,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YAClG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;QAED,sBAAsB;QACtB,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAiC,CAAC,EAAE,CAAC;gBACrE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;oBACtC,OAAO,EAAE,KAAK,CAAC,GAAG;oBAClB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,aAAa;iBACd,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;oBAClF,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE;iBAC3E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,YAAY,CACvB,UAAkB,EAClB,WAAgC;QAEhC,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,2DAA2D;QAC3D,4DAA4D;QAC5D,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CACxE,mBAAmB,CAAC,iBAA0B,EAC9C;YACE,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YAC7B,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;SACxB,EACD,EAAE,WAAW,EAAE,CAChB,CAAC;QACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QACD,MAAM,aAAa,GAAG,gBAA8C,CAAC;QAErE,IAAI,MAA2B,CAAC;QAChC,IAAI,QAAmC,CAAC;QACxC;;;;WAIG;QACH,IAAI,cAAkC,CAAC;QAEvC,+FAA+F;QAC/F,sGAAsG;QACtG,MAAM,WAAW,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;QAE/E,QAAQ,aAAa,CAAC,eAAe,EAAE,CAAC;YACtC,KAAK,+BAA+B,CAAC,UAAU,CAAC,CAAC,CAAC;gBAChD,MAAM,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,WAAW,EAAE,CAAC;gBAClE,gFAAgF;gBAChF,QAAQ,GAAG;oBACT,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;oBACvD,KAAK,EAAE,CAAC,qBAAqB,CAAC;iBAC/B,CAAC;gBACF,MAAM;YACR,CAAC;YAED,KAAK,+BAA+B,CAAC,aAAa,CAAC,CAAC,CAAC;gBACnD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,CAAC;gBAC3C,MAAM,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,WAAW,EAAE,CAAC;gBAC5E,oEAAoE;gBACpE,wDAAwD;gBACxD,+DAA+D;gBAC/D,yEAAyE;gBACzE;;;;;;;;;;;;;;;;;;;mBAmBG;gBACH,cAAc,GAAG,OAAO,CAAC;gBACzB,QAAQ,GAAG,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;gBACpE,MAAM;YACR,CAAC;YAED,KAAK,+BAA+B,CAAC,eAAe,CAAC,CAAC,CAAC;gBACrD,MAAM,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,WAAW,EAAE,CAAC;gBAClE,gFAAgF;gBAChF,QAAQ,GAAG;oBACT,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;oBACvD,KAAK,EAAE,CAAC,qBAAqB,CAAC;iBAC/B,CAAC;gBACF,MAAM;YACR,CAAC;YAED,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;oBAChE,OAAO,EAAE;wBACP,MAAM,EAAE,2CAA2C;wBACnD,OAAO,EAAE,aAAa,CAAC,GAAG;wBAC1B,eAAe,EAAE,aAAa,CAAC,eAAe;qBAC/C;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,qBAAqB,CAClE,mBAAmB,CAAC,iBAA0B,EAC9C,MAAM,EACN,QAAQ,EACR,SAAS,EACT,EAAE,WAAW,EAAE,CAChB,CAAC;QAEF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC;YACrF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;gBAChE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;gBACnF,OAAO,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;QAED;;;;;;;WAOG;QACH,IAAI,cAAc,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,cAAc,EAAE,CAAC;YAC9E,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,oBAAoB,CAAC,qBAAqB,CACnD,mBAAmB,CAAC,iBAA0B,EAC9C,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACnB,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,qBAAqB,CAAC,EAAE,EAC7D,SAAS,EACT,EAAE,WAAW,EAAE,CAChB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4EAA4E,EAAE;oBAC7F,OAAO,EAAE,MAAM,CAAC,GAAG;oBACnB,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,KAAK,IAAmB,EAAE;YAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;gBAC5C,OAAO,EAAE,aAAa,CAAC,GAAG;gBAC1B,eAAe,EAAE,aAAa,CAAC,eAAe;aAC/C,CAAC,CAAC;QACL,CAAC,CAAC;QACF,IAAI,WAAW,EAAE,CAAC;YAChB,mCAAmC,CAAC,WAAW,EAAE;gBAC/C,GAAG,EAAE,6BAA6B,aAAa,CAAC,GAAG,EAAE;gBACrD,OAAO,EAAE,cAAc;aACxB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,cAAc,EAAE,CAAC;QACzB,CAAC;QAED,OAAO,MAAoC,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,aAAa,CAAC,OAAe;QACxC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAEvC,iGAAiG;QACjG,uFAAuF;QACvF,2FAA2F;QAC3F,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAChE,mBAAmB,CAAC,iBAA0B,EAC9C,EAAE,GAAG,EAAE,OAAO,EAAE,CACjB,CAAC;QACF,OAAO,QAAQ,IAAI,IAAI,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,WAAW,CAAC,OAAe;QACtC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,yFAAyF;QACzF,uFAAuF;QACvF,6FAA6F;QAC7F,yFAAyF;QACzF,2FAA2F;QAC3F,yFAAyF;QACzF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,qBAAqB,CACnE,mBAAmB,CAAC,iBAA0B,EAC9C,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAC/C,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,qBAAqB,CAAC,EAAE,CAC5E,CAAC;QAEF,0FAA0F;QAC1F,wEAAwE;QACxE,MAAM,SAAS,GAAG,OAAO,KAAK,IAAI,CAAC;QACnC,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,uBAAuB,CAClC,SAAiB,EACjB,SAAgC,EAChC,WAAgC;QAEhC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,MAAM,MAAM,GAAwB;YAClC,SAAS;YACT,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;SAC9B,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;QAC/B,CAAC;QAED,2FAA2F;QAC3F,8CAA8C;QAC9C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,2BAA2B,CAC9E,mBAAmB,CAAC,iBAA0B,EAC9C,MAAM,EACN,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,qBAAqB,CAAC,EAAE,EAC3E,SAAS,EAAE,0FAA0F;QACrG,iGAAiG;QACjG,gGAAgG;QAChG,0EAA0E;QAC1E,EAAE,WAAW,EAAE,CAChB,CAAC;QACF,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,aAAa,GAAG,KAAK,IAAmB,EAAE;gBAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;oBACzD,SAAS;oBACT,SAAS;oBACT,YAAY;iBACb,CAAC,CAAC;YACL,CAAC,CAAC;YACF,IAAI,WAAW,EAAE,CAAC;gBAChB,mCAAmC,CAAC,WAAW,EAAE;oBAC/C,GAAG,EAAE,6BAA6B,SAAS,IAAI,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,EAAE;oBAC3E,OAAO,EAAE,aAAa;iBACvB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,aAAa,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,qBAAqB,CAChC,SAAiB,EACjB,SAA+B;QAE/B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,yBAAyB,CACpE,mBAAmB,CAAC,iBAA0B,EAC9C;YACE,SAAS;YACT,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YAC7B,UAAU,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;YACzB,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;SACxB,CACF,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,gFAAgF;IAChF,6EAA6E;IAE7E;;;;;OAKG;IACI,KAAK,CAAC,sBAAsB,CACjC,MAA6B,EAC7B,YAAiC,EACjC,gBAIC,EACD,WAA+B;QAE/B,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,cAAc,IAAI,KAAK,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,4BAA4B,IAAI,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,EAClG,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,MAAM,EAAE,2CAA2C;oBACnD,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,KAAK;iBAC/C;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,mBAAmB,GACvB,MAAM,CAAC,4BAA4B,IAAI,SAAS;YAC9C,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC;YAC5D,CAAC,CAAC,SAAS,CAAC;QAEhB,uCAAuC;QACvC,IAAI,MAAM,CAAC,4BAA4B,EAAE,CAAC;YACxC,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,uBAAuB,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,MAAM,iBAAiB,GAAG,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACtF,MAAM,oBAAoB,GAAG,MAAM,CAAC,YAAY;YAC9C,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC;YAChE,CAAC,CAAC,SAAS,CAAC;QAEd,sBAAsB;QACtB,MAAM,YAAY,GAAsB;YACtC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,SAAS,EAAE,iBAAiB;YAC5B,cAAc,EAAE,YAAY,CAAC,cAAc,IAAI,gBAAgB,CAAC,cAAc;YAC9E,kBAAkB,EAAE,gBAAgB,CAAC,YAAY;YACjD,SAAS;YACT,GAAG,CAAC,mBAAmB,IAAI;gBACzB,mBAAmB;aACpB,CAAC;YACF,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;QAEF,+BAA+B;QAC/B,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,YAAY,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACzD,CAAC;QAED,oDAAoD;QACpD,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;YAChC,YAAY,CAAC,oBAAoB,GAAG,IAAI,CAAC;YACzC,YAAY,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAC5C,CAAC;QAED,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,YAAY,GAA2B,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,IAAI,gBAAgB,CAAC,cAAc,CAAC;YAC7E,IAAI,KAAK;gBAAE,YAAY,CAAC,cAAc,GAAG,KAAK,CAAC;YAC/C,KAAK,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC1E,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;gBACtC,IAAI,KAAK;oBAAE,YAAY,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,YAAY,CAAC,SAAS,GAAG,EAAE,YAAY,EAAE,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAEhE,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,sBAAsB,CACjC,MAA6B,EAC7B,YAAiC,EACjC,iBAA8C,EAC9C,WAAgC;QAEhC,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,cAAc,IAAI,KAAK,CAAC,CAAC;QAE/D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE;gBAC/D,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,KAAK;aAC/C,CAAC,CAAC;YACH,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QAC7B,CAAC;QAED,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAC9C,SAAS,EACT,SAAS,EACT,WAAW,CACZ,CAAC;YACF,YAAY,IAAI,KAAK,CAAC;QACxB,CAAC;QAED,MAAM,aAAa,GAAG,KAAK,IAAmB,EAAE;YAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBAC7C,SAAS;gBACT,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,YAAY;aACb,CAAC,CAAC;QACL,CAAC,CAAC;QACF,IAAI,WAAW,EAAE,CAAC;YAChB,mCAAmC,CAAC,WAAW,EAAE;gBAC/C,GAAG,EACD,yCAAyC,SAAS,GAAG;sBACnD,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;gBAClD,OAAO,EAAE,aAAa;aACvB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,aAAa,EAAE,CAAC;QACxB,CAAC;QAED,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;IACxC,CAAC;IAED,6EAA6E;IAC7E,kBAAkB;IAClB,6EAA6E;IAErE,wBAAwB,CAC9B,SAA+B,EAC/B,SAAiB;QAEjB,OAAO,MAAM;aACV,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;aAC5C,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAEO,uBAAuB,CAAC,KAAsB;QACpD,OAAO;YACL,UAAU,EAAE,KAAK,CAAC,KAAK;YACvB,OAAO,EAAE,KAAK,CAAC,GAAG;SACnB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACK,wBAAwB,CAAC,UAAmB;QAClD,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,IAAY,oBAAoB;QAC9B,IAAI,CAAC,IAAI,CAAC,4BAA4B,EAAE,CAAC;YACvC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;gBAChE,OAAO,EAAE,EAAE,MAAM,EAAE,2DAA2D,EAAE;aACjF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,4BAA4B,CAAC;IAC3C,CAAC;IAED;;;;;;;OAOG;IACK,eAAe,CAAC,WAAgC;QACtD,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QACnC,IAAI,WAAW,CAAC,YAAY,KAAK,kBAAkB,CAAC,OAAO,EAAE,CAAC;YAC5D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,MAAM,EAAE,+CAA+C;oBACvD,uBAAuB,EAAE,WAAW,CAAC,YAAY;iBAClD;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,WAAW,CAAC,aAA8B,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACK,8BAA8B,CAAC,KAAc;QACnD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9D,MAAM,UAAU,GAAG,KAKlB,CAAC;QACF,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QAE5C,MAAM,wBAAwB,GAAG,CAAC,KAAc,EAAW,EAAE,CAC3D,KAAK,KAAK,IAAI;eACX,OAAO,KAAK,KAAK,QAAQ;eACzB,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;QACxE,IACE,wBAAwB,CAAC,UAAU,CAAC,UAAU,CAAC;eAC5C,wBAAwB,CAAC,UAAU,CAAC,QAAQ,CAAC,EAChD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,CACL,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ;eACnC,oCAAoC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CACjE,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,kBAAkB,CAAC,SAAwB,EAAE,OAAa,IAAI,IAAI,EAAE;QAC1E,MAAM,EAAE,GAAG,iBAAiB,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;QAC/C,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACK,sBAAsB,CAAI,KAAyB,EAAE,aAAkC;QAC7F,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;YAChC,OAAQ,KAAyC,CAAC,aAAa,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAA;AAp2BY,6BAA6B;IADzC,UAAU,EAAE;IASR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IAGzC,WAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;IAQ/D,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;+CAZZ,0BAA0B;QAC7B,cAAc;GAVhE,6BAA6B,CAo2BzC","sourcesContent":["/**\n * Consumable Token Backend Service\n *\n * Central service for the full lifecycle of consumable tokens:\n * - Token creation with crypto-secure random values\n * - Token validation (expiry, consumption, revocation, type matching)\n * - Atomic token consumption (race-condition safe via findOneAndUpdate)\n * - Token revocation (soft invalidation via revokedAt)\n * - Pipeline helpers for declarative tokenGeneration/tokenRevocation configs\n *\n * Security (R2): Raw token values are NEVER logged. Only token._id is logged.\n */\n\nimport { injectable, inject, optional } from 'inversify';\nimport crypto from 'crypto';\n\nimport {\n  ConsumableToken_ConsumptionMode,\n  resolveSharedPersistenceCollectionName,\n  ErrorType,\n  ErrorCustomMessageReference,\n  PersistenceAdapter,\n  type ConsumableTokenTypes,\n  type TokenGenerationConfig,\n  type TokenRevocationConfig,\n  type StaticOrDerived,\n  type ExecutionContext_RoleInfo,\n} from '@wildo-ai/saas-models';\nimport { durationToSeconds, type DurationValue } from '@wildo-ai/zod-decorators';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\n\nimport { MongoDBService } from '~wildo-backend-lib/databases/services/mongodb.service';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport type { RepositoryGuardedMutation } from '~wildo-backend-lib/base-classes/services/repositories/repository-guarded-mutation.backend.types';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { BackendResourceType } from '~wildo-backend-lib/resources/models/resources-types.backend.schemas';\nimport type { ResourceIdBackendService } from '~wildo-backend-lib/resources/services/resource-id.backend.service';\nimport type {\n  ConsumableToken,\n} from '~wildo-backend-lib/security/consumable-tokens/models/consumable-tokens.shared.schemas';\nimport {\n  registerTransactionPostCommitEffect,\n  type TransactionContext,\n} from '~wildo-backend-lib/databases/models/transaction.shared.schemas';\nimport type { ClientSession } from 'mongodb';\n\n\n// ============================================================================\n// TYPES\n// ============================================================================\n\nexport interface CreateTokenParams {\n  /** Token type identifier (e.g., CoreConsumableTokenTypes.FILE_PUBLIC_ACCESS). NOT the Wildo resource type. */\n  tokenType: ConsumableTokenTypes;\n  consumptionMode: ConsumableToken_ConsumptionMode;\n  expiresIn: DurationValue;\n  organizationId?: string;\n  userId?: string;\n  /** The Wildo resource identifier this token targets (e.g., 'users', 'files'). */\n  resourceIdentifier?: string;\n  relatedId?: string;\n  metadata?: Record<string, any>;\n  roles?: ExecutionContext_RoleInfo[];\n  maxUses?: number;\n  /** W7.3b: Whether this token can be exchanged for a one-off session JWT. */\n  createsOneOffSession?: boolean;\n  /** W7.3b: When the token is consumed — at exchange time or at target operation time. */\n  consumeAt?: 'EXCHANGE' | 'TARGET_OPERATION';\n  /** W7.3b: Scoped caller identity for audit and authorization narrowing. */\n  targeting?: {\n    initiatorIds?: Record<string, string>;\n  };\n  /**\n   * Sparse database-unique ownership key for replace-existing generation.\n   * Removed when the token is revoked or reaches its terminal consumption.\n   */\n  activeGenerationKey?: string;\n}\n\nexport interface TokenGenerationResult {\n  tokenValue: string;\n  tokenId: string;\n}\n\nexport interface TokenRevocationResult {\n  revokedCount: number;\n}\n\n\n// ============================================================================\n// SERVICE\n// ============================================================================\n\n/**\n * revocation-B1: the hard ceiling (in minutes) on the lifetime of ANY one-off SESSION, enforced at TWO points:\n * (1) at MINT — `createToken`, the single chokepoint BOTH one-off mint paths funnel through (the super-admin\n * route's `createOneOffToken` and the declarative resource-config `processTokenGeneration`) — bounding the\n * token's authored duration / LINK validity window fail-closed; and (2) at EXCHANGE —\n * `computeOneOffSessionExpiresAt` — which anchors the minted SESSION's lifetime at CONSUMPTION (the exchange),\n * NOT at production, and clamps it to this ceiling. The exchange anchor is the authoritative session bound;\n * the mint ceiling additionally keeps the link from being exchangeable for longer than the ceiling.\n *\n * A one-off token with `createsOneOffSession` is a session-establishing credential: exchanging it mints a\n * JWT session for another user. The security industry treats the maximum lifetime of such a delegated /\n * impersonated credential as a hard ceiling enforced AT ISSUANCE, on EVERY path, fail-closed — and puts that\n * ceiling at ~12 hours, measured from when the session begins. A per-user-type `oneOffSessionMaxDurationMinutes`\n * may only TIGHTEN below this; nothing exceeds it. Non-session consumable tokens (password-reset, invitation,\n * magic-link) are unaffected.\n *\n * spec-cite: AWS STS `AssumeRole` — `DurationSeconds` is validated against the role's `MaxSessionDuration`\n * (1h default, 12h hard max); an over-max request is REJECTED, not clamped —\n * https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html\n * spec-cite: GCP IAM short-lived credentials — impersonated-credential lifetime defaults to 1h and is capped\n * at 12h (43200s), extendable only via the `iam.allowServiceAccountCredentialLifetimeExtension` org policy —\n * https://cloud.google.com/iam/docs/create-short-lived-credentials-direct\n * spec-cite: OWASP Session Management Cheat Sheet, \"Absolute Timeout\" — every session must have an absolute\n * maximum lifetime enforced regardless of activity, to bound how long a hijacked session stays usable —\n * https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html\n */\nexport const ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES = 12 * 60;\n\n@injectable()\nexport class ConsumableTokenBackendService {\n  private readonly logger: LoggerService;\n  private readonly errorBuilder: ErrorBuilderBackendService;\n  private readonly mongoDBService: MongoDBService;\n  private readonly resourceIdService?: ResourceIdBackendService;\n  private readonly injectedRepositoriesRegistry?: RepositoriesRegistryHandlerBackendService;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.MongoDBService) mongoDBService: MongoDBService,\n    // LAST and OPTIONAL: appended so existing positional constructions keep working, optional so the\n    // harnesses that build this service directly are not forced to wire a dependency they do not use.\n    @inject(SAAS_SERVICE_TYPES.ResourceIdBackendService) @optional() resourceIdService?: ResourceIdBackendService,\n    /**\n     * The adapter-neutral persistence plane this service now writes through.\n     *\n     * LAST and OPTIONAL for the same reason `resourceIdService` is: several harnesses construct this\n     * service positionally, and making it required would break them at construction rather than at\n     * the call they actually exercise.\n     */\n    @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) @optional() repositoriesRegistry?: RepositoriesRegistryHandlerBackendService,\n  ) {\n    this.logger = logger;\n    this.errorBuilder = errorBuilder;\n    this.mongoDBService = mongoDBService;\n    this.resourceIdService = resourceIdService;\n    this.injectedRepositoriesRegistry = repositoriesRegistry;\n  }\n\n\n  // ==========================================================================\n  // CORE TOKEN OPERATIONS\n  // ==========================================================================\n\n  /**\n   * Create a new consumable token.\n   * Generates a 32-byte hex crypto-random token value and persists it.\n   *\n   * @returns The full entity WITH the raw token value (for passing to emails/responses).\n   *          NEVER log the returned token value (R2).\n   */\n  public async createToken(\n    params: CreateTokenParams,\n    transaction?: TransactionContext,\n  ): Promise<ConsumableToken & { token: string }> {\n    const tokenValue = crypto.randomBytes(32).toString('hex');\n    const now = new Date();\n    const expiresAt = this.calculateExpiresAt(params.expiresIn, now);\n\n    // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — a one-off session token is a\n    // session-establishing credential minted for another user, so its lifetime is bounded by the industry\n    // hard ceiling (ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES) HERE — the single point every one-off mint path\n    // funnels through (super-admin route + resource-config `processTokenGeneration`). Fail-closed: an\n    // over-ceiling mint is REJECTED, never silently clamped (matching AWS STS rejecting an over-max AssumeRole).\n    if (params.createsOneOffSession) {\n      const requestedMinutes = durationToSeconds(params.expiresIn) / 60;\n      if (requestedMinutes > ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.ONE_OFF_SESSION_DURATION_EXCEEDS_MAX,\n          context: { requestedMinutes: Math.round(requestedMinutes), absoluteMaxMinutes: ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES }, // diagnostic (log-only)\n        });\n      }\n    }\n    /**\n     * Identity through the framework AUTHORITY, not `crypto.randomUUID()`.\n     *\n     * The id format is a per-resource framework decision (`ResourceIdBackendService`), and the\n     * PostgreSQL repository already mints through it in `withGeneratedRowIdentity`. Minting a UUID\n     * here instead produced a row whose `_id` is not the shape the resource declares, and the\n     * consequence was measured rather than reasoned: the repository read the row correctly but with\n     * **no `_id` at all**, because Mongoose cannot hydrate a UUID into its declared identity type.\n     *\n     * That was invisible while every token path addressed rows by their `token` value and never by\n     * `_id` — the same \"agreed by never meeting\" shape as the collection-name split this service also\n     * carried. It stops being invisible the moment creation moves to the repository (R-W5-3), which\n     * mints through this same authority, so the two would disagree about what an existing row's id\n     * even looks like.\n     *\n     * `@optional()` on the injection: the service is constructed directly in several harnesses, and a\n     * required dependency there would be a churn cost with no safety gain. The fallback is the\n     * previous behaviour, so a harness that does not supply it degrades to what it had before rather\n     * than to something new.\n     */\n    const _id = this.resourceIdService\n      ? String(this.resourceIdService.generateForResource(BackendResourceType.CONSUMABLE_TOKENS as never))\n      : crypto.randomUUID();\n\n    const tokenData: ConsumableToken = {\n      _id,\n      token: tokenValue,\n      tokenType: params.tokenType,\n      resourceIdentifier: params.resourceIdentifier,\n      consumptionMode: params.consumptionMode,\n      organizationId: params.organizationId,\n      userId: params.userId,\n      relatedId: params.relatedId,\n      ...(params.activeGenerationKey && {\n        activeGenerationKey: params.activeGenerationKey,\n      }),\n      metadata: params.metadata || {},\n      roles: params.roles || [],\n      expiresAt,\n      isConsumed: false,\n      usesCount: 0,\n      ...(params.createsOneOffSession !== undefined && { createsOneOffSession: params.createsOneOffSession }),\n      ...(params.consumeAt && { consumeAt: params.consumeAt }),\n      ...(params.targeting && { targeting: params.targeting }),\n      createdAt: now,\n      updatedAt: now,\n    };\n\n    // maxUses is required for BOUNDED_REUSE\n    if (params.consumptionMode === ConsumableToken_ConsumptionMode.BOUNDED_REUSE) {\n      if (!params.maxUses || params.maxUses < 1) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION,\n          context: { reason: 'maxUses is required and must be >= 1 for BOUNDED_REUSE tokens' }\n        });\n      }\n      tokenData.maxUses = params.maxUses;\n    }\n\n    // The adapter narrows `transaction` itself and raises the mismatch error, so this service no\n    // longer needs its own MongoDB-specific narrowing.\n    try {\n      await this.repositoriesRegistry.insertDocumentForInfrastructure(\n        BackendResourceType.CONSUMABLE_TOKENS as never,\n        tokenData as unknown as Record<string, unknown>,\n        undefined,\n        { transaction },\n      );\n    } catch (error) {\n      if (params.activeGenerationKey && this.isActiveGenerationKeyDuplicate(error)\n      ) {\n        throw this.errorBuilder.buildError(ErrorType.CONFLICT, undefined, {\n          customMessageReference:\n            ErrorCustomMessageReference.UNIQUE_CONSTRAINT_VIOLATION,\n          context: {\n            reason: 'consumable_token_active_generation_conflict',\n            tokenType: params.tokenType,\n            relatedId: params.relatedId,\n          },\n        });\n      }\n      throw error;\n    }\n\n    // Log creation without the raw token value (R2), and only after commit\n    // when this token participates in a wider transaction.\n    const logCreation = async (): Promise<void> => {\n      this.logger.info('Consumable token created', {\n        tokenId: _id,\n        tokenType: params.tokenType,\n        consumptionMode: params.consumptionMode,\n        relatedId: params.relatedId,\n        organizationId: params.organizationId,\n        expiresAt: expiresAt.toISOString(),\n      });\n    };\n    if (transaction) {\n      registerTransactionPostCommitEffect(transaction, {\n        key: `consumable-token-created:${_id}`,\n        execute: logCreation,\n      });\n    } else {\n      await logCreation();\n    }\n\n    return tokenData as ConsumableToken & { token: string };\n  }\n\n  /**\n   * Validate a token without consuming it.\n   * Checks: existence, revocation, expiry, consumption status, type matching.\n   *\n   * @param tokenValue - The raw token string from the request\n   * @param expectedTypes - Optional array of accepted token types for this operation\n   * @returns The validated token entity\n   * @throws Appropriate error for each failure mode\n   */\n  public async validateToken(\n    tokenValue: string,\n    expectedTypes?: ConsumableTokenTypes[],\n  ): Promise<ConsumableToken> {\n    this.assertTokenValueIsString(tokenValue);\n    const tokenDoc = await this.repositoriesRegistry.readUnscopedByKey<ConsumableToken>(\n      BackendResourceType.CONSUMABLE_TOKENS as never,\n      { token: tokenValue },\n    );\n\n    if (!tokenDoc) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_NOT_FOUND,\n      });\n    }\n\n    const token = tokenDoc as unknown as ConsumableToken;\n\n    // Check revocation\n    if (token.revokedAt) {\n      this.logger.warn('Revoked token used', { tokenId: token._id });\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_REVOKED,\n        context: { tokenId: token._id },\n      });\n    }\n\n    // Check expiry\n    if (token.expiresAt < new Date()) {\n      this.logger.warn('Expired token used', { tokenId: token._id });\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_EXPIRED,\n        context: { tokenId: token._id },\n      });\n    }\n\n    // Check consumption status based on mode\n    if (token.consumptionMode === ConsumableToken_ConsumptionMode.SINGLE_USE && token.isConsumed) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_ALREADY_CONSUMED,\n        context: { tokenId: token._id },\n      });\n    }\n\n    if (token.consumptionMode === ConsumableToken_ConsumptionMode.BOUNDED_REUSE) {\n      const maxUses = token.maxUses;\n      if (maxUses && token.usesCount >= maxUses) {\n        throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_ALREADY_CONSUMED,\n          context: { tokenId: token._id, usesCount: token.usesCount, maxUses },\n        });\n      }\n    }\n\n    if (token.consumptionMode === ConsumableToken_ConsumptionMode.EPHEMERAL_STATE && token.isConsumed) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_ALREADY_CONSUMED,\n        context: { tokenId: token._id },\n      });\n    }\n\n    // Check type matching\n    if (expectedTypes && expectedTypes.length > 0) {\n      if (!expectedTypes.includes(token.tokenType as ConsumableTokenTypes)) {\n        this.logger.warn('Token type mismatch', {\n          tokenId: token._id,\n          tokenType: token.tokenType,\n          expectedTypes\n        });\n        throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_TYPE_MISMATCH,\n          context: { tokenId: token._id, tokenType: token.tokenType, expectedTypes },\n        });\n      }\n    }\n\n    return token;\n  }\n\n  /**\n   * Atomically consume a token.\n   * Uses MongoDB `findOneAndUpdate` with conditions to prevent race conditions.\n   *\n   * - SINGLE_USE: condition `{ isConsumed: false }`, sets `{ isConsumed: true, usesCount: 1 }`\n   * - BOUNDED_REUSE: condition `{ usesCount: { $lt: maxUses } }`, inc `usesCount`, set `isConsumed` if exhausted\n   * - EPHEMERAL_STATE: condition `{ isConsumed: false }`, sets `{ isConsumed: true }`\n   *\n   * @param tokenValue - The raw token string\n   * @returns The updated token entity\n   * @throws CONSUMABLE_TOKEN_RACE_CONDITION if atomic update fails (concurrent consumption)\n   */\n  public async consumeToken(\n    tokenValue: string,\n    transaction?: TransactionContext,\n  ): Promise<ConsumableToken> {\n    this.assertTokenValueIsString(tokenValue);\n    const now = new Date();\n\n    // First, read the token to determine its consumption mode.\n    // Also check that the token hasn't expired or been revoked.\n    const existingTokenDoc = await this.repositoriesRegistry.readUnscopedByKey<ConsumableToken>(\n      BackendResourceType.CONSUMABLE_TOKENS as never,\n      {\n        token: tokenValue,\n        revokedAt: { $exists: false },\n        expiresAt: { $gt: now },\n      },\n      { transaction },\n    );\n    if (!existingTokenDoc) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_NOT_FOUND,\n      });\n    }\n    const existingToken = existingTokenDoc as unknown as ConsumableToken;\n\n    let filter: Record<string, any>;\n    let mutation: RepositoryGuardedMutation;\n    /**\n     * BOUNDED_REUSE only. `isConsumed` is DERIVED state for that mode — a cache read solely by the\n     * cleanup batch's hard-delete, never by an authorization path — so it is computed from the\n     * post-increment row rather than inside the statement. See the note at the write below.\n     */\n    let boundedMaxUses: number | undefined;\n\n    // All filters include expiresAt + revokedAt guards to prevent consuming expired/revoked tokens\n    // in the atomic update (defense-in-depth against TOCTOU between the read above and the update below).\n    const expiryGuard = { expiresAt: { $gt: now }, revokedAt: { $exists: false } };\n\n    switch (existingToken.consumptionMode) {\n      case ConsumableToken_ConsumptionMode.SINGLE_USE: {\n        filter = { token: tokenValue, isConsumed: false, ...expiryGuard };\n        // Fully expressible: every assignment is a constant, and `$$REMOVE` is `clear`.\n        mutation = {\n          set: { isConsumed: true, usesCount: 1, updatedAt: now },\n          clear: ['activeGenerationKey'],\n        };\n        break;\n      }\n\n      case ConsumableToken_ConsumptionMode.BOUNDED_REUSE: {\n        const maxUses = existingToken.maxUses || 1;\n        filter = { token: tokenValue, usesCount: { $lt: maxUses }, ...expiryGuard };\n        // Use aggregation pipeline update to atomically increment usesCount\n        // AND compute isConsumed from the post-increment value.\n        // This avoids the race condition where two concurrent requests\n        // both read the same pre-increment usesCount and fail to set isConsumed.\n        /**\n         * The INCREMENT is the guarantee; the flag is not.\n         *\n         * Atomicity here comes from the FILTER (`usesCount < maxUses`), which is what refuses the\n         * consume once the allowance is spent — and it is `usesCount`, never `isConsumed`, that\n         * every authorization path reads: this filter, and `validateToken`'s BOUNDED_REUSE branch.\n         * `isConsumed` is a denormalized flag whose only consumer is the cleanup batch's\n         * hard-delete, which ALREADY carries a second sweep for exactly this window (\"defense in\n         * depth for the race condition edge case where isConsumed may not have been atomically\n         * set\").\n         *\n         * MongoDB expressed the derivation inside an aggregation-pipeline update; that is precisely\n         * the raw-operator form the adapter-neutral vocabulary excludes, and a computed set is not\n         * expressible for both adapters through it. Deriving it from the returned post-increment row\n         * keeps the authoritative counter atomic and costs only freshness on a flag nothing gates on.\n         *\n         * Rejected: narrowing the filter to a compare-and-swap on `usesCount` so the post-value were\n         * known here — that would turn two legitimate concurrent consumers of a bounded-reuse token\n         * into one CONFLICT, a behaviour regression rather than a translation.\n         */\n        boundedMaxUses = maxUses;\n        mutation = { increment: { usesCount: 1 }, set: { updatedAt: now } };\n        break;\n      }\n\n      case ConsumableToken_ConsumptionMode.EPHEMERAL_STATE: {\n        filter = { token: tokenValue, isConsumed: false, ...expiryGuard };\n        // Fully expressible: every assignment is a constant, and `$$REMOVE` is `clear`.\n        mutation = {\n          set: { isConsumed: true, usesCount: 1, updatedAt: now },\n          clear: ['activeGenerationKey'],\n        };\n        break;\n      }\n\n      default: {\n        throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {\n          context: {\n            reason: 'consumable_token_consumption_mode_invalid',\n            tokenId: existingToken._id,\n            consumptionMode: existingToken.consumptionMode,\n          },\n        });\n      }\n    }\n\n    const result = await this.repositoriesRegistry.atomicGuardedMutation<ConsumableToken>(\n      BackendResourceType.CONSUMABLE_TOKENS as never,\n      filter,\n      mutation,\n      undefined,\n      { transaction },\n    );\n\n    if (!result) {\n      this.logger.warn('Token consumption race condition', { tokenId: existingToken._id });\n      throw this.errorBuilder.buildError(ErrorType.CONFLICT, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_RACE_CONDITION,\n        context: { tokenId: existingToken._id },\n      });\n    }\n\n    /**\n     * Settle the DERIVED flag for BOUNDED_REUSE, now that the authoritative counter is known.\n     *\n     * Guarded on the same allowance, so a concurrent consumer that has not yet exhausted the token\n     * cannot flip it early. Nothing gates on this flag (see the mutation note above), so a failure to\n     * write it is a freshness loss the cleanup batch's second sweep already covers — it must not turn\n     * a SUCCESSFUL consume into an error for the caller.\n     */\n    if (boundedMaxUses !== undefined && (result.usesCount ?? 0) >= boundedMaxUses) {\n      result.isConsumed = true;\n      try {\n        await this.repositoriesRegistry.atomicGuardedMutation(\n          BackendResourceType.CONSUMABLE_TOKENS as never,\n          { _id: result._id },\n          { set: { isConsumed: true }, clear: ['activeGenerationKey'] },\n          undefined,\n          { transaction },\n        );\n      } catch (error) {\n        this.logger.warn('Consumable token exhausted but its derived isConsumed flag was not written', {\n          tokenId: result._id,\n          ...projectCaughtErrorLogFields(error),\n        });\n      }\n    }\n\n    const logConsumption = async (): Promise<void> => {\n      this.logger.info('Consumable token consumed', {\n        tokenId: existingToken._id,\n        consumptionMode: existingToken.consumptionMode,\n      });\n    };\n    if (transaction) {\n      registerTransactionPostCommitEffect(transaction, {\n        key: `consumable-token-consumed:${existingToken._id}`,\n        execute: logConsumption,\n      });\n    } else {\n      await logConsumption();\n    }\n\n    return result as unknown as ConsumableToken;\n  }\n\n  /**\n   * Fetch a token by its `_id`, WITHOUT any state assertions — a revoked, expired, or consumed row all\n   * pass through. This is deliberately different from `validateToken`, which keys on the token VALUE and\n   * THROWS on any non-live state: an operator flow that acts ON a token needs to read it first and decide\n   * for itself. The one-off-session revoke route uses it to (a) return NOT_FOUND for a missing id, (b)\n   * confirm the row IS a one-off session token before revoking (this door must never touch a\n   * password-reset / invitation / magic-link token by id), and (c) build the revocation audit from the\n   * token's own `userId` / `tokenType`. Returns `null` when no row matches.\n   *\n   * `tokenId` is guarded by the same non-string check as every other primitive here (`{ _id }` reaches\n   * Mongo directly, so a `{$ne}`-shaped value would otherwise match an ARBITRARY token).\n   */\n  public async findTokenById(tokenId: string): Promise<ConsumableToken | null> {\n    this.assertTokenValueIsString(tokenId);\n\n    // Adapter-neutral, like every other read on this service: `getTokenCollection` reaches the Mongo\n    // driver directly, so a raw `findOne` here would make this the one token-lookup door a\n    // PostgreSQL-backed application cannot open. `readUnscopedByKey` is the same primitive the\n    // token-VALUE lookups above already use; only the key differs.\n    const tokenDoc = await this.repositoriesRegistry.readUnscopedByKey<ConsumableToken>(\n      BackendResourceType.CONSUMABLE_TOKENS as never,\n      { _id: tokenId },\n    );\n    return tokenDoc ?? null;\n  }\n\n  /**\n   * Soft-revoke a token by setting revokedAt.\n   * This is a soft invalidation — the record stays in DB for audit.\n   * Hard deletion is handled by the cleanup cron job.\n   *\n   * CONDITIONAL on the row not already being revoked (`revokedAt: { $exists: false }`), mirroring\n   * `revokeTokensByRelatedId`. This makes the transition atomic: two concurrent revocations of the SAME token\n   * transition it exactly once, so a caller can emit its audit only on the real transition (returned `true`)\n   * and never write a duplicate row under a race. Returns whether THIS call performed the revocation\n   * (`false` = the token was already revoked, or does not exist).\n   */\n  public async revokeToken(tokenId: string): Promise<boolean> {\n    const now = new Date();\n\n    // Adapter-neutral by construction: `atomicGuardedMutation` compiles the SAME conditional\n    // transition on either adapter — the PostgreSQL arm translates `{ $exists: false }` to\n    // `IS NULL` — and `clear` is the neutral spelling of the pipeline's `$$REMOVE`. Dropping the\n    // active-generation key is what frees a later token of the same generation to be minted.\n    // Deliberately the same idiom as `revokeTokensByRelatedId`, which the conditional mirrors:\n    // a raw driver call here would make this the one revocation door PostgreSQL cannot open.\n    const revoked = await this.repositoriesRegistry.atomicGuardedMutation(\n      BackendResourceType.CONSUMABLE_TOKENS as never,\n      { _id: tokenId, revokedAt: { $exists: false } },\n      { set: { revokedAt: now, updatedAt: now }, clear: ['activeGenerationKey'] },\n    );\n\n    // `null` is the neutral spelling of \"no row matched the guard\" — the same fact the driver\n    // reported as `modifiedCount === 0`: already revoked, or no such token.\n    const didRevoke = revoked !== null;\n    if (didRevoke) {\n      this.logger.info('Consumable token revoked', { tokenId });\n    }\n    return didRevoke;\n  }\n\n  /**\n   * Revoke all tokens matching a relatedId and optionally a token type.\n   * Uses repository directly (R6 — intentional, not routed through operation pipeline).\n   *\n   * @returns Count of revoked tokens\n   */\n  public async revokeTokensByRelatedId(\n    relatedId: string,\n    tokenType?: ConsumableTokenTypes,\n    transaction?: TransactionContext,\n  ): Promise<number> {\n    const now = new Date();\n\n    const filter: Record<string, any> = {\n      relatedId,\n      revokedAt: { $exists: false },\n    };\n    if (tokenType) {\n      filter.tokenType = tokenType;\n    }\n\n    // The COUNT is the contract: callers report how many tokens were revoked, so the multi-row\n    // primitive returns it rather than a boolean.\n    const revokedCount = await this.repositoriesRegistry.bulkUpdateForInfrastructure(\n      BackendResourceType.CONSUMABLE_TOKENS as never,\n      filter,\n      { set: { revokedAt: now, updatedAt: now }, clear: ['activeGenerationKey'] },\n      undefined, // no execution context: this is a framework-internal revocation, below the operation tier\n      // JOIN THE CALLER'S TRANSACTION. Without this the revocation committed immediately even when the\n      // caller was mid-transaction, so a driver retry could not roll it back — the retry then revoked\n      // nothing and reported 0 for work that had already happened exactly once.\n      { transaction },\n    );\n    if (revokedCount > 0) {\n      const logRevocation = async (): Promise<void> => {\n        this.logger.info('Consumable tokens revoked by relatedId', {\n          relatedId,\n          tokenType,\n          revokedCount,\n        });\n      };\n      if (transaction) {\n        registerTransactionPostCommitEffect(transaction, {\n          key: `consumable-tokens-revoked:${relatedId}:${String(tokenType ?? 'all')}`,\n          execute: logRevocation,\n        });\n      } else {\n        await logRevocation();\n      }\n    }\n\n    return revokedCount;\n  }\n\n  /**\n   * Find all unconsumed, non-revoked, non-expired tokens for a given relatedId and token type.\n   * Used by Email OTP verification (Step 10) to find matching OTP tokens.\n   *\n   * @returns Array of matching token documents (may be empty)\n   */\n  public async findTokensByRelatedId(\n    relatedId: string,\n    tokenType: ConsumableTokenTypes,\n  ): Promise<ConsumableToken[]> {\n    const now = new Date();\n\n    const docs = await this.repositoriesRegistry.findManyForInfrastructure<ConsumableToken>(\n      BackendResourceType.CONSUMABLE_TOKENS as never,\n      {\n        relatedId,\n        tokenType: tokenType,\n        revokedAt: { $exists: false },\n        isConsumed: { $ne: true },\n        expiresAt: { $gt: now },\n      },\n    );\n\n    return docs;\n  }\n\n  // ==========================================================================\n  // PIPELINE HELPERS — Called by services-registry-handler for declarative config\n  // ==========================================================================\n\n  /**\n   * Process a declarative tokenGeneration config from an operation variant.\n   * Called AFTER the core operation succeeds, BEFORE notification dispatch.\n   *\n   * Returns `{ tokenValue, tokenId }` for injection into notification context.\n   */\n  public async processTokenGeneration(\n    config: TokenGenerationConfig,\n    currentState: Record<string, any>,\n    executionContext: {\n      organizationId?: string;\n      userId?: string;\n      resourceType?: string;\n    },\n    transaction: TransactionContext,\n  ): Promise<TokenGenerationResult> {\n    const relatedId = currentState[config.relatedIdField || '_id'];\n    if (config.revokeExistingForSameRelated && (typeof relatedId !== 'string' || relatedId.length === 0)\n    ) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        context: {\n          reason: 'replace_existing_token_related_id_missing',\n          tokenType: config.tokenType,\n          relatedIdField: config.relatedIdField || '_id',\n        },\n      });\n    }\n\n    const activeGenerationKey =\n      config.revokeExistingForSameRelated && relatedId\n        ? this.buildActiveGenerationKey(config.tokenType, relatedId)\n        : undefined;\n\n    // Revoke existing tokens if configured\n    if (config.revokeExistingForSameRelated) {\n      if (relatedId) {\n        await this.revokeTokensByRelatedId(relatedId, config.tokenType, transaction);\n      }\n    }\n\n    // Resolve static or derived values\n    const resolvedExpiresIn = this.resolveStaticOrDerived(config.expiresIn, currentState);\n    const resolvedGrantedRoles = config.grantedRoles\n      ? this.resolveStaticOrDerived(config.grantedRoles, currentState)\n      : undefined;\n\n    // Build create params\n    const createParams: CreateTokenParams = {\n      tokenType: config.tokenType,\n      consumptionMode: config.consumptionMode,\n      expiresIn: resolvedExpiresIn,\n      organizationId: currentState.organizationId || executionContext.organizationId,\n      resourceIdentifier: executionContext.resourceType,\n      relatedId,\n      ...(activeGenerationKey && {\n        activeGenerationKey,\n      }),\n      roles: resolvedGrantedRoles,\n      maxUses: config.maxUses,\n    };\n\n    // Resolve userId if configured\n    if (config.userIdField) {\n      createParams.userId = currentState[config.userIdField];\n    }\n\n    // W7.3b: Bridge to one-off sessions when configured\n    if (config.createsOneOffSession) {\n      createParams.createsOneOffSession = true;\n      createParams.consumeAt = config.consumeAt;\n    }\n\n    if (config.targetingFields) {\n      const initiatorIds: Record<string, string> = {};\n      const orgId = currentState.organizationId || executionContext.organizationId;\n      if (orgId) initiatorIds.organizationId = orgId;\n      for (const [fieldId, fieldPath] of Object.entries(config.targetingFields)) {\n        const value = currentState[fieldPath];\n        if (value) initiatorIds[fieldId] = String(value);\n      }\n      if (Object.keys(initiatorIds).length > 0) {\n        createParams.targeting = { initiatorIds };\n      }\n    }\n\n    const token = await this.createToken(createParams, transaction);\n\n    return this.toTokenGenerationResult(token);\n  }\n\n  /**\n   * Process a declarative tokenRevocation config from an operation variant.\n   * Called BEFORE the core operation (pre-operation step).\n   *\n   * Revokes all tokens matching the related resource ID and configured token types.\n   */\n  public async processTokenRevocation(\n    config: TokenRevocationConfig,\n    currentState: Record<string, any>,\n    _executionContext: { organizationId?: string },\n    transaction?: TransactionContext,\n  ): Promise<TokenRevocationResult> {\n    const relatedId = currentState[config.relatedIdField || '_id'];\n\n    if (!relatedId) {\n      this.logger.warn('Token revocation skipped: no relatedId found', {\n        relatedIdField: config.relatedIdField || '_id',\n      });\n      return { revokedCount: 0 };\n    }\n\n    let totalRevoked = 0;\n    for (const tokenType of config.tokenTypes) {\n      const count = await this.revokeTokensByRelatedId(\n        relatedId,\n        tokenType,\n        transaction,\n      );\n      totalRevoked += count;\n    }\n\n    const logCompletion = async (): Promise<void> => {\n      this.logger.info('Token revocation completed', {\n        relatedId,\n        tokenTypes: config.tokenTypes,\n        totalRevoked,\n      });\n    };\n    if (transaction) {\n      registerTransactionPostCommitEffect(transaction, {\n        key:\n          `consumable-token-revocation-completed:${relatedId}:`\n          + config.tokenTypes.map(String).sort().join(','),\n        execute: logCompletion,\n      });\n    } else {\n      await logCompletion();\n    }\n\n    return { revokedCount: totalRevoked };\n  }\n\n  // ==========================================================================\n  // PRIVATE HELPERS\n  // ==========================================================================\n\n  private buildActiveGenerationKey(\n    tokenType: ConsumableTokenTypes,\n    relatedId: string,\n  ): string {\n    return crypto\n      .createHash('sha256')\n      .update(`${String(tokenType)}\\0${relatedId}`)\n      .digest('hex');\n  }\n\n  private toTokenGenerationResult(token: ConsumableToken): TokenGenerationResult {\n    return {\n      tokenValue: token.token,\n      tokenId: token._id,\n    };\n  }\n\n  /**\n   * Defense-in-depth against NoSQL operator injection. Every raw-collection lookup here keys on the\n   * caller-supplied `token` value (`findOne({ token: tokenValue })`, `findOneAndUpdate({ token: … })`),\n   * so a NON-STRING value (e.g. a `{$regex}` / `{$ne}` object that slipped a caller's boundary\n   * validation) would be interpreted by Mongo as a query OPERATOR and match/consume an ARBITRARY token —\n   * a remote token-destruction primitive (password-reset / invitation / magic-link). A real token value\n   * is always a high-entropy string, so a non-string is by definition \"not found\"; we throw the same\n   * `CONSUMABLE_TOKEN_NOT_FOUND` (kept non-oracle — the injection case is indistinguishable from a miss).\n   * The OAuth provider already rejects such input at its HTTP boundary (400 `invalid_request`); this\n   * guards EVERY other caller of the primitive too.\n   */\n  private assertTokenValueIsString(tokenValue: unknown): asserts tokenValue is string {\n    if (typeof tokenValue !== 'string') {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_NOT_FOUND,\n      });\n    }\n  }\n\n  /**\n   * The persistence plane this service writes through.\n   *\n   * **Replaced a raw MongoDB collection handle.** This service used to reach\n   * `connection.collection(resolveSharedPersistenceCollectionName(CONSUMABLE_TOKENS))` and issue\n   * driver calls directly, which is why consumable-token persistence was \"a MongoDB-native\n   * capability\" — and why every token-coupled operation carried a hard\n   * `requiredAdapter: MONGODB`, making `organizationMembers | create · revoke · resend`\n   * unresolvable on a PostgreSQL platform.\n   *\n   * The registry's framework-internal tier is the right home rather than the resource's declared\n   * operations: those are the ADMINISTRATIVE surface (role-gated on `ORG_ADMIN`), whereas the token\n   * lifecycle runs where there is NO principal — a verification email is a system action, and a\n   * magic-link click is pre-authentication by definition. Routing it through the declared operations\n   * would mean fabricating an administrator to authorize the very credential being established.\n   *\n   * The collection-identity concern the old accessor documented is now structural rather than\n   * conventional: the registry resolves the resource's own storage, so there is no second physical\n   * name for anything to diverge from.\n   *\n   * **Named `repositoriesRegistry` deliberately.** `guarded-write-registry-dispatch.guard.test.ts`\n   * requires every guarded-write call to have a receiver whose last segment is exactly that, because\n   * those primitives do NOT apply the retention hide themselves — it is applied once, at the registry\n   * dispatch. An accessor named anything else would route correctly and still read, to that guard and\n   * to a human, like a call on a bare repository handle.\n   */\n  private get repositoriesRegistry(): RepositoriesRegistryHandlerBackendService {\n    if (!this.injectedRepositoriesRegistry) {\n      throw this.errorBuilder.buildError(ErrorType.DATABASE, undefined, {\n        context: { reason: 'Repositories registry not available for consumable tokens' },\n      });\n    }\n    return this.injectedRepositoriesRegistry;\n  }\n\n  /**\n   * Narrow the database-agnostic transaction before any MongoDB access.\n   *\n   * Consumable-token persistence is MongoDB-native. Casting another adapter's\n   * opaque native transaction to `ClientSession` would turn a configuration\n   * mismatch into driver-dependent behavior, so every transactional entry\n   * path fails at this boundary first.\n   */\n  private getMongoSession(transaction?: TransactionContext): ClientSession | undefined {\n    if (!transaction) return undefined;\n    if (transaction.databaseType !== PersistenceAdapter.MONGODB) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        context: {\n          reason: 'consumable_token_requires_mongodb_transaction',\n          transactionDatabaseType: transaction.databaseType,\n        },\n      });\n    }\n    return transaction.nativeSession as ClientSession;\n  }\n\n  /**\n   * Match only the sparse active-generation index. `createToken` also writes\n   * other unique fields (notably the raw token), and collapsing their failures\n   * into a RESEND race would hide an unrelated persistence defect.\n   */\n  private isActiveGenerationKeyDuplicate(error: unknown): boolean {\n    if (error === null || typeof error !== 'object') return false;\n    const mongoError = error as {\n      code?: unknown;\n      keyPattern?: unknown;\n      keyValue?: unknown;\n      message?: unknown;\n    };\n    if (mongoError.code !== 11000) return false;\n\n    const hasActiveGenerationField = (value: unknown): boolean =>\n      value !== null\n      && typeof value === 'object'\n      && Object.prototype.hasOwnProperty.call(value, 'activeGenerationKey');\n    if (\n      hasActiveGenerationField(mongoError.keyPattern)\n      || hasActiveGenerationField(mongoError.keyValue)\n    ) {\n      return true;\n    }\n\n    return (\n      typeof mongoError.message === 'string'\n      && /\\bindex:\\s+activeGenerationKey_1\\b/.test(mongoError.message)\n    );\n  }\n\n  /**\n   * Calculate the expiration date from a relative duration.\n   */\n  private calculateExpiresAt(expiresIn: DurationValue, from: Date = new Date()): Date {\n    const ms = durationToSeconds(expiresIn) * 1000;\n    return new Date(from.getTime() + ms);\n  }\n\n  /**\n   * Resolve a StaticOrDerived value.\n   * If the value is a function, call it with the currentObject.\n   * If static, return as-is.\n   */\n  private resolveStaticOrDerived<T>(value: StaticOrDerived<T>, currentObject: Record<string, any>): T {\n    if (typeof value === 'function') {\n      return (value as (obj: Record<string, any>) => T)(currentObject);\n    }\n    return value;\n  }\n}\n"]}
+{"version":3,"file":"consumable-token.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/consumable-tokens/services/consumable-token.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EACL,+BAA+B,EAE/B,SAAS,EACT,2BAA2B,EAC3B,mBAAmB,EACnB,sCAAsC,EACtC,wBAAwB,EACxB,kBAAkB,GAMnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAsB,MAAM,0BAA0B,CAAC;AAEjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AAGvF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,mBAAmB,EAAE,MAAM,qEAAqE,CAAC;AAK1G,OAAO,EACL,mCAAmC,GAEpC,MAAM,gEAAgE,CAAC;AA8CxE,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,EAAE,GAAG,EAAE,CAAC;AAGrD,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IACvB,MAAM,CAAgB;IACtB,YAAY,CAA6B;IACzC,cAAc,CAAiB;IAC/B,iBAAiB,CAA4B;IAC7C,4BAA4B,CAA6C;IAE1F,YACqC,MAAqB,EACR,YAAwC,EAC7C,cAA8B,EAGR,iBAA4C,EAQlC,oBAAgE;QAE3I,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,4BAA4B,GAAG,oBAAoB,CAAC;IAC3D,CAAC;IAGD,6EAA6E;IAC7E,wBAAwB;IACxB,6EAA6E;IAE7E;;;;;;OAMG;IACI,KAAK,CAAC,WAAW,CACtB,MAAyB,EACzB,WAAgC;QAEhC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAEjE,wFAAwF;QACxF,sGAAsG;QACtG,sGAAsG;QACtG,kGAAkG;QAClG,6GAA6G;QAC7G,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;YAChC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;YAClE,IAAI,gBAAgB,GAAG,oCAAoC,EAAE,CAAC;gBAC5D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;oBACxF,OAAO,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,EAAE,oCAAoC,EAAE,EAAE,wBAAwB;iBAChJ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,sGAAsG;QACtG,wGAAwG;QACxG,yGAAyG;QACzG,qGAAqG;QACrG,yGAAyG;QACzG,oGAAoG;QACpG,IAAI,MAAM,CAAC,SAAS,KAAK,wBAAwB,CAAC,iBAAiB,EAAE,CAAC;YACpE,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;YAClE,IAAI,gBAAgB,GAAG,sCAAsC,EAAE,CAAC;gBAC9D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,sCAAsC;oBAC1F,OAAO,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,EAAE,sCAAsC,EAAE,EAAE,wBAAwB;iBAClJ,CAAC,CAAC;YACL,CAAC;YACD,IAAI,MAAM,CAAC,eAAe,KAAK,+BAA+B,CAAC,UAAU,EAAE,CAAC;gBAC1E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,EAAE,wBAAwB;iBAClI,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD;;;;;;;;;;;;;;;;;;;WAmBG;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB;YAChC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,iBAA0B,CAAC,CAAC;YACpG,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAExB,MAAM,SAAS,GAAoB;YACjC,GAAG;YACH,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,GAAG,CAAC,MAAM,CAAC,mBAAmB,IAAI;gBAChC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;aAChD,CAAC;YACF,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACzB,SAAS;YACT,UAAU,EAAE,KAAK;YACjB,SAAS,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,oBAAoB,KAAK,SAAS,IAAI,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE,CAAC;YACvG,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;YACxD,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;YACxD,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC;QAEF,wCAAwC;QACxC,IAAI,MAAM,CAAC,eAAe,KAAK,+BAA+B,CAAC,aAAa,EAAE,CAAC;YAC7E,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,+DAA+D,EAAE;iBACrF,CAAC,CAAC;YACL,CAAC;YACD,SAAS,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACrC,CAAC;QAED,6FAA6F;QAC7F,mDAAmD;QACnD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,oBAAoB,CAAC,+BAA+B,CAC7D,mBAAmB,CAAC,iBAA0B,EAC9C,SAA+C,EAC/C,SAAS,EACT,EAAE,WAAW,EAAE,CAChB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAC1E,CAAC;gBACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;oBAChE,sBAAsB,EACpB,2BAA2B,CAAC,2BAA2B;oBACzD,OAAO,EAAE;wBACP,MAAM,EAAE,6CAA6C;wBACrD,SAAS,EAAE,MAAM,CAAC,SAAS;wBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;qBAC5B;iBACF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,uEAAuE;QACvE,uDAAuD;QACvD,MAAM,WAAW,GAAG,KAAK,IAAmB,EAAE;YAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;gBAC3C,OAAO,EAAE,GAAG;gBACZ,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;aACnC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,IAAI,WAAW,EAAE,CAAC;YAChB,mCAAmC,CAAC,WAAW,EAAE;gBAC/C,GAAG,EAAE,4BAA4B,GAAG,EAAE;gBACtC,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,EAAE,CAAC;QACtB,CAAC;QAED,OAAO,SAAgD,CAAC;IAC1D,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,aAAa,CACxB,UAAkB,EAClB,aAAsC;QAEtC,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAChE,mBAAmB,CAAC,iBAA0B,EAC9C,EAAE,KAAK,EAAE,UAAU,EAAE,CACtB,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,QAAsC,CAAC;QAErD,mBAAmB;QACnB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,wBAAwB;gBAC5E,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;QAED,eAAe;QACf,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,wBAAwB;gBAC5E,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;QAED,yCAAyC;QACzC,IAAI,KAAK,CAAC,eAAe,KAAK,+BAA+B,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YAC7F,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,eAAe,KAAK,+BAA+B,CAAC,aAAa,EAAE,CAAC;YAC5E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YAC9B,IAAI,OAAO,IAAI,KAAK,CAAC,SAAS,IAAI,OAAO,EAAE,CAAC;gBAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;oBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,eAAe,KAAK,+BAA+B,CAAC,eAAe,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YAClG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;QAED,sBAAsB;QACtB,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAiC,CAAC,EAAE,CAAC;gBACrE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;oBACtC,OAAO,EAAE,KAAK,CAAC,GAAG;oBAClB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,aAAa;iBACd,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;oBAClF,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE;iBAC3E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,YAAY,CACvB,UAAkB,EAClB,WAAgC;QAEhC,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,2DAA2D;QAC3D,4DAA4D;QAC5D,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CACxE,mBAAmB,CAAC,iBAA0B,EAC9C;YACE,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YAC7B,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;SACxB,EACD,EAAE,WAAW,EAAE,CAChB,CAAC;QACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QACD,MAAM,aAAa,GAAG,gBAA8C,CAAC;QAErE,IAAI,MAA2B,CAAC;QAChC,IAAI,QAAmC,CAAC;QACxC;;;;WAIG;QACH,IAAI,cAAkC,CAAC;QAEvC,+FAA+F;QAC/F,sGAAsG;QACtG,MAAM,WAAW,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;QAE/E,QAAQ,aAAa,CAAC,eAAe,EAAE,CAAC;YACtC,KAAK,+BAA+B,CAAC,UAAU,CAAC,CAAC,CAAC;gBAChD,MAAM,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,WAAW,EAAE,CAAC;gBAClE,gFAAgF;gBAChF,QAAQ,GAAG;oBACT,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;oBACvD,KAAK,EAAE,CAAC,qBAAqB,CAAC;iBAC/B,CAAC;gBACF,MAAM;YACR,CAAC;YAED,KAAK,+BAA+B,CAAC,aAAa,CAAC,CAAC,CAAC;gBACnD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,CAAC;gBAC3C,MAAM,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,WAAW,EAAE,CAAC;gBAC5E,oEAAoE;gBACpE,wDAAwD;gBACxD,+DAA+D;gBAC/D,yEAAyE;gBACzE;;;;;;;;;;;;;;;;;;;mBAmBG;gBACH,cAAc,GAAG,OAAO,CAAC;gBACzB,QAAQ,GAAG,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;gBACpE,MAAM;YACR,CAAC;YAED,KAAK,+BAA+B,CAAC,eAAe,CAAC,CAAC,CAAC;gBACrD,MAAM,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,WAAW,EAAE,CAAC;gBAClE,gFAAgF;gBAChF,QAAQ,GAAG;oBACT,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;oBACvD,KAAK,EAAE,CAAC,qBAAqB,CAAC;iBAC/B,CAAC;gBACF,MAAM;YACR,CAAC;YAED,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;oBAChE,OAAO,EAAE;wBACP,MAAM,EAAE,2CAA2C;wBACnD,OAAO,EAAE,aAAa,CAAC,GAAG;wBAC1B,eAAe,EAAE,aAAa,CAAC,eAAe;qBAC/C;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,qBAAqB,CAClE,mBAAmB,CAAC,iBAA0B,EAC9C,MAAM,EACN,QAAQ,EACR,SAAS,EACT,EAAE,WAAW,EAAE,CAChB,CAAC;QAEF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC;YACrF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;gBAChE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;gBACnF,OAAO,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;QAED;;;;;;;WAOG;QACH,IAAI,cAAc,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,cAAc,EAAE,CAAC;YAC9E,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,oBAAoB,CAAC,qBAAqB,CACnD,mBAAmB,CAAC,iBAA0B,EAC9C,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACnB,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,qBAAqB,CAAC,EAAE,EAC7D,SAAS,EACT,EAAE,WAAW,EAAE,CAChB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4EAA4E,EAAE;oBAC7F,OAAO,EAAE,MAAM,CAAC,GAAG;oBACnB,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,KAAK,IAAmB,EAAE;YAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;gBAC5C,OAAO,EAAE,aAAa,CAAC,GAAG;gBAC1B,eAAe,EAAE,aAAa,CAAC,eAAe;aAC/C,CAAC,CAAC;QACL,CAAC,CAAC;QACF,IAAI,WAAW,EAAE,CAAC;YAChB,mCAAmC,CAAC,WAAW,EAAE;gBAC/C,GAAG,EAAE,6BAA6B,aAAa,CAAC,GAAG,EAAE;gBACrD,OAAO,EAAE,cAAc;aACxB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,cAAc,EAAE,CAAC;QACzB,CAAC;QAED,OAAO,MAAoC,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;;OAWG;IACH;;;;;;OAMG;IACI,KAAK,CAAC,gBAAgB,CAAC,UAAkB;QAC9C,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAC3D,mBAAmB,CAAC,iBAA0B,EAC9C,EAAE,KAAK,EAAE,UAAU,EAAE,CACtB,CAAC;QACF,OAAQ,GAAkC,IAAI,IAAI,CAAC;IACrD,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,OAAe;QACxC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAEvC,2FAA2F;QAC3F,8FAA8F;QAC9F,iGAAiG;QACjG,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAChE,mBAAmB,CAAC,iBAA0B,EAC9C,EAAE,GAAG,EAAE,OAAO,EAAE,CACjB,CAAC;QACF,OAAO,QAAQ,IAAI,IAAI,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;OAUG;IACH;;;;;;;;;;OAUG;IACI,KAAK,CAAC,iCAAiC,CAAC,OAAe,EAAE,MAAc;QAC5E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,wBAAwB,CAAC,iBAAiB,EAAE,CAAC;YACnF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,qBAAqB,CACnE,mBAAmB,CAAC,iBAA0B,EAC9C,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,EAClC,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAChG,CAAC;QACF,OAAO,OAAO,KAAK,IAAI,CAAC;IAC1B,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,OAAe;QACtC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,yFAAyF;QACzF,uFAAuF;QACvF,6FAA6F;QAC7F,yFAAyF;QACzF,2FAA2F;QAC3F,yFAAyF;QACzF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,qBAAqB,CACnE,mBAAmB,CAAC,iBAA0B,EAC9C,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAC/C,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,qBAAqB,CAAC,EAAE,CAC5E,CAAC;QAEF,0FAA0F;QAC1F,wEAAwE;QACxE,MAAM,SAAS,GAAG,OAAO,KAAK,IAAI,CAAC;QACnC,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,uBAAuB,CAClC,SAAiB,EACjB,SAAgC,EAChC,WAAgC;QAEhC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,MAAM,MAAM,GAAwB;YAClC,SAAS;YACT,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;SAC9B,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;QAC/B,CAAC;QAED,2FAA2F;QAC3F,8CAA8C;QAC9C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,2BAA2B,CAC9E,mBAAmB,CAAC,iBAA0B,EAC9C,MAAM,EACN,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,qBAAqB,CAAC,EAAE,EAC3E,SAAS,EAAE,0FAA0F;QACrG,iGAAiG;QACjG,gGAAgG;QAChG,0EAA0E;QAC1E,EAAE,WAAW,EAAE,CAChB,CAAC;QACF,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,aAAa,GAAG,KAAK,IAAmB,EAAE;gBAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;oBACzD,SAAS;oBACT,SAAS;oBACT,YAAY;iBACb,CAAC,CAAC;YACL,CAAC,CAAC;YACF,IAAI,WAAW,EAAE,CAAC;gBAChB,mCAAmC,CAAC,WAAW,EAAE;oBAC/C,GAAG,EAAE,6BAA6B,SAAS,IAAI,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,EAAE;oBAC3E,OAAO,EAAE,aAAa;iBACvB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,aAAa,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,qBAAqB,CAChC,SAAiB,EACjB,SAA+B;QAE/B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,yBAAyB,CACpE,mBAAmB,CAAC,iBAA0B,EAC9C;YACE,SAAS;YACT,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YAC7B,UAAU,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;YACzB,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;SACxB,CACF,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,gFAAgF;IAChF,6EAA6E;IAE7E;;;;;OAKG;IACI,KAAK,CAAC,sBAAsB,CACjC,MAA6B,EAC7B,YAAiC,EACjC,gBAIC,EACD,WAA+B;QAE/B,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,cAAc,IAAI,KAAK,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,4BAA4B,IAAI,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,EAClG,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,MAAM,EAAE,2CAA2C;oBACnD,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,KAAK;iBAC/C;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,mBAAmB,GACvB,MAAM,CAAC,4BAA4B,IAAI,SAAS;YAC9C,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC;YAC5D,CAAC,CAAC,SAAS,CAAC;QAEhB,uCAAuC;QACvC,IAAI,MAAM,CAAC,4BAA4B,EAAE,CAAC;YACxC,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,uBAAuB,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,MAAM,iBAAiB,GAAG,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACtF,MAAM,oBAAoB,GAAG,MAAM,CAAC,YAAY;YAC9C,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC;YAChE,CAAC,CAAC,SAAS,CAAC;QAEd,sBAAsB;QACtB,MAAM,YAAY,GAAsB;YACtC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,SAAS,EAAE,iBAAiB;YAC5B,cAAc,EAAE,YAAY,CAAC,cAAc,IAAI,gBAAgB,CAAC,cAAc;YAC9E,kBAAkB,EAAE,gBAAgB,CAAC,YAAY;YACjD,SAAS;YACT,GAAG,CAAC,mBAAmB,IAAI;gBACzB,mBAAmB;aACpB,CAAC;YACF,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;QAEF,+BAA+B;QAC/B,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,YAAY,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACzD,CAAC;QAED,oDAAoD;QACpD,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;YAChC,YAAY,CAAC,oBAAoB,GAAG,IAAI,CAAC;YACzC,YAAY,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAC5C,CAAC;QAED,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,YAAY,GAA2B,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,IAAI,gBAAgB,CAAC,cAAc,CAAC;YAC7E,IAAI,KAAK;gBAAE,YAAY,CAAC,cAAc,GAAG,KAAK,CAAC;YAC/C,KAAK,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC1E,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;gBACtC,IAAI,KAAK;oBAAE,YAAY,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,YAAY,CAAC,SAAS,GAAG,EAAE,YAAY,EAAE,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAEhE,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,sBAAsB,CACjC,MAA6B,EAC7B,YAAiC,EACjC,iBAA8C,EAC9C,WAAgC;QAEhC,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,cAAc,IAAI,KAAK,CAAC,CAAC;QAE/D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE;gBAC/D,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,KAAK;aAC/C,CAAC,CAAC;YACH,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QAC7B,CAAC;QAED,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAC9C,SAAS,EACT,SAAS,EACT,WAAW,CACZ,CAAC;YACF,YAAY,IAAI,KAAK,CAAC;QACxB,CAAC;QAED,MAAM,aAAa,GAAG,KAAK,IAAmB,EAAE;YAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBAC7C,SAAS;gBACT,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,YAAY;aACb,CAAC,CAAC;QACL,CAAC,CAAC;QACF,IAAI,WAAW,EAAE,CAAC;YAChB,mCAAmC,CAAC,WAAW,EAAE;gBAC/C,GAAG,EACD,yCAAyC,SAAS,GAAG;sBACnD,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;gBAClD,OAAO,EAAE,aAAa;aACvB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,aAAa,EAAE,CAAC;QACxB,CAAC;QAED,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;IACxC,CAAC;IAED,6EAA6E;IAC7E,kBAAkB;IAClB,6EAA6E;IAErE,wBAAwB,CAC9B,SAA+B,EAC/B,SAAiB;QAEjB,OAAO,MAAM;aACV,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;aAC5C,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAEO,uBAAuB,CAAC,KAAsB;QACpD,OAAO;YACL,UAAU,EAAE,KAAK,CAAC,KAAK;YACvB,OAAO,EAAE,KAAK,CAAC,GAAG;SACnB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACK,wBAAwB,CAAC,UAAmB;QAClD,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,IAAY,oBAAoB;QAC9B,IAAI,CAAC,IAAI,CAAC,4BAA4B,EAAE,CAAC;YACvC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;gBAChE,OAAO,EAAE,EAAE,MAAM,EAAE,2DAA2D,EAAE;aACjF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,4BAA4B,CAAC;IAC3C,CAAC;IAED;;;;;;;OAOG;IACK,eAAe,CAAC,WAAgC;QACtD,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QACnC,IAAI,WAAW,CAAC,YAAY,KAAK,kBAAkB,CAAC,OAAO,EAAE,CAAC;YAC5D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,MAAM,EAAE,+CAA+C;oBACvD,uBAAuB,EAAE,WAAW,CAAC,YAAY;iBAClD;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,WAAW,CAAC,aAA8B,CAAC;IACpD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACK,8BAA8B,CAAC,KAAc;QACnD,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAEpD,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC;QACrD,OAAO,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IACzF,CAAC;IAED;;OAEG;IACK,kBAAkB,CAAC,SAAwB,EAAE,OAAa,IAAI,IAAI,EAAE;QAC1E,MAAM,EAAE,GAAG,iBAAiB,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;QAC/C,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACK,sBAAsB,CAAI,KAAyB,EAAE,aAAkC;QAC7F,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;YAChC,OAAQ,KAAyC,CAAC,aAAa,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAA;AAj6BY,6BAA6B;IADzC,UAAU,EAAE;IASR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IAGzC,WAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;IAQ/D,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;+CAZZ,0BAA0B;QAC7B,cAAc;GAVhE,6BAA6B,CAi6BzC","sourcesContent":["/**\n * Consumable Token Backend Service\n *\n * Central service for the full lifecycle of consumable tokens:\n * - Token creation with crypto-secure random values\n * - Token validation (expiry, consumption, revocation, type matching)\n * - Atomic token consumption (race-condition safe via findOneAndUpdate)\n * - Token revocation (soft invalidation via revokedAt)\n * - Pipeline helpers for declarative tokenGeneration/tokenRevocation configs\n *\n * Security (R2): Raw token values are NEVER logged. Only token._id is logged.\n */\n\nimport { injectable, inject, optional } from 'inversify';\nimport crypto from 'crypto';\n\nimport {\n  ConsumableToken_ConsumptionMode,\n  resolveSharedPersistenceCollectionName,\n  ErrorType,\n  ErrorCustomMessageReference,\n  isWildoBackendError,\n  FILE_UPLOAD_GRANT_ABSOLUTE_MAX_MINUTES,\n  CoreConsumableTokenTypes,\n  PersistenceAdapter,\n  type ConsumableTokenTypes,\n  type TokenGenerationConfig,\n  type TokenRevocationConfig,\n  type StaticOrDerived,\n  type ExecutionContext_RoleInfo,\n} from '@wildo-ai/saas-models';\nimport { durationToSeconds, type DurationValue } from '@wildo-ai/zod-decorators';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\n\nimport { MongoDBService } from '~wildo-backend-lib/databases/services/mongodb.service';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport type { RepositoryGuardedMutation } from '~wildo-backend-lib/base-classes/services/repositories/repository-guarded-mutation.backend.types';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { BackendResourceType } from '~wildo-backend-lib/resources/models/resources-types.backend.schemas';\nimport type { ResourceIdBackendService } from '~wildo-backend-lib/resources/services/resource-id.backend.service';\nimport type {\n  ConsumableToken,\n} from '~wildo-backend-lib/security/consumable-tokens/models/consumable-tokens.shared.schemas';\nimport {\n  registerTransactionPostCommitEffect,\n  type TransactionContext,\n} from '~wildo-backend-lib/databases/models/transaction.shared.schemas';\nimport type { ClientSession } from 'mongodb';\n\n\n// ============================================================================\n// TYPES\n// ============================================================================\n\nexport interface CreateTokenParams {\n  /** Token type identifier (e.g., CoreConsumableTokenTypes.FILE_PUBLIC_ACCESS). NOT the Wildo resource type. */\n  tokenType: ConsumableTokenTypes;\n  consumptionMode: ConsumableToken_ConsumptionMode;\n  expiresIn: DurationValue;\n  organizationId?: string;\n  userId?: string;\n  /** The Wildo resource identifier this token targets (e.g., 'users', 'files'). */\n  resourceIdentifier?: string;\n  relatedId?: string;\n  metadata?: Record<string, any>;\n  roles?: ExecutionContext_RoleInfo[];\n  maxUses?: number;\n  /** W7.3b: Whether this token can be exchanged for a one-off session JWT. */\n  createsOneOffSession?: boolean;\n  /** W7.3b: When the token is consumed — at exchange time or at target operation time. */\n  consumeAt?: 'EXCHANGE' | 'TARGET_OPERATION';\n  /** W7.3b: Scoped caller identity for audit and authorization narrowing. */\n  targeting?: {\n    initiatorIds?: Record<string, string>;\n  };\n  /**\n   * Sparse database-unique ownership key for replace-existing generation.\n   * Removed when the token is revoked or reaches its terminal consumption.\n   */\n  activeGenerationKey?: string;\n}\n\nexport interface TokenGenerationResult {\n  tokenValue: string;\n  tokenId: string;\n}\n\nexport interface TokenRevocationResult {\n  revokedCount: number;\n}\n\n\n// ============================================================================\n// SERVICE\n// ============================================================================\n\n/**\n * revocation-B1: the hard ceiling (in minutes) on the lifetime of ANY one-off SESSION, enforced at TWO points:\n * (1) at MINT — `createToken`, the single chokepoint BOTH one-off mint paths funnel through (the super-admin\n * route's `createOneOffToken` and the declarative resource-config `processTokenGeneration`) — bounding the\n * token's authored duration / LINK validity window fail-closed; and (2) at EXCHANGE —\n * `computeOneOffSessionExpiresAt` — which anchors the minted SESSION's lifetime at CONSUMPTION (the exchange),\n * NOT at production, and clamps it to this ceiling. The exchange anchor is the authoritative session bound;\n * the mint ceiling additionally keeps the link from being exchangeable for longer than the ceiling.\n *\n * A one-off token with `createsOneOffSession` is a session-establishing credential: exchanging it mints a\n * JWT session for another user. The security industry treats the maximum lifetime of such a delegated /\n * impersonated credential as a hard ceiling enforced AT ISSUANCE, on EVERY path, fail-closed — and puts that\n * ceiling at ~12 hours, measured from when the session begins. A per-user-type `oneOffSessionMaxDurationMinutes`\n * may only TIGHTEN below this; nothing exceeds it. Non-session consumable tokens (password-reset, invitation,\n * magic-link) are unaffected.\n *\n * spec-cite: AWS STS `AssumeRole` — `DurationSeconds` is validated against the role's `MaxSessionDuration`\n * (1h default, 12h hard max); an over-max request is REJECTED, not clamped —\n * https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html\n * spec-cite: GCP IAM short-lived credentials — impersonated-credential lifetime defaults to 1h and is capped\n * at 12h (43200s), extendable only via the `iam.allowServiceAccountCredentialLifetimeExtension` org policy —\n * https://cloud.google.com/iam/docs/create-short-lived-credentials-direct\n * spec-cite: OWASP Session Management Cheat Sheet, \"Absolute Timeout\" — every session must have an absolute\n * maximum lifetime enforced regardless of activity, to bound how long a hijacked session stays usable —\n * https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html\n */\nexport const ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES = 12 * 60;\n\n@injectable()\nexport class ConsumableTokenBackendService {\n  private readonly logger: LoggerService;\n  private readonly errorBuilder: ErrorBuilderBackendService;\n  private readonly mongoDBService: MongoDBService;\n  private readonly resourceIdService?: ResourceIdBackendService;\n  private readonly injectedRepositoriesRegistry?: RepositoriesRegistryHandlerBackendService;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.MongoDBService) mongoDBService: MongoDBService,\n    // LAST and OPTIONAL: appended so existing positional constructions keep working, optional so the\n    // harnesses that build this service directly are not forced to wire a dependency they do not use.\n    @inject(SAAS_SERVICE_TYPES.ResourceIdBackendService) @optional() resourceIdService?: ResourceIdBackendService,\n    /**\n     * The adapter-neutral persistence plane this service now writes through.\n     *\n     * LAST and OPTIONAL for the same reason `resourceIdService` is: several harnesses construct this\n     * service positionally, and making it required would break them at construction rather than at\n     * the call they actually exercise.\n     */\n    @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) @optional() repositoriesRegistry?: RepositoriesRegistryHandlerBackendService,\n  ) {\n    this.logger = logger;\n    this.errorBuilder = errorBuilder;\n    this.mongoDBService = mongoDBService;\n    this.resourceIdService = resourceIdService;\n    this.injectedRepositoriesRegistry = repositoriesRegistry;\n  }\n\n\n  // ==========================================================================\n  // CORE TOKEN OPERATIONS\n  // ==========================================================================\n\n  /**\n   * Create a new consumable token.\n   * Generates a 32-byte hex crypto-random token value and persists it.\n   *\n   * @returns The full entity WITH the raw token value (for passing to emails/responses).\n   *          NEVER log the returned token value (R2).\n   */\n  public async createToken(\n    params: CreateTokenParams,\n    transaction?: TransactionContext,\n  ): Promise<ConsumableToken & { token: string }> {\n    const tokenValue = crypto.randomBytes(32).toString('hex');\n    const now = new Date();\n    const expiresAt = this.calculateExpiresAt(params.expiresIn, now);\n\n    // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — a one-off session token is a\n    // session-establishing credential minted for another user, so its lifetime is bounded by the industry\n    // hard ceiling (ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES) HERE — the single point every one-off mint path\n    // funnels through (super-admin route + resource-config `processTokenGeneration`). Fail-closed: an\n    // over-ceiling mint is REJECTED, never silently clamped (matching AWS STS rejecting an over-max AssumeRole).\n    if (params.createsOneOffSession) {\n      const requestedMinutes = durationToSeconds(params.expiresIn) / 60;\n      if (requestedMinutes > ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.ONE_OFF_SESSION_DURATION_EXCEEDS_MAX,\n          context: { requestedMinutes: Math.round(requestedMinutes), absoluteMaxMinutes: ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES }, // diagnostic (log-only)\n        });\n      }\n    }\n    // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — a file upload grant is a bearer credential\n    // DESIGNED to leave the trust boundary (an LLM transcript, a shell history), so its lifetime is bounded\n    // HERE, at the one mint chokepoint, per type and fail-closed: an over-ceiling request is REJECTED, never\n    // clamped (issue #312, D8). Nothing else bounds a consumable token's life — measured 2026-09-05, the\n    // one-off ceiling above was the only one — which is why this cannot be left to the caller's `expiresIn`.\n    // SINGLE_USE only: a reusable upload credential is the presigned-URL defect rebuilt inside the API.\n    if (params.tokenType === CoreConsumableTokenTypes.FILE_UPLOAD_GRANT) {\n      const requestedMinutes = durationToSeconds(params.expiresIn) / 60;\n      if (requestedMinutes > FILE_UPLOAD_GRANT_ABSOLUTE_MAX_MINUTES) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_GRANT_DURATION_EXCEEDS_MAX,\n          context: { requestedMinutes: Math.round(requestedMinutes), absoluteMaxMinutes: FILE_UPLOAD_GRANT_ABSOLUTE_MAX_MINUTES }, // diagnostic (log-only)\n        });\n      }\n      if (params.consumptionMode !== ConsumableToken_ConsumptionMode.SINGLE_USE) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION,\n          context: { message: 'A file upload grant must be SINGLE_USE', consumptionMode: params.consumptionMode }, // diagnostic (log-only)\n        });\n      }\n    }\n    /**\n     * Identity through the framework AUTHORITY, not `crypto.randomUUID()`.\n     *\n     * The id format is a per-resource framework decision (`ResourceIdBackendService`), and the\n     * PostgreSQL repository already mints through it in `withGeneratedRowIdentity`. Minting a UUID\n     * here instead produced a row whose `_id` is not the shape the resource declares, and the\n     * consequence was measured rather than reasoned: the repository read the row correctly but with\n     * **no `_id` at all**, because Mongoose cannot hydrate a UUID into its declared identity type.\n     *\n     * That was invisible while every token path addressed rows by their `token` value and never by\n     * `_id` — the same \"agreed by never meeting\" shape as the collection-name split this service also\n     * carried. It stops being invisible the moment creation moves to the repository (R-W5-3), which\n     * mints through this same authority, so the two would disagree about what an existing row's id\n     * even looks like.\n     *\n     * `@optional()` on the injection: the service is constructed directly in several harnesses, and a\n     * required dependency there would be a churn cost with no safety gain. The fallback is the\n     * previous behaviour, so a harness that does not supply it degrades to what it had before rather\n     * than to something new.\n     */\n    const _id = this.resourceIdService\n      ? String(this.resourceIdService.generateForResource(BackendResourceType.CONSUMABLE_TOKENS as never))\n      : crypto.randomUUID();\n\n    const tokenData: ConsumableToken = {\n      _id,\n      token: tokenValue,\n      tokenType: params.tokenType,\n      resourceIdentifier: params.resourceIdentifier,\n      consumptionMode: params.consumptionMode,\n      organizationId: params.organizationId,\n      userId: params.userId,\n      relatedId: params.relatedId,\n      ...(params.activeGenerationKey && {\n        activeGenerationKey: params.activeGenerationKey,\n      }),\n      metadata: params.metadata || {},\n      roles: params.roles || [],\n      expiresAt,\n      isConsumed: false,\n      usesCount: 0,\n      ...(params.createsOneOffSession !== undefined && { createsOneOffSession: params.createsOneOffSession }),\n      ...(params.consumeAt && { consumeAt: params.consumeAt }),\n      ...(params.targeting && { targeting: params.targeting }),\n      createdAt: now,\n      updatedAt: now,\n    };\n\n    // maxUses is required for BOUNDED_REUSE\n    if (params.consumptionMode === ConsumableToken_ConsumptionMode.BOUNDED_REUSE) {\n      if (!params.maxUses || params.maxUses < 1) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION,\n          context: { reason: 'maxUses is required and must be >= 1 for BOUNDED_REUSE tokens' }\n        });\n      }\n      tokenData.maxUses = params.maxUses;\n    }\n\n    // The adapter narrows `transaction` itself and raises the mismatch error, so this service no\n    // longer needs its own MongoDB-specific narrowing.\n    try {\n      await this.repositoriesRegistry.insertDocumentForInfrastructure(\n        BackendResourceType.CONSUMABLE_TOKENS as never,\n        tokenData as unknown as Record<string, unknown>,\n        undefined,\n        { transaction },\n      );\n    } catch (error) {\n      if (params.activeGenerationKey && this.isActiveGenerationKeyDuplicate(error)\n      ) {\n        throw this.errorBuilder.buildError(ErrorType.CONFLICT, undefined, {\n          customMessageReference:\n            ErrorCustomMessageReference.UNIQUE_CONSTRAINT_VIOLATION,\n          context: {\n            reason: 'consumable_token_active_generation_conflict',\n            tokenType: params.tokenType,\n            relatedId: params.relatedId,\n          },\n        });\n      }\n      throw error;\n    }\n\n    // Log creation without the raw token value (R2), and only after commit\n    // when this token participates in a wider transaction.\n    const logCreation = async (): Promise<void> => {\n      this.logger.info('Consumable token created', {\n        tokenId: _id,\n        tokenType: params.tokenType,\n        consumptionMode: params.consumptionMode,\n        relatedId: params.relatedId,\n        organizationId: params.organizationId,\n        expiresAt: expiresAt.toISOString(),\n      });\n    };\n    if (transaction) {\n      registerTransactionPostCommitEffect(transaction, {\n        key: `consumable-token-created:${_id}`,\n        execute: logCreation,\n      });\n    } else {\n      await logCreation();\n    }\n\n    return tokenData as ConsumableToken & { token: string };\n  }\n\n  /**\n   * Validate a token without consuming it.\n   * Checks: existence, revocation, expiry, consumption status, type matching.\n   *\n   * @param tokenValue - The raw token string from the request\n   * @param expectedTypes - Optional array of accepted token types for this operation\n   * @returns The validated token entity\n   * @throws Appropriate error for each failure mode\n   */\n  public async validateToken(\n    tokenValue: string,\n    expectedTypes?: ConsumableTokenTypes[],\n  ): Promise<ConsumableToken> {\n    this.assertTokenValueIsString(tokenValue);\n    const tokenDoc = await this.repositoriesRegistry.readUnscopedByKey<ConsumableToken>(\n      BackendResourceType.CONSUMABLE_TOKENS as never,\n      { token: tokenValue },\n    );\n\n    if (!tokenDoc) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_NOT_FOUND,\n      });\n    }\n\n    const token = tokenDoc as unknown as ConsumableToken;\n\n    // Check revocation\n    if (token.revokedAt) {\n      this.logger.warn('Revoked token used', { tokenId: token._id });\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_REVOKED,\n        context: { tokenId: token._id },\n      });\n    }\n\n    // Check expiry\n    if (token.expiresAt < new Date()) {\n      this.logger.warn('Expired token used', { tokenId: token._id });\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_EXPIRED,\n        context: { tokenId: token._id },\n      });\n    }\n\n    // Check consumption status based on mode\n    if (token.consumptionMode === ConsumableToken_ConsumptionMode.SINGLE_USE && token.isConsumed) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_ALREADY_CONSUMED,\n        context: { tokenId: token._id },\n      });\n    }\n\n    if (token.consumptionMode === ConsumableToken_ConsumptionMode.BOUNDED_REUSE) {\n      const maxUses = token.maxUses;\n      if (maxUses && token.usesCount >= maxUses) {\n        throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_ALREADY_CONSUMED,\n          context: { tokenId: token._id, usesCount: token.usesCount, maxUses },\n        });\n      }\n    }\n\n    if (token.consumptionMode === ConsumableToken_ConsumptionMode.EPHEMERAL_STATE && token.isConsumed) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_ALREADY_CONSUMED,\n        context: { tokenId: token._id },\n      });\n    }\n\n    // Check type matching\n    if (expectedTypes && expectedTypes.length > 0) {\n      if (!expectedTypes.includes(token.tokenType as ConsumableTokenTypes)) {\n        this.logger.warn('Token type mismatch', {\n          tokenId: token._id,\n          tokenType: token.tokenType,\n          expectedTypes\n        });\n        throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_TYPE_MISMATCH,\n          context: { tokenId: token._id, tokenType: token.tokenType, expectedTypes },\n        });\n      }\n    }\n\n    return token;\n  }\n\n  /**\n   * Atomically consume a token.\n   * Uses MongoDB `findOneAndUpdate` with conditions to prevent race conditions.\n   *\n   * - SINGLE_USE: condition `{ isConsumed: false }`, sets `{ isConsumed: true, usesCount: 1 }`\n   * - BOUNDED_REUSE: condition `{ usesCount: { $lt: maxUses } }`, inc `usesCount`, set `isConsumed` if exhausted\n   * - EPHEMERAL_STATE: condition `{ isConsumed: false }`, sets `{ isConsumed: true }`\n   *\n   * @param tokenValue - The raw token string\n   * @returns The updated token entity\n   * @throws CONSUMABLE_TOKEN_RACE_CONDITION if atomic update fails (concurrent consumption)\n   */\n  public async consumeToken(\n    tokenValue: string,\n    transaction?: TransactionContext,\n  ): Promise<ConsumableToken> {\n    this.assertTokenValueIsString(tokenValue);\n    const now = new Date();\n\n    // First, read the token to determine its consumption mode.\n    // Also check that the token hasn't expired or been revoked.\n    const existingTokenDoc = await this.repositoriesRegistry.readUnscopedByKey<ConsumableToken>(\n      BackendResourceType.CONSUMABLE_TOKENS as never,\n      {\n        token: tokenValue,\n        revokedAt: { $exists: false },\n        expiresAt: { $gt: now },\n      },\n      { transaction },\n    );\n    if (!existingTokenDoc) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_NOT_FOUND,\n      });\n    }\n    const existingToken = existingTokenDoc as unknown as ConsumableToken;\n\n    let filter: Record<string, any>;\n    let mutation: RepositoryGuardedMutation;\n    /**\n     * BOUNDED_REUSE only. `isConsumed` is DERIVED state for that mode — a cache read solely by the\n     * cleanup batch's hard-delete, never by an authorization path — so it is computed from the\n     * post-increment row rather than inside the statement. See the note at the write below.\n     */\n    let boundedMaxUses: number | undefined;\n\n    // All filters include expiresAt + revokedAt guards to prevent consuming expired/revoked tokens\n    // in the atomic update (defense-in-depth against TOCTOU between the read above and the update below).\n    const expiryGuard = { expiresAt: { $gt: now }, revokedAt: { $exists: false } };\n\n    switch (existingToken.consumptionMode) {\n      case ConsumableToken_ConsumptionMode.SINGLE_USE: {\n        filter = { token: tokenValue, isConsumed: false, ...expiryGuard };\n        // Fully expressible: every assignment is a constant, and `$$REMOVE` is `clear`.\n        mutation = {\n          set: { isConsumed: true, usesCount: 1, updatedAt: now },\n          clear: ['activeGenerationKey'],\n        };\n        break;\n      }\n\n      case ConsumableToken_ConsumptionMode.BOUNDED_REUSE: {\n        const maxUses = existingToken.maxUses || 1;\n        filter = { token: tokenValue, usesCount: { $lt: maxUses }, ...expiryGuard };\n        // Use aggregation pipeline update to atomically increment usesCount\n        // AND compute isConsumed from the post-increment value.\n        // This avoids the race condition where two concurrent requests\n        // both read the same pre-increment usesCount and fail to set isConsumed.\n        /**\n         * The INCREMENT is the guarantee; the flag is not.\n         *\n         * Atomicity here comes from the FILTER (`usesCount < maxUses`), which is what refuses the\n         * consume once the allowance is spent — and it is `usesCount`, never `isConsumed`, that\n         * every authorization path reads: this filter, and `validateToken`'s BOUNDED_REUSE branch.\n         * `isConsumed` is a denormalized flag whose only consumer is the cleanup batch's\n         * hard-delete, which ALREADY carries a second sweep for exactly this window (\"defense in\n         * depth for the race condition edge case where isConsumed may not have been atomically\n         * set\").\n         *\n         * MongoDB expressed the derivation inside an aggregation-pipeline update; that is precisely\n         * the raw-operator form the adapter-neutral vocabulary excludes, and a computed set is not\n         * expressible for both adapters through it. Deriving it from the returned post-increment row\n         * keeps the authoritative counter atomic and costs only freshness on a flag nothing gates on.\n         *\n         * Rejected: narrowing the filter to a compare-and-swap on `usesCount` so the post-value were\n         * known here — that would turn two legitimate concurrent consumers of a bounded-reuse token\n         * into one CONFLICT, a behaviour regression rather than a translation.\n         */\n        boundedMaxUses = maxUses;\n        mutation = { increment: { usesCount: 1 }, set: { updatedAt: now } };\n        break;\n      }\n\n      case ConsumableToken_ConsumptionMode.EPHEMERAL_STATE: {\n        filter = { token: tokenValue, isConsumed: false, ...expiryGuard };\n        // Fully expressible: every assignment is a constant, and `$$REMOVE` is `clear`.\n        mutation = {\n          set: { isConsumed: true, usesCount: 1, updatedAt: now },\n          clear: ['activeGenerationKey'],\n        };\n        break;\n      }\n\n      default: {\n        throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {\n          context: {\n            reason: 'consumable_token_consumption_mode_invalid',\n            tokenId: existingToken._id,\n            consumptionMode: existingToken.consumptionMode,\n          },\n        });\n      }\n    }\n\n    const result = await this.repositoriesRegistry.atomicGuardedMutation<ConsumableToken>(\n      BackendResourceType.CONSUMABLE_TOKENS as never,\n      filter,\n      mutation,\n      undefined,\n      { transaction },\n    );\n\n    if (!result) {\n      this.logger.warn('Token consumption race condition', { tokenId: existingToken._id });\n      throw this.errorBuilder.buildError(ErrorType.CONFLICT, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_RACE_CONDITION,\n        context: { tokenId: existingToken._id },\n      });\n    }\n\n    /**\n     * Settle the DERIVED flag for BOUNDED_REUSE, now that the authoritative counter is known.\n     *\n     * Guarded on the same allowance, so a concurrent consumer that has not yet exhausted the token\n     * cannot flip it early. Nothing gates on this flag (see the mutation note above), so a failure to\n     * write it is a freshness loss the cleanup batch's second sweep already covers — it must not turn\n     * a SUCCESSFUL consume into an error for the caller.\n     */\n    if (boundedMaxUses !== undefined && (result.usesCount ?? 0) >= boundedMaxUses) {\n      result.isConsumed = true;\n      try {\n        await this.repositoriesRegistry.atomicGuardedMutation(\n          BackendResourceType.CONSUMABLE_TOKENS as never,\n          { _id: result._id },\n          { set: { isConsumed: true }, clear: ['activeGenerationKey'] },\n          undefined,\n          { transaction },\n        );\n      } catch (error) {\n        this.logger.warn('Consumable token exhausted but its derived isConsumed flag was not written', {\n          tokenId: result._id,\n          ...projectCaughtErrorLogFields(error),\n        });\n      }\n    }\n\n    const logConsumption = async (): Promise<void> => {\n      this.logger.info('Consumable token consumed', {\n        tokenId: existingToken._id,\n        consumptionMode: existingToken.consumptionMode,\n      });\n    };\n    if (transaction) {\n      registerTransactionPostCommitEffect(transaction, {\n        key: `consumable-token-consumed:${existingToken._id}`,\n        execute: logConsumption,\n      });\n    } else {\n      await logConsumption();\n    }\n\n    return result as unknown as ConsumableToken;\n  }\n\n  /**\n   * Fetch a token by its `_id`, WITHOUT any state assertions — a revoked, expired, or consumed row all\n   * pass through. This is deliberately different from `validateToken`, which keys on the token VALUE and\n   * THROWS on any non-live state: an operator flow that acts ON a token needs to read it first and decide\n   * for itself. The one-off-session revoke route uses it to (a) return NOT_FOUND for a missing id, (b)\n   * confirm the row IS a one-off session token before revoking (this door must never touch a\n   * password-reset / invitation / magic-link token by id), and (c) build the revocation audit from the\n   * token's own `userId` / `tokenType`. Returns `null` when no row matches.\n   *\n   * `tokenId` is guarded by the same non-string check as every other primitive here (`{ _id }` reaches\n   * Mongo directly, so a `{$ne}`-shaped value would otherwise match an ARBITRARY token).\n   */\n  /**\n   * Read a token row by its VALUE regardless of state — expired, consumed and revoked rows included.\n   *\n   * For status surfaces that must say WHY a token is unusable (`validateToken` refuses those rows, which\n   * is right for authentication and wrong for a status read). Callers hold the value already, so this\n   * discloses nothing they could not learn by presenting it. Never logs the value (R2).\n   */\n  public async findTokenByValue(tokenValue: string): Promise<ConsumableToken | null> {\n    this.assertTokenValueIsString(tokenValue);\n    const doc = await this.repositoriesRegistry.readUnscopedByKey<ConsumableToken>(\n      BackendResourceType.CONSUMABLE_TOKENS as never,\n      { token: tokenValue },\n    );\n    return (doc as unknown as ConsumableToken) ?? null;\n  }\n\n  public async findTokenById(tokenId: string): Promise<ConsumableToken | null> {\n    this.assertTokenValueIsString(tokenId);\n\n    // Adapter-neutral, like every other read on this service: the retired `getTokenCollection`\n    // accessor reached the Mongo driver directly, so a raw `findOne` here would make this the one\n    // token-lookup door a PostgreSQL-backed application cannot open. `readUnscopedByKey` is the same\n    // primitive the token-VALUE lookups above already use; only the key differs.\n    const tokenDoc = await this.repositoriesRegistry.readUnscopedByKey<ConsumableToken>(\n      BackendResourceType.CONSUMABLE_TOKENS as never,\n      { _id: tokenId },\n    );\n    return tokenDoc ?? null;\n  }\n\n  /**\n   * Soft-revoke a token by setting revokedAt.\n   * This is a soft invalidation — the record stays in DB for audit.\n   * Hard deletion is handled by the cleanup cron job.\n   *\n   * CONDITIONAL on the row not already being revoked (`revokedAt: { $exists: false }`), mirroring\n   * `revokeTokensByRelatedId`. This makes the transition atomic: two concurrent revocations of the SAME token\n   * transition it exactly once, so a caller can emit its audit only on the real transition (returned `true`)\n   * and never write a duplicate row under a race. Returns whether THIS call performed the revocation\n   * (`false` = the token was already revoked, or does not exist).\n   */\n  /**\n   * Record, on a redeemed FILE_UPLOAD_GRANT, the file its one upload produced (issue #312, D6/D10).\n   *\n   * Written AFTER the grant is consumed and the FILES row exists, so there is exactly one writer and\n   * a plain replace of `metadata` is safe. Best-effort by contract: the upload has already succeeded\n   * when this runs, so a failure here must not fail it — the caller logs and the status read falls\n   * back to \"REDEEMED, file unknown; re-read the resource\". Returns whether a row was written.\n   *\n   * Replaces the whole `metadata` object rather than a dotted path so the write is adapter-neutral:\n   * the PostgreSQL arm stores `metadata` as one JSON column.\n   */\n  public async recordFileUploadGrantProducedFile(tokenId: string, fileId: string): Promise<boolean> {\n    const existing = await this.findTokenById(tokenId);\n    if (!existing || existing.tokenType !== CoreConsumableTokenTypes.FILE_UPLOAD_GRANT) {\n      return false;\n    }\n    const now = new Date();\n    const written = await this.repositoriesRegistry.atomicGuardedMutation(\n      BackendResourceType.CONSUMABLE_TOKENS as never,\n      { _id: tokenId, isConsumed: true },\n      { set: { metadata: { ...(existing.metadata ?? {}), producedFileId: fileId }, updatedAt: now } },\n    );\n    return written !== null;\n  }\n\n  public async revokeToken(tokenId: string): Promise<boolean> {\n    const now = new Date();\n\n    // Adapter-neutral by construction: `atomicGuardedMutation` compiles the SAME conditional\n    // transition on either adapter — the PostgreSQL arm translates `{ $exists: false }` to\n    // `IS NULL` — and `clear` is the neutral spelling of the pipeline's `$$REMOVE`. Dropping the\n    // active-generation key is what frees a later token of the same generation to be minted.\n    // Deliberately the same idiom as `revokeTokensByRelatedId`, which the conditional mirrors:\n    // a raw driver call here would make this the one revocation door PostgreSQL cannot open.\n    const revoked = await this.repositoriesRegistry.atomicGuardedMutation(\n      BackendResourceType.CONSUMABLE_TOKENS as never,\n      { _id: tokenId, revokedAt: { $exists: false } },\n      { set: { revokedAt: now, updatedAt: now }, clear: ['activeGenerationKey'] },\n    );\n\n    // `null` is the neutral spelling of \"no row matched the guard\" — the same fact the driver\n    // reported as `modifiedCount === 0`: already revoked, or no such token.\n    const didRevoke = revoked !== null;\n    if (didRevoke) {\n      this.logger.info('Consumable token revoked', { tokenId });\n    }\n    return didRevoke;\n  }\n\n  /**\n   * Revoke all tokens matching a relatedId and optionally a token type.\n   * Uses repository directly (R6 — intentional, not routed through operation pipeline).\n   *\n   * @returns Count of revoked tokens\n   */\n  public async revokeTokensByRelatedId(\n    relatedId: string,\n    tokenType?: ConsumableTokenTypes,\n    transaction?: TransactionContext,\n  ): Promise<number> {\n    const now = new Date();\n\n    const filter: Record<string, any> = {\n      relatedId,\n      revokedAt: { $exists: false },\n    };\n    if (tokenType) {\n      filter.tokenType = tokenType;\n    }\n\n    // The COUNT is the contract: callers report how many tokens were revoked, so the multi-row\n    // primitive returns it rather than a boolean.\n    const revokedCount = await this.repositoriesRegistry.bulkUpdateForInfrastructure(\n      BackendResourceType.CONSUMABLE_TOKENS as never,\n      filter,\n      { set: { revokedAt: now, updatedAt: now }, clear: ['activeGenerationKey'] },\n      undefined, // no execution context: this is a framework-internal revocation, below the operation tier\n      // JOIN THE CALLER'S TRANSACTION. Without this the revocation committed immediately even when the\n      // caller was mid-transaction, so a driver retry could not roll it back — the retry then revoked\n      // nothing and reported 0 for work that had already happened exactly once.\n      { transaction },\n    );\n    if (revokedCount > 0) {\n      const logRevocation = async (): Promise<void> => {\n        this.logger.info('Consumable tokens revoked by relatedId', {\n          relatedId,\n          tokenType,\n          revokedCount,\n        });\n      };\n      if (transaction) {\n        registerTransactionPostCommitEffect(transaction, {\n          key: `consumable-tokens-revoked:${relatedId}:${String(tokenType ?? 'all')}`,\n          execute: logRevocation,\n        });\n      } else {\n        await logRevocation();\n      }\n    }\n\n    return revokedCount;\n  }\n\n  /**\n   * Find all unconsumed, non-revoked, non-expired tokens for a given relatedId and token type.\n   * Used by Email OTP verification (Step 10) to find matching OTP tokens.\n   *\n   * @returns Array of matching token documents (may be empty)\n   */\n  public async findTokensByRelatedId(\n    relatedId: string,\n    tokenType: ConsumableTokenTypes,\n  ): Promise<ConsumableToken[]> {\n    const now = new Date();\n\n    const docs = await this.repositoriesRegistry.findManyForInfrastructure<ConsumableToken>(\n      BackendResourceType.CONSUMABLE_TOKENS as never,\n      {\n        relatedId,\n        tokenType: tokenType,\n        revokedAt: { $exists: false },\n        isConsumed: { $ne: true },\n        expiresAt: { $gt: now },\n      },\n    );\n\n    return docs;\n  }\n\n  // ==========================================================================\n  // PIPELINE HELPERS — Called by services-registry-handler for declarative config\n  // ==========================================================================\n\n  /**\n   * Process a declarative tokenGeneration config from an operation variant.\n   * Called AFTER the core operation succeeds, BEFORE notification dispatch.\n   *\n   * Returns `{ tokenValue, tokenId }` for injection into notification context.\n   */\n  public async processTokenGeneration(\n    config: TokenGenerationConfig,\n    currentState: Record<string, any>,\n    executionContext: {\n      organizationId?: string;\n      userId?: string;\n      resourceType?: string;\n    },\n    transaction: TransactionContext,\n  ): Promise<TokenGenerationResult> {\n    const relatedId = currentState[config.relatedIdField || '_id'];\n    if (config.revokeExistingForSameRelated && (typeof relatedId !== 'string' || relatedId.length === 0)\n    ) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        context: {\n          reason: 'replace_existing_token_related_id_missing',\n          tokenType: config.tokenType,\n          relatedIdField: config.relatedIdField || '_id',\n        },\n      });\n    }\n\n    const activeGenerationKey =\n      config.revokeExistingForSameRelated && relatedId\n        ? this.buildActiveGenerationKey(config.tokenType, relatedId)\n        : undefined;\n\n    // Revoke existing tokens if configured\n    if (config.revokeExistingForSameRelated) {\n      if (relatedId) {\n        await this.revokeTokensByRelatedId(relatedId, config.tokenType, transaction);\n      }\n    }\n\n    // Resolve static or derived values\n    const resolvedExpiresIn = this.resolveStaticOrDerived(config.expiresIn, currentState);\n    const resolvedGrantedRoles = config.grantedRoles\n      ? this.resolveStaticOrDerived(config.grantedRoles, currentState)\n      : undefined;\n\n    // Build create params\n    const createParams: CreateTokenParams = {\n      tokenType: config.tokenType,\n      consumptionMode: config.consumptionMode,\n      expiresIn: resolvedExpiresIn,\n      organizationId: currentState.organizationId || executionContext.organizationId,\n      resourceIdentifier: executionContext.resourceType,\n      relatedId,\n      ...(activeGenerationKey && {\n        activeGenerationKey,\n      }),\n      roles: resolvedGrantedRoles,\n      maxUses: config.maxUses,\n    };\n\n    // Resolve userId if configured\n    if (config.userIdField) {\n      createParams.userId = currentState[config.userIdField];\n    }\n\n    // W7.3b: Bridge to one-off sessions when configured\n    if (config.createsOneOffSession) {\n      createParams.createsOneOffSession = true;\n      createParams.consumeAt = config.consumeAt;\n    }\n\n    if (config.targetingFields) {\n      const initiatorIds: Record<string, string> = {};\n      const orgId = currentState.organizationId || executionContext.organizationId;\n      if (orgId) initiatorIds.organizationId = orgId;\n      for (const [fieldId, fieldPath] of Object.entries(config.targetingFields)) {\n        const value = currentState[fieldPath];\n        if (value) initiatorIds[fieldId] = String(value);\n      }\n      if (Object.keys(initiatorIds).length > 0) {\n        createParams.targeting = { initiatorIds };\n      }\n    }\n\n    const token = await this.createToken(createParams, transaction);\n\n    return this.toTokenGenerationResult(token);\n  }\n\n  /**\n   * Process a declarative tokenRevocation config from an operation variant.\n   * Called BEFORE the core operation (pre-operation step).\n   *\n   * Revokes all tokens matching the related resource ID and configured token types.\n   */\n  public async processTokenRevocation(\n    config: TokenRevocationConfig,\n    currentState: Record<string, any>,\n    _executionContext: { organizationId?: string },\n    transaction?: TransactionContext,\n  ): Promise<TokenRevocationResult> {\n    const relatedId = currentState[config.relatedIdField || '_id'];\n\n    if (!relatedId) {\n      this.logger.warn('Token revocation skipped: no relatedId found', {\n        relatedIdField: config.relatedIdField || '_id',\n      });\n      return { revokedCount: 0 };\n    }\n\n    let totalRevoked = 0;\n    for (const tokenType of config.tokenTypes) {\n      const count = await this.revokeTokensByRelatedId(\n        relatedId,\n        tokenType,\n        transaction,\n      );\n      totalRevoked += count;\n    }\n\n    const logCompletion = async (): Promise<void> => {\n      this.logger.info('Token revocation completed', {\n        relatedId,\n        tokenTypes: config.tokenTypes,\n        totalRevoked,\n      });\n    };\n    if (transaction) {\n      registerTransactionPostCommitEffect(transaction, {\n        key:\n          `consumable-token-revocation-completed:${relatedId}:`\n          + config.tokenTypes.map(String).sort().join(','),\n        execute: logCompletion,\n      });\n    } else {\n      await logCompletion();\n    }\n\n    return { revokedCount: totalRevoked };\n  }\n\n  // ==========================================================================\n  // PRIVATE HELPERS\n  // ==========================================================================\n\n  private buildActiveGenerationKey(\n    tokenType: ConsumableTokenTypes,\n    relatedId: string,\n  ): string {\n    return crypto\n      .createHash('sha256')\n      .update(`${String(tokenType)}\\0${relatedId}`)\n      .digest('hex');\n  }\n\n  private toTokenGenerationResult(token: ConsumableToken): TokenGenerationResult {\n    return {\n      tokenValue: token.token,\n      tokenId: token._id,\n    };\n  }\n\n  /**\n   * Defense-in-depth against NoSQL operator injection. Every raw-collection lookup here keys on the\n   * caller-supplied `token` value (`findOne({ token: tokenValue })`, `findOneAndUpdate({ token: … })`),\n   * so a NON-STRING value (e.g. a `{$regex}` / `{$ne}` object that slipped a caller's boundary\n   * validation) would be interpreted by Mongo as a query OPERATOR and match/consume an ARBITRARY token —\n   * a remote token-destruction primitive (password-reset / invitation / magic-link). A real token value\n   * is always a high-entropy string, so a non-string is by definition \"not found\"; we throw the same\n   * `CONSUMABLE_TOKEN_NOT_FOUND` (kept non-oracle — the injection case is indistinguishable from a miss).\n   * The OAuth provider already rejects such input at its HTTP boundary (400 `invalid_request`); this\n   * guards EVERY other caller of the primitive too.\n   */\n  private assertTokenValueIsString(tokenValue: unknown): asserts tokenValue is string {\n    if (typeof tokenValue !== 'string') {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONSUMABLE_TOKEN_NOT_FOUND,\n      });\n    }\n  }\n\n  /**\n   * The persistence plane this service writes through.\n   *\n   * **Replaced a raw MongoDB collection handle.** This service used to reach\n   * `connection.collection(resolveSharedPersistenceCollectionName(CONSUMABLE_TOKENS))` and issue\n   * driver calls directly, which is why consumable-token persistence was \"a MongoDB-native\n   * capability\" — and why every token-coupled operation carried a hard\n   * `requiredAdapter: MONGODB`, making `organizationMembers | create · revoke · resend`\n   * unresolvable on a PostgreSQL platform.\n   *\n   * The registry's framework-internal tier is the right home rather than the resource's declared\n   * operations: those are the ADMINISTRATIVE surface (role-gated on `ORG_ADMIN`), whereas the token\n   * lifecycle runs where there is NO principal — a verification email is a system action, and a\n   * magic-link click is pre-authentication by definition. Routing it through the declared operations\n   * would mean fabricating an administrator to authorize the very credential being established.\n   *\n   * The collection-identity concern the old accessor documented is now structural rather than\n   * conventional: the registry resolves the resource's own storage, so there is no second physical\n   * name for anything to diverge from.\n   *\n   * **Named `repositoriesRegistry` deliberately.** `guarded-write-registry-dispatch.guard.test.ts`\n   * requires every guarded-write call to have a receiver whose last segment is exactly that, because\n   * those primitives do NOT apply the retention hide themselves — it is applied once, at the registry\n   * dispatch. An accessor named anything else would route correctly and still read, to that guard and\n   * to a human, like a call on a bare repository handle.\n   */\n  private get repositoriesRegistry(): RepositoriesRegistryHandlerBackendService {\n    if (!this.injectedRepositoriesRegistry) {\n      throw this.errorBuilder.buildError(ErrorType.DATABASE, undefined, {\n        context: { reason: 'Repositories registry not available for consumable tokens' },\n      });\n    }\n    return this.injectedRepositoriesRegistry;\n  }\n\n  /**\n   * Narrow the database-agnostic transaction before any MongoDB access.\n   *\n   * Consumable-token persistence is MongoDB-native. Casting another adapter's\n   * opaque native transaction to `ClientSession` would turn a configuration\n   * mismatch into driver-dependent behavior, so every transactional entry\n   * path fails at this boundary first.\n   */\n  private getMongoSession(transaction?: TransactionContext): ClientSession | undefined {\n    if (!transaction) return undefined;\n    if (transaction.databaseType !== PersistenceAdapter.MONGODB) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        context: {\n          reason: 'consumable_token_requires_mongodb_transaction',\n          transactionDatabaseType: transaction.databaseType,\n        },\n      });\n    }\n    return transaction.nativeSession as ClientSession;\n  }\n\n  /**\n   * Match only the sparse active-generation index. `createToken` also writes other unique fields\n   * (notably the raw token), and collapsing their failures into a RESEND race would hide an\n   * unrelated persistence defect.\n   *\n   * ## Branches on the CLASSIFIED conflict, never on driver internals\n   *\n   * This used to require a raw MongoDB error with `code: 11000` and a `keyPattern`, and could\n   * therefore never fire. `insertRawDocument` translates the duplicate before it escapes —\n   * `throw this.handleMongoDBError(error)` on the Mongo arm, `handlePostgresError` on the\n   * PostgreSQL one — so what reaches this catch is the classified CONFLICT, carrying no `code` and\n   * no `keyPattern`. The RESEND race surfaced as a generic CONFLICT and the specific\n   * `consumable_token_active_generation_conflict` reference was unreachable through the real stack.\n   *\n   * The infrastructure tier's own comment says why detecting on driver internals was the wrong\n   * shape in the first place: without the translation \"every caller would need adapter-specific\n   * detection, which is precisely what this tier exists to remove\". On PostgreSQL there is no\n   * `code: 11000` to match at ALL — a unique violation is SQLSTATE `23505` — so the old predicate\n   * was not merely unreachable, it was unwritable for the adapter both example applications now run.\n   *\n   * `violatedFields` is the adapter-neutral answer both arms populate: Mongo from `keyPattern`\n   * (falling back to the message), PostgreSQL from the constraint's columns.\n   */\n  private isActiveGenerationKeyDuplicate(error: unknown): boolean {\n    if (!isWildoBackendError(error)) return false;\n    if (error.type !== ErrorType.CONFLICT) return false;\n\n    const violatedFields = error.context?.violatedFields;\n    return Array.isArray(violatedFields) && violatedFields.includes('activeGenerationKey');\n  }\n\n  /**\n   * Calculate the expiration date from a relative duration.\n   */\n  private calculateExpiresAt(expiresIn: DurationValue, from: Date = new Date()): Date {\n    const ms = durationToSeconds(expiresIn) * 1000;\n    return new Date(from.getTime() + ms);\n  }\n\n  /**\n   * Resolve a StaticOrDerived value.\n   * If the value is a function, call it with the currentObject.\n   * If static, return as-is.\n   */\n  private resolveStaticOrDerived<T>(value: StaticOrDerived<T>, currentObject: Record<string, any>): T {\n    if (typeof value === 'function') {\n      return (value as (obj: Record<string, any>) => T)(currentObject);\n    }\n    return value;\n  }\n}\n"]}

package/dist/esm/security/credential-rotation-grace.backend.utils.d.ts

@@ -26,10 +26,15 @@ export declare function isRotationGraceWindowOpen(invalidationDate?: Date | null
  * Whether a credential (api-key / OAuth client) has passed its `expiresAt`. `null`/`undefined` =
  * no expiry set = never expires.
  *
- * Enforced at AUTH-TIME on every machine front because nothing sweeps a credential's `status` to
- * EXPIRED — there is no `EXPIRED` producer, no Mongo TTL, and no cron over `expiresAt`. Without this
- * check an expired-but-`ACTIVE` credential authenticates indefinitely, making both `expiresAt` and
- * the `EXTEND_EXPIRY` operation decorative. Callers apply it alongside the ACTIVE gate:
+ * Enforced at AUTH-TIME on every machine front, and that is where the enforcement STAYS.
+ *
+ * There IS an `EXPIRED` producer since 2026-09-08 — the nightly credential-expiry sweep (#413)
+ * dispatches each resource's `expire` verb — but it is BOOKKEEPING, never the control. It always
+ * lags: a credential that elapses at 09:00 still reads ACTIVE until 02:30 the next morning. This
+ * check is what makes that lag harmless, so a caller must never replace it with a `status` test.
+ * Do that and the sweep's lag becomes an authorization hole rather than a stale display, and
+ * `expiresAt` plus the `EXTEND_EXPIRY` operation go back to being decorative. Callers apply it
+ * alongside the ACTIVE gate:
  * `!record || record.status !== ACTIVE || isCredentialExpired(record.expiresAt)`. SINGLE SOURCE OF
  * TRUTH shared by the api-key + OAuth-client request-auth handlers and the `/oauth/token` exchange.
  */

package/dist/esm/security/credential-rotation-grace.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-rotation-grace.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/security/credential-rotation-grace.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,yBAAyB,CAAC,gBAAgB,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAGjF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAGpE"}
+{"version":3,"file":"credential-rotation-grace.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/security/credential-rotation-grace.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,yBAAyB,CAAC,gBAAgB,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAGjF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAGpE"}

package/dist/esm/security/credential-rotation-grace.backend.utils.js

@@ -30,10 +30,15 @@ export function isRotationGraceWindowOpen(invalidationDate) {
  * Whether a credential (api-key / OAuth client) has passed its `expiresAt`. `null`/`undefined` =
  * no expiry set = never expires.
  *
- * Enforced at AUTH-TIME on every machine front because nothing sweeps a credential's `status` to
- * EXPIRED — there is no `EXPIRED` producer, no Mongo TTL, and no cron over `expiresAt`. Without this
- * check an expired-but-`ACTIVE` credential authenticates indefinitely, making both `expiresAt` and
- * the `EXTEND_EXPIRY` operation decorative. Callers apply it alongside the ACTIVE gate:
+ * Enforced at AUTH-TIME on every machine front, and that is where the enforcement STAYS.
+ *
+ * There IS an `EXPIRED` producer since 2026-09-08 — the nightly credential-expiry sweep (#413)
+ * dispatches each resource's `expire` verb — but it is BOOKKEEPING, never the control. It always
+ * lags: a credential that elapses at 09:00 still reads ACTIVE until 02:30 the next morning. This
+ * check is what makes that lag harmless, so a caller must never replace it with a `status` test.
+ * Do that and the sweep's lag becomes an authorization hole rather than a stale display, and
+ * `expiresAt` plus the `EXTEND_EXPIRY` operation go back to being decorative. Callers apply it
+ * alongside the ACTIVE gate:
  * `!record || record.status !== ACTIVE || isCredentialExpired(record.expiresAt)`. SINGLE SOURCE OF
  * TRUTH shared by the api-key + OAuth-client request-auth handlers and the `/oauth/token` exchange.
  */

package/dist/esm/security/credential-rotation-grace.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-rotation-grace.backend.utils.js","sourceRoot":"","sources":["../../../../src/security/credential-rotation-grace.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,yBAAyB,CAAC,gBAA8B;IACtE,IAAI,gBAAgB,KAAK,IAAI,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7E,OAAO,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAuB;IACzD,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AACrD,CAAC","sourcesContent":["/**\n * Whether a credential's PREVIOUS secret — moved into the rotation-grace slot when the credential\n * was reissued — is still inside its grace window and may therefore still authenticate.\n *\n * `invalidationDate` is written by the ROTATE / REGENERATE reissue handlers on both api-keys and\n * OAuth clients, and its three states carry distinct semantics:\n *\n * - `null` / `undefined` → **open-ended overlap**. This is what REGENERATE writes: the reissue is\n *   ADDITIVE — it mints a new secret WITHOUT invalidating the prior one, so the prior secret keeps\n *   authenticating until the NEXT reissue. REGENERATE is therefore NOT a way to cut off a leaked\n *   secret: to revoke a compromised credential you must either REVOKE it (status → non-ACTIVE,\n *   which fails the `status === ACTIVE` gate every caller applies to the resolved record) or ROTATE\n *   with an explicit invalidation date. This open-endedness is deliberate, not a bug.\n * - a FUTURE date → still valid — a bounded overlap window (e.g. a ROTATE handover deadline).\n * - `now` / a PAST date → expired.\n *\n * Callers MUST additionally require the resolved record's `status === ACTIVE`, so a\n * deactivated/expired credential's previous secret never authenticates regardless of this window.\n *\n * SINGLE SOURCE OF TRUTH shared by the api-key request-auth handlers, the OAuth-client\n * direct-secret handlers, and the `/oauth/token` client-secret exchange — they MUST agree on grace\n * semantics, so the check lives here once rather than being copied per call site.\n */\nexport function isRotationGraceWindowOpen(invalidationDate?: Date | null): boolean {\n  if (invalidationDate === null || invalidationDate === undefined) return true;\n  return new Date(invalidationDate).getTime() > Date.now();\n}\n\n/**\n * Whether a credential (api-key / OAuth client) has passed its `expiresAt`. `null`/`undefined` =\n * no expiry set = never expires.\n *\n * Enforced at AUTH-TIME on every machine front because nothing sweeps a credential's `status` to\n * EXPIRED — there is no `EXPIRED` producer, no Mongo TTL, and no cron over `expiresAt`. Without this\n * check an expired-but-`ACTIVE` credential authenticates indefinitely, making both `expiresAt` and\n * the `EXTEND_EXPIRY` operation decorative. Callers apply it alongside the ACTIVE gate:\n * `!record || record.status !== ACTIVE || isCredentialExpired(record.expiresAt)`. SINGLE SOURCE OF\n * TRUTH shared by the api-key + OAuth-client request-auth handlers and the `/oauth/token` exchange.\n */\nexport function isCredentialExpired(expiresAt?: Date | null): boolean {\n  if (expiresAt === null || expiresAt === undefined) return false;\n  return new Date(expiresAt).getTime() <= Date.now();\n}\n"]}
+{"version":3,"file":"credential-rotation-grace.backend.utils.js","sourceRoot":"","sources":["../../../../src/security/credential-rotation-grace.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,yBAAyB,CAAC,gBAA8B;IACtE,IAAI,gBAAgB,KAAK,IAAI,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7E,OAAO,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAuB;IACzD,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AACrD,CAAC","sourcesContent":["/**\n * Whether a credential's PREVIOUS secret — moved into the rotation-grace slot when the credential\n * was reissued — is still inside its grace window and may therefore still authenticate.\n *\n * `invalidationDate` is written by the ROTATE / REGENERATE reissue handlers on both api-keys and\n * OAuth clients, and its three states carry distinct semantics:\n *\n * - `null` / `undefined` → **open-ended overlap**. This is what REGENERATE writes: the reissue is\n *   ADDITIVE — it mints a new secret WITHOUT invalidating the prior one, so the prior secret keeps\n *   authenticating until the NEXT reissue. REGENERATE is therefore NOT a way to cut off a leaked\n *   secret: to revoke a compromised credential you must either REVOKE it (status → non-ACTIVE,\n *   which fails the `status === ACTIVE` gate every caller applies to the resolved record) or ROTATE\n *   with an explicit invalidation date. This open-endedness is deliberate, not a bug.\n * - a FUTURE date → still valid — a bounded overlap window (e.g. a ROTATE handover deadline).\n * - `now` / a PAST date → expired.\n *\n * Callers MUST additionally require the resolved record's `status === ACTIVE`, so a\n * deactivated/expired credential's previous secret never authenticates regardless of this window.\n *\n * SINGLE SOURCE OF TRUTH shared by the api-key request-auth handlers, the OAuth-client\n * direct-secret handlers, and the `/oauth/token` client-secret exchange — they MUST agree on grace\n * semantics, so the check lives here once rather than being copied per call site.\n */\nexport function isRotationGraceWindowOpen(invalidationDate?: Date | null): boolean {\n  if (invalidationDate === null || invalidationDate === undefined) return true;\n  return new Date(invalidationDate).getTime() > Date.now();\n}\n\n/**\n * Whether a credential (api-key / OAuth client) has passed its `expiresAt`. `null`/`undefined` =\n * no expiry set = never expires.\n *\n * Enforced at AUTH-TIME on every machine front, and that is where the enforcement STAYS.\n *\n * There IS an `EXPIRED` producer since 2026-09-08 — the nightly credential-expiry sweep (#413)\n * dispatches each resource's `expire` verb — but it is BOOKKEEPING, never the control. It always\n * lags: a credential that elapses at 09:00 still reads ACTIVE until 02:30 the next morning. This\n * check is what makes that lag harmless, so a caller must never replace it with a `status` test.\n * Do that and the sweep's lag becomes an authorization hole rather than a stale display, and\n * `expiresAt` plus the `EXTEND_EXPIRY` operation go back to being decorative. Callers apply it\n * alongside the ACTIVE gate:\n * `!record || record.status !== ACTIVE || isCredentialExpired(record.expiresAt)`. SINGLE SOURCE OF\n * TRUTH shared by the api-key + OAuth-client request-auth handlers and the `/oauth/token` exchange.\n */\nexport function isCredentialExpired(expiresAt?: Date | null): boolean {\n  if (expiresAt === null || expiresAt === undefined) return false;\n  return new Date(expiresAt).getTime() <= Date.now();\n}\n"]}

package/dist/esm/security/jwt/services/jwt.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/jwt/services/jwt.backend.service.ts"],"names":[],"mappings":"AACA,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAC,MAAM,sEAAsE,CAAC;AAC9G,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,cAAc,EAA4B,iBAAiB,EAAoB,MAAM,wEAAwE,CAAC;AACvK,OAAO,EAAE,6BAA6B,EAAqB,kCAAkC,EAAE,kCAAkC,EAAE,MAAM,oFAAoF,CAAC;AAC9N,OAAO,EACL,kBAAkB,EAInB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAgC9G,qBACa,iBAAiB;IAIS,OAAO,CAAC,MAAM;IACJ,OAAO,CAAC,aAAa;IAClB,OAAO,CAAC,YAAY;IALtE,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAGpC,MAAM,EAAE,aAAa,EACX,aAAa,EAAE,uBAAuB,EACnC,YAAY,EAAE,0BAA0B;IAMlG;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAE/B;IAGL,mBAAmB,CAAC,MAAM,EAAE,6BAA6B,GAAG,OAAO,CAAC,MAAM,CAAC;IA0BjF;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,8BAA8B,CAClC,MAAM,EAAE,6BAA6B,EACrC,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,GACvD,OAAO,CAAC,MAAM,CAAC;IA2BlB;;;;;;;;;;;;OAYG;IACG,wBAAwB,CAC5B,MAAM,EAAE,kCAAkC,EAC1C,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,GACvD,OAAO,CAAC,MAAM,CAAC;IAuBlB;;;;;;;;;;;;OAYG;IACG,mBAAmB,CAAC,MAAM,EAAE;QAChC,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,MAAM,CAAC;IAyCb,kBAAkB,CACtB,MAAM,EAAE,kCAAkC,EAC1C,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,GACtC,OAAO,CAAC,MAAM,CAAC;IA6BlB;;;OAGG;IACH,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAE7D;;;;;;;;;;OAUG;IACI,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAyB5D;;;;;;;OAOG;IACI,aAAa,CAAC,QAAQ,GAAE,cAAc,EAA4C,GAAG;QAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE;IAuB9H,cAAc,CAAC,GAAG,GAAE,cAAsD,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAiDjJ,gBAAgB,CAAC,GAAG,GAAE,iBAAyD,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IA8B1I;;;;;;;OAOG;IACG,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,GAAE,cAAsD,GAAG,OAAO,CAAC,MAAM,CAAC;IAUzF,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,GAAE,cAAsD,GAAG,OAAO,CAAC,MAAM,CAAC;IAOxG,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAwCrG;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,iBAAyD,GAAG,OAAO,CAAC,OAAO,CAAC;IA4C7G;;;OAGG;IACG,gCAAgC,CACpC,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,iBAAyD,EAC9D,OAAO,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,OAAO,CAAC;QAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1F,OAAO,CAAC,OAAO,CAAC;IA+DnB;;;;;;;OAOG;IACG,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA0CzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACG,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAsDnF,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,iBAAyD,GAAG,OAAO,CAAC,OAAO,CAAC;IAM7H,SAAS,CACpB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,GAAG,CAAC,aAAa,EAChC,cAAc,CAAC,EAAE;QACf,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,sBAAsB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;KACxD,GACA,OAAO,CAAC,OAAO,CAAC;IA4BnB;;;OAGG;IACU,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAU7G;;;OAGG;IACU,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAkBlI;;;OAGG;IACH,OAAO,CAAC,WAAW;IASnB;;;;;;;;;;;OAWG;IACI,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAQlE"}
+{"version":3,"file":"jwt.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/jwt/services/jwt.backend.service.ts"],"names":[],"mappings":"AACA,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAC,MAAM,sEAAsE,CAAC;AAC9G,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,cAAc,EAA4B,iBAAiB,EAAoB,MAAM,wEAAwE,CAAC;AACvK,OAAO,EAAE,6BAA6B,EAAqB,kCAAkC,EAAE,kCAAkC,EAAE,MAAM,oFAAoF,CAAC;AAC9N,OAAO,EACL,kBAAkB,EAKnB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAe9G,qBACa,iBAAiB;IAIS,OAAO,CAAC,MAAM;IACJ,OAAO,CAAC,aAAa;IAClB,OAAO,CAAC,YAAY;IALtE,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAGpC,MAAM,EAAE,aAAa,EACX,aAAa,EAAE,uBAAuB,EACnC,YAAY,EAAE,0BAA0B;IAMlG;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAE/B;IAGL,mBAAmB,CAAC,MAAM,EAAE,6BAA6B,GAAG,OAAO,CAAC,MAAM,CAAC;IA0BjF;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,8BAA8B,CAClC,MAAM,EAAE,6BAA6B,EACrC,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,GACvD,OAAO,CAAC,MAAM,CAAC;IA2BlB;;;;;;;;;;;;OAYG;IACG,wBAAwB,CAC5B,MAAM,EAAE,kCAAkC,EAC1C,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,GACvD,OAAO,CAAC,MAAM,CAAC;IAuBlB;;;;;;;;;;;;OAYG;IACG,mBAAmB,CAAC,MAAM,EAAE;QAChC,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,MAAM,CAAC;IAyCb,kBAAkB,CACtB,MAAM,EAAE,kCAAkC,EAC1C,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,GACtC,OAAO,CAAC,MAAM,CAAC;IA6BlB;;;OAGG;IACH,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAE7D;;;;;;;;;;OAUG;IACI,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAyB5D;;;;;;;OAOG;IACI,aAAa,CAAC,QAAQ,GAAE,cAAc,EAA4C,GAAG;QAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE;IAuB9H,cAAc,CAAC,GAAG,GAAE,cAAsD,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAiDjJ,gBAAgB,CAAC,GAAG,GAAE,iBAAyD,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IA8B1I;;;;;;;OAOG;IACG,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,GAAE,cAAsD,GAAG,OAAO,CAAC,MAAM,CAAC;IAUzF,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,GAAE,cAAsD,GAAG,OAAO,CAAC,MAAM,CAAC;IAOxG,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAwCrG;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,iBAAyD,GAAG,OAAO,CAAC,OAAO,CAAC;IA4C7G;;;OAGG;IACG,gCAAgC,CACpC,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,iBAAyD,EAC9D,OAAO,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,OAAO,CAAC;QAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1F,OAAO,CAAC,OAAO,CAAC;IA+DnB;;;;;;;OAOG;IACG,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA0CzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACG,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAsDnF,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,iBAAyD,GAAG,OAAO,CAAC,OAAO,CAAC;IAM7H,SAAS,CACpB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,GAAG,CAAC,aAAa,EAChC,cAAc,CAAC,EAAE;QACf,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,sBAAsB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;KACxD,GACA,OAAO,CAAC,OAAO,CAAC;IA4BnB;;;OAGG;IACU,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAU7G;;;OAGG;IACU,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAkBlI;;;OAGG;IACH,OAAO,CAAC,WAAW;IASnB;;;;;;;;;;;OAWG;IACI,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAQlE"}

package/dist/esm/security/jwt/services/jwt.backend.service.js

@@ -16,28 +16,11 @@ import { AppConfigurationService } from '../../../config/services/app-configurat
 import { LoggerService } from '../../../monitoring/logger/services/logger.service.js';
 import { SAAS_SERVICE_TYPES } from '../../../inject/models/service-types.js';
 import { JwtPrivateKeys, JwtPrivateKeySignOptions, JwtVerifyOptions } from '../../../security/authentications/models/jwt.backend.schemas.js';
-import { ErrorCustomMessageReference, ErrorType, } from '@wildo-ai/saas-models';
+import { ErrorCustomMessageReference, ErrorType, OIDC_RESERVED_ID_TOKEN_CLAIM_NAMES, } from '@wildo-ai/saas-models';
 import stringify from 'safe-stable-stringify';
 import { createHash, createPublicKey } from 'crypto';
 import { randomUUID } from 'crypto';
 import { ErrorBuilderBackendService } from '../../../errors/services/error-builder.backend.service.js';
-/**
- * The OIDC / RFC 7519 protocol + security claim names the ID-token builder OWNS. `extraClaims` (the
- * scope-gated IDENTITY claims from the userinfo/ID-token resolver) must carry ONLY identity claims — these
- * reserved names are stripped BEFORE `extraClaims` is spread, so a same-named entry can never ride into the
- * ID token uncontrolled: a smuggled `nbf` (which would later make the token fail verification), a forged
- * `nonce` / `acr` / `amr` / `at_hash`, or a spoofed `iss` / `aud` / `sub` (the last are already overridden by
- * the server-set claims below — these are the ones the builder does NOT otherwise re-set). ONE named source
- * (closed vocabulary) so the strip list can never drift from the builder's own claim set.
- * semantic-literal-boundary: OIDC Core / RFC 7519 registered claim names.
- * assurance-control: WILDO.IDENTITY.TOKEN_INTEGRITY — an ID token's protocol/security claims are server-authored only.
- */
-const OIDC_RESERVED_ID_TOKEN_CLAIM_NAMES = new Set([
-    // `sid` (OIDC Session Management / Front-Channel & Back-Channel Logout) is SERVER-AUTHORED here — it is
-    // the End-User's OP session id the RP-Initiated Logout endpoint keys on (revocation-C). Reserving it bars
-    // a client from smuggling its own `sid` via `extraClaims`, exactly like `nonce`/`acr`/`azp` below.
-    'iss', 'sub', 'aud', 'exp', 'nbf', 'iat', 'jti', 'azp', 'nonce', 'auth_time', 'at_hash', 'c_hash', 'acr', 'amr', 'sid',
-]);
 /**
  * A rotated public key self-retires when its optional `notAfter` instant has passed — so an operator can
  * schedule a compromised or aged prior key to STOP verifying (and drop out of the JWKS) WITHOUT a redeploy or a