npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.1 → 1.1.3 - Mend

@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (972) hide show

package/dist/esm/security/jwt/services/jwt.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"jwt.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/jwt/services/jwt.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAC,MAAM,sEAAsE,CAAC;AAC9G,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAqB,gBAAgB,EAAE,MAAM,wEAAwE,CAAC;AAEvK,OAAO,EAEL,2BAA2B,EAC3B,SAAS,GAEV,MAAM,uBAAuB,CAAC;AAC/B,OAAO,SAAS,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G;;;;;;;;;;GAUG;AACH,MAAM,kCAAkC,GAAwB,IAAI,GAAG,CAAC;IACtE,wGAAwG;IACxG,0GAA0G;IAC1G,mGAAmG;IACnG,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;CACvH,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,KAAmC;IAC7D,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACzD,CAAC;AAGM,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAIiB;IACU;IACG;IALhD,QAAQ,CAA+D;IAEjF,YAC6C,MAAqB,EACX,aAAsC,EACnC,YAAwC;QAFrD,WAAM,GAAN,MAAM,CAAe;QACX,kBAAa,GAAb,aAAa,CAAyB;QACnC,iBAAY,GAAZ,YAAY,CAA4B;QAEhG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;;;;;OAUG;IACc,yBAAyB,GAAG;QAC3C,kBAAkB,EAAE,IAAI;KAChB,CAAC;IAGX,KAAK,CAAC,mBAAmB,CAAC,MAAqC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC;QAEvB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;QAC1B,8DAA8D;QAC9D,uEAAuE;QACvE,iEAAiE;QACjE,sEAAsE;QACtE,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC;QAEtF,MAAM,OAAO,GAAG;YACd,GAAG,MAAM;YACT,GAAG,EAAE,UAAU,EAAE;YACjB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAClC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,kBAAkB,GAAG,EAAE;YAC5D,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,YAAY;YACjB,GAAG;YACH,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,8BAA8B,CAClC,MAAqC,EACrC,OAAwD;QAExD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;gBAChE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;gBAC5D,OAAO,EAAE,EAAE,OAAO,EAAE,qFAAqF,EAAE;aAC5G,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC;QACvG,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,MAAM,OAAO,GAAG;YACd,GAAG,MAAM;YACT,GAAG,EAAE,UAAU,EAAE;YACjB,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,OAAO,GAAG,EAAE;YACvB,GAAG,EAAE,MAAM;YACX,yFAAyF;YACzF,0EAA0E;YAC1E,GAAG,EAAE,OAAO,CAAC,QAAQ;YACrB,GAAG,EAAE,MAAM,CAAC,MAAM;YAClB,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC;QAEF,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,wBAAwB,CAC5B,MAA0C,EAC1C,OAAwD;QAExD,8EAA8E;QAC9E,0FAA0F;QAC1F,wFAAwF;QACxF,+FAA+F;QAC/F,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,0BAA0B,EAAE,IAAI,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAC7F,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC;QACvG,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,MAAM,OAAO,GAAG;YACd,GAAG,MAAM;YACT,GAAG,EAAE,UAAU,EAAE;YACjB,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,OAAO,GAAG,EAAE;YACvB,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,OAAO,CAAC,QAAQ;YACrB,GAAG,EAAE,MAAM,CAAC,QAAQ;YACpB,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC;QAEF,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,mBAAmB,CAAC,MAQzB;QACC,wFAAwF;QACxF,8FAA8F;QAC9F,4FAA4F;QAC5F,8FAA8F;QAC9F,mFAAmF;QACnF,kGAAkG;QAClG,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,0BAA0B,EAAE,CAAC;QAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,mBAAmB;gBACvE,OAAO,EAAE,EAAE,OAAO,EAAE,8IAA8I,EAAE;aACrK,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC;QACtG,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,wGAAwG;QACxG,4GAA4G;QAC5G,kGAAkG;QAClG,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,CACvC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,kCAAkC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAC3G,CAAC;QAEF,MAAM,OAAO,GAAG;YACd,GAAG,cAAc;YACjB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,GAAG,EAAE,MAAM,CAAC,QAAQ;YACpB,GAAG,EAAE,UAAU,EAAE;YACjB,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,OAAO,GAAG,EAAE;YACvB,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,MAAM,CAAC,QAAQ;YACpB,GAAG,EAAE,MAAM,CAAC,MAAM;SACnB,CAAC;QAEF,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,MAA0C,EAC1C,OAAuC;QAEvC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC;QACvB,wEAAwE;QACxE,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,0BAA0B,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC;QAE5F,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,0BAA0B,CAAC;QACpE,MAAM,UAAU,GAAG,OAAO,EAAE,gBAAgB,IAAI,iBAAiB,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;QAE1B,MAAM,OAAO,GAAG;YACd,GAAG,MAAM;YACT,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,UAAU,EAAE;YAC/B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAClC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU;YAC/C,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,eAAe;YACpB,GAAG;YACH,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,2CAA2C,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,UAAU,YAAY,CAAC,CAAC,CAAC,GAAG,0BAA0B,OAAO,EAAE,CAAC,CAAC;QACzJ,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,sBAAsB,CAAC,CAAC;QACrF,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,kFAAkF;IACjE,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE7D;;;;;;;;;;OAUG;IACI,uBAAuB,CAAC,YAAoB;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,GAAG,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAEjE,CAAC;QAEF,IAAI,SAAiB,CAAC;QACtB,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACrB,SAAS,GAAG,WAAW,GAAG,CAAC,GAAG,qBAAqB,GAAG,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC;QAC9E,CAAC;aAAM,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;YAC7B,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,mBAAmB;gBACvE,OAAO,EAAE,EAAE,OAAO,EAAE,+CAA+C,GAAG,CAAC,GAAG,EAAE,EAAE;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACvE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAC5C,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;OAOG;IACI,aAAa,CAAC,WAA6B,CAAC,cAAc,CAAC,sBAAsB,CAAC;QACvF,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAuC,CAAC;QAC7F,MAAM,OAAO,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,iBAAiB,IAAI,EAAE,CAA2F,CAAC;QAEtJ,MAAM,IAAI,GAAmC,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,MAAM,MAAM,GAAG,CAAC,GAAY,EAAQ,EAAE;YACpC,IAAI,CAAC,GAAG;gBAAE,OAAO;YACjB,MAAM,GAAG,GAAG,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO;YAC9B,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClB,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAA4B,CAAC;YACtF,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC;QAEF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5B,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC;gBAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAsB,cAAc,CAAC,sBAAsB;QAC9E,MAAM,UAAU,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;QAE/C,0BAA0B;QAC1B,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE;YAC1C,YAAY,EAAE,GAAG;YACjB,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;YACrE,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;YAClE,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC;YAC1D,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAElD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,mBAAmB;gBACvE,OAAO,EAAE;oBACP,OAAO,EAAE,mBAAmB,GAAG,qCAAqC;oBACpE,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;oBACrE,YAAY,EAAE,GAAG;iBAClB;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,mBAAmB;gBACvE,OAAO,EAAE;oBACP,OAAO,EAAE,kBAAkB,GAAG,6BAA6B;oBAC3D,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;oBAClE,YAAY,EAAE,GAAG;iBAClB;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,GAAG,UAAU;YACb,iFAAiF;YACjF,oFAAoF;YACpF,4CAA4C;YAC5C,KAAK,EAAE,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC;YAC9C,UAAU;YACV,SAAS;SACV,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAyB,cAAc,CAAC,sBAAsB;QACnF,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;QAE/C,MAAM,SAAS,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC;QAEpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,mBAAmB,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,kBAAkB,GAAG,6BAA6B,EAAE,EAAE,CAAC,CAAC;QAChO,CAAC;QAED,MAAM,gBAAgB,GAAG;YACvB,cAAc,CAAC,4BAA4B;YAC3C,cAAc,CAAC,0BAA0B;YACzC,cAAc,CAAC,mBAAmB;YAClC,cAAc,CAAC,sBAAsB;SACtC,CAAC,QAAQ,CAAC,GAAqB,CAAC,CAAC;QAElC,IAAI,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;QACjC,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QACtC,CAAC;QAED,OAAO;YACL,GAAG,YAAY;YACf,MAAM;YACN,SAAS;SACV,CAAC;IACJ,CAAC;IAGD;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,CAAC,OAAY,EAAE,MAAsB,cAAc,CAAC,sBAAsB;QAClF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAElD,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,WAAW,EAAE,GAAG,UAAU,CAAC;QAE7D,IAAI,CAAC,QAAQ,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;QAEzD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAC,OAAgB,EAAE,MAAsB,cAAc,CAAC,sBAAsB;QACjG,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,EAAE,UAAU,EAAE,GAAG,WAAW,EAAE,GAAG,UAAU,CAAC;QAClD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IAC5D,CAAC;IAGM,KAAK,CAAC,OAAO,CAAC,OAAY,EAAE,UAAkB,EAAE,WAA4B;QACjF,yEAAyE;QACzE,MAAM,gBAAgB,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;QAE5C,IAAI,OAAO,CAAC,GAAG,IAAI,gBAAgB,CAAC,SAAS,EAAE,CAAC;YAC9C,OAAO,gBAAgB,CAAC,SAAS,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,oEAAoE,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,IAAI,gBAAgB,CAAC,MAAM,EAAE,CAAC;YAC3C,OAAO,gBAAgB,CAAC,MAAM,CAAC;YAC/B,IAAI,CAAC,QAAQ,CAAC,iEAAiE,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,IAAI,gBAAgB,CAAC,QAAQ,EAAE,CAAC;YAC7C,OAAO,gBAAgB,CAAC,QAAQ,CAAC;YACjC,IAAI,CAAC,QAAQ,CAAC,mEAAmE,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC5C,OAAO,gBAAgB,CAAC,OAAO,CAAC;YAChC,IAAI,CAAC,QAAQ,CAAC,kEAAkE,CAAC,CAAC;QACpF,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,GAAiB,EAAE,KAAyB,EAAE,EAAE;gBAC/F,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,kBAAkB,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;oBAC/L,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC;qBAAM,IAAI,CAAC,KAAK,EAAE,CAAC;oBAClB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,kDAAkD,EAAE,EAAE,CAAC,CAAC;oBAC9O,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAC;oBAC/C,OAAO,CAAC,KAAK,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,MAAyB,cAAc,CAAC,sBAAsB;QACxF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,GAAG,YAAY,CAAC;QAErD,IAAI,CAAC,QAAQ,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;QAE3D,wBAAwB;QACxB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,eAAe,EAAE,CAAC;YACzB,0FAA0F;YAC1F,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC5G,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnD,MAAM,eAAe,CAAC;YACxB,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,SAAS,EAAE,CAAC;gBACd,8DAA8D;gBAC9D,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;gBACvH,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;oBAC5E,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;oBACtF,OAAO,OAAO,CAAC;gBACjB,CAAC;YACH,CAAC;YAED,qEAAqE;YACrE,IAAI,CAAC,QAAQ,CAAC,UAAU,cAAc,CAAC,MAAM,oCAAoC,GAAG,EAAE,CAAC,CAAC;YACxF,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;oBAC5E,IAAI,CAAC,QAAQ,CAAC,0DAA0D,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBACnF,OAAO,OAAO,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,+BAA+B;gBACjC,CAAC;YACH,CAAC;YAED,qEAAqE;YACrE,MAAM,eAAe,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gCAAgC,CACpC,KAAa,EACb,MAAyB,cAAc,CAAC,sBAAsB,EAC9D,OAA2F;QAE3F,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,GAAG,YAAY,CAAC;QACrD,2FAA2F;QAC3F,6FAA6F;QAC7F,gGAAgG;QAChG,+FAA+F;QAC/F,8FAA8F;QAC9F,yBAAyB;QACzB,IAAI,OAAO,EAAE,cAAc,EAAE,CAAC;YAC5B,OAAQ,aAAwC,CAAC,QAAQ,CAAC;QAC5D,CAAC;QACD,wGAAwG;QACxG,2GAA2G;QAC3G,gGAAgG;QAChG,qGAAqG;QACrG,sGAAsG;QACtG,IAAI,OAAO,EAAE,cAAc,KAAK,SAAS,EAAE,CAAC;YACzC,aAAqC,CAAC,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;QACzE,CAAC;QACD,wGAAwG;QACxG,yGAAyG;QACzG,2EAA2E;QAC3E,yGAAyG;QACzG,IAAI,OAAO,EAAE,gBAAgB,EAAE,CAAC;YAC7B,aAAgD,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC5E,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,mEAAmE,GAAG,EAAE,CAAC,CAAC;QAExF,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC/F,CAAC;QAAC,OAAO,eAAe,EAAE,CAAC;YACzB,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC5G,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnD,MAAM,eAAe,CAAC;YACxB,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;gBACvH,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;oBAC5G,IAAI,CAAC,QAAQ,CAAC,qDAAqD,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;oBAC9F,OAAO,OAAO,CAAC;gBACjB,CAAC;YACH,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,UAAU,cAAc,CAAC,MAAM,0CAA0C,GAAG,eAAe,CAAC,CAAC;YAC3G,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;oBAC5G,IAAI,CAAC,QAAQ,CAAC,kEAAkE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC3F,OAAO,OAAO,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,+BAA+B;gBACjC,CAAC;YACH,CAAC;YAED,MAAM,eAAe,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAa;QACpC,MAAM,GAAG,GAAG,cAAc,CAAC,sBAAsB,CAAC;QAClD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,GAAG,YAAY,CAAC;QACrD,MAAM,oBAAoB,GAAG,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QAE7E,IAAI,CAAC,QAAQ,CAAC,mDAAmD,CAAC,CAAC;QAEnE,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,eAAe,EAAE,CAAC;YACzB,oEAAoE;YACpE,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC5G,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnD,MAAM,eAAe,CAAC;YACxB,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;gBACvH,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;oBACnF,IAAI,CAAC,QAAQ,CAAC,uDAAuD,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;oBAChG,OAAO,OAAO,CAAC;gBACjB,CAAC;YACH,CAAC;YAED,iCAAiC;YACjC,IAAI,CAAC,QAAQ,CAAC,6CAA6C,cAAc,CAAC,MAAM,iBAAiB,CAAC,CAAC;YACnG,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;oBACnF,IAAI,CAAC,QAAQ,CAAC,yCAAyC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBAClE,OAAO,OAAO,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,WAAW;gBACb,CAAC;YACH,CAAC;YACD,MAAM,eAAe,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,iBAAqC;QAC3E,MAAM,GAAG,GAAG,cAAc,CAAC,sBAAsB,CAAC;QAClD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,GAAG,YAAY,CAAC;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,0BAA0B,EAAE,CAAC;QACpE,6FAA6F;QAC7F,mGAAmG;QACnG,0FAA0F;QAC1F,EAAE;QACF,qFAAqF;QACrF,gGAAgG;QAChG,+FAA+F;QAC/F,gGAAgG;QAChG,2FAA2F;QAC3F,MAAM,CAAC,qBAAqB,EAAE,GAAG,0BAA0B,CAAC,GAAG,iBAAiB,IAAI,EAAE,CAAC;QACvF,MAAM,QAAQ,GACZ,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,qBAAqB,EAAE,GAAG,0BAA0B,CAAC,CAAC;QAC7G,MAAM,oBAAoB,GAAsB,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAEpG,IAAI,CAAC,QAAQ,CAAC,8CAA8C,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE5E,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACtG,CAAC;QAAC,OAAO,eAAe,EAAE,CAAC;YACzB,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC5G,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnD,MAAM,eAAe,CAAC;YACxB,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;gBACvH,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,oBAAoB,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;oBACnH,IAAI,CAAC,QAAQ,CAAC,uDAAuD,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;oBAChG,OAAO,OAAO,CAAC;gBACjB,CAAC;YACH,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,UAAU,cAAc,CAAC,MAAM,gDAAgD,CAAC,CAAC;YAC/F,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,oBAAoB,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;oBACnH,IAAI,CAAC,QAAQ,CAAC,oEAAoE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC7F,OAAO,OAAO,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,+BAA+B;gBACjC,CAAC;YACH,CAAC;YAED,MAAM,eAAe,CAAC;QACxB,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,OAAgB,EAAE,KAAa,EAAE,MAAyB,cAAc,CAAC,sBAAsB;QACrH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,GAAG,YAAY,CAAC;QACrD,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IACtE,CAAC;IAEM,KAAK,CAAC,SAAS,CACpB,KAAa,EACb,SAAiB,EACjB,aAAgC,EAChC,cAGC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,GAA4B,EAAE,OAAY,EAAE,EAAE;gBACzF,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBAC9E,sBAAsB,EAAE,2BAA2B,CAAC,uBAAuB;wBAC3E,OAAO,EAAE;4BACP,wBAAwB;4BACxB,YAAY,EAAE,GAAG,CAAC,IAAI;4BACtB,eAAe,EAAE,GAAG,CAAC,OAAO;yBAC7B;wBACD,KAAK,EAAE,GAAG,CAAC,KAAK;wBAChB,kBAAkB,EAAE,cAAc,EAAE,kBAAkB;wBACtD,sBAAsB,EAAE,cAAc,EAAE,sBAAsB;qBAC/D,CAAC,CAAC;oBACH,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE;wBAC/C,aAAa,EAAE,OAAO,EAAE,GAAG;wBAC3B,eAAe,EAAE,OAAO,EAAE,GAAG;qBAC9B,CAAC,CAAC;oBACH,OAAO,CAAC,OAAO,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAGD;;;OAGG;IACI,KAAK,CAAC,WAAW,CAAC,OAAgB,EAAE,UAAkB,EAAE,WAA4B;QACzF,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,oDAAoD,EAAE,EAAE,CAAC,CAAC;QAC1O,CAAC;QACD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,CAAC,0CAA0C,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IAChF,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,aAAa,CAAC,OAAgB,EAAE,KAAa,EAAE,SAAiB,EAAE,aAAgC;QAC7G,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,oDAAoD,EAAE,EAAE,CAAC,CAAC;QAC1O,CAAC;QACD,MAAM,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ,CAAC,uDAAuD,CAAC,CAAC;QAEvE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QACtE,MAAM,YAAY,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,IAAK,OAA0B,CAAC,CAAC,CAAC,CAAC;QACxG,MAAM,OAAO,GAAG,YAAY,KAAK,iBAAiB,CAAC;QAEnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,6EAA6E,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,WAAW,CAAC,KAAa;QAC/B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,OAAO,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACI,uBAAuB,CAAC,KAAa;QAC1C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAA8B,CAAC;YAC/D,OAAO,OAAO,OAAO,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF,CAAA;AA7zBY,iBAAiB;IAD7B,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCAFI,aAAa;QACI,uBAAuB;QACrB,0BAA0B;GANvF,iBAAiB,CA6zB7B","sourcesContent":["import { inject, injectable } from 'inversify';\nimport jwt from 'jsonwebtoken';\nimport { AppConfigurationService} from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { JwtPrivateKeys, JwtPrivateKeySignOptions, VerifiableJwtKeys, JwtVerifyOptions } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport { Jwt_AppAuth_CreationParameter, JwtClaim_App_Auth, Jwt_RefreshToken_CreationParameter, Jwt_MachineToken_CreationParameter } from '~wildo-backend-lib/security/authentications/models/authentications.backend.schemas';\nimport {\n ErrorActionBackend,\n ErrorCustomMessageReference,\n ErrorType,\n ExecutionContext_ExecutionType,\n} from '@wildo-ai/saas-models';\nimport stringify from 'safe-stable-stringify';\nimport { createHash, createPublicKey } from 'crypto';\nimport { randomUUID } from 'crypto';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\n\n/*\n The OIDC / RFC 7519 protocol + security claim names the ID-token builder OWNS. `extraClaims` (the\n * scope-gated IDENTITY claims from the userinfo/ID-token resolver) must carry ONLY identity claims — these\n * reserved names are stripped BEFORE `extraClaims` is spread, so a same-named entry can never ride into the\n * ID token uncontrolled: a smuggled `nbf` (which would later make the token fail verification), a forged\n * `nonce` / `acr` / `amr` / `at_hash`, or a spoofed `iss` / `aud` / `sub` (the last are already overridden by\n * the server-set claims below — these are the ones the builder does NOT otherwise re-set). ONE named source\n * (closed vocabulary) so the strip list can never drift from the builder's own claim set.\n * semantic-literal-boundary: OIDC Core / RFC 7519 registered claim names.\n * assurance-control: WILDO.IDENTITY.TOKEN_INTEGRITY — an ID token's protocol/security claims are server-authored only.\n /\nconst OIDC_RESERVED_ID_TOKEN_CLAIM_NAMES: ReadonlySet<string> = new Set([\n // `sid` (OIDC Session Management / Front-Channel & Back-Channel Logout) is SERVER-AUTHORED here — it is\n // the End-User's OP session id the RP-Initiated Logout endpoint keys on (revocation-C). Reserving it bars\n // a client from smuggling its own `sid` via `extraClaims`, exactly like `nonce`/`acr`/`azp` below.\n 'iss', 'sub', 'aud', 'exp', 'nbf', 'iat', 'jti', 'azp', 'nonce', 'auth_time', 'at_hash', 'c_hash', 'acr', 'amr', 'sid',\n]);\n\n/\n A rotated public key self-retires when its optional `notAfter` instant has passed — so an operator can\n * schedule a compromised or aged prior key to STOP verifying (and drop out of the JWKS) WITHOUT a redeploy or a\n * manual config removal. Active = no `notAfter`, or a `notAfter` still in the future. Before this, a listed\n * rotated key verified indefinitely, bounded only by manual removal + the token's own `exp`. Applied at BOTH\n * the JWKS advertisement and every verify fallback so the two never disagree on which prior keys are live.\n /\nfunction isRotatedKeyActive(entry: { notAfter?: Date \| string }): boolean {\n if (!entry.notAfter) return true;\n return new Date(entry.notAfter).getTime() > Date.now();\n}\n\n@injectable()\nexport class JwtBackendService {\n protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private configService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private errorBuilder: ErrorBuilderBackendService\n ) {\n this.logDebug = this.logger.debugByType(\"JwtBackendService\");\n this.logger.setDebugTypeLogging(\"JwtBackendService\", false);\n }\n\n /\n Runtime-only verification options for renewable request/socket auth paths.\n \n These treat verification failures as routine control flow (the client\n * refreshes and retries), so they suppress the error's backend side-effect\n * actions (e.g. `ALERT`) while still preserving the rest of the backend error\n * contract. Logging is NO LONGER a construction-time action — it is owned by\n * the handling boundary (HTTP `expressErrorHandler`, websocket auth), which\n * classifies an expired token to `debug` on its own — so the boundary keeps\n * full control of the final human-facing severity without any per-call opt-out.\n /\n private readonly quietVerifyRuntimeOptions = {\n skipBackendActions: true,\n } as const;\n\n\n async createJwtForAppAuth(params: Jwt_AppAuth_CreationParameter): Promise<string> {\n const appSlug = this.configService.appSlug;\n const issuer = appSlug;\n\n const sub = params.userId;\n // F-24 (Slice 3.3): operator-authored TTL from `serviceAuth`,\n // overlaid by `app-configuration-loader.backend.service.ts`. The field\n // is required on the resolved `AppConfiguration_JWT_Schema` so a\n // missing value would fail at bootstrap, not silently downgrade here.\n const accessTokenMinutes = this.configService.config.jwt.accessTokenExpirationMinutes;\n\n const payload = {\n ...params,\n jti: randomUUID(),\n iat: Math.floor(Date.now() / 1000),\n exp: Math.floor(Date.now() / 1000) + accessTokenMinutes 60,\n iss: issuer,\n aud: \"AUTH_TOKEN\",\n sub,\n type: params.type,\n };\n\n const jwt = await this.sign(payload);\n return jwt;\n }\n\n /*\n Mint a USER-delegated access token for an EXTERNAL agent surface (A2A / MCP),\n * audience-bound per RFC 8707. Identical to {@link createJwtForAppAuth} EXCEPT it sets\n * `aud = options.audience` (the target A2A/MCP endpoint's canonical URI) instead of the\n * first-party `'AUTH_TOKEN'`. This is the load-bearing confinement (B-S2): the MAIN resource\n * API accepts only `aud='AUTH_TOKEN'` user tokens, so it REJECTS this token — a consented\n * third-party client can act for the user at the named agent endpoint ONLY, never as a full\n * first-party session. `azp` (the delegating `client_id`, required here) carries attribution.\n * Authority is roles-only: the user's roles are fetched at auth time — there is NO authz\n * `scope` on the token (identity `openid` may ride for identity only). Signed with the same\n * JWKS-advertised `APPLICATION_AUTH_TOKEN` key + `iss=appSlug` so the existing user-token\n * verify path accepts it. NO refresh token is issued for a delegated agent token.\n \n REVOCATION: a delegated token has no stored server-side handle, so there is no SELECTIVE\n * per-token revocation (RFC 7009 `/oauth/revoke` operates on refresh tokens, of which this has\n * none). It is invalidated (a) by its short capped TTL (see the caller's delegated-TTL cap), or\n * (b) globally, alongside the user's other tokens, when a credential change sets\n * `TOKEN_INVALID_BEFORE:<userId>` (the external verify arm enforces `iat <= invalidBefore` — the\n * same-second boundary is rejected fail-closed; see `evaluateUserTokenInvalidationFence`). A\n * dedicated per-consent revocation surface is a future extension.\n /\n async createJwtForDelegatedUserToken(\n params: Jwt_AppAuth_CreationParameter,\n options: { audience: string; expiresInMinutes?: number },\n ): Promise<string> {\n if (!params.azp) {\n throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {\n customMessageReference: ErrorCustomMessageReference.INTERNAL,\n context: { message: 'A delegated user token MUST carry `azp` (the delegating client_id) for attribution.' },\n });\n }\n const issuer = this.configService.appSlug;\n const minutes = options.expiresInMinutes ?? this.configService.config.jwt.accessTokenExpirationMinutes;\n const now = Math.floor(Date.now() / 1000);\n\n const payload = {\n ...params,\n jti: randomUUID(),\n iat: now,\n exp: now + minutes 60,\n iss: issuer,\n // RFC 8707 resource indicator = the agent endpoint. NOT 'AUTH_TOKEN' — the main resource\n // API rejects this, confining the delegated token to the A2A/MCP surface.\n aud: options.audience,\n sub: params.userId,\n type: params.type,\n };\n\n return this.sign(payload);\n }\n\n /*\n Sign an OAuth 2.0 client-credentials (machine-to-machine) access token. Distinct from\n * `createJwtForAppAuth`, which hardcodes `sub = userId` + `aud = \"AUTH_TOKEN\"`\n * (user-specific). Here `sub = clientId` and `aud` is the RFC 8707 resource\n * indicator (the canonical URI of the target resource server — the MCP endpoint,\n * A2A agent, or generic API the token is minted for). `signRaw` strips the per-key\n * default `aud`/`sub` because the payload carries its own, so the same\n * `APPLICATION_AUTH_TOKEN` ES256 key signs it. See D7 in the external-access plan.\n \n @param params - the machine claim (type = ORGANIZATION_MACHINE/APPLICATION_MACHINE, clientId/scopeId/roles)\n * @param options.audience - RFC 8707 resource indicator = the token's intended `aud`\n * @param options.expiresInMinutes - TTL override; defaults to the app access-token TTL (short-lived)\n /\n async createJwtForMachineToken(\n params: Jwt_MachineToken_CreationParameter,\n options: { audience: string; expiresInMinutes?: number },\n ): Promise<string> {\n // OIDC: `iss` MUST be the issuer URL (matching the discovery doc's `issuer` +\n // `jwks_uri`), not the app slug — so an external relying party validating a machine token\n // resolves the right JWKS. Falls back to the app slug pre-config / when the public base\n // URL is unresolvable. (Trunk amendment surfaced by the OIDC branch; machine-token path only.)\n const issuer = this.configService.resolveApiResourceAudience() ?? this.configService.appSlug;\n const minutes = options.expiresInMinutes ?? this.configService.config.jwt.accessTokenExpirationMinutes;\n const now = Math.floor(Date.now() / 1000);\n\n const payload = {\n ...params,\n jti: randomUUID(),\n iat: now,\n exp: now + minutes 60,\n iss: issuer,\n aud: options.audience,\n sub: params.clientId,\n type: params.type,\n };\n\n return this.sign(payload);\n }\n\n /*\n Sign an OIDC ID Token (OIDC Core §2) for the authorization_code flow. `sub` = the user id,\n * `aud` = the client id, `iss` = the issuer URL (matching the discovery doc + JWKS). Signed\n * with the same `APPLICATION_AUTH_TOKEN` ES256 key the JWKS advertises, so a relying party\n * verifies it by `kid`. `nonce`/`auth_time` are echoed when present; `extraClaims` carries\n * standard claims (email/name) when the granted scopes permit them.\n \n `sid` (revocation-C) is the End-User's OP session id, echoed when present. It is what the\n * RP-Initiated Logout endpoint (`/oauth/end-session`) reads from the `id_token_hint` to terminate\n * that exact session (`invalidateSession(sid)`) — so an RP logout reaches the Wildo login session\n * the delegation was authorized from, not every session of the user. Server-authored (reserved\n * against `extraClaims` smuggling); omitted for a token minted outside any login session.\n /\n async createJwtForIdToken(params: {\n userId: string;\n clientId: string;\n nonce?: string;\n authTime?: number;\n sid?: string;\n extraClaims?: Record<string, unknown>;\n expiresInMinutes?: number;\n }): Promise<string> {\n // Fail closed: an ID token's `iss` MUST be the resolvable issuer URL that the discovery\n // document and JWKS advertise — a relying party validates `iss` against discovery and fetches\n // the JWKS from it. Falling back to the (non-URL) app slug would mint an ID token no RP can\n // validate. So when the public base URL is unresolvable we REFUSE to mint (matching discovery\n // and the token endpoint, which both 503 on the same condition) rather than emit a\n // structurally-invalid token. (Machine tokens are guarded by the token endpoint's own pre-check.)\n const issuer = this.configService.resolveApiResourceAudience();\n if (!issuer) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.JWT_TOKEN_NOT_FOUND,\n context: { message: 'Cannot mint an OIDC ID token: the issuer (API resource audience) is unresolvable — set the app public base URL to the external https origin.' },\n });\n }\n const minutes = params.expiresInMinutes ?? this.configService.config.jwt.accessTokenExpirationMinutes;\n const now = Math.floor(Date.now() / 1000);\n\n // Defense-in-depth: keep ONLY genuine identity claims from `extraClaims`; every protocol/security claim\n // name is stripped (see {@link OIDC_RESERVED_ID_TOKEN_CLAIM_NAMES}) so the server-authored claims below are\n // the ONLY source of `iss`/`aud`/`sub`/`exp`/`nbf`/`nonce`/`acr`/… — no id_token claim smuggling.\n const identityClaims = Object.fromEntries(\n Object.entries(params.extraClaims ?? {}).filter(([name]) => !OIDC_RESERVED_ID_TOKEN_CLAIM_NAMES.has(name)),\n );\n\n const payload = {\n ...identityClaims,\n ...(params.nonce ? { nonce: params.nonce } : {}),\n ...(params.authTime ? { auth_time: params.authTime } : {}),\n ...(params.sid ? { sid: params.sid } : {}),\n azp: params.clientId,\n jti: randomUUID(),\n iat: now,\n exp: now + minutes 60,\n iss: issuer,\n aud: params.clientId,\n sub: params.userId,\n };\n\n return this.sign(payload);\n }\n\n async createRefreshToken(\n params: Jwt_RefreshToken_CreationParameter,\n options?: { expiresInSeconds?: number },\n ): Promise<string> {\n const appSlug = this.configService.appSlug;\n const issuer = appSlug;\n // F-24 (Slice 3.3): operator-authored TTL from `serviceAuth`. The field\n // is required on the resolved `AppConfiguration_JWT_Schema`; if it is\n // ever missing here that signals a misconfigured bootstrap and should\n // surface (NaN exp) rather than silently mint a default-lifetime token.\n const refreshTokenExpirationDays = this.configService.config.jwt.refreshTokenExpirationDays;\n\n const defaultExpSeconds = 60 * 60 * 24 * refreshTokenExpirationDays;\n const expSeconds = options?.expiresInSeconds ?? defaultExpSeconds;\n const sub = params.userId;\n\n const payload = {\n ...params,\n jti: params.jti \|\| randomUUID(),\n iat: Math.floor(Date.now() / 1000),\n exp: Math.floor(Date.now() / 1000) + expSeconds,\n iss: issuer,\n aud: \"REFRESH_TOKEN\",\n sub,\n type: params.type,\n };\n\n this.logDebug(`Creating refresh token with expiration: ${options?.expiresInSeconds ? `${expSeconds}s (custom)` : `${refreshTokenExpirationDays} days`}`);\n const refreshToken = await this.sign(payload, JwtPrivateKeys.APPLICATION_AUTH_TOKEN);\n return refreshToken;\n }\n\n /*\n Get JWT signing configuration (loads on first access)\n * Private keys are loaded from secrets, public keys from main config\n /\n /* Cache of RFC 7638 thumbprints keyed by public-key PEM (stable per process). /\n private readonly _kidByPublicKey = new Map<string, string>();\n\n /\n RFC 7638 JWK Thumbprint of a public key (PEM) — the stable, key-UNIQUE `kid` used in\n * signed JWT headers and (future) JWKS entries. Replaces the previous scheme where `kid`\n * was the `JwtPrivateKeys` enum NAME (fixed per key TYPE, not per key version) — which is\n * not rotation-unique and would advertise a wrong/ambiguous `kid` in a JWKS. Derived purely\n * from the public key material, so it needs NO config-schema or key-provisioner change and\n * moves with the key across rotation. Computed via the JWK canonical form (RFC 7638 §3:\n * required members only, lexicographic order, no whitespace) → SHA-256 → base64url. Cached.\n \n @param publicKeyPem EC P-256 (or RSA) public key in PEM. @returns the base64url thumbprint.\n /\n public computeKidFromPublicKey(publicKeyPem: string): string {\n const cached = this._kidByPublicKey.get(publicKeyPem);\n if (cached) return cached;\n\n const jwk = createPublicKey(publicKeyPem).export({ format: 'jwk' }) as {\n kty?: string; crv?: string; x?: string; y?: string; n?: string; e?: string;\n };\n\n let canonical: string;\n if (jwk.kty === 'EC') {\n canonical = `{\"crv\":\"${jwk.crv}\",\"kty\":\"EC\",\"x\":\"${jwk.x}\",\"y\":\"${jwk.y}\"}`;\n } else if (jwk.kty === 'RSA') {\n canonical = `{\"e\":\"${jwk.e}\",\"kty\":\"RSA\",\"n\":\"${jwk.n}\"}`;\n } else {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.JWT_TOKEN_NOT_FOUND,\n context: { message: `Cannot compute kid for unsupported JWK kty: ${jwk.kty}` },\n });\n }\n\n const kid = createHash('sha256').update(canonical).digest('base64url');\n this._kidByPublicKey.set(publicKeyPem, kid);\n return kid;\n }\n\n /\n Public JSON Web Key Set (RFC 7517) for the OIDC `jwks_uri`. By default exposes the\n * `APPLICATION_AUTH_TOKEN` key — the ES256 key that signs the auth + machine access tokens\n * external parties verify. Each JWK's `kid` is the RFC 7638 thumbprint (the SAME value\n * in every token header), so a relying party selects the right key by `kid`. Includes the\n * current key plus any `rotatedPublicKeys`, so tokens signed with a prior key still verify\n * during a rotation overlap. Private material never appears (public JWK only).\n /\n public getPublicJwks(keyTypes: JwtPrivateKeys[] = [JwtPrivateKeys.APPLICATION_AUTH_TOKEN]): { keys: Array<Record<string, unknown>> } {\n const jwtConfig = this.configService.jwtConfig;\n const publicKeys = (jwtConfig.config?.publicKey ?? {}) as Record<string, string \| undefined>;\n const rotated = (jwtConfig.config?.rotatedPublicKeys ?? {}) as Record<string, Array<{ kid: string; publicKey: string; notAfter?: Date }> \| undefined>;\n\n const keys: Array<Record<string, unknown>> = [];\n const seenKids = new Set<string>();\n const addPem = (pem?: string): void => {\n if (!pem) return;\n const kid = this.computeKidFromPublicKey(pem);\n if (seenKids.has(kid)) return;\n seenKids.add(kid);\n const jwk = createPublicKey(pem).export({ format: 'jwk' }) as Record<string, unknown>;\n keys.push({ ...jwk, kid, use: 'sig', alg: 'ES256' });\n };\n\n for (const keyType of keyTypes) {\n addPem(publicKeys[keyType]);\n for (const entry of (rotated[keyType] ?? []).filter(isRotatedKeyActive)) addPem(entry.publicKey);\n }\n return { keys };\n }\n\n async getSignOptions(key: JwtPrivateKeys = JwtPrivateKeys.APPLICATION_AUTH_TOKEN): Promise<jwt.SignOptions & { privateKey: string, publicKey: string }> {\n const signConfig = JwtPrivateKeySignOptions[key];\n const jwtConfig = this.configService.jwtConfig;\n\n // Debug JWT configuration\n this.logDebug('🔧 JWT Configuration Debug', {\n requestedKey: key,\n availablePrivateKeys: Object.keys(jwtConfig.secrets.privateKey \|\| {}),\n availablePublicKeys: Object.keys(jwtConfig.config.publicKey \|\| {}),\n hasPrivateKey: !!(jwtConfig.secrets.privateKey \|\| {})[key],\n hasPublicKey: !!(jwtConfig.config.publicKey \|\| {})[key]\n });\n\n const privateKey = jwtConfig.secrets.privateKey[key];\n const publicKey = jwtConfig.config.publicKey[key];\n\n if (!privateKey) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.JWT_TOKEN_NOT_FOUND,\n context: {\n message: `Private key for ${key} not found in secrets configuration`,\n availablePrivateKeys: Object.keys(jwtConfig.secrets.privateKey \|\| {}),\n requestedKey: key\n }\n });\n }\n\n if (!publicKey) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.JWT_TOKEN_NOT_FOUND,\n context: {\n message: `Public key for ${key} not found in configuration`,\n availablePublicKeys: Object.keys(jwtConfig.config.publicKey \|\| {}),\n requestedKey: key\n }\n });\n }\n\n return {\n ...signConfig,\n // Stable, key-unique RFC 7638 thumbprint kid (overrides the enum-name `keyid` in\n // `JwtPrivateKeySignOptions`). This is what a JWKS endpoint advertises and what the\n // verify path matches rotated keys against.\n keyid: this.computeKidFromPublicKey(publicKey),\n privateKey,\n publicKey\n };\n }\n\n async getVerifyOptions(key: VerifiableJwtKeys = JwtPrivateKeys.APPLICATION_AUTH_TOKEN): Promise<jwt.VerifyOptions & { publicKey: string }> {\n const verifyConfig = JwtVerifyOptions[key];\n const jwtConfig = this.configService.jwtConfig;\n\n const publicKey = (jwtConfig.config.publicKey)[key];\n\n if (!publicKey) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, { customMessageReference: ErrorCustomMessageReference.JWT_TOKEN_NOT_FOUND, context: { message: `Public key for ${key} not found in configuration` } });\n }\n\n const isApplicationKey = [\n JwtPrivateKeys.APPLICATION_PLATFORM_REQUEST,\n JwtPrivateKeys.APPLICATION_WORKER_REQUEST,\n JwtPrivateKeys.APPLICATION_WEBHOOK,\n JwtPrivateKeys.APPLICATION_AUTH_TOKEN,\n ].includes(key as JwtPrivateKeys);\n\n let issuer = verifyConfig.issuer;\n if (isApplicationKey) {\n issuer = this.configService.appSlug;\n }\n\n return {\n ...verifyConfig,\n issuer,\n publicKey\n };\n }\n\n\n /\n Sign a JWT token. Algorithm is fixed per key by `JwtPrivateKeySignOptions`\n * (ES256 / ECDSA P-256 today — see `JwtDefaultSignOptions`); the `serviceAuth` block does NOT\n * author algorithm \\u2014 see Slice 3.3 closeout.\n * @param payload - The payload to sign\n * @param key - The private key type to use for signing\n * @returns Promise resolving to JWT token string\n /\n async sign(payload: any, key: JwtPrivateKeys = JwtPrivateKeys.APPLICATION_AUTH_TOKEN): Promise<string> {\n const signConfig = await this.getSignOptions(key);\n\n const { privateKey, publicKey, ...signOptions } = signConfig;\n\n this.logDebug(`Signing JWT token with key type: ${key}`);\n\n return this.signRaw(payload, privateKey, signOptions);\n }\n\n public async signHash(payload: unknown, key: JwtPrivateKeys = JwtPrivateKeys.APPLICATION_AUTH_TOKEN): Promise<string> {\n const signConfig = await this.getSignOptions(key);\n const { privateKey, ...signOptions } = signConfig;\n return this.signHashRaw(payload, privateKey, signOptions);\n }\n\n\n public async signRaw(payload: any, privateKey: string, signOptions: jwt.SignOptions): Promise<string> {\n // Remove conflicting options if payload already has corresponding fields\n const cleanSignOptions = { ...signOptions };\n\n if (payload.exp && cleanSignOptions.expiresIn) {\n delete cleanSignOptions.expiresIn;\n this.logDebug('Removed expiresIn from sign options due to existing exp in payload');\n }\n\n if (payload.iss && cleanSignOptions.issuer) {\n delete cleanSignOptions.issuer;\n this.logDebug('Removed issuer from sign options due to existing iss in payload');\n }\n\n if (payload.aud && cleanSignOptions.audience) {\n delete cleanSignOptions.audience;\n this.logDebug('Removed audience from sign options due to existing aud in payload');\n }\n\n if (payload.sub && cleanSignOptions.subject) {\n delete cleanSignOptions.subject;\n this.logDebug('Removed subject from sign options due to existing sub in payload');\n }\n\n return new Promise((resolve, reject) => {\n jwt.sign(payload, privateKey, cleanSignOptions, (err: Error \| null, token: string \| undefined) => {\n if (err) {\n const error = this.errorBuilder.buildFromStandardError(err, undefined, { customMessageReference: ErrorCustomMessageReference.JWT_SIGNING_FAILED, context: { message: 'JWT signing failed' } });\n reject(error);\n } else if (!token) {\n const error = this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, { customMessageReference: ErrorCustomMessageReference.JWT_TOKEN_GENERATION_FAILED, context: { message: 'JWT token generation failed - token is undefined' } });\n reject(error);\n } else {\n this.logDebug('JWT token signed successfully');\n resolve(token);\n }\n });\n });\n }\n\n /\n Verify a JWT token. Algorithm is fixed per key by `JwtPrivateKeySignOptions`\n * (ES256 / ECDSA P-256 today — see `JwtDefaultSignOptions`); the `serviceAuth` block does NOT\n * author algorithm \\u2014 see Slice 3.3 closeout.\n \n L6: Supports key rotation. Tries the current key first. If verification fails,\n * tries each rotated public key for this key type before giving up.\n \n @param token - The JWT token to verify\n * @param key - The key type to use for verification\n * @returns Promise resolving to decoded token payload\n /\n async verify(token: string, key: VerifiableJwtKeys = JwtPrivateKeys.APPLICATION_AUTH_TOKEN): Promise<unknown> {\n const verifyConfig = await this.getVerifyOptions(key);\n const { publicKey, ...verifyOptions } = verifyConfig;\n\n this.logDebug(`Verifying JWT token with key type: ${key}`);\n\n // Try current key first\n try {\n return await this.verifyRaw(token, publicKey, verifyOptions);\n } catch (currentKeyError) {\n // L6: If current key fails, try rotated keys — match by kid from JWT header when possible\n const rotatedEntries = this.configService.config?.jwt?.rotatedPublicKeys?.[key]?.filter(isRotatedKeyActive);\n if (!rotatedEntries \|\| rotatedEntries.length === 0) {\n throw currentKeyError;\n }\n\n const headerKid = this._extractKid(token);\n if (headerKid) {\n // Direct kid match — avoids full verification attempt per key\n const match = rotatedEntries.find(e => this.computeKidFromPublicKey(e.publicKey) === headerKid \|\| e.kid === headerKid);\n if (match) {\n const decoded = await this.verifyRaw(token, match.publicKey, verifyOptions);\n this.logDebug('JWT verified with rotated key via kid match', { key, kid: headerKid });\n return decoded;\n }\n }\n\n // Fallback: sequential iteration (kid missing or no kid match found)\n this.logDebug(`Trying ${rotatedEntries.length} rotated key(s) sequentially for ${key}`);\n for (const entry of rotatedEntries) {\n try {\n const decoded = await this.verifyRaw(token, entry.publicKey, verifyOptions);\n this.logDebug('JWT verified with rotated key — consider rotating tokens', { key });\n return decoded;\n } catch {\n // Continue to next rotated key\n }\n }\n\n // All keys exhausted — throw the original error from the current key\n throw currentKeyError;\n }\n }\n\n /\n Verify a JWT without emitting the default backend LOG action on failure.\n * The caller becomes responsible for the final log wording/severity.\n /\n async verifyWithoutBackendErrorActions(\n token: string,\n key: VerifiableJwtKeys = JwtPrivateKeys.APPLICATION_AUTH_TOKEN,\n options?: { ignoreAudience?: boolean; ignoreExpiration?: boolean; issuerOverride?: string },\n ): Promise<unknown> {\n const verifyConfig = await this.getVerifyOptions(key);\n const { publicKey, ...verifyOptions } = verifyConfig;\n // The EXTERNAL user-delegated path (A2A / MCP) binds a token to an AGENT endpoint audience\n // (RFC 8707) rather than the first-party `aud='AUTH_TOKEN'`, so it verifies aud-AGNOSTICALLY\n // and then checks the agent audience EXPLICITLY against the serving endpoint. Every FIRST-PARTY\n // path keeps the audience gate — that gate is precisely what confines a delegated token OUT of\n // the main API / manual-controller / socket surfaces (B-S2 / R4). Never pass `ignoreAudience`\n // on a first-party path.\n if (options?.ignoreAudience) {\n delete (verifyOptions as { audience?: unknown }).audience;\n }\n // revocation-C: an OIDC id_token's `iss` is the PUBLIC issuer URL (`resolveApiResourceAudience()`), NOT\n // the `appSlug` that `getVerifyOptions` forces for the APPLICATION_AUTH_TOKEN key (correct for first-party\n // access/refresh tokens, whose `iss` IS the slug). The RP-Initiated Logout endpoint verifies an\n // `id_token_hint` against that public issuer instead — keeping the issuer check INSIDE `jwt.verify`,\n // atomic with the signature, rather than deferring it to a manual post-check the caller could forget.\n if (options?.issuerOverride !== undefined) {\n (verifyOptions as { issuer?: string }).issuer = options.issuerOverride;\n }\n // revocation-C: RP-Initiated Logout 1.0 §2 permits an EXPIRED `id_token_hint` (it is a HINT about which\n // session to end, not a live credential — the signature still proves WE minted it). Only the end_session\n // path passes this; every credential-bearing verify keeps expiry enforced.\n // spec-cite: OpenID Connect RP-Initiated Logout 1.0 §2 (`id_token_hint` — a previously issued ID Token).\n if (options?.ignoreExpiration) {\n (verifyOptions as { ignoreExpiration?: boolean }).ignoreExpiration = true;\n }\n\n this.logDebug(`Verifying JWT token without backend error actions for key type: ${key}`);\n\n try {\n return await this.verifyRaw(token, publicKey, verifyOptions, this.quietVerifyRuntimeOptions);\n } catch (currentKeyError) {\n const rotatedEntries = this.configService.config?.jwt?.rotatedPublicKeys?.[key]?.filter(isRotatedKeyActive);\n if (!rotatedEntries \|\| rotatedEntries.length === 0) {\n throw currentKeyError;\n }\n\n const headerKid = this._extractKid(token);\n if (headerKid) {\n const match = rotatedEntries.find(e => this.computeKidFromPublicKey(e.publicKey) === headerKid \|\| e.kid === headerKid);\n if (match) {\n const decoded = await this.verifyRaw(token, match.publicKey, verifyOptions, this.quietVerifyRuntimeOptions);\n this.logDebug('JWT verified with rotated key via kid match (quiet)', { key, kid: headerKid });\n return decoded;\n }\n }\n\n this.logDebug(`Trying ${rotatedEntries.length} rotated key(s) sequentially for quiet ${key} verification`);\n for (const entry of rotatedEntries) {\n try {\n const decoded = await this.verifyRaw(token, entry.publicKey, verifyOptions, this.quietVerifyRuntimeOptions);\n this.logDebug('JWT verified with rotated key (quiet) — consider rotating tokens', { key });\n return decoded;\n } catch {\n // Continue to next rotated key\n }\n }\n\n throw currentKeyError;\n }\n }\n\n /\n Verify a refresh token JWT.\n * Uses the same signing key as APPLICATION_AUTH_TOKEN but overrides the audience\n * to REFRESH_TOKEN (refresh tokens are signed with aud: 'REFRESH_TOKEN' while\n * access tokens use aud: 'AUTH_TOKEN').\n \n L6: Supports key rotation — tries rotated keys if the current key fails.\n /\n async verifyRefreshToken(token: string): Promise<unknown> {\n const key = JwtPrivateKeys.APPLICATION_AUTH_TOKEN;\n const verifyConfig = await this.getVerifyOptions(key);\n const { publicKey, ...verifyOptions } = verifyConfig;\n const refreshVerifyOptions = { ...verifyOptions, audience: 'REFRESH_TOKEN' };\n\n this.logDebug('Verifying refresh token (audience: REFRESH_TOKEN)');\n\n try {\n return await this.verifyRaw(token, publicKey, refreshVerifyOptions);\n } catch (currentKeyError) {\n // L6: Try rotated keys — match by kid from JWT header when possible\n const rotatedEntries = this.configService.config?.jwt?.rotatedPublicKeys?.[key]?.filter(isRotatedKeyActive);\n if (!rotatedEntries \|\| rotatedEntries.length === 0) {\n throw currentKeyError;\n }\n\n const headerKid = this._extractKid(token);\n if (headerKid) {\n const match = rotatedEntries.find(e => this.computeKidFromPublicKey(e.publicKey) === headerKid \|\| e.kid === headerKid);\n if (match) {\n const decoded = await this.verifyRaw(token, match.publicKey, refreshVerifyOptions);\n this.logDebug('Refresh token verified with rotated key via kid match', { key, kid: headerKid });\n return decoded;\n }\n }\n\n // Fallback: sequential iteration\n this.logDebug(`Refresh token: current key failed, trying ${rotatedEntries.length} rotated key(s)`);\n for (const entry of rotatedEntries) {\n try {\n const decoded = await this.verifyRaw(token, entry.publicKey, refreshVerifyOptions);\n this.logDebug('Refresh token verified with rotated key', { key });\n return decoded;\n } catch {\n // Continue\n }\n }\n throw currentKeyError;\n }\n }\n\n /\n Verify an OAuth 2.0 client-credentials (machine-to-machine) access token.\n \n Distinct from the user access-token verify (`verify` / `verifyWithoutBackendErrorActions`),\n * whose `APPLICATION_AUTH_TOKEN` options enforce `issuer = appSlug` + `audience = 'AUTH_TOKEN'`.\n * A machine token is RFC-8707 audience-bound: `createJwtForMachineToken` mints it with\n * `iss = resolveApiResourceAudience()` (the stable app issuer) and `aud = <resource>` — the\n * generic API audience by default, OR a per-endpoint resource-server audience (MCP / A2A) when the\n * client named that `resource` at the token endpoint. Verifying with the user options would reject\n * EVERY machine token on the `aud`/`iss` check, so this method overrides `issuer` to the app issuer\n * and `audience` to the expected audience(s).\n \n `expectedAudiences` — the audience(s) this caller accepts (RFC 8707). Omitted (the default, used\n * by the main-API choke point) ⇒ the generic API audience only, so a per-endpoint MCP/A2A token\n * stays confined OUT of the main API. An external resource server (MCP / A2A) passes\n * `[<its own endpoint audience>]` — STRICT since the 2026-07-29 flip: it accepts ONLY a token minted\n * for its own surface and rejects a generic API-audience token (an API token and an agent token never\n * cross). `aud` must match one of the provided audiences. Signature + `exp` + ES256 pinning are\n * always enforced (shared with the user path).\n \n Quiet (`skipBackendActions`) like `verifyWithoutBackendErrorActions`: the request-auth choke point\n * classifies expired-vs-invalid and owns the final log severity.\n \n Fail-closed on unresolvable audience: when the resolved audience list is empty (public base URL\n * lost AND no explicit override), `audience`/`issuer` are left unset (jsonwebtoken skips those\n * checks) and the caller's own audience guard rejects the request — so a machine token is never\n * accepted without a validated audience, and signature + `exp` are still enforced here regardless.\n \n Supports key rotation identically to the sibling verify methods (current key, then kid-matched /\n * sequential rotated keys).\n /\n async verifyMachineToken(token: string, expectedAudiences?: readonly string[]): Promise<unknown> {\n const key = JwtPrivateKeys.APPLICATION_AUTH_TOKEN;\n const verifyConfig = await this.getVerifyOptions(key);\n const { publicKey, ...verifyOptions } = verifyConfig;\n const apiAudience = this.configService.resolveApiResourceAudience();\n // `iss` is ALWAYS the app issuer (the API resource audience). `aud` is the caller's accepted\n // audience(s): the explicit `expectedAudiences` when given (per-endpoint MCP/A2A opt-in), else the\n // generic API audience (the default the main-API choke point relies on to stay confined).\n //\n // `jwt.VerifyOptions['audience']` types the multi-audience form as a NON-EMPTY tuple\n // (`[string \| RegExp, ...(string \| RegExp)[]]`), not `string[]` — an empty array would silently\n // mean \"accept no audience\" while still engaging jsonwebtoken's `aud` check. Destructuring the\n // head proves non-emptiness to the type system and keeps the empty-list case on the fail-closed\n // branch documented above (audience left unset ⇒ the caller's own audience guard rejects).\n const [firstExpectedAudience, ...remainingExpectedAudiences] = expectedAudiences ?? [];\n const audience: jwt.VerifyOptions['audience'] =\n firstExpectedAudience === undefined ? apiAudience : [firstExpectedAudience, ...remainingExpectedAudiences];\n const machineVerifyOptions: jwt.VerifyOptions = { ...verifyOptions, audience, issuer: apiAudience };\n\n this.logDebug('Verifying machine (client-credentials) token', { audience });\n\n try {\n return await this.verifyRaw(token, publicKey, machineVerifyOptions, this.quietVerifyRuntimeOptions);\n } catch (currentKeyError) {\n const rotatedEntries = this.configService.config?.jwt?.rotatedPublicKeys?.[key]?.filter(isRotatedKeyActive);\n if (!rotatedEntries \|\| rotatedEntries.length === 0) {\n throw currentKeyError;\n }\n\n const headerKid = this._extractKid(token);\n if (headerKid) {\n const match = rotatedEntries.find(e => this.computeKidFromPublicKey(e.publicKey) === headerKid \|\| e.kid === headerKid);\n if (match) {\n const decoded = await this.verifyRaw(token, match.publicKey, machineVerifyOptions, this.quietVerifyRuntimeOptions);\n this.logDebug('machine token verified with rotated key via kid match', { key, kid: headerKid });\n return decoded;\n }\n }\n\n this.logDebug(`Trying ${rotatedEntries.length} rotated key(s) sequentially for machine token`);\n for (const entry of rotatedEntries) {\n try {\n const decoded = await this.verifyRaw(token, entry.publicKey, machineVerifyOptions, this.quietVerifyRuntimeOptions);\n this.logDebug('machine token verified with rotated key — consider rotating tokens', { key });\n return decoded;\n } catch {\n // Continue to next rotated key\n }\n }\n\n throw currentKeyError;\n }\n }\n\n public async verifyHash(payload: unknown, token: string, key: VerifiableJwtKeys = JwtPrivateKeys.APPLICATION_AUTH_TOKEN): Promise<boolean> {\n const verifyConfig = await this.getVerifyOptions(key);\n const { publicKey, ...verifyOptions } = verifyConfig;\n return this.verifyHashRaw(payload, token, publicKey, verifyOptions);\n }\n\n public async verifyRaw(\n token: string,\n publicKey: string,\n verifyOptions: jwt.VerifyOptions,\n runtimeOptions?: {\n skipBackendActions?: boolean;\n skipBackendActionTypes?: readonly ErrorActionBackend[];\n },\n ): Promise<unknown> {\n return new Promise((resolve, reject) => {\n jwt.verify(token, publicKey, verifyOptions, (err: jwt.VerifyErrors \| null, decoded: any) => {\n if (err) {\n const error = this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.JWT_VERIFICATION_FAILED,\n context: {\n // diagnostic (log-only)\n jwtErrorName: err.name,\n jwtErrorMessage: err.message,\n },\n stack: err.stack,\n skipBackendActions: runtimeOptions?.skipBackendActions,\n skipBackendActionTypes: runtimeOptions?.skipBackendActionTypes,\n });\n reject(error);\n } else {\n this.logDebug('JWT token verified successfully', {\n decodedIssuer: decoded?.iss,\n decodedAudience: decoded?.aud,\n });\n resolve(decoded);\n }\n });\n });\n }\n\n\n /\n Deterministically stringify the payload and sign the SHA-256 hash as a JWT payload.\n * Payload used for signing has the shape: { h: <sha256_hex>, alg: 'sha256' }\n /\n public async signHashRaw(payload: unknown, privateKey: string, signOptions: jwt.SignOptions): Promise<string> {\n const normalized = stringify(payload);\n if (!normalized) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, { customMessageReference: ErrorCustomMessageReference.JWT_TOKEN_GENERATION_FAILED, context: { message: 'JWT token generation failed - payload is undefined' } });\n }\n const sha256Hex = createHash('sha256').update(normalized).digest('hex');\n this.logDebug('Signing SHA-256 hash of provided payload');\n return this.signRaw({ h: sha256Hex, alg: 'sha256' }, privateKey, signOptions);\n }\n\n /\n Verify that the provided token is a valid signature of the SHA-256 hash of the payload.\n * Returns true only if the token verifies and the embedded hash matches the freshly computed hash.\n /\n public async verifyHashRaw(payload: unknown, token: string, publicKey: string, verifyOptions: jwt.VerifyOptions): Promise<boolean> {\n const normalized = stringify(payload);\n if (!normalized) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, { customMessageReference: ErrorCustomMessageReference.JWT_TOKEN_GENERATION_FAILED, context: { message: 'JWT token generation failed - payload is undefined' } });\n }\n const expectedSha256Hex = createHash('sha256').update(normalized).digest('hex');\n this.logDebug('Verifying SHA-256 hash signature for provided payload');\n\n const decoded = await this.verifyRaw(token, publicKey, verifyOptions);\n const receivedHash = typeof decoded === 'string' ? decoded : (decoded && (decoded as jwt.JwtPayload).h);\n const matches = receivedHash === expectedSha256Hex;\n\n if (!matches) {\n this.logger.warn?.('Hash mismatch during verifyHashRaw: token hash does not match computed hash');\n }\n return matches;\n }\n\n /\n L6: Extract `kid` (Key ID) from a JWT's header without verifying the token.\n * Returns undefined if the header cannot be decoded or has no kid.\n /\n private _extractKid(token: string): string \| undefined {\n try {\n const decoded = jwt.decode(token, { complete: true });\n return decoded?.header?.kid;\n } catch {\n return undefined;\n }\n }\n\n /\n Peek the `type` claim of a bearer token WITHOUT verifying its signature.\n \n Used ONLY to route the token to the correct verify options — the user access-token verify\n * (`audience:'AUTH_TOKEN'`) vs the machine-token verify ({@link verifyMachineToken},\n * `audience = resolveApiResourceAudience()`) — because the two token families carry different\n * `aud`/`iss` and a single verify cannot satisfy both. The value is UNTRUSTED: the selected verify\n * still fully checks the signature, so a forged/attacker-set `type` cannot bypass authentication\n * (worst case it selects the wrong audience and the signature/audience check rejects the token).\n * Returns `undefined` for a malformed/undecodable token → the caller falls back to the user verify,\n * which then rejects it fail-closed.\n */\n public peekUnverifiedClaimType(token: string): string \| undefined {\n try {\n const decoded = jwt.decode(token) as { type?: unknown } \| null;\n return typeof decoded?.type === 'string' ? decoded.type : undefined;\n } catch {\n return undefined;\n }\n }\n}\n\n"]}
1	+ {"version":3,"file":"jwt.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/jwt/services/jwt.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAC,MAAM,sEAAsE,CAAC;AAC9G,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAqB,gBAAgB,EAAE,MAAM,wEAAwE,CAAC;AAEvK,OAAO,EAEL,2BAA2B,EAC3B,SAAS,EAET,kCAAkC,GACnC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,SAAS,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAG9G;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,KAAmC;IAC7D,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACzD,CAAC;AAGM,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAIiB;IACU;IACG;IALhD,QAAQ,CAA+D;IAEjF,YAC6C,MAAqB,EACX,aAAsC,EACnC,YAAwC;QAFrD,WAAM,GAAN,MAAM,CAAe;QACX,kBAAa,GAAb,aAAa,CAAyB;QACnC,iBAAY,GAAZ,YAAY,CAA4B;QAEhG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;;;;;OAUG;IACc,yBAAyB,GAAG;QAC3C,kBAAkB,EAAE,IAAI;KAChB,CAAC;IAGX,KAAK,CAAC,mBAAmB,CAAC,MAAqC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC;QAEvB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;QAC1B,8DAA8D;QAC9D,uEAAuE;QACvE,iEAAiE;QACjE,sEAAsE;QACtE,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC;QAEtF,MAAM,OAAO,GAAG;YACd,GAAG,MAAM;YACT,GAAG,EAAE,UAAU,EAAE;YACjB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAClC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,kBAAkB,GAAG,EAAE;YAC5D,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,YAAY;YACjB,GAAG;YACH,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,8BAA8B,CAClC,MAAqC,EACrC,OAAwD;QAExD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;gBAChE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;gBAC5D,OAAO,EAAE,EAAE,OAAO,EAAE,qFAAqF,EAAE;aAC5G,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC;QACvG,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,MAAM,OAAO,GAAG;YACd,GAAG,MAAM;YACT,GAAG,EAAE,UAAU,EAAE;YACjB,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,OAAO,GAAG,EAAE;YACvB,GAAG,EAAE,MAAM;YACX,yFAAyF;YACzF,0EAA0E;YAC1E,GAAG,EAAE,OAAO,CAAC,QAAQ;YACrB,GAAG,EAAE,MAAM,CAAC,MAAM;YAClB,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC;QAEF,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,wBAAwB,CAC5B,MAA0C,EAC1C,OAAwD;QAExD,8EAA8E;QAC9E,0FAA0F;QAC1F,wFAAwF;QACxF,+FAA+F;QAC/F,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,0BAA0B,EAAE,IAAI,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAC7F,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC;QACvG,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,MAAM,OAAO,GAAG;YACd,GAAG,MAAM;YACT,GAAG,EAAE,UAAU,EAAE;YACjB,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,OAAO,GAAG,EAAE;YACvB,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,OAAO,CAAC,QAAQ;YACrB,GAAG,EAAE,MAAM,CAAC,QAAQ;YACpB,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC;QAEF,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,mBAAmB,CAAC,MAQzB;QACC,wFAAwF;QACxF,8FAA8F;QAC9F,4FAA4F;QAC5F,8FAA8F;QAC9F,mFAAmF;QACnF,kGAAkG;QAClG,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,0BAA0B,EAAE,CAAC;QAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,mBAAmB;gBACvE,OAAO,EAAE,EAAE,OAAO,EAAE,8IAA8I,EAAE;aACrK,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC;QACtG,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,wGAAwG;QACxG,4GAA4G;QAC5G,kGAAkG;QAClG,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,CACvC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,kCAAkC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAC3G,CAAC;QAEF,MAAM,OAAO,GAAG;YACd,GAAG,cAAc;YACjB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,GAAG,EAAE,MAAM,CAAC,QAAQ;YACpB,GAAG,EAAE,UAAU,EAAE;YACjB,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,OAAO,GAAG,EAAE;YACvB,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,MAAM,CAAC,QAAQ;YACpB,GAAG,EAAE,MAAM,CAAC,MAAM;SACnB,CAAC;QAEF,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,MAA0C,EAC1C,OAAuC;QAEvC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC;QACvB,wEAAwE;QACxE,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,0BAA0B,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC;QAE5F,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,0BAA0B,CAAC;QACpE,MAAM,UAAU,GAAG,OAAO,EAAE,gBAAgB,IAAI,iBAAiB,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;QAE1B,MAAM,OAAO,GAAG;YACd,GAAG,MAAM;YACT,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,UAAU,EAAE;YAC/B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAClC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU;YAC/C,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,eAAe;YACpB,GAAG;YACH,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,2CAA2C,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,UAAU,YAAY,CAAC,CAAC,CAAC,GAAG,0BAA0B,OAAO,EAAE,CAAC,CAAC;QACzJ,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,sBAAsB,CAAC,CAAC;QACrF,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,kFAAkF;IACjE,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE7D;;;;;;;;;;OAUG;IACI,uBAAuB,CAAC,YAAoB;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,GAAG,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAEjE,CAAC;QAEF,IAAI,SAAiB,CAAC;QACtB,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACrB,SAAS,GAAG,WAAW,GAAG,CAAC,GAAG,qBAAqB,GAAG,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC;QAC9E,CAAC;aAAM,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;YAC7B,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,mBAAmB;gBACvE,OAAO,EAAE,EAAE,OAAO,EAAE,+CAA+C,GAAG,CAAC,GAAG,EAAE,EAAE;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACvE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAC5C,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;OAOG;IACI,aAAa,CAAC,WAA6B,CAAC,cAAc,CAAC,sBAAsB,CAAC;QACvF,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAuC,CAAC;QAC7F,MAAM,OAAO,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,iBAAiB,IAAI,EAAE,CAA2F,CAAC;QAEtJ,MAAM,IAAI,GAAmC,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,MAAM,MAAM,GAAG,CAAC,GAAY,EAAQ,EAAE;YACpC,IAAI,CAAC,GAAG;gBAAE,OAAO;YACjB,MAAM,GAAG,GAAG,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO;YAC9B,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClB,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAA4B,CAAC;YACtF,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC;QAEF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5B,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC;gBAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAsB,cAAc,CAAC,sBAAsB;QAC9E,MAAM,UAAU,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;QAE/C,0BAA0B;QAC1B,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE;YAC1C,YAAY,EAAE,GAAG;YACjB,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;YACrE,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;YAClE,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC;YAC1D,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAElD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,mBAAmB;gBACvE,OAAO,EAAE;oBACP,OAAO,EAAE,mBAAmB,GAAG,qCAAqC;oBACpE,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;oBACrE,YAAY,EAAE,GAAG;iBAClB;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,mBAAmB;gBACvE,OAAO,EAAE;oBACP,OAAO,EAAE,kBAAkB,GAAG,6BAA6B;oBAC3D,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;oBAClE,YAAY,EAAE,GAAG;iBAClB;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,GAAG,UAAU;YACb,iFAAiF;YACjF,oFAAoF;YACpF,4CAA4C;YAC5C,KAAK,EAAE,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC;YAC9C,UAAU;YACV,SAAS;SACV,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAyB,cAAc,CAAC,sBAAsB;QACnF,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;QAE/C,MAAM,SAAS,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC;QAEpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,mBAAmB,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,kBAAkB,GAAG,6BAA6B,EAAE,EAAE,CAAC,CAAC;QAChO,CAAC;QAED,MAAM,gBAAgB,GAAG;YACvB,cAAc,CAAC,4BAA4B;YAC3C,cAAc,CAAC,0BAA0B;YACzC,cAAc,CAAC,mBAAmB;YAClC,cAAc,CAAC,sBAAsB;SACtC,CAAC,QAAQ,CAAC,GAAqB,CAAC,CAAC;QAElC,IAAI,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;QACjC,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QACtC,CAAC;QAED,OAAO;YACL,GAAG,YAAY;YACf,MAAM;YACN,SAAS;SACV,CAAC;IACJ,CAAC;IAGD;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,CAAC,OAAY,EAAE,MAAsB,cAAc,CAAC,sBAAsB;QAClF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAElD,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,WAAW,EAAE,GAAG,UAAU,CAAC;QAE7D,IAAI,CAAC,QAAQ,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;QAEzD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAC,OAAgB,EAAE,MAAsB,cAAc,CAAC,sBAAsB;QACjG,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,EAAE,UAAU,EAAE,GAAG,WAAW,EAAE,GAAG,UAAU,CAAC;QAClD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IAC5D,CAAC;IAGM,KAAK,CAAC,OAAO,CAAC,OAAY,EAAE,UAAkB,EAAE,WAA4B;QACjF,yEAAyE;QACzE,MAAM,gBAAgB,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;QAE5C,IAAI,OAAO,CAAC,GAAG,IAAI,gBAAgB,CAAC,SAAS,EAAE,CAAC;YAC9C,OAAO,gBAAgB,CAAC,SAAS,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,oEAAoE,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,IAAI,gBAAgB,CAAC,MAAM,EAAE,CAAC;YAC3C,OAAO,gBAAgB,CAAC,MAAM,CAAC;YAC/B,IAAI,CAAC,QAAQ,CAAC,iEAAiE,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,IAAI,gBAAgB,CAAC,QAAQ,EAAE,CAAC;YAC7C,OAAO,gBAAgB,CAAC,QAAQ,CAAC;YACjC,IAAI,CAAC,QAAQ,CAAC,mEAAmE,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC5C,OAAO,gBAAgB,CAAC,OAAO,CAAC;YAChC,IAAI,CAAC,QAAQ,CAAC,kEAAkE,CAAC,CAAC;QACpF,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,GAAiB,EAAE,KAAyB,EAAE,EAAE;gBAC/F,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,kBAAkB,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;oBAC/L,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC;qBAAM,IAAI,CAAC,KAAK,EAAE,CAAC;oBAClB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,kDAAkD,EAAE,EAAE,CAAC,CAAC;oBAC9O,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAC;oBAC/C,OAAO,CAAC,KAAK,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,MAAyB,cAAc,CAAC,sBAAsB;QACxF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,GAAG,YAAY,CAAC;QAErD,IAAI,CAAC,QAAQ,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;QAE3D,wBAAwB;QACxB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,eAAe,EAAE,CAAC;YACzB,0FAA0F;YAC1F,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC5G,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnD,MAAM,eAAe,CAAC;YACxB,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,SAAS,EAAE,CAAC;gBACd,8DAA8D;gBAC9D,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;gBACvH,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;oBAC5E,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;oBACtF,OAAO,OAAO,CAAC;gBACjB,CAAC;YACH,CAAC;YAED,qEAAqE;YACrE,IAAI,CAAC,QAAQ,CAAC,UAAU,cAAc,CAAC,MAAM,oCAAoC,GAAG,EAAE,CAAC,CAAC;YACxF,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;oBAC5E,IAAI,CAAC,QAAQ,CAAC,0DAA0D,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBACnF,OAAO,OAAO,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,+BAA+B;gBACjC,CAAC;YACH,CAAC;YAED,qEAAqE;YACrE,MAAM,eAAe,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gCAAgC,CACpC,KAAa,EACb,MAAyB,cAAc,CAAC,sBAAsB,EAC9D,OAA2F;QAE3F,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,GAAG,YAAY,CAAC;QACrD,2FAA2F;QAC3F,6FAA6F;QAC7F,gGAAgG;QAChG,+FAA+F;QAC/F,8FAA8F;QAC9F,yBAAyB;QACzB,IAAI,OAAO,EAAE,cAAc,EAAE,CAAC;YAC5B,OAAQ,aAAwC,CAAC,QAAQ,CAAC;QAC5D,CAAC;QACD,wGAAwG;QACxG,2GAA2G;QAC3G,gGAAgG;QAChG,qGAAqG;QACrG,sGAAsG;QACtG,IAAI,OAAO,EAAE,cAAc,KAAK,SAAS,EAAE,CAAC;YACzC,aAAqC,CAAC,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;QACzE,CAAC;QACD,wGAAwG;QACxG,yGAAyG;QACzG,2EAA2E;QAC3E,yGAAyG;QACzG,IAAI,OAAO,EAAE,gBAAgB,EAAE,CAAC;YAC7B,aAAgD,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC5E,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,mEAAmE,GAAG,EAAE,CAAC,CAAC;QAExF,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC/F,CAAC;QAAC,OAAO,eAAe,EAAE,CAAC;YACzB,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC5G,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnD,MAAM,eAAe,CAAC;YACxB,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;gBACvH,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;oBAC5G,IAAI,CAAC,QAAQ,CAAC,qDAAqD,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;oBAC9F,OAAO,OAAO,CAAC;gBACjB,CAAC;YACH,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,UAAU,cAAc,CAAC,MAAM,0CAA0C,GAAG,eAAe,CAAC,CAAC;YAC3G,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;oBAC5G,IAAI,CAAC,QAAQ,CAAC,kEAAkE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC3F,OAAO,OAAO,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,+BAA+B;gBACjC,CAAC;YACH,CAAC;YAED,MAAM,eAAe,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAa;QACpC,MAAM,GAAG,GAAG,cAAc,CAAC,sBAAsB,CAAC;QAClD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,GAAG,YAAY,CAAC;QACrD,MAAM,oBAAoB,GAAG,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QAE7E,IAAI,CAAC,QAAQ,CAAC,mDAAmD,CAAC,CAAC;QAEnE,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,eAAe,EAAE,CAAC;YACzB,oEAAoE;YACpE,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC5G,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnD,MAAM,eAAe,CAAC;YACxB,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;gBACvH,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;oBACnF,IAAI,CAAC,QAAQ,CAAC,uDAAuD,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;oBAChG,OAAO,OAAO,CAAC;gBACjB,CAAC;YACH,CAAC;YAED,iCAAiC;YACjC,IAAI,CAAC,QAAQ,CAAC,6CAA6C,cAAc,CAAC,MAAM,iBAAiB,CAAC,CAAC;YACnG,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;oBACnF,IAAI,CAAC,QAAQ,CAAC,yCAAyC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBAClE,OAAO,OAAO,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,WAAW;gBACb,CAAC;YACH,CAAC;YACD,MAAM,eAAe,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,iBAAqC;QAC3E,MAAM,GAAG,GAAG,cAAc,CAAC,sBAAsB,CAAC;QAClD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,GAAG,YAAY,CAAC;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,0BAA0B,EAAE,CAAC;QACpE,6FAA6F;QAC7F,mGAAmG;QACnG,0FAA0F;QAC1F,EAAE;QACF,qFAAqF;QACrF,gGAAgG;QAChG,+FAA+F;QAC/F,gGAAgG;QAChG,2FAA2F;QAC3F,MAAM,CAAC,qBAAqB,EAAE,GAAG,0BAA0B,CAAC,GAAG,iBAAiB,IAAI,EAAE,CAAC;QACvF,MAAM,QAAQ,GACZ,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,qBAAqB,EAAE,GAAG,0BAA0B,CAAC,CAAC;QAC7G,MAAM,oBAAoB,GAAsB,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAEpG,IAAI,CAAC,QAAQ,CAAC,8CAA8C,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE5E,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACtG,CAAC;QAAC,OAAO,eAAe,EAAE,CAAC;YACzB,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC5G,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnD,MAAM,eAAe,CAAC;YACxB,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;gBACvH,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,oBAAoB,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;oBACnH,IAAI,CAAC,QAAQ,CAAC,uDAAuD,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;oBAChG,OAAO,OAAO,CAAC;gBACjB,CAAC;YACH,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,UAAU,cAAc,CAAC,MAAM,gDAAgD,CAAC,CAAC;YAC/F,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,oBAAoB,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;oBACnH,IAAI,CAAC,QAAQ,CAAC,oEAAoE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC7F,OAAO,OAAO,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,+BAA+B;gBACjC,CAAC;YACH,CAAC;YAED,MAAM,eAAe,CAAC;QACxB,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,OAAgB,EAAE,KAAa,EAAE,MAAyB,cAAc,CAAC,sBAAsB;QACrH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,GAAG,YAAY,CAAC;QACrD,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IACtE,CAAC;IAEM,KAAK,CAAC,SAAS,CACpB,KAAa,EACb,SAAiB,EACjB,aAAgC,EAChC,cAGC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,GAA4B,EAAE,OAAY,EAAE,EAAE;gBACzF,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBAC9E,sBAAsB,EAAE,2BAA2B,CAAC,uBAAuB;wBAC3E,OAAO,EAAE;4BACP,wBAAwB;4BACxB,YAAY,EAAE,GAAG,CAAC,IAAI;4BACtB,eAAe,EAAE,GAAG,CAAC,OAAO;yBAC7B;wBACD,KAAK,EAAE,GAAG,CAAC,KAAK;wBAChB,kBAAkB,EAAE,cAAc,EAAE,kBAAkB;wBACtD,sBAAsB,EAAE,cAAc,EAAE,sBAAsB;qBAC/D,CAAC,CAAC;oBACH,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE;wBAC/C,aAAa,EAAE,OAAO,EAAE,GAAG;wBAC3B,eAAe,EAAE,OAAO,EAAE,GAAG;qBAC9B,CAAC,CAAC;oBACH,OAAO,CAAC,OAAO,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAGD;;;OAGG;IACI,KAAK,CAAC,WAAW,CAAC,OAAgB,EAAE,UAAkB,EAAE,WAA4B;QACzF,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,oDAAoD,EAAE,EAAE,CAAC,CAAC;QAC1O,CAAC;QACD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,CAAC,0CAA0C,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IAChF,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,aAAa,CAAC,OAAgB,EAAE,KAAa,EAAE,SAAiB,EAAE,aAAgC;QAC7G,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,oDAAoD,EAAE,EAAE,CAAC,CAAC;QAC1O,CAAC;QACD,MAAM,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ,CAAC,uDAAuD,CAAC,CAAC;QAEvE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QACtE,MAAM,YAAY,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,IAAK,OAA0B,CAAC,CAAC,CAAC,CAAC;QACxG,MAAM,OAAO,GAAG,YAAY,KAAK,iBAAiB,CAAC;QAEnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,6EAA6E,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,WAAW,CAAC,KAAa;QAC/B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,OAAO,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACI,uBAAuB,CAAC,KAAa;QAC1C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAA8B,CAAC;YAC/D,OAAO,OAAO,OAAO,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF,CAAA;AA7zBY,iBAAiB;IAD7B,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCAFI,aAAa;QACI,uBAAuB;QACrB,0BAA0B;GANvF,iBAAiB,CA6zB7B","sourcesContent":["import { inject, injectable } from 'inversify';\nimport jwt from 'jsonwebtoken';\nimport { AppConfigurationService} from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { JwtPrivateKeys, JwtPrivateKeySignOptions, VerifiableJwtKeys, JwtVerifyOptions } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport { Jwt_AppAuth_CreationParameter, JwtClaim_App_Auth, Jwt_RefreshToken_CreationParameter, Jwt_MachineToken_CreationParameter } from '~wildo-backend-lib/security/authentications/models/authentications.backend.schemas';\nimport {\n ErrorActionBackend,\n ErrorCustomMessageReference,\n ErrorType,\n ExecutionContext_ExecutionType,\n OIDC_RESERVED_ID_TOKEN_CLAIM_NAMES,\n} from '@wildo-ai/saas-models';\nimport stringify from 'safe-stable-stringify';\nimport { createHash, createPublicKey } from 'crypto';\nimport { randomUUID } from 'crypto';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\n\n\n/*\n A rotated public key self-retires when its optional `notAfter` instant has passed — so an operator can\n * schedule a compromised or aged prior key to STOP verifying (and drop out of the JWKS) WITHOUT a redeploy or a\n * manual config removal. Active = no `notAfter`, or a `notAfter` still in the future. Before this, a listed\n * rotated key verified indefinitely, bounded only by manual removal + the token's own `exp`. Applied at BOTH\n * the JWKS advertisement and every verify fallback so the two never disagree on which prior keys are live.\n /\nfunction isRotatedKeyActive(entry: { notAfter?: Date \| string }): boolean {\n if (!entry.notAfter) return true;\n return new Date(entry.notAfter).getTime() > Date.now();\n}\n\n@injectable()\nexport class JwtBackendService {\n protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private configService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private errorBuilder: ErrorBuilderBackendService\n ) {\n this.logDebug = this.logger.debugByType(\"JwtBackendService\");\n this.logger.setDebugTypeLogging(\"JwtBackendService\", false);\n }\n\n /\n Runtime-only verification options for renewable request/socket auth paths.\n \n These treat verification failures as routine control flow (the client\n * refreshes and retries), so they suppress the error's backend side-effect\n * actions (e.g. `ALERT`) while still preserving the rest of the backend error\n * contract. Logging is NO LONGER a construction-time action — it is owned by\n * the handling boundary (HTTP `expressErrorHandler`, websocket auth), which\n * classifies an expired token to `debug` on its own — so the boundary keeps\n * full control of the final human-facing severity without any per-call opt-out.\n /\n private readonly quietVerifyRuntimeOptions = {\n skipBackendActions: true,\n } as const;\n\n\n async createJwtForAppAuth(params: Jwt_AppAuth_CreationParameter): Promise<string> {\n const appSlug = this.configService.appSlug;\n const issuer = appSlug;\n\n const sub = params.userId;\n // F-24 (Slice 3.3): operator-authored TTL from `serviceAuth`,\n // overlaid by `app-configuration-loader.backend.service.ts`. The field\n // is required on the resolved `AppConfiguration_JWT_Schema` so a\n // missing value would fail at bootstrap, not silently downgrade here.\n const accessTokenMinutes = this.configService.config.jwt.accessTokenExpirationMinutes;\n\n const payload = {\n ...params,\n jti: randomUUID(),\n iat: Math.floor(Date.now() / 1000),\n exp: Math.floor(Date.now() / 1000) + accessTokenMinutes 60,\n iss: issuer,\n aud: \"AUTH_TOKEN\",\n sub,\n type: params.type,\n };\n\n const jwt = await this.sign(payload);\n return jwt;\n }\n\n /*\n Mint a USER-delegated access token for an EXTERNAL agent surface (A2A / MCP),\n * audience-bound per RFC 8707. Identical to {@link createJwtForAppAuth} EXCEPT it sets\n * `aud = options.audience` (the target A2A/MCP endpoint's canonical URI) instead of the\n * first-party `'AUTH_TOKEN'`. This is the load-bearing confinement (B-S2): the MAIN resource\n * API accepts only `aud='AUTH_TOKEN'` user tokens, so it REJECTS this token — a consented\n * third-party client can act for the user at the named agent endpoint ONLY, never as a full\n * first-party session. `azp` (the delegating `client_id`, required here) carries attribution.\n * Authority is roles-only: the user's roles are fetched at auth time — there is NO authz\n * `scope` on the token (identity `openid` may ride for identity only). Signed with the same\n * JWKS-advertised `APPLICATION_AUTH_TOKEN` key + `iss=appSlug` so the existing user-token\n * verify path accepts it. NO refresh token is issued for a delegated agent token.\n \n REVOCATION: a delegated token has no stored server-side handle, so there is no SELECTIVE\n * per-token revocation (RFC 7009 `/oauth/revoke` operates on refresh tokens, of which this has\n * none). It is invalidated (a) by its short capped TTL (see the caller's delegated-TTL cap), or\n * (b) globally, alongside the user's other tokens, when a credential change sets\n * `TOKEN_INVALID_BEFORE:<userId>` (the external verify arm enforces `iat <= invalidBefore` — the\n * same-second boundary is rejected fail-closed; see `evaluateUserTokenInvalidationFence`). A\n * dedicated per-consent revocation surface is a future extension.\n /\n async createJwtForDelegatedUserToken(\n params: Jwt_AppAuth_CreationParameter,\n options: { audience: string; expiresInMinutes?: number },\n ): Promise<string> {\n if (!params.azp) {\n throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {\n customMessageReference: ErrorCustomMessageReference.INTERNAL,\n context: { message: 'A delegated user token MUST carry `azp` (the delegating client_id) for attribution.' },\n });\n }\n const issuer = this.configService.appSlug;\n const minutes = options.expiresInMinutes ?? this.configService.config.jwt.accessTokenExpirationMinutes;\n const now = Math.floor(Date.now() / 1000);\n\n const payload = {\n ...params,\n jti: randomUUID(),\n iat: now,\n exp: now + minutes 60,\n iss: issuer,\n // RFC 8707 resource indicator = the agent endpoint. NOT 'AUTH_TOKEN' — the main resource\n // API rejects this, confining the delegated token to the A2A/MCP surface.\n aud: options.audience,\n sub: params.userId,\n type: params.type,\n };\n\n return this.sign(payload);\n }\n\n /*\n Sign an OAuth 2.0 client-credentials (machine-to-machine) access token. Distinct from\n * `createJwtForAppAuth`, which hardcodes `sub = userId` + `aud = \"AUTH_TOKEN\"`\n * (user-specific). Here `sub = clientId` and `aud` is the RFC 8707 resource\n * indicator (the canonical URI of the target resource server — the MCP endpoint,\n * A2A agent, or generic API the token is minted for). `signRaw` strips the per-key\n * default `aud`/`sub` because the payload carries its own, so the same\n * `APPLICATION_AUTH_TOKEN` ES256 key signs it. See D7 in the external-access plan.\n \n @param params - the machine claim (type = ORGANIZATION_MACHINE/APPLICATION_MACHINE, clientId/scopeId/roles)\n * @param options.audience - RFC 8707 resource indicator = the token's intended `aud`\n * @param options.expiresInMinutes - TTL override; defaults to the app access-token TTL (short-lived)\n /\n async createJwtForMachineToken(\n params: Jwt_MachineToken_CreationParameter,\n options: { audience: string; expiresInMinutes?: number },\n ): Promise<string> {\n // OIDC: `iss` MUST be the issuer URL (matching the discovery doc's `issuer` +\n // `jwks_uri`), not the app slug — so an external relying party validating a machine token\n // resolves the right JWKS. Falls back to the app slug pre-config / when the public base\n // URL is unresolvable. (Trunk amendment surfaced by the OIDC branch; machine-token path only.)\n const issuer = this.configService.resolveApiResourceAudience() ?? this.configService.appSlug;\n const minutes = options.expiresInMinutes ?? this.configService.config.jwt.accessTokenExpirationMinutes;\n const now = Math.floor(Date.now() / 1000);\n\n const payload = {\n ...params,\n jti: randomUUID(),\n iat: now,\n exp: now + minutes 60,\n iss: issuer,\n aud: options.audience,\n sub: params.clientId,\n type: params.type,\n };\n\n return this.sign(payload);\n }\n\n /*\n Sign an OIDC ID Token (OIDC Core §2) for the authorization_code flow. `sub` = the user id,\n * `aud` = the client id, `iss` = the issuer URL (matching the discovery doc + JWKS). Signed\n * with the same `APPLICATION_AUTH_TOKEN` ES256 key the JWKS advertises, so a relying party\n * verifies it by `kid`. `nonce`/`auth_time` are echoed when present; `extraClaims` carries\n * standard claims (email/name) when the granted scopes permit them.\n \n `sid` (revocation-C) is the End-User's OP session id, echoed when present. It is what the\n * RP-Initiated Logout endpoint (`/oauth/end-session`) reads from the `id_token_hint` to terminate\n * that exact session (`invalidateSession(sid)`) — so an RP logout reaches the Wildo login session\n * the delegation was authorized from, not every session of the user. Server-authored (reserved\n * against `extraClaims` smuggling); omitted for a token minted outside any login session.\n /\n async createJwtForIdToken(params: {\n userId: string;\n clientId: string;\n nonce?: string;\n authTime?: number;\n sid?: string;\n extraClaims?: Record<string, unknown>;\n expiresInMinutes?: number;\n }): Promise<string> {\n // Fail closed: an ID token's `iss` MUST be the resolvable issuer URL that the discovery\n // document and JWKS advertise — a relying party validates `iss` against discovery and fetches\n // the JWKS from it. Falling back to the (non-URL) app slug would mint an ID token no RP can\n // validate. So when the public base URL is unresolvable we REFUSE to mint (matching discovery\n // and the token endpoint, which both 503 on the same condition) rather than emit a\n // structurally-invalid token. (Machine tokens are guarded by the token endpoint's own pre-check.)\n const issuer = this.configService.resolveApiResourceAudience();\n if (!issuer) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.JWT_TOKEN_NOT_FOUND,\n context: { message: 'Cannot mint an OIDC ID token: the issuer (API resource audience) is unresolvable — set the app public base URL to the external https origin.' },\n });\n }\n const minutes = params.expiresInMinutes ?? this.configService.config.jwt.accessTokenExpirationMinutes;\n const now = Math.floor(Date.now() / 1000);\n\n // Defense-in-depth: keep ONLY genuine identity claims from `extraClaims`; every protocol/security claim\n // name is stripped (see {@link OIDC_RESERVED_ID_TOKEN_CLAIM_NAMES}) so the server-authored claims below are\n // the ONLY source of `iss`/`aud`/`sub`/`exp`/`nbf`/`nonce`/`acr`/… — no id_token claim smuggling.\n const identityClaims = Object.fromEntries(\n Object.entries(params.extraClaims ?? {}).filter(([name]) => !OIDC_RESERVED_ID_TOKEN_CLAIM_NAMES.has(name)),\n );\n\n const payload = {\n ...identityClaims,\n ...(params.nonce ? { nonce: params.nonce } : {}),\n ...(params.authTime ? { auth_time: params.authTime } : {}),\n ...(params.sid ? { sid: params.sid } : {}),\n azp: params.clientId,\n jti: randomUUID(),\n iat: now,\n exp: now + minutes 60,\n iss: issuer,\n aud: params.clientId,\n sub: params.userId,\n };\n\n return this.sign(payload);\n }\n\n async createRefreshToken(\n params: Jwt_RefreshToken_CreationParameter,\n options?: { expiresInSeconds?: number },\n ): Promise<string> {\n const appSlug = this.configService.appSlug;\n const issuer = appSlug;\n // F-24 (Slice 3.3): operator-authored TTL from `serviceAuth`. The field\n // is required on the resolved `AppConfiguration_JWT_Schema`; if it is\n // ever missing here that signals a misconfigured bootstrap and should\n // surface (NaN exp) rather than silently mint a default-lifetime token.\n const refreshTokenExpirationDays = this.configService.config.jwt.refreshTokenExpirationDays;\n\n const defaultExpSeconds = 60 * 60 * 24 * refreshTokenExpirationDays;\n const expSeconds = options?.expiresInSeconds ?? defaultExpSeconds;\n const sub = params.userId;\n\n const payload = {\n ...params,\n jti: params.jti \|\| randomUUID(),\n iat: Math.floor(Date.now() / 1000),\n exp: Math.floor(Date.now() / 1000) + expSeconds,\n iss: issuer,\n aud: \"REFRESH_TOKEN\",\n sub,\n type: params.type,\n };\n\n this.logDebug(`Creating refresh token with expiration: ${options?.expiresInSeconds ? `${expSeconds}s (custom)` : `${refreshTokenExpirationDays} days`}`);\n const refreshToken = await this.sign(payload, JwtPrivateKeys.APPLICATION_AUTH_TOKEN);\n return refreshToken;\n }\n\n /*\n Get JWT signing configuration (loads on first access)\n * Private keys are loaded from secrets, public keys from main config\n /\n /* Cache of RFC 7638 thumbprints keyed by public-key PEM (stable per process). /\n private readonly _kidByPublicKey = new Map<string, string>();\n\n /\n RFC 7638 JWK Thumbprint of a public key (PEM) — the stable, key-UNIQUE `kid` used in\n * signed JWT headers and (future) JWKS entries. Replaces the previous scheme where `kid`\n * was the `JwtPrivateKeys` enum NAME (fixed per key TYPE, not per key version) — which is\n * not rotation-unique and would advertise a wrong/ambiguous `kid` in a JWKS. Derived purely\n * from the public key material, so it needs NO config-schema or key-provisioner change and\n * moves with the key across rotation. Computed via the JWK canonical form (RFC 7638 §3:\n * required members only, lexicographic order, no whitespace) → SHA-256 → base64url. Cached.\n \n @param publicKeyPem EC P-256 (or RSA) public key in PEM. @returns the base64url thumbprint.\n /\n public computeKidFromPublicKey(publicKeyPem: string): string {\n const cached = this._kidByPublicKey.get(publicKeyPem);\n if (cached) return cached;\n\n const jwk = createPublicKey(publicKeyPem).export({ format: 'jwk' }) as {\n kty?: string; crv?: string; x?: string; y?: string; n?: string; e?: string;\n };\n\n let canonical: string;\n if (jwk.kty === 'EC') {\n canonical = `{\"crv\":\"${jwk.crv}\",\"kty\":\"EC\",\"x\":\"${jwk.x}\",\"y\":\"${jwk.y}\"}`;\n } else if (jwk.kty === 'RSA') {\n canonical = `{\"e\":\"${jwk.e}\",\"kty\":\"RSA\",\"n\":\"${jwk.n}\"}`;\n } else {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.JWT_TOKEN_NOT_FOUND,\n context: { message: `Cannot compute kid for unsupported JWK kty: ${jwk.kty}` },\n });\n }\n\n const kid = createHash('sha256').update(canonical).digest('base64url');\n this._kidByPublicKey.set(publicKeyPem, kid);\n return kid;\n }\n\n /\n Public JSON Web Key Set (RFC 7517) for the OIDC `jwks_uri`. By default exposes the\n * `APPLICATION_AUTH_TOKEN` key — the ES256 key that signs the auth + machine access tokens\n * external parties verify. Each JWK's `kid` is the RFC 7638 thumbprint (the SAME value\n * in every token header), so a relying party selects the right key by `kid`. Includes the\n * current key plus any `rotatedPublicKeys`, so tokens signed with a prior key still verify\n * during a rotation overlap. Private material never appears (public JWK only).\n /\n public getPublicJwks(keyTypes: JwtPrivateKeys[] = [JwtPrivateKeys.APPLICATION_AUTH_TOKEN]): { keys: Array<Record<string, unknown>> } {\n const jwtConfig = this.configService.jwtConfig;\n const publicKeys = (jwtConfig.config?.publicKey ?? {}) as Record<string, string \| undefined>;\n const rotated = (jwtConfig.config?.rotatedPublicKeys ?? {}) as Record<string, Array<{ kid: string; publicKey: string; notAfter?: Date }> \| undefined>;\n\n const keys: Array<Record<string, unknown>> = [];\n const seenKids = new Set<string>();\n const addPem = (pem?: string): void => {\n if (!pem) return;\n const kid = this.computeKidFromPublicKey(pem);\n if (seenKids.has(kid)) return;\n seenKids.add(kid);\n const jwk = createPublicKey(pem).export({ format: 'jwk' }) as Record<string, unknown>;\n keys.push({ ...jwk, kid, use: 'sig', alg: 'ES256' });\n };\n\n for (const keyType of keyTypes) {\n addPem(publicKeys[keyType]);\n for (const entry of (rotated[keyType] ?? []).filter(isRotatedKeyActive)) addPem(entry.publicKey);\n }\n return { keys };\n }\n\n async getSignOptions(key: JwtPrivateKeys = JwtPrivateKeys.APPLICATION_AUTH_TOKEN): Promise<jwt.SignOptions & { privateKey: string, publicKey: string }> {\n const signConfig = JwtPrivateKeySignOptions[key];\n const jwtConfig = this.configService.jwtConfig;\n\n // Debug JWT configuration\n this.logDebug('🔧 JWT Configuration Debug', {\n requestedKey: key,\n availablePrivateKeys: Object.keys(jwtConfig.secrets.privateKey \|\| {}),\n availablePublicKeys: Object.keys(jwtConfig.config.publicKey \|\| {}),\n hasPrivateKey: !!(jwtConfig.secrets.privateKey \|\| {})[key],\n hasPublicKey: !!(jwtConfig.config.publicKey \|\| {})[key]\n });\n\n const privateKey = jwtConfig.secrets.privateKey[key];\n const publicKey = jwtConfig.config.publicKey[key];\n\n if (!privateKey) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.JWT_TOKEN_NOT_FOUND,\n context: {\n message: `Private key for ${key} not found in secrets configuration`,\n availablePrivateKeys: Object.keys(jwtConfig.secrets.privateKey \|\| {}),\n requestedKey: key\n }\n });\n }\n\n if (!publicKey) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.JWT_TOKEN_NOT_FOUND,\n context: {\n message: `Public key for ${key} not found in configuration`,\n availablePublicKeys: Object.keys(jwtConfig.config.publicKey \|\| {}),\n requestedKey: key\n }\n });\n }\n\n return {\n ...signConfig,\n // Stable, key-unique RFC 7638 thumbprint kid (overrides the enum-name `keyid` in\n // `JwtPrivateKeySignOptions`). This is what a JWKS endpoint advertises and what the\n // verify path matches rotated keys against.\n keyid: this.computeKidFromPublicKey(publicKey),\n privateKey,\n publicKey\n };\n }\n\n async getVerifyOptions(key: VerifiableJwtKeys = JwtPrivateKeys.APPLICATION_AUTH_TOKEN): Promise<jwt.VerifyOptions & { publicKey: string }> {\n const verifyConfig = JwtVerifyOptions[key];\n const jwtConfig = this.configService.jwtConfig;\n\n const publicKey = (jwtConfig.config.publicKey)[key];\n\n if (!publicKey) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, { customMessageReference: ErrorCustomMessageReference.JWT_TOKEN_NOT_FOUND, context: { message: `Public key for ${key} not found in configuration` } });\n }\n\n const isApplicationKey = [\n JwtPrivateKeys.APPLICATION_PLATFORM_REQUEST,\n JwtPrivateKeys.APPLICATION_WORKER_REQUEST,\n JwtPrivateKeys.APPLICATION_WEBHOOK,\n JwtPrivateKeys.APPLICATION_AUTH_TOKEN,\n ].includes(key as JwtPrivateKeys);\n\n let issuer = verifyConfig.issuer;\n if (isApplicationKey) {\n issuer = this.configService.appSlug;\n }\n\n return {\n ...verifyConfig,\n issuer,\n publicKey\n };\n }\n\n\n /\n Sign a JWT token. Algorithm is fixed per key by `JwtPrivateKeySignOptions`\n * (ES256 / ECDSA P-256 today — see `JwtDefaultSignOptions`); the `serviceAuth` block does NOT\n * author algorithm \\u2014 see Slice 3.3 closeout.\n * @param payload - The payload to sign\n * @param key - The private key type to use for signing\n * @returns Promise resolving to JWT token string\n /\n async sign(payload: any, key: JwtPrivateKeys = JwtPrivateKeys.APPLICATION_AUTH_TOKEN): Promise<string> {\n const signConfig = await this.getSignOptions(key);\n\n const { privateKey, publicKey, ...signOptions } = signConfig;\n\n this.logDebug(`Signing JWT token with key type: ${key}`);\n\n return this.signRaw(payload, privateKey, signOptions);\n }\n\n public async signHash(payload: unknown, key: JwtPrivateKeys = JwtPrivateKeys.APPLICATION_AUTH_TOKEN): Promise<string> {\n const signConfig = await this.getSignOptions(key);\n const { privateKey, ...signOptions } = signConfig;\n return this.signHashRaw(payload, privateKey, signOptions);\n }\n\n\n public async signRaw(payload: any, privateKey: string, signOptions: jwt.SignOptions): Promise<string> {\n // Remove conflicting options if payload already has corresponding fields\n const cleanSignOptions = { ...signOptions };\n\n if (payload.exp && cleanSignOptions.expiresIn) {\n delete cleanSignOptions.expiresIn;\n this.logDebug('Removed expiresIn from sign options due to existing exp in payload');\n }\n\n if (payload.iss && cleanSignOptions.issuer) {\n delete cleanSignOptions.issuer;\n this.logDebug('Removed issuer from sign options due to existing iss in payload');\n }\n\n if (payload.aud && cleanSignOptions.audience) {\n delete cleanSignOptions.audience;\n this.logDebug('Removed audience from sign options due to existing aud in payload');\n }\n\n if (payload.sub && cleanSignOptions.subject) {\n delete cleanSignOptions.subject;\n this.logDebug('Removed subject from sign options due to existing sub in payload');\n }\n\n return new Promise((resolve, reject) => {\n jwt.sign(payload, privateKey, cleanSignOptions, (err: Error \| null, token: string \| undefined) => {\n if (err) {\n const error = this.errorBuilder.buildFromStandardError(err, undefined, { customMessageReference: ErrorCustomMessageReference.JWT_SIGNING_FAILED, context: { message: 'JWT signing failed' } });\n reject(error);\n } else if (!token) {\n const error = this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, { customMessageReference: ErrorCustomMessageReference.JWT_TOKEN_GENERATION_FAILED, context: { message: 'JWT token generation failed - token is undefined' } });\n reject(error);\n } else {\n this.logDebug('JWT token signed successfully');\n resolve(token);\n }\n });\n });\n }\n\n /\n Verify a JWT token. Algorithm is fixed per key by `JwtPrivateKeySignOptions`\n * (ES256 / ECDSA P-256 today — see `JwtDefaultSignOptions`); the `serviceAuth` block does NOT\n * author algorithm \\u2014 see Slice 3.3 closeout.\n \n L6: Supports key rotation. Tries the current key first. If verification fails,\n * tries each rotated public key for this key type before giving up.\n \n @param token - The JWT token to verify\n * @param key - The key type to use for verification\n * @returns Promise resolving to decoded token payload\n /\n async verify(token: string, key: VerifiableJwtKeys = JwtPrivateKeys.APPLICATION_AUTH_TOKEN): Promise<unknown> {\n const verifyConfig = await this.getVerifyOptions(key);\n const { publicKey, ...verifyOptions } = verifyConfig;\n\n this.logDebug(`Verifying JWT token with key type: ${key}`);\n\n // Try current key first\n try {\n return await this.verifyRaw(token, publicKey, verifyOptions);\n } catch (currentKeyError) {\n // L6: If current key fails, try rotated keys — match by kid from JWT header when possible\n const rotatedEntries = this.configService.config?.jwt?.rotatedPublicKeys?.[key]?.filter(isRotatedKeyActive);\n if (!rotatedEntries \|\| rotatedEntries.length === 0) {\n throw currentKeyError;\n }\n\n const headerKid = this._extractKid(token);\n if (headerKid) {\n // Direct kid match — avoids full verification attempt per key\n const match = rotatedEntries.find(e => this.computeKidFromPublicKey(e.publicKey) === headerKid \|\| e.kid === headerKid);\n if (match) {\n const decoded = await this.verifyRaw(token, match.publicKey, verifyOptions);\n this.logDebug('JWT verified with rotated key via kid match', { key, kid: headerKid });\n return decoded;\n }\n }\n\n // Fallback: sequential iteration (kid missing or no kid match found)\n this.logDebug(`Trying ${rotatedEntries.length} rotated key(s) sequentially for ${key}`);\n for (const entry of rotatedEntries) {\n try {\n const decoded = await this.verifyRaw(token, entry.publicKey, verifyOptions);\n this.logDebug('JWT verified with rotated key — consider rotating tokens', { key });\n return decoded;\n } catch {\n // Continue to next rotated key\n }\n }\n\n // All keys exhausted — throw the original error from the current key\n throw currentKeyError;\n }\n }\n\n /\n Verify a JWT without emitting the default backend LOG action on failure.\n * The caller becomes responsible for the final log wording/severity.\n /\n async verifyWithoutBackendErrorActions(\n token: string,\n key: VerifiableJwtKeys = JwtPrivateKeys.APPLICATION_AUTH_TOKEN,\n options?: { ignoreAudience?: boolean; ignoreExpiration?: boolean; issuerOverride?: string },\n ): Promise<unknown> {\n const verifyConfig = await this.getVerifyOptions(key);\n const { publicKey, ...verifyOptions } = verifyConfig;\n // The EXTERNAL user-delegated path (A2A / MCP) binds a token to an AGENT endpoint audience\n // (RFC 8707) rather than the first-party `aud='AUTH_TOKEN'`, so it verifies aud-AGNOSTICALLY\n // and then checks the agent audience EXPLICITLY against the serving endpoint. Every FIRST-PARTY\n // path keeps the audience gate — that gate is precisely what confines a delegated token OUT of\n // the main API / manual-controller / socket surfaces (B-S2 / R4). Never pass `ignoreAudience`\n // on a first-party path.\n if (options?.ignoreAudience) {\n delete (verifyOptions as { audience?: unknown }).audience;\n }\n // revocation-C: an OIDC id_token's `iss` is the PUBLIC issuer URL (`resolveApiResourceAudience()`), NOT\n // the `appSlug` that `getVerifyOptions` forces for the APPLICATION_AUTH_TOKEN key (correct for first-party\n // access/refresh tokens, whose `iss` IS the slug). The RP-Initiated Logout endpoint verifies an\n // `id_token_hint` against that public issuer instead — keeping the issuer check INSIDE `jwt.verify`,\n // atomic with the signature, rather than deferring it to a manual post-check the caller could forget.\n if (options?.issuerOverride !== undefined) {\n (verifyOptions as { issuer?: string }).issuer = options.issuerOverride;\n }\n // revocation-C: RP-Initiated Logout 1.0 §2 permits an EXPIRED `id_token_hint` (it is a HINT about which\n // session to end, not a live credential — the signature still proves WE minted it). Only the end_session\n // path passes this; every credential-bearing verify keeps expiry enforced.\n // spec-cite: OpenID Connect RP-Initiated Logout 1.0 §2 (`id_token_hint` — a previously issued ID Token).\n if (options?.ignoreExpiration) {\n (verifyOptions as { ignoreExpiration?: boolean }).ignoreExpiration = true;\n }\n\n this.logDebug(`Verifying JWT token without backend error actions for key type: ${key}`);\n\n try {\n return await this.verifyRaw(token, publicKey, verifyOptions, this.quietVerifyRuntimeOptions);\n } catch (currentKeyError) {\n const rotatedEntries = this.configService.config?.jwt?.rotatedPublicKeys?.[key]?.filter(isRotatedKeyActive);\n if (!rotatedEntries \|\| rotatedEntries.length === 0) {\n throw currentKeyError;\n }\n\n const headerKid = this._extractKid(token);\n if (headerKid) {\n const match = rotatedEntries.find(e => this.computeKidFromPublicKey(e.publicKey) === headerKid \|\| e.kid === headerKid);\n if (match) {\n const decoded = await this.verifyRaw(token, match.publicKey, verifyOptions, this.quietVerifyRuntimeOptions);\n this.logDebug('JWT verified with rotated key via kid match (quiet)', { key, kid: headerKid });\n return decoded;\n }\n }\n\n this.logDebug(`Trying ${rotatedEntries.length} rotated key(s) sequentially for quiet ${key} verification`);\n for (const entry of rotatedEntries) {\n try {\n const decoded = await this.verifyRaw(token, entry.publicKey, verifyOptions, this.quietVerifyRuntimeOptions);\n this.logDebug('JWT verified with rotated key (quiet) — consider rotating tokens', { key });\n return decoded;\n } catch {\n // Continue to next rotated key\n }\n }\n\n throw currentKeyError;\n }\n }\n\n /\n Verify a refresh token JWT.\n * Uses the same signing key as APPLICATION_AUTH_TOKEN but overrides the audience\n * to REFRESH_TOKEN (refresh tokens are signed with aud: 'REFRESH_TOKEN' while\n * access tokens use aud: 'AUTH_TOKEN').\n \n L6: Supports key rotation — tries rotated keys if the current key fails.\n /\n async verifyRefreshToken(token: string): Promise<unknown> {\n const key = JwtPrivateKeys.APPLICATION_AUTH_TOKEN;\n const verifyConfig = await this.getVerifyOptions(key);\n const { publicKey, ...verifyOptions } = verifyConfig;\n const refreshVerifyOptions = { ...verifyOptions, audience: 'REFRESH_TOKEN' };\n\n this.logDebug('Verifying refresh token (audience: REFRESH_TOKEN)');\n\n try {\n return await this.verifyRaw(token, publicKey, refreshVerifyOptions);\n } catch (currentKeyError) {\n // L6: Try rotated keys — match by kid from JWT header when possible\n const rotatedEntries = this.configService.config?.jwt?.rotatedPublicKeys?.[key]?.filter(isRotatedKeyActive);\n if (!rotatedEntries \|\| rotatedEntries.length === 0) {\n throw currentKeyError;\n }\n\n const headerKid = this._extractKid(token);\n if (headerKid) {\n const match = rotatedEntries.find(e => this.computeKidFromPublicKey(e.publicKey) === headerKid \|\| e.kid === headerKid);\n if (match) {\n const decoded = await this.verifyRaw(token, match.publicKey, refreshVerifyOptions);\n this.logDebug('Refresh token verified with rotated key via kid match', { key, kid: headerKid });\n return decoded;\n }\n }\n\n // Fallback: sequential iteration\n this.logDebug(`Refresh token: current key failed, trying ${rotatedEntries.length} rotated key(s)`);\n for (const entry of rotatedEntries) {\n try {\n const decoded = await this.verifyRaw(token, entry.publicKey, refreshVerifyOptions);\n this.logDebug('Refresh token verified with rotated key', { key });\n return decoded;\n } catch {\n // Continue\n }\n }\n throw currentKeyError;\n }\n }\n\n /\n Verify an OAuth 2.0 client-credentials (machine-to-machine) access token.\n \n Distinct from the user access-token verify (`verify` / `verifyWithoutBackendErrorActions`),\n * whose `APPLICATION_AUTH_TOKEN` options enforce `issuer = appSlug` + `audience = 'AUTH_TOKEN'`.\n * A machine token is RFC-8707 audience-bound: `createJwtForMachineToken` mints it with\n * `iss = resolveApiResourceAudience()` (the stable app issuer) and `aud = <resource>` — the\n * generic API audience by default, OR a per-endpoint resource-server audience (MCP / A2A) when the\n * client named that `resource` at the token endpoint. Verifying with the user options would reject\n * EVERY machine token on the `aud`/`iss` check, so this method overrides `issuer` to the app issuer\n * and `audience` to the expected audience(s).\n \n `expectedAudiences` — the audience(s) this caller accepts (RFC 8707). Omitted (the default, used\n * by the main-API choke point) ⇒ the generic API audience only, so a per-endpoint MCP/A2A token\n * stays confined OUT of the main API. An external resource server (MCP / A2A) passes\n * `[<its own endpoint audience>]` — STRICT since the 2026-07-29 flip: it accepts ONLY a token minted\n * for its own surface and rejects a generic API-audience token (an API token and an agent token never\n * cross). `aud` must match one of the provided audiences. Signature + `exp` + ES256 pinning are\n * always enforced (shared with the user path).\n \n Quiet (`skipBackendActions`) like `verifyWithoutBackendErrorActions`: the request-auth choke point\n * classifies expired-vs-invalid and owns the final log severity.\n \n Fail-closed on unresolvable audience: when the resolved audience list is empty (public base URL\n * lost AND no explicit override), `audience`/`issuer` are left unset (jsonwebtoken skips those\n * checks) and the caller's own audience guard rejects the request — so a machine token is never\n * accepted without a validated audience, and signature + `exp` are still enforced here regardless.\n \n Supports key rotation identically to the sibling verify methods (current key, then kid-matched /\n * sequential rotated keys).\n /\n async verifyMachineToken(token: string, expectedAudiences?: readonly string[]): Promise<unknown> {\n const key = JwtPrivateKeys.APPLICATION_AUTH_TOKEN;\n const verifyConfig = await this.getVerifyOptions(key);\n const { publicKey, ...verifyOptions } = verifyConfig;\n const apiAudience = this.configService.resolveApiResourceAudience();\n // `iss` is ALWAYS the app issuer (the API resource audience). `aud` is the caller's accepted\n // audience(s): the explicit `expectedAudiences` when given (per-endpoint MCP/A2A opt-in), else the\n // generic API audience (the default the main-API choke point relies on to stay confined).\n //\n // `jwt.VerifyOptions['audience']` types the multi-audience form as a NON-EMPTY tuple\n // (`[string \| RegExp, ...(string \| RegExp)[]]`), not `string[]` — an empty array would silently\n // mean \"accept no audience\" while still engaging jsonwebtoken's `aud` check. Destructuring the\n // head proves non-emptiness to the type system and keeps the empty-list case on the fail-closed\n // branch documented above (audience left unset ⇒ the caller's own audience guard rejects).\n const [firstExpectedAudience, ...remainingExpectedAudiences] = expectedAudiences ?? [];\n const audience: jwt.VerifyOptions['audience'] =\n firstExpectedAudience === undefined ? apiAudience : [firstExpectedAudience, ...remainingExpectedAudiences];\n const machineVerifyOptions: jwt.VerifyOptions = { ...verifyOptions, audience, issuer: apiAudience };\n\n this.logDebug('Verifying machine (client-credentials) token', { audience });\n\n try {\n return await this.verifyRaw(token, publicKey, machineVerifyOptions, this.quietVerifyRuntimeOptions);\n } catch (currentKeyError) {\n const rotatedEntries = this.configService.config?.jwt?.rotatedPublicKeys?.[key]?.filter(isRotatedKeyActive);\n if (!rotatedEntries \|\| rotatedEntries.length === 0) {\n throw currentKeyError;\n }\n\n const headerKid = this._extractKid(token);\n if (headerKid) {\n const match = rotatedEntries.find(e => this.computeKidFromPublicKey(e.publicKey) === headerKid \|\| e.kid === headerKid);\n if (match) {\n const decoded = await this.verifyRaw(token, match.publicKey, machineVerifyOptions, this.quietVerifyRuntimeOptions);\n this.logDebug('machine token verified with rotated key via kid match', { key, kid: headerKid });\n return decoded;\n }\n }\n\n this.logDebug(`Trying ${rotatedEntries.length} rotated key(s) sequentially for machine token`);\n for (const entry of rotatedEntries) {\n try {\n const decoded = await this.verifyRaw(token, entry.publicKey, machineVerifyOptions, this.quietVerifyRuntimeOptions);\n this.logDebug('machine token verified with rotated key — consider rotating tokens', { key });\n return decoded;\n } catch {\n // Continue to next rotated key\n }\n }\n\n throw currentKeyError;\n }\n }\n\n public async verifyHash(payload: unknown, token: string, key: VerifiableJwtKeys = JwtPrivateKeys.APPLICATION_AUTH_TOKEN): Promise<boolean> {\n const verifyConfig = await this.getVerifyOptions(key);\n const { publicKey, ...verifyOptions } = verifyConfig;\n return this.verifyHashRaw(payload, token, publicKey, verifyOptions);\n }\n\n public async verifyRaw(\n token: string,\n publicKey: string,\n verifyOptions: jwt.VerifyOptions,\n runtimeOptions?: {\n skipBackendActions?: boolean;\n skipBackendActionTypes?: readonly ErrorActionBackend[];\n },\n ): Promise<unknown> {\n return new Promise((resolve, reject) => {\n jwt.verify(token, publicKey, verifyOptions, (err: jwt.VerifyErrors \| null, decoded: any) => {\n if (err) {\n const error = this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.JWT_VERIFICATION_FAILED,\n context: {\n // diagnostic (log-only)\n jwtErrorName: err.name,\n jwtErrorMessage: err.message,\n },\n stack: err.stack,\n skipBackendActions: runtimeOptions?.skipBackendActions,\n skipBackendActionTypes: runtimeOptions?.skipBackendActionTypes,\n });\n reject(error);\n } else {\n this.logDebug('JWT token verified successfully', {\n decodedIssuer: decoded?.iss,\n decodedAudience: decoded?.aud,\n });\n resolve(decoded);\n }\n });\n });\n }\n\n\n /\n Deterministically stringify the payload and sign the SHA-256 hash as a JWT payload.\n * Payload used for signing has the shape: { h: <sha256_hex>, alg: 'sha256' }\n /\n public async signHashRaw(payload: unknown, privateKey: string, signOptions: jwt.SignOptions): Promise<string> {\n const normalized = stringify(payload);\n if (!normalized) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, { customMessageReference: ErrorCustomMessageReference.JWT_TOKEN_GENERATION_FAILED, context: { message: 'JWT token generation failed - payload is undefined' } });\n }\n const sha256Hex = createHash('sha256').update(normalized).digest('hex');\n this.logDebug('Signing SHA-256 hash of provided payload');\n return this.signRaw({ h: sha256Hex, alg: 'sha256' }, privateKey, signOptions);\n }\n\n /\n Verify that the provided token is a valid signature of the SHA-256 hash of the payload.\n * Returns true only if the token verifies and the embedded hash matches the freshly computed hash.\n /\n public async verifyHashRaw(payload: unknown, token: string, publicKey: string, verifyOptions: jwt.VerifyOptions): Promise<boolean> {\n const normalized = stringify(payload);\n if (!normalized) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, { customMessageReference: ErrorCustomMessageReference.JWT_TOKEN_GENERATION_FAILED, context: { message: 'JWT token generation failed - payload is undefined' } });\n }\n const expectedSha256Hex = createHash('sha256').update(normalized).digest('hex');\n this.logDebug('Verifying SHA-256 hash signature for provided payload');\n\n const decoded = await this.verifyRaw(token, publicKey, verifyOptions);\n const receivedHash = typeof decoded === 'string' ? decoded : (decoded && (decoded as jwt.JwtPayload).h);\n const matches = receivedHash === expectedSha256Hex;\n\n if (!matches) {\n this.logger.warn?.('Hash mismatch during verifyHashRaw: token hash does not match computed hash');\n }\n return matches;\n }\n\n /\n L6: Extract `kid` (Key ID) from a JWT's header without verifying the token.\n * Returns undefined if the header cannot be decoded or has no kid.\n /\n private _extractKid(token: string): string \| undefined {\n try {\n const decoded = jwt.decode(token, { complete: true });\n return decoded?.header?.kid;\n } catch {\n return undefined;\n }\n }\n\n /\n Peek the `type` claim of a bearer token WITHOUT verifying its signature.\n \n Used ONLY to route the token to the correct verify options — the user access-token verify\n * (`audience:'AUTH_TOKEN'`) vs the machine-token verify ({@link verifyMachineToken},\n * `audience = resolveApiResourceAudience()`) — because the two token families carry different\n * `aud`/`iss` and a single verify cannot satisfy both. The value is UNTRUSTED: the selected verify\n * still fully checks the signature, so a forged/attacker-set `type` cannot bypass authentication\n * (worst case it selects the wrong audience and the signature/audience check rejects the token).\n * Returns `undefined` for a malformed/undecodable token → the caller falls back to the user verify,\n * which then rejects it fail-closed.\n */\n public peekUnverifiedClaimType(token: string): string \| undefined {\n try {\n const decoded = jwt.decode(token) as { type?: unknown } \| null;\n return typeof decoded?.type === 'string' ? decoded.type : undefined;\n } catch {\n return undefined;\n }\n }\n}\n\n"]}

package/dist/esm/security/oauth-clients/oauth-client-generation.backend.utils.d.ts CHANGED Viewed

@@ -55,4 +55,30 @@ export interface GeneratedOAuthClientSecretMaterial {
  * `plainSecret` exactly once.
  */
 export declare function generateOAuthClientSecretMaterial(scope: ApiKeyScope): GeneratedOAuthClientSecretMaterial;
+/**
+ * Hash a presented registration access token into its persisted lookup representation.
+ *
+ * Deterministic SHA-256, for the same reason as the client secret: the configuration endpoint
+ * resolves a presented Bearer token by re-hashing and matching an indexed column, and the plaintext
+ * is 32 random bytes rather than a password. Any change here must be mirrored wherever a presented
+ * token is looked up, or every issued token stops authenticating.
+ */
+export declare function hashRegistrationAccessToken(plainToken: string): string;
+export interface GeneratedRegistrationAccessTokenMaterial {
+    /** Full token — returned to the client once, at registration, and never persisted. */
+    plainToken: string;
+    /** First 8 chars — persisted so an operator can identify the token without seeing it. */
+    registrationAccessTokenPrefix: string;
+    /** `sha256(plainToken)` — the only persisted representation. */
+    registrationAccessTokenHash: string;
+}
+/**
+ * Mint a registration access token for a dynamically registered client.
+ *
+ * The caller persists the two derived fields and returns `plainToken` exactly once, in the RFC 7591
+ * registration response. There is no way to recover it afterwards — which is why RFC 7592 §5 says it
+ * "SHOULD NOT expire while a client is still actively registered": a client that loses it has lost
+ * the ability to manage its own registration, permanently.
+ */
+export declare function generateRegistrationAccessTokenMaterial(): GeneratedRegistrationAccessTokenMaterial;
 //# sourceMappingURL=oauth-client-generation.backend.utils.d.ts.map

package/dist/esm/security/oauth-clients/oauth-client-generation.backend.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-client-generation.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-client-generation.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAkBpD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,MAAM,WAAW,kCAAkC;IACjD,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,WAAW,GAAG,kCAAkC,CAQxG"}
1	+ {"version":3,"file":"oauth-client-generation.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-client-generation.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAkBpD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,MAAM,WAAW,kCAAkC;IACjD,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,WAAW,GAAG,kCAAkC,CAQxG;AAsBD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED,MAAM,WAAW,wCAAwC;IACvD,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,6BAA6B,EAAE,MAAM,CAAC;IACtC,gEAAgE;IAChE,2BAA2B,EAAE,MAAM,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,uCAAuC,IAAI,wCAAwC,CAOlG"}

package/dist/esm/security/oauth-clients/oauth-client-generation.backend.utils.js CHANGED Viewed

@@ -71,4 +71,47 @@ export function generateOAuthClientSecretMaterial(scope) {
         hashedSecret: hashOAuthClientSecret(plainSecret),
     };
 }
+/* ─────────────────────────────────────────────────────────────────────────────
+ * Registration access token (RFC 7592)
+ * ────────────────────────────────────────────────────────────────────────── */
+/** Exact length of the persisted `registrationAccessTokenPrefix` display field (schema: `.length(8)`). */
+const REGISTRATION_ACCESS_TOKEN_PREFIX_LENGTH = 8;
+/** Plaintext entropy: 32 random bytes → 64 hex chars, matching the client secret. */
+const REGISTRATION_ACCESS_TOKEN_RANDOM_BYTES = 32;
+/**
+ * Its own prefix, distinct from `oc_app_` / `oc_org_`.
+ *
+ * The request-auth choke point routes a presented credential by prefix, and this token must NEVER
+ * resolve to a machine principal: it authenticates a caller's standing to administer ONE client's
+ * registration, not the client itself. A shared prefix would make that distinction depend on which
+ * lookup happened to run first.
+ */
+const REGISTRATION_ACCESS_TOKEN_PREFIX = 'rat_';
+/**
+ * Hash a presented registration access token into its persisted lookup representation.
+ *
+ * Deterministic SHA-256, for the same reason as the client secret: the configuration endpoint
+ * resolves a presented Bearer token by re-hashing and matching an indexed column, and the plaintext
+ * is 32 random bytes rather than a password. Any change here must be mirrored wherever a presented
+ * token is looked up, or every issued token stops authenticating.
+ */
+export function hashRegistrationAccessToken(plainToken) {
+    return crypto.createHash('sha256').update(plainToken).digest('hex');
+}
+/**
+ * Mint a registration access token for a dynamically registered client.
+ *
+ * The caller persists the two derived fields and returns `plainToken` exactly once, in the RFC 7591
+ * registration response. There is no way to recover it afterwards — which is why RFC 7592 §5 says it
+ * "SHOULD NOT expire while a client is still actively registered": a client that loses it has lost
+ * the ability to manage its own registration, permanently.
+ */
+export function generateRegistrationAccessTokenMaterial() {
+    const plainToken = `${REGISTRATION_ACCESS_TOKEN_PREFIX}${crypto.randomBytes(REGISTRATION_ACCESS_TOKEN_RANDOM_BYTES).toString('hex')}`;
+    return {
+        plainToken,
+        registrationAccessTokenPrefix: plainToken.slice(0, REGISTRATION_ACCESS_TOKEN_PREFIX_LENGTH),
+        registrationAccessTokenHash: hashRegistrationAccessToken(plainToken),
+    };
+}
 //# sourceMappingURL=oauth-client-generation.backend.utils.js.map

package/dist/esm/security/oauth-clients/oauth-client-generation.backend.utils.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-client-generation.backend.utils.js","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-client-generation.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,yFAAyF;AACzF,MAAM,iCAAiC,GAAG,CAAC,CAAC;AAE5C,sFAAsF;AACtF,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAE5C;;;;GAIG;AACH,MAAM,2BAA2B,GAAgC;IAC/D,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,SAAS;IACrC,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,SAAS;CACrC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,iCAAiC,CAAC,KAAkB;IAClE,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,GAAG,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,gCAAgC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACvG,OAAO;QACL,WAAW;QACX,YAAY,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,iCAAiC,CAAC;QACrE,YAAY,EAAE,qBAAqB,CAAC,WAAW,CAAC;KACjD,CAAC;AACJ,CAAC","sourcesContent":["/*\n OAuth Client Secret Generation & Hashing Utilities\n \n Server-side generation of the secret material for the `organizationOAuthClients`\n * and `applicationOAuthClients` resources. FAITHFUL MIRROR of\n * `api-key-generation.backend.utils.ts` — an OAuth client secret has three parts,\n * two persisted and one ephemeral:\n \n - `plainSecret` — the full secret, shown to the caller EXACTLY ONCE at creation\n * (surfaced through the CREATE operation's `plainSecret` ephemeral\n * response field) and NEVER persisted. Format\n * `oc_org_<hex>` / `oc_app_<hex>`. The `oc_` prefix (distinct from\n * the api-key `sk_` prefix) is DELIBERATE: the request-auth choke\n * point routes a presented secret to a DISTINCT principal\n * (an OAuth client vs an api-key credential — both resolve to the same machine principal) by\n * this prefix.\n * - `hashedSecret` — `sha256(plainSecret)` (hex). The ONLY representation persisted,\n * and the indexed unique column (`.isUnique().isDBIndexed()`) the\n * client-credentials token exchange resolves a presented secret\n * against (re-hash, then equality-match) in O(1). A deterministic\n * hash — not bcrypt — is REQUIRED for an indexed equality lookup;\n * it is safe here because the secret is high-entropy (32 random\n * bytes), so the offline fast-hash brute-force risk that motivates\n * bcrypt for low-entropy passwords does not apply.\n * - `secretPrefix` — the first 8 characters of `plainSecret`, persisted and shown in\n * lists (`.isSummaryField()`) so an admin can identify a client\n * without revealing the secret.\n \n SHA-256 here matches the framework's established token-hashing scheme (api-keys,\n * SCIM token generation).\n /\n\nimport crypto from 'node:crypto';\nimport { ApiKeyScope } from '@wildo-ai/saas-models';\n\n/* Exact length of the persisted `secretPrefix` display field (schema: `.length(8)`). /\nconst OAUTH_CLIENT_SECRET_PREFIX_LENGTH = 8;\n\n/* Plaintext entropy: 32 random bytes → 64 hex chars (matches api-key generation). /\nconst OAUTH_CLIENT_SECRET_RANDOM_BYTES = 32;\n\n/\n Human-routable scope prefix the request-auth choke point keys off (`startsWith`).\n * Distinct from the api-key `sk_org_`/`sk_app_` prefixes so a presented secret routes\n * to the correct principal kind.\n /\nconst OAUTH_CLIENT_SCOPE_PREFIXES: Record<ApiKeyScope, string> = {\n [ApiKeyScope.ORGANIZATION]: 'oc_org_',\n [ApiKeyScope.APPLICATION]: 'oc_app_',\n};\n\n/\n Hash a plaintext OAuth client secret into its persisted, indexed lookup\n * representation.\n \n Deterministic (SHA-256 hex) so the client-credentials token exchange can resolve a\n * presented secret by re-hashing it and matching the unique `hashedSecret` column.\n * Any future change here MUST be mirrored in whatever the auth path uses to look up a\n * presented secret, or previously-issued secrets stop authenticating.\n /\nexport function hashOAuthClientSecret(plainSecret: string): string {\n return crypto.createHash('sha256').update(plainSecret).digest('hex');\n}\n\nexport interface GeneratedOAuthClientSecretMaterial {\n /* Full secret — surfaced to the caller once, never persisted. /\n plainSecret: string;\n /* First 8 chars of `plainSecret` — persisted + shown for identification. /\n secretPrefix: string;\n /* `sha256(plainSecret)` — the only persisted / indexed representation. /\n hashedSecret: string;\n}\n\n/\n Generate fresh OAuth client secret material for the given scope. Returns the\n * one-time plaintext alongside the two persisted fields (`secretPrefix`,\n * `hashedSecret`). The caller persists `secretPrefix` + `hashedSecret` and surfaces\n * `plainSecret` exactly once.\n */\nexport function generateOAuthClientSecretMaterial(scope: ApiKeyScope): GeneratedOAuthClientSecretMaterial {\n const prefix = OAUTH_CLIENT_SCOPE_PREFIXES[scope];\n const plainSecret = `${prefix}${crypto.randomBytes(OAUTH_CLIENT_SECRET_RANDOM_BYTES).toString('hex')}`;\n return {\n plainSecret,\n secretPrefix: plainSecret.slice(0, OAUTH_CLIENT_SECRET_PREFIX_LENGTH),\n hashedSecret: hashOAuthClientSecret(plainSecret),\n };\n}\n"]}
1	+ {"version":3,"file":"oauth-client-generation.backend.utils.js","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-client-generation.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,yFAAyF;AACzF,MAAM,iCAAiC,GAAG,CAAC,CAAC;AAE5C,sFAAsF;AACtF,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAE5C;;;;GAIG;AACH,MAAM,2BAA2B,GAAgC;IAC/D,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,SAAS;IACrC,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,SAAS;CACrC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,iCAAiC,CAAC,KAAkB;IAClE,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,GAAG,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,gCAAgC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACvG,OAAO;QACL,WAAW;QACX,YAAY,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,iCAAiC,CAAC;QACrE,YAAY,EAAE,qBAAqB,CAAC,WAAW,CAAC;KACjD,CAAC;AACJ,CAAC;AAED;;gFAEgF;AAEhF,0GAA0G;AAC1G,MAAM,uCAAuC,GAAG,CAAC,CAAC;AAElD,qFAAqF;AACrF,MAAM,sCAAsC,GAAG,EAAE,CAAC;AAElD;;;;;;;GAOG;AACH,MAAM,gCAAgC,GAAG,MAAM,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAAkB;IAC5D,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAWD;;;;;;;GAOG;AACH,MAAM,UAAU,uCAAuC;IACrD,MAAM,UAAU,GAAG,GAAG,gCAAgC,GAAG,MAAM,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACtI,OAAO;QACL,UAAU;QACV,6BAA6B,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,uCAAuC,CAAC;QAC3F,2BAA2B,EAAE,2BAA2B,CAAC,UAAU,CAAC;KACrE,CAAC;AACJ,CAAC","sourcesContent":["/*\n OAuth Client Secret Generation & Hashing Utilities\n \n Server-side generation of the secret material for the `organizationOAuthClients`\n * and `applicationOAuthClients` resources. FAITHFUL MIRROR of\n * `api-key-generation.backend.utils.ts` — an OAuth client secret has three parts,\n * two persisted and one ephemeral:\n \n - `plainSecret` — the full secret, shown to the caller EXACTLY ONCE at creation\n * (surfaced through the CREATE operation's `plainSecret` ephemeral\n * response field) and NEVER persisted. Format\n * `oc_org_<hex>` / `oc_app_<hex>`. The `oc_` prefix (distinct from\n * the api-key `sk_` prefix) is DELIBERATE: the request-auth choke\n * point routes a presented secret to a DISTINCT principal\n * (an OAuth client vs an api-key credential — both resolve to the same machine principal) by\n * this prefix.\n * - `hashedSecret` — `sha256(plainSecret)` (hex). The ONLY representation persisted,\n * and the indexed unique column (`.isUnique().isDBIndexed()`) the\n * client-credentials token exchange resolves a presented secret\n * against (re-hash, then equality-match) in O(1). A deterministic\n * hash — not bcrypt — is REQUIRED for an indexed equality lookup;\n * it is safe here because the secret is high-entropy (32 random\n * bytes), so the offline fast-hash brute-force risk that motivates\n * bcrypt for low-entropy passwords does not apply.\n * - `secretPrefix` — the first 8 characters of `plainSecret`, persisted and shown in\n * lists (`.isSummaryField()`) so an admin can identify a client\n * without revealing the secret.\n \n SHA-256 here matches the framework's established token-hashing scheme (api-keys,\n * SCIM token generation).\n /\n\nimport crypto from 'node:crypto';\nimport { ApiKeyScope } from '@wildo-ai/saas-models';\n\n/* Exact length of the persisted `secretPrefix` display field (schema: `.length(8)`). /\nconst OAUTH_CLIENT_SECRET_PREFIX_LENGTH = 8;\n\n/* Plaintext entropy: 32 random bytes → 64 hex chars (matches api-key generation). /\nconst OAUTH_CLIENT_SECRET_RANDOM_BYTES = 32;\n\n/\n Human-routable scope prefix the request-auth choke point keys off (`startsWith`).\n * Distinct from the api-key `sk_org_`/`sk_app_` prefixes so a presented secret routes\n * to the correct principal kind.\n /\nconst OAUTH_CLIENT_SCOPE_PREFIXES: Record<ApiKeyScope, string> = {\n [ApiKeyScope.ORGANIZATION]: 'oc_org_',\n [ApiKeyScope.APPLICATION]: 'oc_app_',\n};\n\n/\n Hash a plaintext OAuth client secret into its persisted, indexed lookup\n * representation.\n \n Deterministic (SHA-256 hex) so the client-credentials token exchange can resolve a\n * presented secret by re-hashing it and matching the unique `hashedSecret` column.\n * Any future change here MUST be mirrored in whatever the auth path uses to look up a\n * presented secret, or previously-issued secrets stop authenticating.\n /\nexport function hashOAuthClientSecret(plainSecret: string): string {\n return crypto.createHash('sha256').update(plainSecret).digest('hex');\n}\n\nexport interface GeneratedOAuthClientSecretMaterial {\n /* Full secret — surfaced to the caller once, never persisted. /\n plainSecret: string;\n /* First 8 chars of `plainSecret` — persisted + shown for identification. /\n secretPrefix: string;\n /* `sha256(plainSecret)` — the only persisted / indexed representation. /\n hashedSecret: string;\n}\n\n/\n Generate fresh OAuth client secret material for the given scope. Returns the\n * one-time plaintext alongside the two persisted fields (`secretPrefix`,\n * `hashedSecret`). The caller persists `secretPrefix` + `hashedSecret` and surfaces\n * `plainSecret` exactly once.\n /\nexport function generateOAuthClientSecretMaterial(scope: ApiKeyScope): GeneratedOAuthClientSecretMaterial {\n const prefix = OAUTH_CLIENT_SCOPE_PREFIXES[scope];\n const plainSecret = `${prefix}${crypto.randomBytes(OAUTH_CLIENT_SECRET_RANDOM_BYTES).toString('hex')}`;\n return {\n plainSecret,\n secretPrefix: plainSecret.slice(0, OAUTH_CLIENT_SECRET_PREFIX_LENGTH),\n hashedSecret: hashOAuthClientSecret(plainSecret),\n };\n}\n\n/ ─────────────────────────────────────────────────────────────────────────────\n * Registration access token (RFC 7592)\n * ────────────────────────────────────────────────────────────────────────── /\n\n/* Exact length of the persisted `registrationAccessTokenPrefix` display field (schema: `.length(8)`). /\nconst REGISTRATION_ACCESS_TOKEN_PREFIX_LENGTH = 8;\n\n/* Plaintext entropy: 32 random bytes → 64 hex chars, matching the client secret. /\nconst REGISTRATION_ACCESS_TOKEN_RANDOM_BYTES = 32;\n\n/\n Its own prefix, distinct from `oc_app_` / `oc_org_`.\n \n The request-auth choke point routes a presented credential by prefix, and this token must NEVER\n * resolve to a machine principal: it authenticates a caller's standing to administer ONE client's\n * registration, not the client itself. A shared prefix would make that distinction depend on which\n * lookup happened to run first.\n /\nconst REGISTRATION_ACCESS_TOKEN_PREFIX = 'rat_';\n\n/\n Hash a presented registration access token into its persisted lookup representation.\n \n Deterministic SHA-256, for the same reason as the client secret: the configuration endpoint\n * resolves a presented Bearer token by re-hashing and matching an indexed column, and the plaintext\n * is 32 random bytes rather than a password. Any change here must be mirrored wherever a presented\n * token is looked up, or every issued token stops authenticating.\n /\nexport function hashRegistrationAccessToken(plainToken: string): string {\n return crypto.createHash('sha256').update(plainToken).digest('hex');\n}\n\nexport interface GeneratedRegistrationAccessTokenMaterial {\n /* Full token — returned to the client once, at registration, and never persisted. /\n plainToken: string;\n /* First 8 chars — persisted so an operator can identify the token without seeing it. /\n registrationAccessTokenPrefix: string;\n /* `sha256(plainToken)` — the only persisted representation. /\n registrationAccessTokenHash: string;\n}\n\n/\n Mint a registration access token for a dynamically registered client.\n \n The caller persists the two derived fields and returns `plainToken` exactly once, in the RFC 7591\n * registration response. There is no way to recover it afterwards — which is why RFC 7592 §5 says it\n * \"SHOULD NOT expire while a client is still actively registered\": a client that loses it has lost\n * the ability to manage its own registration, permanently.\n */\nexport function generateRegistrationAccessTokenMaterial(): GeneratedRegistrationAccessTokenMaterial {\n const plainToken = `${REGISTRATION_ACCESS_TOKEN_PREFIX}${crypto.randomBytes(REGISTRATION_ACCESS_TOKEN_RANDOM_BYTES).toString('hex')}`;\n return {\n plainToken,\n registrationAccessTokenPrefix: plainToken.slice(0, REGISTRATION_ACCESS_TOKEN_PREFIX_LENGTH),\n registrationAccessTokenHash: hashRegistrationAccessToken(plainToken),\n };\n}\n"]}

package/dist/esm/security/oauth-clients/oauth-clients.custom-impl.backend.service.d.ts CHANGED Viewed

@@ -54,7 +54,14 @@ import type { RoleHierarchyResolver } from '../../security/authorizations/role-c
 export type OAuthClientImplHandlers = Parameters<typeof createResourceCustomServiceImplementation>[0]['handlers'];
 /** CREATE — enforce the role-ceiling, then mint material; surface `plainSecret` once. Exported for focused create-pipeline unit tests. */
 export declare function buildOAuthClientMintHandlers(scope: ApiKeyScope, roleHierarchyResolver: RoleHierarchyResolver): OAuthClientImplHandlers;
-/** CREATE impls — org default + org `admin` + app default. */
+/**
+ * EXPIRE impls — registered separately from the other ops rather than through
+ * `oauthClientFactoriesForOperation`, because that helper hardcodes `variantType: API_CALL` and
+ * fans out over each resource's HTTP variants. EXPIRE is INTERNAL_CALL with a single default
+ * variant, so it needs its own registration or the lookup key would never match and the guard above
+ * would be silently unreachable.
+ */
+export declare function createOAuthClientExpireFactories(): ResourceCustomServiceImplementationFactory[];
 export declare function createOAuthClientCreateFactories(): ResourceCustomServiceImplementationFactory[];
 /** ROTATE impls — bounded grace window. */
 export declare function createOAuthClientRotateFactories(): ResourceCustomServiceImplementationFactory[];

package/dist/esm/security/oauth-clients/oauth-clients.custom-impl.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-clients.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-clients.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EACL,WAAW,EASZ,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,yCAAyC,EACzC,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAMpH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uEAAuE,CAAC;AAqDnH,wFAAwF;AACxF,MAAM,MAAM,uBAAuB,GAAG,UAAU,CAAC,OAAO,yCAAyC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;AA4DlH,0IAA0I;AAC1I,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,qBAAqB,GAAG,uBAAuB,CAyBtI;~~AA4DD~~,~~8DAA8D~~;~~AAC9D~~,wBAAgB,gCAAgC,IAAI,0CAA0C,EAAE,CAK/F;AAED,2CAA2C;AAC3C,wBAAgB,gCAAgC,IAAI,0CAA0C,EAAE,CAK/F;AAED,6CAA6C;AAC7C,wBAAgB,oCAAoC,IAAI,0CAA0C,EAAE,CAKnG"}
1	+ {"version":3,"file":"oauth-clients.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-clients.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EACL,WAAW,EASZ,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,yCAAyC,EACzC,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAMpH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uEAAuE,CAAC;AAqDnH,wFAAwF;AACxF,MAAM,MAAM,uBAAuB,GAAG,UAAU,CAAC,OAAO,yCAAyC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;AA4DlH,0IAA0I;AAC1I,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,qBAAqB,GAAG,uBAAuB,CAyBtI;AA4FD;;;;;;GAMG;AACH,wBAAgB,gCAAgC,IAAI,0CAA0C,EAAE,CAc/F;AAED,wBAAgB,gCAAgC,IAAI,0CAA0C,EAAE,CAK/F;AAED,2CAA2C;AAC3C,wBAAgB,gCAAgC,IAAI,0CAA0C,EAAE,CAK/F;AAED,6CAA6C;AAC7C,wBAAgB,oCAAoC,IAAI,0CAA0C,EAAE,CAKnG"}

package/dist/esm/security/oauth-clients/oauth-clients.custom-impl.backend.service.js CHANGED Viewed

@@ -214,6 +214,55 @@ function buildOAuthClientReissueHandlers(scope, kind) {
     };
 }
 /** CREATE impls — org default + org `admin` + app default. */
+/**
+ * ACTIVE → EXPIRED, forced — the transition the credential-expiry sweep dispatches (#413).
+ *
+ * The FIRST status-transition handler on this resource: OAuth clients ship ROTATE and REGENERATE
+ * and no deactivate/reactivate pair, so unlike api-keys there was no generic transition helper to
+ * reuse. The 409 is the whole reason the sweep goes through a verb — an INACTIVE client was retired
+ * by an administrator, and relabelling it EXPIRED would erase who ended it.
+ *
+ * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — credential state transitions are
+ * explicit and validated, never inferred from a caller-supplied field.
+ */
+function buildOAuthClientExpireHandlers() {
+    return {
+        prefixCoreOperations: async (_id, _input, executionContext, _operationPath, utils) => {
+            const current = utils.currentObject;
+            if (current && current.status !== OAuthClientStatus.ACTIVE) {
+                throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {
+                    customMessageReference: ErrorCustomMessageReference.CONFLICT,
+                    context: {
+                        message: `OAuth client cannot move to '${OAuthClientStatus.EXPIRED}' from status '${current.status}'`,
+                        oauthClientStatus: current.status,
+                    },
+                });
+            }
+            return { status: OAuthClientStatus.EXPIRED };
+        },
+    };
+}
+/**
+ * EXPIRE impls — registered separately from the other ops rather than through
+ * `oauthClientFactoriesForOperation`, because that helper hardcodes `variantType: API_CALL` and
+ * fans out over each resource's HTTP variants. EXPIRE is INTERNAL_CALL with a single default
+ * variant, so it needs its own registration or the lookup key would never match and the guard above
+ * would be silently unreachable.
+ */
+export function createOAuthClientExpireFactories() {
+    return OAUTH_CLIENT_TARGETS.map((target) => {
+        const factory = (_resourcesRegistryService, _container) => createResourceCustomServiceImplementation({
+            operationPath: {
+                resourceIdentifier: target.resourceType,
+                operationIdentifier: target.ops.EXPIRE,
+                variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                isOperationDefault: true,
+            },
+            handlers: buildOAuthClientExpireHandlers(),
+        });
+        return factory;
+    });
+}
 export function createOAuthClientCreateFactories() {
     return oauthClientFactoriesForOperation(() => CoreResourceOperation.CREATE, (target, container) => buildOAuthClientMintHandlers(target.scope, createRoleHierarchyResolver(container)));
 }