npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.2 → 1.1.3 - Mend

@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (853) hide show

package/dist/esm/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"enterprise-user-provisioning.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAI9G,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAIhK,OAAO,EACL,2CAA2C,EAC3C,sCAAsC,EACtC,4CAA4C,EAC5C,uCAAuC,GACxC,MAAM,4FAA4F,CAAC;AAGpG,OAAO,EAAE,oCAAoC,EAAE,MAAM,8FAA8F,CAAC;AAEpJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,6EAA6E,CAAC;AACtH,OAAO,EAAE,6BAA6B,EAAE,MAAM,+EAA+E,CAAC;AAC9H,OAAO,EAAE,sBAAsB,EAAE,MAAM,qFAAqF,CAAC;AAC7H,OAAO,EAAE,yBAAyB,EAAE,MAAM,2FAA2F,CAAC;AACtI,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,SAAS,EACT,2BAA2B,EAC3B,0BAA0B,EAC1B,cAAc,EACd,iBAAiB,EAEjB,UAAU,EACV,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,8BAA8B,EAC9B,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAI/B,mGAAmG;AACnG,yGAAyG;AACzG,OAAO,EACL,mCAAmC,EACnC,oCAAoC,GACrC,MAAM,mFAAmF,CAAC;AA2BpF,IAAM,wCAAwC,GAA9C,MAAM,wCAAwC;IAIG;IACa;IACW;IACH;IACZ;IACC;IACA;IACK;IAOF;IAKc;IAE9D;IAxBF,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EAC7B,uBAA8D,EACjE,aAAwD,EACpE,WAA0C,EACzC,gBAAyC,EACzC,gBAAyC,EACpC,UAAwC,EAO1C,mBAA+C,EAKjC,0BAAoE,EAElI,6BAA0E;QArBvC,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,4BAAuB,GAAvB,uBAAuB,CAAuC;QACjE,kBAAa,GAAb,aAAa,CAA2C;QACpE,gBAAW,GAAX,WAAW,CAA+B;QACzC,qBAAgB,GAAhB,gBAAgB,CAAyB;QACzC,qBAAgB,GAAhB,gBAAgB,CAAyB;QACpC,eAAU,GAAV,UAAU,CAA8B;QAO1C,wBAAmB,GAAnB,mBAAmB,CAA4B;QAKjC,+BAA0B,GAA1B,0BAA0B,CAA0C;QAElI,kCAA6B,GAA7B,6BAA6B,CAA6C;QAE3F,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;IACvE,CAAC;IAED,kEAAkE;IAClE,0BAA0B;IAC1B,kEAAkE;IAElE;;;;;;;;;;OAUG;IACI,KAAK,CAAC,uBAAuB,CAClC,OAA8B,EAC9B,UAAyC,EACzC,kBAAgD,EAChD,gBAAqD,EAAE;QAEvD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAEtD,yBAAyB;QACzB,IAAI,kBAAkB,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YAC/D,IAAI,CAAC,WAAW,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;iBACjF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,iFAAiF;QACjF,sFAAsF;QACtF,wFAAwF;QACxF,oFAAoF;QACpF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAEjF,gBAAgB;QAChB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAC/B,OAAO,CAAC,KAAK,IAAI,EAAE,EACnB,kBAAkB,CAAC,WAAW,IAAI,EAAE,EACpC,kBAAkB,CAAC,eAAe,CACnC,CAAC;QACF,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC;YAC3C,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7E,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC/D,KAAK,EACL,aAAa,CACd,CAAC;QACF,MAAM,yBAAyB,GAAG,UAAU,CAAC,MAAM,KAAK,sBAAsB,CAAC,IAAI;YACjF,CAAC,CAAC,8BAA8B,CAAC,2BAA2B;YAC5D,CAAC,CAAC,8BAA8B,CAAC,kBAAkB,CAAC;QAEtD,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,qBAAqB,CAC/B,EAAE,EACF,YAAY,EACZ,OAAO,EACP,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,yBAAyB,CAC1B,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,4FAA4F;QAC5F,0FAA0F;QAC1F,gDAAgD;QAChD,MAAM,WAAW,GAAG,2BAA2B,CAC7C,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE;YACnC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS;YACxC,CAAC,CAAC,SAAS,EACb,eAAe,EACf,EAAE,EACF,yBAAyB,CAC1B,CAAC;QACF,IACE,WAAW,CAAC,sBAAsB,CAAC,MAAM,KAAK,CAAC;eAC5C,CAAC,WAAW,CAAC,OAAO,EACvB,CAAC;YACD,0FAA0F;YAC1F,2FAA2F;YAC3F,yFAAyF;YACzF,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CACrE,EAAE,EACF,OAAO,CAAC,KAAK,CACd,CAAC;YACF,IAAI,sBAAsB,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,qBAAqB,CAC/B,EAAE,EACF,sBAAsB,EACtB,OAAO,EACP,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,yBAAyB,CAC1B,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;gBACzE,OAAO,EAAE;oBACP,OAAO,EAAE,yBAAyB;oBAClC,eAAe,EAAE,WAAW,CAAC,eAAe;oBAC5C,eAAe;iBAChB;aACF,CAAC,CAAC;QACL,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC,kBAAkB,CAAC,eAAe,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;aAClF,CAAC,CAAC;QACL,CAAC;QAED,4FAA4F;QAC5F,8FAA8F;QAC9F,+FAA+F;QAC/F,+FAA+F;QAC/F,+FAA+F;QAC/F,2FAA2F;QAC3F,8FAA8F;QAC9F,4BAA4B;QAC5B,MAAM,yBAAyB,GAC7B,UAAU,CAAC,MAAM,KAAK,sBAAsB,CAAC,IAAI,IAAI,kBAAkB,CAAC,eAAe,KAAK,KAAK,CAAC;QAEpG,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,wDAAwD;QACxD,MAAM,kBAAkB,GACtB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;YAC5C,CAAC,CAAC,uCAAuC;YACzC,CAAC,CAAC,sCAAsC,CAAC;QAC7C,IAAI,MAAiC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,kBAAkB,CAClE,kBAAkB,EAClB,KAAK,EAAE,cAAc,EAAE,EAAE;gBACvB,IAAI,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CACrD,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF;oBACE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE;oBAClC,MAAM,EAAE,yBAAyB;wBAC/B,CAAC,CAAC,UAAU,CAAC,oBAAoB;wBACjC,CAAC,CAAC,UAAU,CAAC,MAAM;oBACrB,QAAQ,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBACnC,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW;wBACtD,CAAC,CAAC,eAAe;wBACjB,CAAC,CAAC,EAAE;iBACP,EACD,cAAc,CACf,CAAC;gBAEF,IAAI,gBAAgB,GAAG,KAAK,CAAC;gBAC7B,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,EAAE,CAAC;oBACnD,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAC/C,EAAE,EACF,OAAO,EACP,KAAK,CAAC,cAAc,EACpB,cAAc,EACd,cAAc,CACf,CAAC;oBAEF,+DAA+D;oBAC/D,qEAAqE;oBACrE,yDAAyD;oBACzD,OAAO,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAChD,EAAE,EACF,OAAO,EACP,eAAe,EACf,cAAc,CACf,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,kBAAkB,CAC3B,EAAE,EACF,OAAO,CAAC,GAAG,EACX,OAAO,EACP,UAAU,EACV,cAAc,CACf,CAAC;gBAEF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC3D,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EACpB,cAAc,CACf,CAAC;gBACF,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;wBAChE,OAAO,EAAE,EAAE,MAAM,EAAE,mDAAmD,EAAE;qBACzE,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO;oBACL,IAAI,EAAE,aAAa;oBACnB,KAAK,EAAE,IAAI;oBACX,gBAAgB;oBAChB,WAAW,EAAE,cAAc;iBAC5B,CAAC;YACJ,CAAC,EACD;gBACE,kEAAkE;gBAClE,qEAAqE;gBACrE,sEAAsE;gBACtE,2BAA2B,EAAE;oBAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC;aACF,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC3D,+DAA+D;gBAC/D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC/E,IAAI,CAAC,UAAU;oBAAE,MAAM,KAAK,CAAC;gBAC7B,OAAO,IAAI,CAAC,qBAAqB,CAC/B,EAAE,EACF,UAAU,EACV,OAAO,EACP,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,yBAAyB,CAC1B,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,8FAA8F;QAC9F,6FAA6F;QAC7F,8FAA8F;QAC9F,uFAAuF;QACvF,IAAI,yBAAyB,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,0BAA0B,CAAC,qBAAqB,CAAC;gBAC1D,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;gBACvB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;gBACxB,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,wEAAwE,EAAE;gBACtF,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;gBACvB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;QAED,6FAA6F;QAC7F,IAAI,UAAU,CAAC,MAAM,KAAK,sBAAsB,CAAC,IAAI,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;oBAC1C,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;oBACvB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,cAAc,EAAE,iBAAiB,CAAC,UAAU;oBAC5C,UAAU,EAAE,UAAU,CAAC,MAAM;oBAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,cAAc,EAAE,oCAAoC,CAAC,KAAK,CAAC;oBAC3D,aAAa,EAAE,mCAAmC,CAAC,KAAK,CAAC;oBACzD,SAAS,EAAE,QAAQ;oBACnB,SAAS,EAAE,yBAAyB;oBACpC,SAAS,EAAE,cAAc,UAAU,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;iBACrE,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,+BAA+B,CACzD,EAAE,EACF,oCAAoC,CAAC,KAAK,CAAC,EAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,CAChB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,QAAQ,CAAC,mDAAmD,EAAE;oBACjE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;iBACxB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE;YAC3D,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;YACvB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,cAAc;SACtB,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,8BAA8B,CAC1C,KAAgC,EAChC,aAAkD;QAElD,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;YAClD,OAAO,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAE7D,gBAAgB,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,MAAM,EAAE,yCAAyC;oBACjD,cAAc,EAAE,KAAK,CAAC,cAAc;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE;YAC7D,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,iBAAiB;YAChD,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,YAAY,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,MAAM,EAAE,mDAAmD;oBAC3D,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,gBAAgB,EAAE,YAAY,CAAC,IAAI;iBACpC;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,mBAAmB,GAAG,YAAY,CAAC,IAAI;YAC3C,CAAC,CAAC,iBAAiB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,SAAS,IAAI,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;QAEP,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,qBAAqB,CACjC,EAAyB,EACzB,iBAAuB,EACvB,OAA8B,EAC9B,UAAyC,EACzC,mBAAiD,EACjD,cAAwB,EACxB,eAAkC,EAClC,yBAAyD;QAEzD,IAAI,CAAC,+BAA+B,CAAC,iBAAiB,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAEtD,MAAM,sBAAsB,GAC1B,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;YAC5C,CAAC,CAAC,4CAA4C;YAC9C,CAAC,CAAC,2CAA2C,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,kBAAkB,CACxE,sBAAsB,EACtB,KAAK,EAAE,cAAc,EAAE,EAAE;YACvB,IAAI,YAAY,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACxD,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,GAAG,EAAE,iBAAiB,CAAC,GAAG,EAAE,EAC9B,cAAc,CACf,CAAC;YACF,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;iBAClF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,+BAA+B,CAAC,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YAEtE,IAAI,kBAAkB,GAA8B,IAAI,CAAC;YACzD,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,EAAE,CAAC;gBACnD,kBAAkB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAC9D,gBAAgB,CAAC,oBAAoB,EACrC;oBACE,MAAM,EAAE,YAAY,CAAC,GAAG;oBACxB,cAAc,EAAE,KAAK,CAAC,cAAc;iBACrC,EACD,cAAc,CACf,CAAC;YACJ,CAAC;YAED,MAAM,kBAAkB,GACtB,UAAU,CAAC,MAAM,KAAK,sBAAsB,CAAC,IAAI;mBAC9C,YAAY,CAAC,MAAM,KAAK,UAAU,CAAC,kBAAkB,CAAC;YAC3D,IACE,kBAAkB;mBACf,CACD,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;uBAC3C,kBAAkB,EAAE,MAAM,KAAK,wBAAwB,CAAC,OAAO,CACnE,EACD,CAAC;gBACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;oBACjF,OAAO,EAAE;wBACP,UAAU,EAAE,YAAY,CAAC,MAAM;wBAC/B,MAAM,EAAE,kDAAkD;qBAC3D;iBACF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,kBAAkB,GAAG,kBAAkB;gBAC3C,CAAC,CAAC,8BAA8B,CAAC,UAAU;gBAC3C,CAAC,CAAC,yBAAyB,CAAC;YAC9B,MAAM,WAAW,GAAG,2BAA2B,CAC7C,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE;gBACnC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS;gBACxC,CAAC,CAAC,SAAS,EACb,eAAe,EACf,YAAY,CAAC,SAAS,IAAI,EAAE,EAC5B,kBAAkB,CACnB,CAAC;YACF,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBACzB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;oBACzE,OAAO,EAAE;wBACP,OAAO,EAAE,kBAAkB;wBAC3B,eAAe,EAAE,WAAW,CAAC,eAAe;wBAC5C,eAAe;qBAChB;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,gBAAgB,GAAG,KAAK,CAAC;YAC7B,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,EAAE,CAAC;gBACnD,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAC/C,EAAE,EACF,YAAY,EACZ,KAAK,CAAC,cAAc,EACpB,cAAc,EACd,cAAc,EACd,kBAAkB,CACnB,CAAC;YACJ,CAAC;YAED,YAAY,GAAG,MAAM,IAAI,CAAC,6BAA6B,CACrD,EAAE,EACF,YAAY,EACZ,eAAe,EACf,cAAc,CACf,CAAC;YAEF,IAAI,YAAY,CAAC,MAAM,KAAK,UAAU,CAAC,kBAAkB,EAAE,CAAC;gBAC1D,yFAAyF;gBACzF,wFAAwF;gBACxF,iFAAiF;gBACjF,sFAAsF;gBACtF,yFAAyF;gBACzF,0FAA0F;gBAC1F,uFAAuF;gBACvF,8BAA8B;gBAC9B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC7D,gBAAgB,CAAC,KAAK,EACtB;oBACE,GAAG,EAAE,YAAY,CAAC,GAAG;oBACrB,MAAM,EAAE,UAAU,CAAC,kBAAkB;iBACtC,EACD,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,EAC7B,cAAc,CACf,CAAC;gBACF,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE,EAAE,MAAM,EAAE,sCAAsC,EAAE;qBAC5D,CAAC,CAAC;gBACL,CAAC;gBACD,YAAY,GAAG,SAAS,CAAC;YAC3B,CAAC;YAED,MAAM,IAAI,CAAC,kBAAkB,CAC3B,EAAE,EACF,YAAY,CAAC,GAAG,EAChB,OAAO,EACP,UAAU,EACV,cAAc,CACf,CAAC;YAEF,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,KAAK;gBACZ,gBAAgB;gBAChB,WAAW,EAAE,cAAc;aAC5B,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,MAAM,oCAAoC,CAAC,EAAE,EAAE;YAC7C,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;YACvB,OAAO;YACP,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,kDAAkD,EAAE;YAChE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;YACvB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SAC1C,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,6CAA6C,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE1E,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kEAAkE;IAClE,+DAA+D;IAC/D,kEAAkE;IAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACK,+BAA+B,CAAC,YAAkB,EAAE,MAA+C;QACzG,IAAI,YAAY,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,KAAK,UAAU,CAAC,kBAAkB,EAAE,CAAC;YACvG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,6CAA6C,CAAC,MAAc;QACxE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE;gBAC3F,YAAY,EAAE,IAAI;gBAClB,kBAAkB,EAAE,EAAE;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gFAAgF;YAChF,oFAAoF;YACpF,mFAAmF;YACnF,0EAA0E;YAC1E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6EAA6E,EAAE;gBAC9F,MAAM;gBACN,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,sCAAsC,CAAC,cAAsB;QACxE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CACvD,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,cAAc,EAAE,CACnB,CAAC;YACF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YAC1D,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9F,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,IAAI,CAAC,6CAA6C,CAAC,MAAM,CAAC,CAAC;YACnE,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC,QAAQ,CAAC,qDAAqD,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACxH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oFAAoF;YACpF,qFAAqF;YACrF,kEAAkE;YAClE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0DAA0D,EAAE;gBAC3E,cAAc;gBACd,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,yCAAyC;IACzC,kEAAkE;IAElE;;;OAGG;IACI,KAAK,CAAC,aAAa,CACxB,MAAc,EACd,KAA+F,EAC/F,UAAwC;QAExC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAChH,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,aAAa,EAAG,eAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACnH,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,mGAAmG;QACnG,oGAAoG;QACpG,kGAAkG;QAClG,4FAA4F;QAC5F,oGAAoG;QACpG,sFAAsF;QACtF,MAAM,oCAAoC,CAAC,EAAE,EAAE;YAC7C,MAAM;YACN,OAAO,EAAE,KAAK;YACd,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAClE,6CAA6C;IAC7C,kEAAkE;IAElE;;;OAGG;IACI,KAAK,CAAC,iBAAiB,CAC5B,MAAc,EACd,cAAsB,EACtB,kBAAgD;QAEhD,6FAA6F;QAC7F,4FAA4F;QAC5F,8FAA8F;QAC9F,uEAAuE;QACvE,IAAI,kBAAkB,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;YACrD,IAAI,CAAC,QAAQ,CAAC,4EAA4E,EAAE;gBAC1F,MAAM;gBACN,cAAc;aACf,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACxG,IAAI,IAAI,EAAE,CAAC;YACT,6FAA6F;YAC7F,2FAA2F;YAC3F,kBAAkB;YAClB,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;YAE/G,yEAAyE;YACzE,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACxD,gBAAgB,CAAC,oBAAoB,EACrC,EAAE,EACF,EAAE,MAAM,EAAE,cAAc,EAAE,CAC3B,CAAC;gBACF,IAAI,UAAU,EAAE,CAAC;oBACf,2FAA2F;oBAC3F,yFAAyF;oBACzF,yFAAyF;oBACzF,sFAAsF;oBACtF,sFAAsF;oBACtF,kFAAkF;oBAClF,wFAAwF;oBACxF,2EAA2E;oBAC3E,kFAAkF;oBAClF,EAAE;oBACF,kFAAkF;oBAClF,yDAAyD;oBACzD,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC3C,gBAAgB,CAAC,oBAAoB,EACpC,UAAkB,CAAC,GAAG,EACvB,EAAE,MAAM,EAAE,wBAAwB,CAAC,QAAQ,EAAE,EAC7C,EAAE,YAAY,EAAE,EAAE,cAAc,EAAE,EAAE,CACrC,CAAC;oBACF,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAC5C,IAAI,CAAC,QAAQ,CAAC,+EAA+E,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7G,CAAC;YAED,kEAAkE;YAClE,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAAC;oBAC1C,MAAM,iBAAiB,GAAI,IAAI,CAAC,gBAAgB,CAAC,MAA2E,EAAE,iBAAiB,CAAC;oBAChJ,MAAM,eAAe,GAAI,IAAI,CAAC,gBAAgB,CAAC,MAA6F,EAAE,SAAS,CAAC;oBACxJ,MAAM,yBAAyB,CAAC,EAAE,EAAE;wBAClC,MAAM;wBACN,cAAc;wBACd,iBAAiB;wBACjB,eAAe;wBACf,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;wBACrD,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;4BAChC,MAAM,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC;wBACzD,CAAC;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,IAAI,mBAAmB,CAAC,WAAW,CAAC;oBAAE,MAAM,WAAW,CAAC;gBACxD,IAAI,CAAC,QAAQ,CAAC,0DAA0D,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACxF,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,8CAA8C,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,eAAe;IACf,kEAAkE;IAElE;;;;;;;;;;;OAWG;IACI,QAAQ,CAAC,QAAkB,EAAE,WAAmC,EAAE,eAA0B;QACjG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAEpE,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9C,IAAI,eAAe,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1D,IAAI,CAAC,QAAQ,CAAC,iDAAiD,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;oBACnG,SAAS;gBACX,CAAC;gBACD,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,kEAAkE;IAClE,0BAA0B;IAC1B,kEAAkE;IAElE;;;;;OAKG;IACK,KAAK,CAAC,mBAAmB,CAC/B,EAAyB,EACzB,IAAU,EACV,cAAsB,EACtB,KAAe,EACf,cAA8B,EAC9B,qBACE,8BAA8B,CAAC,2BAA2B;QAE5D,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAChE,gBAAgB,CAAC,oBAAoB,EACrC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,EACpC,cAAc,CACf,CAAC;QACF,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,cAAc,CAAC,MAAM,KAAK,wBAAwB,CAAC,MAAM,EAAE,CAAC;gBAC9D,IAAI,CAAC,QAAQ,CAAC,oDAAoD,EAAE;oBAClE,MAAM,EAAE,IAAI,CAAC,GAAG;oBAChB,cAAc;iBACf,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,cAAc,CAAC,MAAM,KAAK,wBAAwB,CAAC,OAAO,EAAE,CAAC;gBAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,OAAO,EAAE;wBACP,MAAM,EAAE,uCAAuC;wBAC/C,YAAY,EAAE,cAAc,CAAC,GAAG;wBAChC,gBAAgB,EAAE,cAAc,CAAC,MAAM;wBACvC,MAAM,EAAE,IAAI,CAAC,GAAG;wBAChB,cAAc;qBACf;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,kBAAkB,KAAK,8BAA8B,CAAC,UAAU,EAAE,CAAC;gBACrE,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC,EAAE,EAAE;oBACzD,UAAU,EAAE,cAAc;oBAC1B,IAAI;oBACJ,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;oBACvC,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;oBACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;oBAC7C,cAAc;oBACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC,CAAC;gBACH,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC;oBACpC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;wBACrE,OAAO,EAAE;4BACP,MAAM,EAAE,iDAAiD;4BACzD,YAAY,EAAE,cAAc,CAAC,GAAG;4BAChC,MAAM,EAAE,IAAI,CAAC,GAAG;4BAChB,cAAc;yBACf;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC7D,gBAAgB,CAAC,oBAAoB,EACrC;oBACE,GAAG,EAAE,cAAc,CAAC,GAAG;oBACvB,MAAM,EAAE,wBAAwB,CAAC,OAAO;iBACzC,EACD,EAAE,MAAM,EAAE,wBAAwB,CAAC,MAAM,EAAE,EAC3C,cAAc,CACf,CAAC;gBACF,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;wBAChE,OAAO,EAAE;4BACP,MAAM,EAAE,4CAA4C;4BACpD,YAAY,EAAE,cAAc,CAAC,GAAG;4BAChC,MAAM,EAAE,IAAI,CAAC,GAAG;4BAChB,cAAc;yBACf;qBACF,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,uBAAuB,CAAC,EAAE,EAAE;oBAChC,MAAM,EAAE,IAAI,CAAC,GAAG;oBAChB,cAAc;oBACd,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE;wBACtD,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,iBAAiB;wBAChD,CAAC,CAAC,SAAS;oBACb,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;oBACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;oBAC7C,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,uEAAuE,EAAE;gBACrF,MAAM,EAAE,IAAI,CAAC,GAAG;gBAChB,cAAc;gBACd,kBAAkB;aACnB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,cAAc,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QAChC,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE;YAC7D,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,iBAAiB;YAChD,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,iBAAiB,EAAE,CAAC;YACrD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAC9D,gBAAgB,CAAC,aAAa,EAC9B,EAAE,GAAG,EAAE,cAAc,EAAE,EACvB,cAAc,CACf,CAAC;YACF,MAAM,WAAW,GAAG,YAAY,EAAE,IAAI;gBACpC,CAAC,CAAC,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,iBAAiB;gBACzD,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,WAAW;gBAAE,cAAc,GAAG,CAAC,WAAW,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,iBAAiB,EAAE,CAAC;YACnD,MAAM,sBAAsB,CAAC,EAAE,EAAE;gBAC/B,cAAc;gBACd,KAAK,EAAE,cAAc;gBACrB,iBAAiB;gBACjB,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;gBACrD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QAED,sEAAsE;QACtE,iDAAiD;QACjD,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC3C,gBAAgB,CAAC,oBAAoB,EACrC;YACE,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,cAAc;YACd,KAAK,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;YAC7D,MAAM,EAAE,wBAAwB,CAAC,MAAM;SACxC,EACD,cAAc,CACf,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE;YAC/C,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,cAAc;YACd,KAAK,EAAE,cAAc;SACtB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,6BAA6B,CACzC,EAAyB,EACzB,IAAU,EACV,mBAAsC,EACtC,cAA8B;QAE9B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACzD,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EACjB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE;oBACP,MAAM,EAAE,gDAAgD;oBACxD,MAAM,EAAE,IAAI,CAAC,GAAG;iBACjB;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,IAAI,EAAE,CAAC;QACjD,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;aACnD,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,WAAW,CAAC;QAElD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAC3D,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,WAAW,CAAC,GAAG,EACf,EAAE,SAAS,EAAE,CAAC,GAAG,YAAY,EAAE,GAAG,YAAY,CAAC,EAAE,EACjD,cAAc,CACf,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;gBAChE,OAAO,EAAE;oBACP,MAAM,EAAE,wCAAwC;oBAChD,MAAM,EAAE,IAAI,CAAC,GAAG;oBAChB,YAAY;iBACb;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,kEAAkE;IAClE,yBAAyB;IACzB,kEAAkE;IAE1D,KAAK,CAAC,kBAAkB,CAC9B,EAAyB,EACzB,MAAc,EACd,OAA8B,EAC9B,UAAyC,EACzC,cAA8B;QAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;YAChE,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE;YAC1C,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAC9D,gBAAgB,CAAC,mBAAmB,EACpC;YACE,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,cAAc,EAAE,iBAAiB,CAAC,UAAU;YAC5C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,GAAG,WAAW;SACf,EACD,cAAc,CACf,CAAC;QAEF,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACnC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;oBAChE,OAAO,EAAE;wBACP,MAAM,EAAE,oDAAoD;wBAC5D,cAAc,EAAE,YAAY,CAAC,GAAG;wBAChC,YAAY,EAAE,YAAY,CAAC,MAAM;wBACjC,eAAe,EAAE,MAAM;wBACvB,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;qBACjC;iBACF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC;YAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;YAC9C,MAAM,YAAY,GAAG,aAAa,IAAI,IAAI,IAAI,QAAQ,IAAI,IAAI,IAAI,aAAa,KAAK,QAAQ,CAAC;YAE7F,sFAAsF;YACtF,8EAA8E;YAC9E,oFAAoF;YACpF,+EAA+E;YAC/E,kCAAkC;YAClC,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC3C,gBAAgB,CAAC,mBAAmB,EACpC,YAAY,CAAC,GAAG,EAChB;gBACE,UAAU,EAAE,IAAI,IAAI,EAAE;gBACtB,aAAa,EAAE,OAAO,CAAC,KAAK;gBAC5B,mBAAmB,EAAE,OAAO,CAAC,WAAW;gBACxC,iBAAiB,EAAE,OAAO,CAAC,SAAS;gBACpC,kBAAkB,EAAE,OAAO,CAAC,SAAS;aACtC,EACD,cAAc,CACf,CAAC;YAEF,IAAI,YAAY,IAAI,UAAU,CAAC,MAAM,KAAK,sBAAsB,CAAC,IAAI,EAAE,CAAC;gBACtE,MAAM,cAAc,GAAG,oCAAoC,CAAC,KAAK,CAAC,CAAC;gBACnE,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAChC,sBAAsB,CAAC,kBAAkB,EACzC,0BAA0B,CAAC,MAAM,EACjC;oBACE,MAAM,EAAE,YAAY,CAAC,MAAM;oBAC3B,cAAc;oBACd,aAAa,EAAE,mCAAmC,CAAC,KAAK,CAAC;oBACzD,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,aAAa;oBACb,QAAQ;iBACT,EACD,MAAM,IAAI,CAAC,aAAa,CAAC,+BAA+B,CAAC,EAAE,EAAE,cAAc,EAAE,YAAY,CAAC,MAAM,CAAC,CAClG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAyB,CAAC,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC3C,gBAAgB,CAAC,mBAAmB,EACpC;YACE,MAAM;YACN,cAAc,EAAE,iBAAiB,CAAC,UAAU;YAC5C,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,aAAa,EAAE,OAAO,CAAC,KAAK;YAC5B,mBAAmB,EAAE,OAAO,CAAC,WAAW;YACxC,iBAAiB,EAAE,OAAO,CAAC,SAAS;YACpC,kBAAkB,EAAE,OAAO,CAAC,SAAS;YACrC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,cAAc,EAAE,oCAAoC,CAAC,KAAK,CAAC;YAC3D,aAAa,EAAE,mCAAmC,CAAC,KAAK,CAAC;YACzD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,EACD,cAAc,CACf,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,sBAAsB,CAC5B,UAAyC;QAEzC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,MAAM,EAAE,qCAAqC;oBAC7C,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,UAAU,CAAC,KAAK,CAAC;IAC1B,CAAC;IAED,kEAAkE;IAClE,6BAA6B;IAC7B,kEAAkE;IAElE;;;;;OAKG;IACK,KAAK,CAAC,2BAA2B;QACvC,OAAO,IAAI,CAAC,aAAa,CAAC,4BAA4B,CAAC,IAAI,CAAC,aAAa,CAAC,2BAA2B,EAAE,CAAC,CAAC;IAC3G,CAAC;CACF,CAAA;AAtpCY,wCAAwC;IADpD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAC1C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAOhD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAK9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,CAAA;IAC5D,YAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;qCApBJ,aAAa;QACM,0BAA0B,YAEjB,yCAAyC,YAEjD,uBAAuB;GAT9F,wCAAwC,CAspCpD","sourcesContent":["/*\n EnterpriseUserProvisioningBackendService\n \n Handles enterprise user lifecycle operations: creation, update, deactivation,\n * and IdP role → org role mapping. Reusable by both SSO JIT provisioning (Step 15)\n * and SCIM directory provisioning (Step 20).\n \n Step 15: Enterprise SSO — Org OIDC Connection Resolver & Provisioning\n * DI Symbol: EnterpriseUserProvisioningService\n \n Design (Decision 13):\n * - All methods use INTERNALLY_INITIATED_REQUEST execution context\n * - All methods emit audit events via AuditLogsBackendService\n * - provisionEnterpriseUser() handles: User creation, UserProfile creation, scoped membership,\n * and UserIdentityLink creation — all transactional\n \n FUTURE (SCIM Step 20): SCIM controller will call these same methods.\n /\n\nimport 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { ServiceOptions } from '~wildo-backend-lib/base-classes/models/repositories.backend.schemas';\nimport { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport type {\n ResourcePersistenceUnitOfWorkBackendService,\n} from '~wildo-backend-lib/databases/services/resource-persistence-unit-of-work.backend.service';\nimport {\n APPLICATION_EXISTING_USER_LINK_UNIT_OF_WORK,\n APPLICATION_USER_CREATION_UNIT_OF_WORK,\n ORGANIZATION_EXISTING_USER_LINK_UNIT_OF_WORK,\n ORGANIZATION_USER_CREATION_UNIT_OF_WORK,\n} from '~wildo-backend-lib/security/authentications/models/identity-persistence-boundaries.backend';\nimport type { AuthTokenIssuerBackendService } from '~wildo-backend-lib/security/authentications/services/auth-token-issuer.backend.service';\nimport type { AuthUserLookupBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-user-lookup.backend.service';\nimport { ensureUserProfileFromIdentityProfile } from '~wildo-backend-lib/security/authentications/services/utils/ensure-user-profile.backend.utils';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { grantUserTypesOnOrgJoin } from '~wildo-backend-lib/organizations/services/user-org-type-grant.backend.utils';\nimport { applyInvitationAcceptanceCore } from '~wildo-backend-lib/organizations/services/invitation-acceptance.backend.utils';\nimport { validateOrgMemberRoles } from '~wildo-backend-lib/organizations/services/org-member-roles-validation.backend.utils';\nimport { revokeUserTypesOnOrgLeave } from '~wildo-backend-lib/organizations/services/user-type-revocation-on-org-leave.backend.utils';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport {\n CoreResourceType,\n CoreAuditableEventType,\n ErrorType,\n ErrorCustomMessageReference,\n ResourceOperationRiskLevel,\n CORE_APP_ROLES,\n SsoConnectionType,\n User,\n UserStatus,\n OrganizationMemberStatus,\n AuthScopeType,\n ExternalIdentitySource,\n RegistrationAcquisitionChannel,\n evaluateUserTypeAcquisition,\n isWildoBackendError,\n} from '@wildo-ai/saas-models';\nimport type { OrganizationMember, UserIdentityLink } from '@wildo-ai/saas-models';\nimport type { EmailVerificationInitiatorBackendService } from '~wildo-backend-lib/security/authentications/services/email-verification-initiator.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n// `EnterpriseProvisioningConfig` now lives in the models layer (sso-connection.backend.schemas) so\n// the connection type can reference it — one shape for the provisioning settings, built once per source.\nimport {\n getApplicationIdFromEnterpriseScope,\n getOrganizationIdFromEnterpriseScope,\n} from '~wildo-backend-lib/security/authentications/models/sso-connection.backend.schemas';\nimport type {\n EnterpriseConnectionScope,\n NormalizedUserProfile,\n ProvisioningConnectionContext,\n EnterpriseProvisioningConfig,\n} from '~wildo-backend-lib/security/authentications/models/sso-connection.backend.schemas';\n\n/* Result of an enterprise user provisioning operation /\nexport interface EnterpriseProvisionResult {\n user: User;\n isNew: boolean;\n /* False for application-scoped provisioning, which never owns organization membership. /\n orgMemberCreated: boolean;\n mappedRoles: string[];\n}\n\n/\n Exact identity target used only when an enterprise connection has no organization-type grants.\n * The caller must derive it from the initiating/default frontend service; it is never selected by\n * scanning for an arbitrary permissive user type.\n /\nexport interface EnterpriseProvisioningTargetContext {\n fallbackUserType?: string;\n}\n\n@injectable()\nexport class EnterpriseUserProvisioningBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory) private readonly authEcFactory: AuthExecutionContextFactoryBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthTokenIssuer) private readonly tokenIssuer: AuthTokenIssuerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) private readonly auditLogsService: AuditLogsBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.AuthUserLookupService) private readonly userLookup: AuthUserLookupBackendService,\n // Trusted in-process writes to system resources whose client-shaped CREATE/UPDATE DTO\n // strips context FKs (`userId`/`organizationId`) and the backend-only `providerRawProfile`:\n // USER_PROFILES, USER_IDENTITY_LINKS, ORGANIZATION_MEMBERS. Enterprise JIT / SCIM / SAML\n // provisioning runs on a synthesised system EC with no HTTP request context to seed the\n // FKs, so `createAsSystem`/`updateAsSystem` re-attach them past the strict-DTO parse\n // (fail-closed `systemAccessPolicy` opt-in). Reads stay on the caller EC.\n @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n // Shared EMAIL_VERIFICATION token+email sender. Used by the SCIM path when the directory's\n // config disables auto-verify: a new user is created PENDING_VERIFICATION and must confirm\n // their email before they can sign in. Appended LAST to keep the test's positional\n // construction stable.\n @inject(SAAS_SERVICE_TYPES.EmailVerificationInitiatorService) private readonly emailVerificationInitiator: EmailVerificationInitiatorBackendService,\n @inject(SAAS_SERVICE_TYPES.ResourcePersistenceUnitOfWorkService)\n private readonly resourcePersistenceUnitOfWork: ResourcePersistenceUnitOfWorkBackendService,\n ) {\n this.logDebug = this.logger.debugByType('EnterpriseUserProvisioning');\n this.logger.setDebugTypeLogging('EnterpriseUserProvisioning', false);\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Create or Link Org User\n // ═══════════════════════════════════════════════════════════════\n\n /\n Create or link a user within an organization from an IdP profile.\n \n Flow:\n * 1. Verify email domain is in allowedDomains (if any)\n * 2. Check if user already exists by email\n * - If exists: verify/add org membership\n * - If not exists: check autoCreateUsers, create user + profile + org member\n * 3. Map IdP roles → org roles\n * 4. Create identity link\n /\n public async provisionEnterpriseUser(\n profile: NormalizedUserProfile,\n connection: ProvisioningConnectionContext,\n provisioningConfig: EnterpriseProvisioningConfig,\n targetContext: EnterpriseProvisioningTargetContext = {},\n ): Promise<EnterpriseProvisionResult> {\n const ec = await this.getInternalExecutionContext();\n const scope = this.requireEnterpriseScope(connection);\n\n // 1. Verify email domain\n if (provisioningConfig.allowedDomains.length > 0) {\n const emailDomain = profile.email.split('@')[1]?.toLowerCase();\n if (!emailDomain \|\| !provisioningConfig.allowedDomains.includes(emailDomain)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n });\n }\n }\n\n // 2. Check if user already exists. `findAnyUserByEmail` spans ALL statuses, so a\n // user invited-but-not-yet-accepted (PENDING_INVITATION, provisioned by the org-admin\n // invite) is found here by the STRICT unique email anchor. There is never a second user\n // for the same email (D8 `.isUnique()`), so SSO/SCIM binds to that single identity.\n const existingUser = await this.userLookup.findAnyUserByEmail(ec, profile.email);\n\n // Map IdP roles\n const mappedRoles = this.mapRoles(\n profile.roles \|\| [],\n provisioningConfig.roleMapping \|\| {},\n provisioningConfig.allowedOrgRoles,\n );\n const effectiveRoles = mappedRoles.length > 0\n ? mappedRoles\n : (provisioningConfig.defaultRole ? [provisioningConfig.defaultRole] : []);\n const targetUserTypes = await this.resolveProvisioningTargetTypes(\n scope,\n targetContext,\n );\n const defaultAcquisitionChannel = connection.source === ExternalIdentitySource.SCIM\n ? RegistrationAcquisitionChannel.ADMINISTRATIVE_PROVISIONING\n : RegistrationAcquisitionChannel.ENTERPRISE_SSO_JIT;\n\n if (existingUser) {\n return this.provisionExistingUser(\n ec,\n existingUser,\n profile,\n connection,\n provisioningConfig,\n effectiveRoles,\n targetUserTypes,\n defaultAcquisitionChannel,\n );\n }\n\n // Registration policy governs acquisition, not authentication by an existing account. Resolve\n // every type the new account will actually receive and require the canonical channel matrix\n // before `autoCreateUsers` or any irreversible write. SCIM is an administrative directory\n // action; OIDC/SAML are automatic external JIT.\n const acquisition = evaluateUserTypeAcquisition(\n this.appConfigService.isInitialized()\n ? this.appConfigService.config.userTypes\n : undefined,\n targetUserTypes,\n [],\n defaultAcquisitionChannel,\n );\n if (\n acquisition.newlyAcquiredUserTypes.length === 0\n \|\| !acquisition.allowed\n ) {\n // A concurrent invitation/provision may have created the identity after the first lookup.\n // Re-read once before returning the new-user denial so an INVITED race winner is evaluated\n // with invitation semantics and an existing holder is evaluated only for its real delta.\n const concurrentExistingUser = await this.userLookup.findAnyUserByEmail(\n ec,\n profile.email,\n );\n if (concurrentExistingUser) {\n return this.provisionExistingUser(\n ec,\n concurrentExistingUser,\n profile,\n connection,\n provisioningConfig,\n effectiveRoles,\n targetUserTypes,\n defaultAcquisitionChannel,\n );\n }\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n context: {\n channel: defaultAcquisitionChannel,\n deniedUserTypes: acquisition.deniedUserTypes,\n targetUserTypes,\n },\n });\n }\n\n // User doesn't exist — check autoCreateUsers\n if (!provisioningConfig.autoCreateUsers) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_FOUND,\n });\n }\n\n // AUTH-21: SCIM directories can require email verification (`autoVerifyEmail: false` on the\n // SCIM provisioning config) even though the IdP vouches for the user. When set, a NEW user is\n // created PENDING_VERIFICATION and must confirm ownership via the emailed link before they can\n // sign in — the S0.7 gate above hard-stops PENDING_VERIFICATION on every subsequent provision/\n // login until they do. Scoped to the SCIM source ONLY: the interactive SSO/OIDC/SAML paths log\n // the user in synchronously, so downgrading them to PENDING_VERIFICATION would lock out an\n // in-flight login. `autoVerifyEmail` defaults true everywhere, so this is inert unless a SCIM\n // admin explicitly opts in.\n const requiresEmailVerification =\n connection.source === ExternalIdentitySource.SCIM && provisioningConfig.autoVerifyEmail === false;\n\n // 3. Create the identity, its scope-owned relationship, its grants, and its\n // identity link as one database unit of work. Organization-derived types\n // are deliberately absent from the initial user insert and become visible\n // only after membership exists in the same transaction.\n const creationUnitOfWork =\n scope.scopeType === AuthScopeType.ORGANIZATION\n ? ORGANIZATION_USER_CREATION_UNIT_OF_WORK\n : APPLICATION_USER_CREATION_UNIT_OF_WORK;\n let result: EnterpriseProvisionResult;\n try {\n result = await this.resourcePersistenceUnitOfWork.executeTransaction(\n creationUnitOfWork,\n async (serviceOptions) => {\n let newUser = await this.servicesRegistryHandler.create<User>(\n CoreResourceType.USERS,\n ec,\n {\n email: profile.email.toLowerCase(),\n status: requiresEmailVerification\n ? UserStatus.PENDING_VERIFICATION\n : UserStatus.ACTIVE,\n appRoles: [CORE_APP_ROLES.APP_USER],\n userTypes: scope.scopeType === AuthScopeType.APPLICATION\n ? targetUserTypes\n : [],\n },\n serviceOptions,\n );\n\n let orgMemberCreated = false;\n if (scope.scopeType === AuthScopeType.ORGANIZATION) {\n orgMemberCreated = await this.ensureOrgMembership(\n ec,\n newUser,\n scope.organizationId,\n effectiveRoles,\n serviceOptions,\n );\n\n // The member-create postfix owns typed-organization grants. An\n // untyped organization instead uses the exact fallback type resolved\n // above; apply it only after membership has been proven.\n newUser = await this.ensureAuthorizedTypesAssigned(\n ec,\n newUser,\n targetUserTypes,\n serviceOptions,\n );\n }\n\n await this.createIdentityLink(\n ec,\n newUser._id,\n profile,\n connection,\n serviceOptions,\n );\n\n const persistedUser = await this.servicesRegistryHandler.read<User>(\n CoreResourceType.USERS,\n ec,\n { _id: newUser._id },\n serviceOptions,\n );\n if (!persistedUser) {\n throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {\n context: { reason: 'enterprise_provisioned_user_missing_before_commit' },\n });\n }\n\n return {\n user: persistedUser,\n isNew: true,\n orgMemberCreated,\n mappedRoles: effectiveRoles,\n };\n },\n {\n // The parent user mutation owns profile composition. The registry\n // queues that child seed after commit, but it must still receive the\n // original IdP name input through the adapter-neutral ServiceOptions.\n compositionSeedRequestInput: {\n firstName: profile.firstName,\n lastName: profile.lastName,\n displayName: profile.displayName,\n },\n },\n );\n } catch (error) {\n if (isWildoBackendError(error) && error.statusCode === 409) {\n // Concurrent request created the user first — re-read and link\n const raceWinner = await this.userLookup.findAnyUserByEmail(ec, profile.email);\n if (!raceWinner) throw error;\n return this.provisionExistingUser(\n ec,\n raceWinner,\n profile,\n connection,\n provisioningConfig,\n effectiveRoles,\n targetUserTypes,\n defaultAcquisitionChannel,\n );\n }\n throw error;\n }\n\n // AUTH-21: for a SCIM user created PENDING_VERIFICATION, send the verification email now that\n // the user + membership + identity link exist. Request-less context ⇒ the initiator resolves\n // the app's primary frontend URL from config for the `/confirm-email` link. Fail-safe: a send\n // failure is logged (not thrown) — the user is still created and can trigger a resend.\n if (requiresEmailVerification) {\n await this.emailVerificationInitiator.sendVerificationEmail({\n userId: result.user._id,\n email: result.user.email,\n firstName: profile.firstName,\n });\n this.logDebug('SCIM user created PENDING_VERIFICATION — verification email dispatched', {\n userId: result.user._id,\n scopeType: scope.scopeType,\n scopeId: scope.scopeId,\n });\n }\n\n // Audit log — only for SSO JIT provisioning (SCIM has its own audit at the controller level)\n if (connection.source !== ExternalIdentitySource.SCIM) {\n try {\n await this.auditLogsService.logUserSSOLogin({\n userId: result.user._id,\n email: profile.email,\n providerRef: connection.providerRef,\n connectionType: SsoConnectionType.ENTERPRISE,\n authSource: connection.source,\n scopeType: scope.scopeType,\n organizationId: getOrganizationIdFromEnterpriseScope(scope),\n applicationId: getApplicationIdFromEnterpriseScope(scope),\n ipAddress: 'system',\n userAgent: 'enterprise-provisioning',\n sessionId: `enterprise:${connection.providerRef}:${result.user._id}`,\n }, await this.authEcFactory.createForAuditRoutingOrFallback(\n ec,\n getOrganizationIdFromEnterpriseScope(scope),\n result.user._id,\n ));\n } catch {\n this.logDebug('Audit log for JIT provisioning failed (non-fatal)', {\n userId: result.user._id,\n });\n }\n }\n\n this.logDebug('New user provisioned via enterprise SSO JIT', {\n userId: result.user._id,\n scopeType: scope.scopeType,\n scopeId: scope.scopeId,\n roles: effectiveRoles,\n });\n\n return result;\n }\n\n /\n Resolve the exact types this enterprise provisioning operation may grant.\n \n Organization-type grants are authoritative and may contain several types. The exact caller\n * fallback is used only when no grant exists (including application-scoped SSO, whose scope id\n * is not an organization id). An empty result fails closed in the caller.\n /\n private async resolveProvisioningTargetTypes(\n scope: EnterpriseConnectionScope,\n targetContext: EnterpriseProvisioningTargetContext,\n ): Promise<string[]> {\n if (scope.scopeType === AuthScopeType.APPLICATION) {\n return targetContext.fallbackUserType ? [targetContext.fallbackUserType] : [];\n }\n\n const organization = await this.systemAccessService.readAsSystem<{\n type?: string;\n }>(CoreResourceType.ORGANIZATIONS, { _id: scope.organizationId });\n if (!organization) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n reason: 'enterprise_organization_scope_not_found',\n organizationId: scope.organizationId,\n },\n });\n }\n\n const organizationTypes = this.appConfigService.isInitialized()\n ? this.appConfigService.config.organizationTypes\n : undefined;\n if (organization.type && !organizationTypes?.[organization.type]) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n reason: 'enterprise_organization_type_definition_not_found',\n organizationId: scope.organizationId,\n organizationType: organization.type,\n },\n });\n }\n\n const orgGrantedUserTypes = organization.type\n ? organizationTypes?.[organization.type]?.userTypes ?? []\n : [];\n\n if (orgGrantedUserTypes.length > 0) {\n return [...new Set(orgGrantedUserTypes)];\n }\n return targetContext.fallbackUserType ? [targetContext.fallbackUserType] : [];\n }\n\n /\n Completes every existing-identity path through one policy and mutation sequence.\n \n The initial lookup, a second lookup after a denied new-user policy, and the duplicate-create\n * 409 recovery all converge here. This prevents race recovery from silently dropping status,\n * acquisition-channel, application-fallback, invitation, profile, membership, or link behavior.\n /\n private async provisionExistingUser(\n ec: ExecutionContext<any>,\n existingUserInput: User,\n profile: NormalizedUserProfile,\n connection: ProvisioningConnectionContext,\n _provisioningConfig: EnterpriseProvisioningConfig,\n effectiveRoles: string[],\n targetUserTypes: readonly string[],\n defaultAcquisitionChannel: RegistrationAcquisitionChannel,\n ): Promise<EnterpriseProvisionResult> {\n this.assertExistingUserProvisionable(existingUserInput, connection.source);\n const scope = this.requireEnterpriseScope(connection);\n\n const existingUserUnitOfWork =\n scope.scopeType === AuthScopeType.ORGANIZATION\n ? ORGANIZATION_EXISTING_USER_LINK_UNIT_OF_WORK\n : APPLICATION_EXISTING_USER_LINK_UNIT_OF_WORK;\n const result = await this.resourcePersistenceUnitOfWork.executeTransaction(\n existingUserUnitOfWork,\n async (serviceOptions) => {\n let existingUser = await this.servicesRegistryHandler.read<User>(\n CoreResourceType.USERS,\n ec,\n { _id: existingUserInput._id },\n serviceOptions,\n );\n if (!existingUser) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_FOUND,\n });\n }\n this.assertExistingUserProvisionable(existingUser, connection.source);\n\n let existingMembership: OrganizationMember \| null = null;\n if (scope.scopeType === AuthScopeType.ORGANIZATION) {\n existingMembership = await this.systemAccessService.readAsSystem<OrganizationMember>(\n CoreResourceType.ORGANIZATION_MEMBERS,\n {\n userId: existingUser._id,\n organizationId: scope.organizationId,\n },\n serviceOptions,\n );\n }\n\n const consumesInvitation =\n connection.source !== ExternalIdentitySource.SCIM\n && existingUser.status === UserStatus.PENDING_INVITATION;\n if (\n consumesInvitation\n && (\n scope.scopeType !== AuthScopeType.ORGANIZATION\n \|\| existingMembership?.status !== OrganizationMemberStatus.INVITED\n )\n ) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n context: {\n userStatus: existingUser.status,\n reason: 'enterprise_invitation_not_active_at_target_scope',\n },\n });\n }\n\n const acquisitionChannel = consumesInvitation\n ? RegistrationAcquisitionChannel.INVITATION\n : defaultAcquisitionChannel;\n const acquisition = evaluateUserTypeAcquisition(\n this.appConfigService.isInitialized()\n ? this.appConfigService.config.userTypes\n : undefined,\n targetUserTypes,\n existingUser.userTypes ?? [],\n acquisitionChannel,\n );\n if (!acquisition.allowed) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n context: {\n channel: acquisitionChannel,\n deniedUserTypes: acquisition.deniedUserTypes,\n targetUserTypes,\n },\n });\n }\n\n let orgMemberCreated = false;\n if (scope.scopeType === AuthScopeType.ORGANIZATION) {\n orgMemberCreated = await this.ensureOrgMembership(\n ec,\n existingUser,\n scope.organizationId,\n effectiveRoles,\n serviceOptions,\n acquisitionChannel,\n );\n }\n\n existingUser = await this.ensureAuthorizedTypesAssigned(\n ec,\n existingUser,\n targetUserTypes,\n serviceOptions,\n );\n\n if (existingUser.status === UserStatus.PENDING_INVITATION) {\n // SYSTEM door: `status` is `.excludeFromUpdate()`, so a handler write is stripped by the\n // repository's strict re-parse — the filter matches, the row comes back, and NOTHING is\n // persisted. The account stays PENDING_INVITATION while the caller sees success.\n // Enumerated with the sibling activations (email verification, invitation accept) per\n // `.claude/rules/invariant-call-site-enumeration.md`: the invariant is \"a `status` write\n // goes through the system door\", and it holds at every site or none. The compare-and-swap\n // is preserved — the filter still pins the observed status, so a concurrent activation\n // still loses the race below.\n const activated = await this.systemAccessService.updateAsSystem<User>(\n CoreResourceType.USERS,\n {\n _id: existingUser._id,\n status: UserStatus.PENDING_INVITATION,\n },\n { status: UserStatus.ACTIVE },\n serviceOptions,\n );\n if (!activated) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n context: { reason: 'enterprise_user_activation_race_lost' },\n });\n }\n existingUser = activated;\n }\n\n await this.createIdentityLink(\n ec,\n existingUser._id,\n profile,\n connection,\n serviceOptions,\n );\n\n return {\n user: existingUser,\n isNew: false,\n orgMemberCreated,\n mappedRoles: effectiveRoles,\n };\n },\n );\n\n await ensureUserProfileFromIdentityProfile(ec, {\n userId: result.user._id,\n profile,\n servicesRegistryHandler: this.servicesRegistryHandler,\n systemAccessService: this.systemAccessService,\n logger: this.logger,\n });\n this.logDebug('Existing user linked via enterprise provisioning', {\n userId: result.user._id,\n scopeType: scope.scopeType,\n scopeId: scope.scopeId,\n orgMemberCreated: result.orgMemberCreated,\n });\n await this._reconcileLocalCredentialsForDirectoryManaged(result.user._id);\n\n return result;\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Private: Fail-Closed Status Gate (S0.7 — enterprise sibling)\n // ═══════════════════════════════════════════════════════════════\n\n /\n Fail-closed status gate for an existing user resolved by email during enterprise\n * provisioning — the shared guard for every {@link provisionEnterpriseUser} entry point (enterprise\n * SSO/OIDC JIT, SAML ACS, and SCIM `POST /Users` + bulk).\n \n Only two statuses may proceed:\n * - `ACTIVE` — link the enterprise identity and (re)assert org membership directly.\n * - `PENDING_INVITATION` — the org-admin-provisioned invitee's first IdP login; the caller\n * activates the account (`PENDING_INVITATION → ACTIVE`) and consumes the `INVITED` membership.\n \n Every other status is a hard stop, thrown BEFORE any membership or identity-link side effect:\n * - `INACTIVE` / `SUSPENDED` / `DELETED` — a deprovisioned account must not regain an active\n * organization membership, an IdP identity link, or (via SAML/OIDC token issuance) a session\n * by re-authenticating through the IdP or being re-pushed by SCIM.\n * - `PENDING_VERIFICATION` — self-registration email verification is a separate flow; the\n * invite gate is deliberately not widened to it (mirrors the social-OAuth S0.7 gate).\n \n ### Why the gate lives HERE, not only in the callers\n * This service is the single choke point all three surfaces funnel through, and the downstream\n * token issuer is NOT a gate: `AuthTokenIssuerBackendService` reads `user.status` only to derive\n * the `emailVerified` claim and mints tokens for whatever `userId` it is handed. Placing the\n * gate at this shared seam closes the sibling gap on all three surfaces at once, where the\n * caller-side guards do not:\n * - SAML's own post-provision status check fires only AFTER `provisionEnterpriseUser` already created the\n * membership + identity link — so without this gate the token is blocked but the side effects leak.\n * - SCIM has no status gate at all.\n * - The OIDC callback issues tokens without re-checking status, and its pre-provision gate is\n * skipped entirely when `autoLinkByEmail` is disabled for all user types.\n \n Mirrors the fail-closed gate in `OAuth2AuthenticationBackendService.provisionOrLinkUser`.\n \n @throws AUTHENTICATION / `AUTHENTICATION_ACCOUNT_LOCKED` when the status is not provisionable.\n /\n private assertExistingUserProvisionable(existingUser: User, source: ProvisioningConnectionContext['source']): void {\n if (existingUser.status !== UserStatus.ACTIVE && existingUser.status !== UserStatus.PENDING_INVITATION) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n context: { userStatus: existingUser.status, source },\n });\n }\n }\n\n /\n AUTH-24 reconciliation: a user provisioned into a directory-MANAGED org (the SCIM push implies a live\n * SCIM token + DIRECTORY_PROVISIONING for the org) must not retain a LOCAL first-factor credential — a\n * password or an enrolled passkey would survive IdP deprovisioning (the deprovisioning bypass). Physically\n * clear BOTH on the user's `USER_CREDENTIALS` row. TOTP / backup codes are SECOND factors (they sit ON TOP\n * of the IdP first factor) and are intentionally left intact. `updateAsSystem` re-attaches the cleared\n * backend-only fields past the strict request-DTO parse (mirrors the TOTP-disable clear in\n * `auth-method-management`), and `passwordHash` is `.nullish()` in `UserCredentialsSchema` so the `null`\n * destroy-write ALSO round-trips the service-layer OUTPUT projection (`transformOutput` →\n * `internalDto.parse`, which re-validates the persisted doc against the full schema) instead of throwing\n * `service_resource_transformation_failed` on the after-image. No-ops when the user has no credential\n * row. Best-effort: a failure is logged, NEVER thrown —\n * reconciliation must not fail the SCIM provisioning that added the user. The effective policy already\n * renders these methods DORMANT for a managed user (`resolveEffectiveAuthPolicy`); this is the\n * compliance-grade DESTRUCTION on top (chosen over dormant-only). See\n * `.claude/plans/auth-24-credential-lifecycle.md`.\n /\n private async _reconcileLocalCredentialsForDirectoryManaged(userId: string): Promise<void> {\n try {\n await this.systemAccessService.updateAsSystem(CoreResourceType.USER_CREDENTIALS, { userId }, {\n passwordHash: null,\n passkeyCredentials: [],\n });\n } catch (error) {\n // Best-effort reconciliation: never throws. Project the caught value into flat,\n // structured, raw-JSON log fields — the thrown error here is a `WildoError_Backend`\n // (a plain object, NOT an `Error` instance), so `JSON.stringify(error)` would have\n // emitted a doubly-escaped, un-greppable blob under a single `error` key.\n this.logger.warn('AUTH-24: failed to reconcile local credentials for a directory-managed user', {\n userId,\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n /\n AUTH-24 bulk reconciliation: when an org ACTIVATES SCIM (mints a live token → becomes actively\n * directory-managed), reconcile the local credentials of every ALREADY-IdP-PROVISIONED member now, rather\n * than waiting for each user's next SCIM sync. \"Provisioned\" = has a `USER_IDENTITY_LINKS` row for this org\n * (SSO-JIT users who predate the SCIM token are the realistic set; a locally-invited member has no link and\n * is EXEMPT — the provisioned-only decision). Idempotent (re-sweeping an already-cleared user is a no-op)\n * and best-effort (logged, never thrown — must not fail the token mint). Part 1 (`resolveEffectiveAuthPolicy`)\n * already renders these members dormant the moment the org is managed; this brings the physical DESTRUCTION\n * forward to activation time. See `.claude/plans/auth-24-credential-lifecycle.md`.\n /\n public async sweepDirectoryManagedCredentialsForOrg(organizationId: string): Promise<void> {\n try {\n const links = await this.systemAccessService.listAsSystem<{ userId: string }>(\n CoreResourceType.USER_IDENTITY_LINKS,\n { organizationId },\n );\n const linkArr = Array.isArray(links) ? links : links.data;\n const userIds = [...new Set(linkArr.map((l) => l.userId).filter((id): id is string => !!id))];\n for (const userId of userIds) {\n await this._reconcileLocalCredentialsForDirectoryManaged(userId);\n }\n if (userIds.length > 0) {\n this.logDebug('AUTH-24: swept local credentials on SCIM activation', { organizationId, memberCount: userIds.length });\n }\n } catch (error) {\n // Same best-effort treatment as the per-user path: structured, raw-JSON fields so a\n // thrown `WildoError_Backend` (a plain object, not an `Error`) keeps its full detail\n // instead of collapsing to `String(error)` (`'[object Object]'`).\n this.logger.warn('AUTH-24: bulk credential sweep on SCIM activation failed', {\n organizationId,\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Update Org User (used by SCIM Step 20)\n // ═══════════════════════════════════════════════════════════════\n\n /\n Update an existing org user's profile attributes.\n * FUTURE: Called by SCIM PATCH/PUT handlers (Step 20).\n /\n public async updateOrgUser(\n userId: string,\n attrs: Partial<{ firstName: string; lastName: string; displayName: string; avatarUrl: string }>,\n _orgConfig: EnterpriseProvisioningConfig,\n ): Promise<void> {\n const ec = await this.getInternalExecutionContext();\n\n try {\n const existingProfile = await this.servicesRegistryHandler.read(CoreResourceType.USER_PROFILES, ec, { userId });\n if (existingProfile) {\n await this.systemAccessService.updateAsSystem(CoreResourceType.USER_PROFILES, (existingProfile as any)._id, attrs);\n return;\n }\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n this.logDebug('User profile update failed (non-fatal)', { userId });\n return;\n }\n\n // AUTH-18 (SCIM upsert / reconcile-on-every-provision): no profile exists yet, so a SCIM PUT/PATCH\n // that would otherwise SILENTLY NO-OP (there is nothing to update) instead CREATES the profile from\n // the pushed attributes — correct PUT semantics, and the convergence path for a SCIM-managed user\n // who never authenticates interactively (so never hits the login reconcile). Name-guarded +\n // best-effort via the shared ensure util (create-if-absent; the primary UPDATE above still surfaces\n // structured errors to the SCIM caller — only the convergence create is best-effort).\n await ensureUserProfileFromIdentityProfile(ec, {\n userId,\n profile: attrs,\n servicesRegistryHandler: this.servicesRegistryHandler,\n systemAccessService: this.systemAccessService,\n logger: this.logger,\n });\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Deactivate Org User (used by SCIM Step 20)\n // ═══════════════════════════════════════════════════════════════\n\n /\n Deactivate an org user (set status to INACTIVE).\n * FUTURE: Called by SCIM DELETE or status-change handlers (Step 20).\n /\n public async deactivateOrgUser(\n userId: string,\n organizationId: string,\n provisioningConfig: EnterpriseProvisioningConfig,\n ): Promise<void> {\n // Honor the SCIM config's `autoDeactivateUsers`. `undefined` (SSO/SAML paths, and any config\n // that predates the field) means \"deactivate\" — the historical unconditional behaviour — so\n // only an explicit `false` (a deliberate SCIM-admin choice: the directory pushes removals but\n // the org offboards elsewhere) turns a directory removal into a no-op.\n if (provisioningConfig.autoDeactivateUsers === false) {\n this.logDebug('SCIM deactivation skipped — autoDeactivateUsers is disabled for this scope', {\n userId,\n organizationId,\n });\n return;\n }\n\n const ec = await this.getInternalExecutionContext();\n\n const user = await this.servicesRegistryHandler.read<User>(CoreResourceType.USERS, ec, { _id: userId });\n if (user) {\n // `status` is `.excludeFromUpdate()`; a handler write is stripped by the repository's strict\n // re-parse, which would leave a deprovisioned directory user fully ACTIVE. The system door\n // re-attaches it.\n await this.systemAccessService.updateAsSystem(CoreResourceType.USERS, userId, { status: UserStatus.INACTIVE });\n\n // M9 fix: Also deactivate the org membership so the user loses org roles\n try {\n const membership = await this.servicesRegistryHandler.read(\n CoreResourceType.ORGANIZATION_MEMBERS,\n ec,\n { userId, organizationId },\n );\n if (membership) {\n // `updateAsSystem`, NOT the plain service-tier `update`. `OrganizationMemberSchema.status`\n // is `.excludeFromCreate().excludeFromUpdate()`, so the strict update DTO drops it — the\n // plain door persisted NOTHING here while still returning a row and logging success, and\n // the offboarded user kept an ACTIVE membership and therefore every organization role\n // (`execution-context-creator` builds `initiatorRoles` from ACTIVE memberships). Only\n // `updateAsSystem` re-attaches `.excludeFromUpdate()` fields past that strip, via\n // `deriveWritePreserveFields` — the same reason the identity-link update below uses it,\n // and the door invitation acceptance already uses to flip this very field.\n // Pinned by `scim-deprovision-membership-status-write.mongo.integration.test.ts`.\n //\n // NOTE the sibling `USERS` write above is correct as-is: `User.status` carries no\n // `.excludeFromUpdate()`, so the plain door persists it.\n await this.systemAccessService.updateAsSystem(\n CoreResourceType.ORGANIZATION_MEMBERS,\n (membership as any)._id,\n { status: OrganizationMemberStatus.INACTIVE },\n { scopeContext: { organizationId } },\n );\n this.logDebug('Org membership deactivated', { userId, organizationId });\n }\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n this.logDebug('Org membership deactivation skipped (ORGANIZATION_MEMBERS repo may not exist)', { userId });\n }\n\n // W5.12: Revoke user types granted by this org when deprovisioned\n try {\n if (this.appConfigService.isInitialized()) {\n const organizationTypes = (this.appConfigService.config as { organizationTypes?: Record<string, { userTypes?: string[] }> })?.organizationTypes;\n const userTypesConfig = (this.appConfigService.config as { userTypes?: Record<string, { requiresOrgMembership?: { orgTypes: string[] } }> })?.userTypes;\n await revokeUserTypesOnOrgLeave(ec, {\n userId,\n organizationId,\n organizationTypes,\n userTypesConfig,\n servicesRegistryHandler: this.servicesRegistryHandler,\n onUserTypesRevoked: async (uid) => {\n await this.tokenIssuer.invalidateAllTokensForUser(uid);\n },\n });\n }\n } catch (revokeError) {\n if (isWildoBackendError(revokeError)) throw revokeError;\n this.logDebug('User type revocation on deactivation skipped (non-fatal)', { userId });\n }\n\n this.logDebug('User deactivated via enterprise provisioning', { userId });\n }\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Role Mapping\n // ═══════════════════════════════════════════════════════════════\n\n /\n Map IdP role claims to organization roles using the org's roleMapping configuration.\n \n L9 fix: Added optional `allowedOrgRoles` parameter. When provided, mapped roles\n * that are not in the allowed list are silently dropped and logged. This prevents\n * a misconfigured role mapping from assigning arbitrary role identifiers (e.g., SUPER_ADMIN).\n \n @param idpRoles - Roles from the IdP claims (OIDC roles claim or SAML attribute)\n * @param roleMapping - Org's IdP role → org role mapping (e.g., { \"admin\": \"ORG_ADMIN\", \"viewer\": \"VIEWER\" })\n * @param allowedOrgRoles - Optional allowlist of valid org roles. If provided, mapped roles not in this list are rejected.\n * @returns Mapped org role identifiers\n /\n public mapRoles(idpRoles: string[], roleMapping: Record<string, string>, allowedOrgRoles?: string[]): string[] {\n if (!idpRoles.length \|\| !Object.keys(roleMapping).length) return [];\n\n const mappedRoles: string[] = [];\n for (const idpRole of idpRoles) {\n const orgRole = roleMapping[idpRole];\n if (orgRole && !mappedRoles.includes(orgRole)) {\n if (allowedOrgRoles && !allowedOrgRoles.includes(orgRole)) {\n this.logDebug('Mapped role rejected — not in allowed org roles', { idpRole, mappedRole: orgRole });\n continue;\n }\n mappedRoles.push(orgRole);\n }\n }\n return mappedRoles;\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Private: Org Membership\n // ═══════════════════════════════════════════════════════════════\n\n /\n Ensure the user is a member of the organization.\n * If they're already a member, no-op. If not, create the membership.\n \n @returns true if a new membership was created\n /\n private async ensureOrgMembership(\n ec: ExecutionContext<any>,\n user: User,\n organizationId: string,\n roles: string[],\n serviceOptions: ServiceOptions,\n acquisitionChannel: RegistrationAcquisitionChannel =\n RegistrationAcquisitionChannel.ADMINISTRATIVE_PROVISIONING,\n ): Promise<boolean> {\n const existingMember = await this.systemAccessService.readAsSystem<OrganizationMember>(\n CoreResourceType.ORGANIZATION_MEMBERS,\n { userId: user._id, organizationId },\n serviceOptions,\n );\n if (existingMember) {\n if (existingMember.status === OrganizationMemberStatus.ACTIVE) {\n this.logDebug('User already has an active organization membership', {\n userId: user._id,\n organizationId,\n });\n return false;\n }\n\n if (existingMember.status !== OrganizationMemberStatus.INVITED) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n context: {\n reason: 'enterprise_membership_not_activatable',\n membershipId: existingMember._id,\n membershipStatus: existingMember.status,\n userId: user._id,\n organizationId,\n },\n });\n }\n\n if (acquisitionChannel === RegistrationAcquisitionChannel.INVITATION) {\n const acceptance = await applyInvitationAcceptanceCore(ec, {\n membership: existingMember,\n user,\n appConfigService: this.appConfigService,\n errorBuilder: this.errorBuilder,\n servicesRegistryHandler: this.servicesRegistryHandler,\n systemAccessService: this.systemAccessService,\n serviceOptions,\n logDebug: this.logDebug,\n });\n if (!acceptance.membershipActivated) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n context: {\n reason: 'enterprise_invitation_revoked_during_acceptance',\n membershipId: existingMember._id,\n userId: user._id,\n organizationId,\n },\n });\n }\n } else {\n const activated = await this.systemAccessService.updateAsSystem<OrganizationMember>(\n CoreResourceType.ORGANIZATION_MEMBERS,\n {\n _id: existingMember._id,\n status: OrganizationMemberStatus.INVITED,\n },\n { status: OrganizationMemberStatus.ACTIVE },\n serviceOptions,\n );\n if (!activated) {\n throw this.errorBuilder.buildError(ErrorType.CONFLICT, undefined, {\n context: {\n reason: 'enterprise_membership_activation_race_lost',\n membershipId: existingMember._id,\n userId: user._id,\n organizationId,\n },\n });\n }\n await grantUserTypesOnOrgJoin(ec, {\n userId: user._id,\n organizationId,\n organizationTypes: this.appConfigService.isInitialized()\n ? this.appConfigService.config.organizationTypes\n : undefined,\n servicesRegistryHandler: this.servicesRegistryHandler,\n systemAccessService: this.systemAccessService,\n serviceOptions,\n });\n }\n\n this.logDebug('Pending organization membership activated via enterprise provisioning', {\n userId: user._id,\n organizationId,\n acquisitionChannel,\n });\n return true;\n }\n\n let effectiveRoles = [...roles];\n const organizationTypes = this.appConfigService.isInitialized()\n ? this.appConfigService.config.organizationTypes\n : undefined;\n if (effectiveRoles.length === 0 && organizationTypes) {\n const organization = await this.systemAccessService.readAsSystem<{ type?: string }>(\n CoreResourceType.ORGANIZATIONS,\n { _id: organizationId },\n serviceOptions,\n );\n const defaultRole = organization?.type\n ? organizationTypes[organization.type]?.defaultMemberRole\n : undefined;\n if (defaultRole) effectiveRoles = [defaultRole];\n }\n if (effectiveRoles.length > 0 && organizationTypes) {\n await validateOrgMemberRoles(ec, {\n organizationId,\n roles: effectiveRoles,\n organizationTypes,\n servicesRegistryHandler: this.servicesRegistryHandler,\n errorBuilder: this.errorBuilder,\n serviceOptions,\n });\n }\n\n // The system-access write preserves the context foreign keys that the\n // client-shaped CREATE DTO intentionally strips.\n await this.systemAccessService.createAsSystem<OrganizationMember>(\n CoreResourceType.ORGANIZATION_MEMBERS,\n {\n userId: user._id,\n organizationId,\n roles: effectiveRoles.length > 0 ? effectiveRoles : undefined,\n status: OrganizationMemberStatus.ACTIVE,\n },\n serviceOptions,\n );\n\n this.logDebug('Organization membership created', {\n userId: user._id,\n organizationId,\n roles: effectiveRoles,\n });\n return true;\n }\n\n /\n Add only the policy-authorized acquisition delta inside the caller's transaction.\n \n The re-read prevents a stale caller snapshot from overwriting grants applied by\n * the membership-create postfix in the same database unit of work.\n /\n private async ensureAuthorizedTypesAssigned(\n ec: ExecutionContext<any>,\n user: User,\n authorizedUserTypes: readonly string[],\n serviceOptions: ServiceOptions,\n ): Promise<User> {\n const currentUser = await this.servicesRegistryHandler.read<User>(\n CoreResourceType.USERS,\n ec,\n { _id: user._id },\n serviceOptions,\n );\n if (!currentUser) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n context: {\n reason: 'enterprise_user_missing_during_type_assignment',\n userId: user._id,\n },\n });\n }\n\n const currentTypes = currentUser.userTypes ?? [];\n const missingTypes = [...new Set(authorizedUserTypes)]\n .filter((userType) => !currentTypes.includes(userType));\n if (missingTypes.length === 0) return currentUser;\n\n const updatedUser = await this.servicesRegistryHandler.update<User>(\n CoreResourceType.USERS,\n ec,\n currentUser._id,\n { userTypes: [...currentTypes, ...missingTypes] },\n serviceOptions,\n );\n if (!updatedUser) {\n throw this.errorBuilder.buildError(ErrorType.CONFLICT, undefined, {\n context: {\n reason: 'enterprise_user_type_assignment_failed',\n userId: user._id,\n missingTypes,\n },\n });\n }\n return updatedUser;\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Private: Identity Link\n // ═══════════════════════════════════════════════════════════════\n\n private async createIdentityLink(\n ec: ExecutionContext<any>,\n userId: string,\n profile: NormalizedUserProfile,\n connection: ProvisioningConnectionContext,\n serviceOptions: ServiceOptions,\n ): Promise<void> {\n const scope = this.requireEnterpriseScope(connection);\n const scopeFilter = scope.scopeType === AuthScopeType.ORGANIZATION\n ? { organizationId: scope.organizationId }\n : { applicationId: scope.applicationId };\n const existingLink = await this.systemAccessService.readAsSystem<UserIdentityLink>(\n CoreResourceType.USER_IDENTITY_LINKS,\n {\n providerRef: connection.providerRef,\n providerUserId: profile.providerUserId,\n connectionType: SsoConnectionType.ENTERPRISE,\n scopeType: scope.scopeType,\n connectionId: scope.connectionId,\n ...scopeFilter,\n },\n serviceOptions,\n );\n\n if (existingLink) {\n if (existingLink.userId !== userId) {\n throw this.errorBuilder.buildError(ErrorType.CONFLICT, undefined, {\n context: {\n reason: 'enterprise_identity_already_linked_to_another_user',\n identityLinkId: existingLink._id,\n linkedUserId: existingLink.userId,\n attemptedUserId: userId,\n scopeType: scope.scopeType,\n scopeId: scope.scopeId,\n connectionId: scope.connectionId,\n },\n });\n }\n const previousEmail = existingLink.providerEmail?.toLowerCase();\n const newEmail = profile.email?.toLowerCase();\n const emailChanged = previousEmail != null && newEmail != null && previousEmail !== newEmail;\n\n // `lastUsedAt` (`.excludeFromUpdate()`) and `providerRawProfile` (`.isBackendOnly()`)\n // are re-attached past the strict-DTO strip automatically by `updateAsSystem`\n // (`deriveTrustedSystemWritePreservedFields` preserves authored excludeFromUpdate +\n // backend-only fields), so the \"last used\" timestamp advances without a manual\n // `preserveServerInjectedFields`.\n await this.systemAccessService.updateAsSystem(\n CoreResourceType.USER_IDENTITY_LINKS,\n existingLink._id,\n {\n lastUsedAt: new Date(),\n providerEmail: profile.email,\n providerDisplayName: profile.displayName,\n providerAvatarUrl: profile.avatarUrl,\n providerRawProfile: profile.rawClaims,\n },\n serviceOptions,\n );\n\n if (emailChanged && connection.source === ExternalIdentitySource.SAML) {\n const organizationId = getOrganizationIdFromEnterpriseScope(scope);\n this.auditLogsService.logSAMLEvent(\n CoreAuditableEventType.SAML_EMAIL_CHANGED,\n ResourceOperationRiskLevel.MEDIUM,\n {\n userId: existingLink.userId,\n organizationId,\n applicationId: getApplicationIdFromEnterpriseScope(scope),\n connectionId: scope.connectionId,\n providerRef: connection.providerRef,\n previousEmail,\n newEmail,\n },\n await this.authEcFactory.createForAuditRoutingOrFallback(ec, organizationId, existingLink.userId),\n ).catch(() => { / fire-and-forget / });\n }\n return;\n }\n\n await this.systemAccessService.createAsSystem(\n CoreResourceType.USER_IDENTITY_LINKS,\n {\n userId,\n connectionType: SsoConnectionType.ENTERPRISE,\n providerRef: connection.providerRef,\n providerUserId: profile.providerUserId,\n providerEmail: profile.email,\n providerDisplayName: profile.displayName,\n providerAvatarUrl: profile.avatarUrl,\n providerRawProfile: profile.rawClaims,\n scopeType: scope.scopeType,\n organizationId: getOrganizationIdFromEnterpriseScope(scope),\n applicationId: getApplicationIdFromEnterpriseScope(scope),\n connectionId: scope.connectionId,\n source: connection.source,\n },\n serviceOptions,\n );\n }\n\n /\n Enterprise provisioning is never meaningful without the exact connection scope.\n * Rejecting a missing scope here prevents a resolver defect from degrading into an\n * application-wide identity link or an organization-free membership mutation.\n /\n private requireEnterpriseScope(\n connection: ProvisioningConnectionContext,\n ): EnterpriseConnectionScope {\n if (!connection.scope) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n reason: 'enterprise_connection_scope_missing',\n providerRef: connection.providerRef,\n source: connection.source,\n },\n });\n }\n return connection.scope;\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Private: Execution Context\n // ═══════════════════════════════════════════════════════════════\n\n /\n System-level EC for enterprise user provisioning (SCIM/JIT).\n * Uses INTERNALLY_INITIATED_REQUEST with APP_ADMIN_SUPER_ADMIN —\n * these operations act on behalf of the system, not a specific user.\n * Primary intent: user creation/provisioning from enterprise IdP.\n */\n private async getInternalExecutionContext(): Promise<ExecutionContext<any>> {\n return this.authEcFactory.createForSystemAuthOperation(this.authEcFactory.getUsersCreateOperationPath());\n }\n}\n"]}
1	+ {"version":3,"file":"enterprise-user-provisioning.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAI9G,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAIhK,OAAO,EACL,2CAA2C,EAC3C,sCAAsC,EACtC,4CAA4C,EAC5C,uCAAuC,GACxC,MAAM,4FAA4F,CAAC;AAGpG,OAAO,EAAE,oCAAoC,EAAE,MAAM,8FAA8F,CAAC;AAEpJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,6EAA6E,CAAC;AACtH,OAAO,EAAE,6BAA6B,EAAE,MAAM,+EAA+E,CAAC;AAC9H,OAAO,EAAE,sBAAsB,EAAE,MAAM,qFAAqF,CAAC;AAC7H,OAAO,EAAE,yBAAyB,EAAE,MAAM,2FAA2F,CAAC;AACtI,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,6BAA6B,EAAE,MAAM,gFAAgF,CAAC;AAE/H,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,SAAS,EACT,2BAA2B,EAC3B,0BAA0B,EAC1B,cAAc,EACd,iBAAiB,EAEjB,UAAU,EACV,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,8BAA8B,EAC9B,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAI/B,mGAAmG;AACnG,yGAAyG;AACzG,OAAO,EACL,mCAAmC,EACnC,oCAAoC,GACrC,MAAM,mFAAmF,CAAC;AA2BpF,IAAM,wCAAwC,GAA9C,MAAM,wCAAwC;IAIG;IACa;IACW;IACH;IACZ;IACC;IACA;IACK;IAOF;IAKc;IAE9D;IAMqD;IA9BvD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EAC7B,uBAA8D,EACjE,aAAwD,EACpE,WAA0C,EACzC,gBAAyC,EACzC,gBAAyC,EACpC,UAAwC,EAO1C,mBAA+C,EAKjC,0BAAoE,EAElI,6BAA0E,EAMrB,iBAAkD;QA3BpE,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,4BAAuB,GAAvB,uBAAuB,CAAuC;QACjE,kBAAa,GAAb,aAAa,CAA2C;QACpE,gBAAW,GAAX,WAAW,CAA+B;QACzC,qBAAgB,GAAhB,gBAAgB,CAAyB;QACzC,qBAAgB,GAAhB,gBAAgB,CAAyB;QACpC,eAAU,GAAV,UAAU,CAA8B;QAO1C,wBAAmB,GAAnB,mBAAmB,CAA4B;QAKjC,+BAA0B,GAA1B,0BAA0B,CAA0C;QAElI,kCAA6B,GAA7B,6BAA6B,CAA6C;QAMrB,sBAAiB,GAAjB,iBAAiB,CAAiC;QAExH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;IACvE,CAAC;IAED,kEAAkE;IAClE,0BAA0B;IAC1B,kEAAkE;IAElE;;;;;;;;;;OAUG;IACI,KAAK,CAAC,uBAAuB,CAClC,OAA8B,EAC9B,UAAyC,EACzC,kBAAgD,EAChD,gBAAqD,EAAE;QAEvD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAEtD,yBAAyB;QACzB,IAAI,kBAAkB,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YAC/D,IAAI,CAAC,WAAW,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;iBACjF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,iFAAiF;QACjF,sFAAsF;QACtF,wFAAwF;QACxF,oFAAoF;QACpF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAEjF,gBAAgB;QAChB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAC/B,OAAO,CAAC,KAAK,IAAI,EAAE,EACnB,kBAAkB,CAAC,WAAW,IAAI,EAAE,EACpC,kBAAkB,CAAC,eAAe,CACnC,CAAC;QACF,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC;YAC3C,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7E,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC/D,KAAK,EACL,aAAa,CACd,CAAC;QACF,MAAM,yBAAyB,GAAG,UAAU,CAAC,MAAM,KAAK,sBAAsB,CAAC,IAAI;YACjF,CAAC,CAAC,8BAA8B,CAAC,2BAA2B;YAC5D,CAAC,CAAC,8BAA8B,CAAC,kBAAkB,CAAC;QAEtD,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,qBAAqB,CAC/B,EAAE,EACF,YAAY,EACZ,OAAO,EACP,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,yBAAyB,CAC1B,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,4FAA4F;QAC5F,0FAA0F;QAC1F,gDAAgD;QAChD,MAAM,WAAW,GAAG,2BAA2B,CAC7C,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE;YACnC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS;YACxC,CAAC,CAAC,SAAS,EACb,eAAe,EACf,EAAE,EACF,yBAAyB,CAC1B,CAAC;QACF,IACE,WAAW,CAAC,sBAAsB,CAAC,MAAM,KAAK,CAAC;eAC5C,CAAC,WAAW,CAAC,OAAO,EACvB,CAAC;YACD,0FAA0F;YAC1F,2FAA2F;YAC3F,yFAAyF;YACzF,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CACrE,EAAE,EACF,OAAO,CAAC,KAAK,CACd,CAAC;YACF,IAAI,sBAAsB,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,qBAAqB,CAC/B,EAAE,EACF,sBAAsB,EACtB,OAAO,EACP,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,yBAAyB,CAC1B,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;gBACzE,OAAO,EAAE;oBACP,OAAO,EAAE,yBAAyB;oBAClC,eAAe,EAAE,WAAW,CAAC,eAAe;oBAC5C,eAAe;iBAChB;aACF,CAAC,CAAC;QACL,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC,kBAAkB,CAAC,eAAe,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;aAClF,CAAC,CAAC;QACL,CAAC;QAED,4FAA4F;QAC5F,8FAA8F;QAC9F,+FAA+F;QAC/F,+FAA+F;QAC/F,+FAA+F;QAC/F,2FAA2F;QAC3F,8FAA8F;QAC9F,4BAA4B;QAC5B,MAAM,yBAAyB,GAC7B,UAAU,CAAC,MAAM,KAAK,sBAAsB,CAAC,IAAI,IAAI,kBAAkB,CAAC,eAAe,KAAK,KAAK,CAAC;QAEpG,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,wDAAwD;QACxD,MAAM,kBAAkB,GACtB,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;YAC5C,CAAC,CAAC,uCAAuC;YACzC,CAAC,CAAC,sCAAsC,CAAC;QAC7C,IAAI,MAAiC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,kBAAkB,CAClE,kBAAkB,EAClB,KAAK,EAAE,cAAc,EAAE,EAAE;gBACvB,IAAI,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CACrD,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF;oBACE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE;oBAClC,MAAM,EAAE,yBAAyB;wBAC/B,CAAC,CAAC,UAAU,CAAC,oBAAoB;wBACjC,CAAC,CAAC,UAAU,CAAC,MAAM;oBACrB,QAAQ,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBACnC,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW;wBACtD,CAAC,CAAC,eAAe;wBACjB,CAAC,CAAC,EAAE;iBACP,EACD,cAAc,CACf,CAAC;gBAEF,IAAI,gBAAgB,GAAG,KAAK,CAAC;gBAC7B,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,EAAE,CAAC;oBACnD,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAC/C,EAAE,EACF,OAAO,EACP,KAAK,CAAC,cAAc,EACpB,cAAc,EACd,cAAc,CACf,CAAC;oBAEF,+DAA+D;oBAC/D,qEAAqE;oBACrE,yDAAyD;oBACzD,OAAO,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAChD,EAAE,EACF,OAAO,EACP,eAAe,EACf,cAAc,CACf,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,CAAC,kBAAkB,CAC3B,EAAE,EACF,OAAO,CAAC,GAAG,EACX,OAAO,EACP,UAAU,EACV,cAAc,CACf,CAAC;gBAEF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC3D,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EACpB,cAAc,CACf,CAAC;gBACF,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;wBAChE,OAAO,EAAE,EAAE,MAAM,EAAE,mDAAmD,EAAE;qBACzE,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO;oBACL,IAAI,EAAE,aAAa;oBACnB,KAAK,EAAE,IAAI;oBACX,gBAAgB;oBAChB,WAAW,EAAE,cAAc;iBAC5B,CAAC;YACJ,CAAC,EACD;gBACE,kEAAkE;gBAClE,qEAAqE;gBACrE,sEAAsE;gBACtE,2BAA2B,EAAE;oBAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC;aACF,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC3D,+DAA+D;gBAC/D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC/E,IAAI,CAAC,UAAU;oBAAE,MAAM,KAAK,CAAC;gBAC7B,OAAO,IAAI,CAAC,qBAAqB,CAC/B,EAAE,EACF,UAAU,EACV,OAAO,EACP,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,yBAAyB,CAC1B,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,8FAA8F;QAC9F,6FAA6F;QAC7F,8FAA8F;QAC9F,uFAAuF;QACvF,IAAI,yBAAyB,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,0BAA0B,CAAC,qBAAqB,CAAC;gBAC1D,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;gBACvB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;gBACxB,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,wEAAwE,EAAE;gBACtF,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;gBACvB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;QAED,6FAA6F;QAC7F,IAAI,UAAU,CAAC,MAAM,KAAK,sBAAsB,CAAC,IAAI,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;oBAC1C,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;oBACvB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,cAAc,EAAE,iBAAiB,CAAC,UAAU;oBAC5C,UAAU,EAAE,UAAU,CAAC,MAAM;oBAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,cAAc,EAAE,oCAAoC,CAAC,KAAK,CAAC;oBAC3D,aAAa,EAAE,mCAAmC,CAAC,KAAK,CAAC;oBACzD,SAAS,EAAE,QAAQ;oBACnB,SAAS,EAAE,yBAAyB;oBACpC,SAAS,EAAE,cAAc,UAAU,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;iBACrE,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,+BAA+B,CACzD,EAAE,EACF,oCAAoC,CAAC,KAAK,CAAC,EAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,CAChB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,QAAQ,CAAC,mDAAmD,EAAE;oBACjE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;iBACxB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE;YAC3D,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;YACvB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,cAAc;SACtB,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,8BAA8B,CAC1C,KAAgC,EAChC,aAAkD;QAElD,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;YAClD,OAAO,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAE7D,gBAAgB,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,MAAM,EAAE,yCAAyC;oBACjD,cAAc,EAAE,KAAK,CAAC,cAAc;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE;YAC7D,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,iBAAiB;YAChD,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,YAAY,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,MAAM,EAAE,mDAAmD;oBAC3D,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,gBAAgB,EAAE,YAAY,CAAC,IAAI;iBACpC;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,mBAAmB,GAAG,YAAY,CAAC,IAAI;YAC3C,CAAC,CAAC,iBAAiB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,SAAS,IAAI,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;QAEP,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,qBAAqB,CACjC,EAAyB,EACzB,iBAAuB,EACvB,OAA8B,EAC9B,UAAyC,EACzC,mBAAiD,EACjD,cAAwB,EACxB,eAAkC,EAClC,yBAAyD;QAEzD,IAAI,CAAC,+BAA+B,CAAC,iBAAiB,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAEtD,MAAM,sBAAsB,GAC1B,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;YAC5C,CAAC,CAAC,4CAA4C;YAC9C,CAAC,CAAC,2CAA2C,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,kBAAkB,CACxE,sBAAsB,EACtB,KAAK,EAAE,cAAc,EAAE,EAAE;YACvB,IAAI,YAAY,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACxD,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,GAAG,EAAE,iBAAiB,CAAC,GAAG,EAAE,EAC9B,cAAc,CACf,CAAC;YACF,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;iBAClF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,+BAA+B,CAAC,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YAEtE,IAAI,kBAAkB,GAA8B,IAAI,CAAC;YACzD,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,EAAE,CAAC;gBACnD,kBAAkB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAC9D,gBAAgB,CAAC,oBAAoB,EACrC;oBACE,MAAM,EAAE,YAAY,CAAC,GAAG;oBACxB,cAAc,EAAE,KAAK,CAAC,cAAc;iBACrC,EACD,cAAc,CACf,CAAC;YACJ,CAAC;YAED,MAAM,kBAAkB,GACtB,UAAU,CAAC,MAAM,KAAK,sBAAsB,CAAC,IAAI;mBAC9C,YAAY,CAAC,MAAM,KAAK,UAAU,CAAC,kBAAkB,CAAC;YAC3D,IACE,kBAAkB;mBACf,CACD,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;uBAC3C,kBAAkB,EAAE,MAAM,KAAK,wBAAwB,CAAC,OAAO,CACnE,EACD,CAAC;gBACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;oBACjF,OAAO,EAAE;wBACP,UAAU,EAAE,YAAY,CAAC,MAAM;wBAC/B,MAAM,EAAE,kDAAkD;qBAC3D;iBACF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,kBAAkB,GAAG,kBAAkB;gBAC3C,CAAC,CAAC,8BAA8B,CAAC,UAAU;gBAC3C,CAAC,CAAC,yBAAyB,CAAC;YAC9B,MAAM,WAAW,GAAG,2BAA2B,CAC7C,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE;gBACnC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS;gBACxC,CAAC,CAAC,SAAS,EACb,eAAe,EACf,YAAY,CAAC,SAAS,IAAI,EAAE,EAC5B,kBAAkB,CACnB,CAAC;YACF,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBACzB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;oBACzE,OAAO,EAAE;wBACP,OAAO,EAAE,kBAAkB;wBAC3B,eAAe,EAAE,WAAW,CAAC,eAAe;wBAC5C,eAAe;qBAChB;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,gBAAgB,GAAG,KAAK,CAAC;YAC7B,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,EAAE,CAAC;gBACnD,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAC/C,EAAE,EACF,YAAY,EACZ,KAAK,CAAC,cAAc,EACpB,cAAc,EACd,cAAc,EACd,kBAAkB,CACnB,CAAC;YACJ,CAAC;YAED,YAAY,GAAG,MAAM,IAAI,CAAC,6BAA6B,CACrD,EAAE,EACF,YAAY,EACZ,eAAe,EACf,cAAc,CACf,CAAC;YAEF,IAAI,YAAY,CAAC,MAAM,KAAK,UAAU,CAAC,kBAAkB,EAAE,CAAC;gBAC1D,yFAAyF;gBACzF,wFAAwF;gBACxF,iFAAiF;gBACjF,sFAAsF;gBACtF,yFAAyF;gBACzF,0FAA0F;gBAC1F,uFAAuF;gBACvF,8BAA8B;gBAC9B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC7D,gBAAgB,CAAC,KAAK,EACtB;oBACE,GAAG,EAAE,YAAY,CAAC,GAAG;oBACrB,MAAM,EAAE,UAAU,CAAC,kBAAkB;iBACtC,EACD,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,EAC7B,cAAc,CACf,CAAC;gBACF,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE,EAAE,MAAM,EAAE,sCAAsC,EAAE;qBAC5D,CAAC,CAAC;gBACL,CAAC;gBACD,YAAY,GAAG,SAAS,CAAC;YAC3B,CAAC;YAED,MAAM,IAAI,CAAC,kBAAkB,CAC3B,EAAE,EACF,YAAY,CAAC,GAAG,EAChB,OAAO,EACP,UAAU,EACV,cAAc,CACf,CAAC;YAEF,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,KAAK;gBACZ,gBAAgB;gBAChB,WAAW,EAAE,cAAc;aAC5B,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,MAAM,oCAAoC,CAAC,EAAE,EAAE;YAC7C,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;YACvB,OAAO;YACP,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,kDAAkD,EAAE;YAChE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;YACvB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SAC1C,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,iDAAiD,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAErF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACK,KAAK,CAAC,iDAAiD,CAC7D,KAAgC,EAChC,MAAc;QAEd,MAAM,cAAc,GAAG,oCAAoC,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,CAAC,cAAc;YAAE,OAAO;QAE5B,IAAI,qBAA8B,CAAC;QACnC,IAAI,CAAC;YACH,qBAAqB,GAAG,MAAM,6BAA6B,CAAC;gBAC1D,cAAc;gBACd,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;gBACzC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+FAA+F,EAAE;gBAChH,cAAc;gBACd,MAAM;gBACN,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,qBAAqB;YAAE,OAAO;QACnC,MAAM,IAAI,CAAC,6CAA6C,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;IAED,kEAAkE;IAClE,+DAA+D;IAC/D,kEAAkE;IAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACK,+BAA+B,CAAC,YAAkB,EAAE,MAA+C;QACzG,IAAI,YAAY,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,KAAK,UAAU,CAAC,kBAAkB,EAAE,CAAC;YACvG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACK,KAAK,CAAC,6CAA6C,CAAC,MAAc;QACxE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE;gBAC3F,YAAY,EAAE,IAAI;gBAClB,kBAAkB,EAAE,EAAE;aACvB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gFAAgF;YAChF,oFAAoF;YACpF,mFAAmF;YACnF,0EAA0E;YAC1E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6EAA6E,EAAE;gBAC9F,MAAM;gBACN,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACI,KAAK,CAAC,sCAAsC,CACjD,cAAsB;QAEtB,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,6BAA6B,EAAE,EAAc,EAAE,CAAC;QAClG,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CACvD,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,cAAc,EAAE,CACnB,CAAC;YACF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YAC1D,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9F,OAAO,CAAC,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;YAEzC,MAAM,kBAAkB,GAAa,EAAE,CAAC;YACxC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,IAAI,CAAC,6CAA6C,CAAC,MAAM,CAAC;oBAAE,OAAO,CAAC,OAAO,EAAE,CAAC;;oBACnF,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvC,CAAC;YAED,wFAAwF;YACxF,gFAAgF;YAChF,KAAK,MAAM,MAAM,IAAI,kBAAkB,EAAE,CAAC;gBACxC,IAAI,MAAM,IAAI,CAAC,6CAA6C,CAAC,MAAM,CAAC;oBAAE,OAAO,CAAC,OAAO,EAAE,CAAC;;oBACnF,OAAO,CAAC,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1D,CAAC;YAED,IAAI,OAAO,CAAC,6BAA6B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrD,qFAAqF;gBACrF,kFAAkF;gBAClF,6FAA6F;gBAC7F,8FAA8F;gBAC9F,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0FAA0F,EAAE;oBAC5G,cAAc;oBACd,OAAO,EAAE,OAAO,CAAC,6BAA6B;oBAC9C,eAAe,EAAE,OAAO,CAAC,eAAe;iBACzC,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,IAAI,CAAC,QAAQ,CAAC,qDAAqD,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACxH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,4FAA4F;YAC5F,6FAA6F;YAC7F,0FAA0F;YAC1F,8FAA8F;YAC9F,8EAA8E;YAC9E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qFAAqF,EAAE;gBACvG,cAAc;gBACd,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,kEAAkE;IAClE,yCAAyC;IACzC,kEAAkE;IAElE;;;OAGG;IACI,KAAK,CAAC,aAAa,CACxB,MAAc,EACd,KAA+F,EAC/F,UAAwC;QAExC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAChH,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,aAAa,EAAG,eAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACnH,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,mGAAmG;QACnG,oGAAoG;QACpG,kGAAkG;QAClG,4FAA4F;QAC5F,oGAAoG;QACpG,sFAAsF;QACtF,MAAM,oCAAoC,CAAC,EAAE,EAAE;YAC7C,MAAM;YACN,OAAO,EAAE,KAAK;YACd,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAClE,6CAA6C;IAC7C,kEAAkE;IAElE;;;OAGG;IACI,KAAK,CAAC,iBAAiB,CAC5B,MAAc,EACd,cAAsB,EACtB,kBAAgD;QAEhD,6FAA6F;QAC7F,4FAA4F;QAC5F,8FAA8F;QAC9F,uEAAuE;QACvE,IAAI,kBAAkB,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;YACrD,IAAI,CAAC,QAAQ,CAAC,4EAA4E,EAAE;gBAC1F,MAAM;gBACN,cAAc;aACf,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACxG,IAAI,IAAI,EAAE,CAAC;YACT,6FAA6F;YAC7F,2FAA2F;YAC3F,kBAAkB;YAClB,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;YAE/G,yEAAyE;YACzE,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACxD,gBAAgB,CAAC,oBAAoB,EACrC,EAAE,EACF,EAAE,MAAM,EAAE,cAAc,EAAE,CAC3B,CAAC;gBACF,IAAI,UAAU,EAAE,CAAC;oBACf,2FAA2F;oBAC3F,yFAAyF;oBACzF,yFAAyF;oBACzF,sFAAsF;oBACtF,sFAAsF;oBACtF,kFAAkF;oBAClF,wFAAwF;oBACxF,2EAA2E;oBAC3E,kFAAkF;oBAClF,EAAE;oBACF,kFAAkF;oBAClF,yDAAyD;oBACzD,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC3C,gBAAgB,CAAC,oBAAoB,EACpC,UAAkB,CAAC,GAAG,EACvB,EAAE,MAAM,EAAE,wBAAwB,CAAC,QAAQ,EAAE,EAC7C,EAAE,YAAY,EAAE,EAAE,cAAc,EAAE,EAAE,CACrC,CAAC;oBACF,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAC5C,IAAI,CAAC,QAAQ,CAAC,+EAA+E,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7G,CAAC;YAED,kEAAkE;YAClE,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAAC;oBAC1C,MAAM,iBAAiB,GAAI,IAAI,CAAC,gBAAgB,CAAC,MAA2E,EAAE,iBAAiB,CAAC;oBAChJ,MAAM,eAAe,GAAI,IAAI,CAAC,gBAAgB,CAAC,MAA6F,EAAE,SAAS,CAAC;oBACxJ,MAAM,yBAAyB,CAAC,EAAE,EAAE;wBAClC,MAAM;wBACN,cAAc;wBACd,iBAAiB;wBACjB,eAAe;wBACf,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;wBACrD,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;4BAChC,MAAM,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC;wBACzD,CAAC;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,IAAI,mBAAmB,CAAC,WAAW,CAAC;oBAAE,MAAM,WAAW,CAAC;gBACxD,IAAI,CAAC,QAAQ,CAAC,0DAA0D,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACxF,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,8CAA8C,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,eAAe;IACf,kEAAkE;IAElE;;;;;;;;;;;OAWG;IACI,QAAQ,CAAC,QAAkB,EAAE,WAAmC,EAAE,eAA0B;QACjG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAEpE,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9C,IAAI,eAAe,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1D,IAAI,CAAC,QAAQ,CAAC,iDAAiD,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;oBACnG,SAAS;gBACX,CAAC;gBACD,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,kEAAkE;IAClE,0BAA0B;IAC1B,kEAAkE;IAElE;;;;;OAKG;IACK,KAAK,CAAC,mBAAmB,CAC/B,EAAyB,EACzB,IAAU,EACV,cAAsB,EACtB,KAAe,EACf,cAA8B,EAC9B,qBACE,8BAA8B,CAAC,2BAA2B;QAE5D,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAChE,gBAAgB,CAAC,oBAAoB,EACrC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,EACpC,cAAc,CACf,CAAC;QACF,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,cAAc,CAAC,MAAM,KAAK,wBAAwB,CAAC,MAAM,EAAE,CAAC;gBAC9D,IAAI,CAAC,QAAQ,CAAC,oDAAoD,EAAE;oBAClE,MAAM,EAAE,IAAI,CAAC,GAAG;oBAChB,cAAc;iBACf,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,cAAc,CAAC,MAAM,KAAK,wBAAwB,CAAC,OAAO,EAAE,CAAC;gBAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,OAAO,EAAE;wBACP,MAAM,EAAE,uCAAuC;wBAC/C,YAAY,EAAE,cAAc,CAAC,GAAG;wBAChC,gBAAgB,EAAE,cAAc,CAAC,MAAM;wBACvC,MAAM,EAAE,IAAI,CAAC,GAAG;wBAChB,cAAc;qBACf;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,kBAAkB,KAAK,8BAA8B,CAAC,UAAU,EAAE,CAAC;gBACrE,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC,EAAE,EAAE;oBACzD,UAAU,EAAE,cAAc;oBAC1B,IAAI;oBACJ,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;oBACvC,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;oBACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;oBAC7C,cAAc;oBACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC,CAAC;gBACH,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC;oBACpC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;wBACrE,OAAO,EAAE;4BACP,MAAM,EAAE,iDAAiD;4BACzD,YAAY,EAAE,cAAc,CAAC,GAAG;4BAChC,MAAM,EAAE,IAAI,CAAC,GAAG;4BAChB,cAAc;yBACf;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC7D,gBAAgB,CAAC,oBAAoB,EACrC;oBACE,GAAG,EAAE,cAAc,CAAC,GAAG;oBACvB,MAAM,EAAE,wBAAwB,CAAC,OAAO;iBACzC,EACD,EAAE,MAAM,EAAE,wBAAwB,CAAC,MAAM,EAAE,EAC3C,cAAc,CACf,CAAC;gBACF,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;wBAChE,OAAO,EAAE;4BACP,MAAM,EAAE,4CAA4C;4BACpD,YAAY,EAAE,cAAc,CAAC,GAAG;4BAChC,MAAM,EAAE,IAAI,CAAC,GAAG;4BAChB,cAAc;yBACf;qBACF,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,uBAAuB,CAAC,EAAE,EAAE;oBAChC,MAAM,EAAE,IAAI,CAAC,GAAG;oBAChB,cAAc;oBACd,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE;wBACtD,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,iBAAiB;wBAChD,CAAC,CAAC,SAAS;oBACb,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;oBACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;oBAC7C,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,uEAAuE,EAAE;gBACrF,MAAM,EAAE,IAAI,CAAC,GAAG;gBAChB,cAAc;gBACd,kBAAkB;aACnB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,cAAc,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QAChC,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE;YAC7D,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,iBAAiB;YAChD,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,iBAAiB,EAAE,CAAC;YACrD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAC9D,gBAAgB,CAAC,aAAa,EAC9B,EAAE,GAAG,EAAE,cAAc,EAAE,EACvB,cAAc,CACf,CAAC;YACF,MAAM,WAAW,GAAG,YAAY,EAAE,IAAI;gBACpC,CAAC,CAAC,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,iBAAiB;gBACzD,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,WAAW;gBAAE,cAAc,GAAG,CAAC,WAAW,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,iBAAiB,EAAE,CAAC;YACnD,MAAM,sBAAsB,CAAC,EAAE,EAAE;gBAC/B,cAAc;gBACd,KAAK,EAAE,cAAc;gBACrB,iBAAiB;gBACjB,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;gBACrD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QAED,sEAAsE;QACtE,iDAAiD;QACjD,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC3C,gBAAgB,CAAC,oBAAoB,EACrC;YACE,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,cAAc;YACd,KAAK,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;YAC7D,MAAM,EAAE,wBAAwB,CAAC,MAAM;SACxC,EACD,cAAc,CACf,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE;YAC/C,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,cAAc;YACd,KAAK,EAAE,cAAc;SACtB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,6BAA6B,CACzC,EAAyB,EACzB,IAAU,EACV,mBAAsC,EACtC,cAA8B;QAE9B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACzD,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EACjB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE;oBACP,MAAM,EAAE,gDAAgD;oBACxD,MAAM,EAAE,IAAI,CAAC,GAAG;iBACjB;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,IAAI,EAAE,CAAC;QACjD,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;aACnD,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,WAAW,CAAC;QAElD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAC3D,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,WAAW,CAAC,GAAG,EACf,EAAE,SAAS,EAAE,CAAC,GAAG,YAAY,EAAE,GAAG,YAAY,CAAC,EAAE,EACjD,cAAc,CACf,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;gBAChE,OAAO,EAAE;oBACP,MAAM,EAAE,wCAAwC;oBAChD,MAAM,EAAE,IAAI,CAAC,GAAG;oBAChB,YAAY;iBACb;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,kEAAkE;IAClE,yBAAyB;IACzB,kEAAkE;IAE1D,KAAK,CAAC,kBAAkB,CAC9B,EAAyB,EACzB,MAAc,EACd,OAA8B,EAC9B,UAAyC,EACzC,cAA8B;QAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;YAChE,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE;YAC1C,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAC9D,gBAAgB,CAAC,mBAAmB,EACpC;YACE,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,cAAc,EAAE,iBAAiB,CAAC,UAAU;YAC5C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,GAAG,WAAW;SACf,EACD,cAAc,CACf,CAAC;QAEF,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACnC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;oBAChE,OAAO,EAAE;wBACP,MAAM,EAAE,oDAAoD;wBAC5D,cAAc,EAAE,YAAY,CAAC,GAAG;wBAChC,YAAY,EAAE,YAAY,CAAC,MAAM;wBACjC,eAAe,EAAE,MAAM;wBACvB,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;qBACjC;iBACF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC;YAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;YAC9C,MAAM,YAAY,GAAG,aAAa,IAAI,IAAI,IAAI,QAAQ,IAAI,IAAI,IAAI,aAAa,KAAK,QAAQ,CAAC;YAE7F,sFAAsF;YACtF,8EAA8E;YAC9E,oFAAoF;YACpF,+EAA+E;YAC/E,kCAAkC;YAClC,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC3C,gBAAgB,CAAC,mBAAmB,EACpC,YAAY,CAAC,GAAG,EAChB;gBACE,UAAU,EAAE,IAAI,IAAI,EAAE;gBACtB,aAAa,EAAE,OAAO,CAAC,KAAK;gBAC5B,mBAAmB,EAAE,OAAO,CAAC,WAAW;gBACxC,iBAAiB,EAAE,OAAO,CAAC,SAAS;gBACpC,kBAAkB,EAAE,OAAO,CAAC,SAAS;aACtC,EACD,cAAc,CACf,CAAC;YAEF,IAAI,YAAY,IAAI,UAAU,CAAC,MAAM,KAAK,sBAAsB,CAAC,IAAI,EAAE,CAAC;gBACtE,MAAM,cAAc,GAAG,oCAAoC,CAAC,KAAK,CAAC,CAAC;gBACnE,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAChC,sBAAsB,CAAC,kBAAkB,EACzC,0BAA0B,CAAC,MAAM,EACjC;oBACE,MAAM,EAAE,YAAY,CAAC,MAAM;oBAC3B,cAAc;oBACd,aAAa,EAAE,mCAAmC,CAAC,KAAK,CAAC;oBACzD,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,aAAa;oBACb,QAAQ;iBACT,EACD,MAAM,IAAI,CAAC,aAAa,CAAC,+BAA+B,CAAC,EAAE,EAAE,cAAc,EAAE,YAAY,CAAC,MAAM,CAAC,CAClG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAyB,CAAC,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC3C,gBAAgB,CAAC,mBAAmB,EACpC;YACE,MAAM;YACN,cAAc,EAAE,iBAAiB,CAAC,UAAU;YAC5C,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,aAAa,EAAE,OAAO,CAAC,KAAK;YAC5B,mBAAmB,EAAE,OAAO,CAAC,WAAW;YACxC,iBAAiB,EAAE,OAAO,CAAC,SAAS;YACpC,kBAAkB,EAAE,OAAO,CAAC,SAAS;YACrC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,cAAc,EAAE,oCAAoC,CAAC,KAAK,CAAC;YAC3D,aAAa,EAAE,mCAAmC,CAAC,KAAK,CAAC;YACzD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,EACD,cAAc,CACf,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,sBAAsB,CAC5B,UAAyC;QAEzC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,MAAM,EAAE,qCAAqC;oBAC7C,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,UAAU,CAAC,KAAK,CAAC;IAC1B,CAAC;IAED,kEAAkE;IAClE,6BAA6B;IAC7B,kEAAkE;IAElE;;;;;OAKG;IACK,KAAK,CAAC,2BAA2B;QACvC,OAAO,IAAI,CAAC,aAAa,CAAC,4BAA4B,CAAC,IAAI,CAAC,aAAa,CAAC,2BAA2B,EAAE,CAAC,CAAC;IAC3G,CAAC;CACF,CAAA;AA3yCY,wCAAwC;IADpD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAC1C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAOhD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAK9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,CAAA;IAC5D,YAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAO/D,YAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;qCA3BQ,aAAa;QACM,0BAA0B,YAEjB,yCAAyC,YAEjD,uBAAuB;GAT9F,wCAAwC,CA2yCpD","sourcesContent":["/*\n EnterpriseUserProvisioningBackendService\n \n Handles enterprise user lifecycle operations: creation, update, deactivation,\n * and IdP role → org role mapping. Reusable by both SSO JIT provisioning (Step 15)\n * and SCIM directory provisioning (Step 20).\n \n Step 15: Enterprise SSO — Org OIDC Connection Resolver & Provisioning\n * DI Symbol: EnterpriseUserProvisioningService\n \n Design (Decision 13):\n * - All methods use INTERNALLY_INITIATED_REQUEST execution context\n * - All methods emit audit events via AuditLogsBackendService\n * - provisionEnterpriseUser() handles: User creation, UserProfile creation, scoped membership,\n * and UserIdentityLink creation — all transactional\n \n FUTURE (SCIM Step 20): SCIM controller will call these same methods.\n /\n\nimport 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { ServiceOptions } from '~wildo-backend-lib/base-classes/models/repositories.backend.schemas';\nimport { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport type {\n ResourcePersistenceUnitOfWorkBackendService,\n} from '~wildo-backend-lib/databases/services/resource-persistence-unit-of-work.backend.service';\nimport {\n APPLICATION_EXISTING_USER_LINK_UNIT_OF_WORK,\n APPLICATION_USER_CREATION_UNIT_OF_WORK,\n ORGANIZATION_EXISTING_USER_LINK_UNIT_OF_WORK,\n ORGANIZATION_USER_CREATION_UNIT_OF_WORK,\n} from '~wildo-backend-lib/security/authentications/models/identity-persistence-boundaries.backend';\nimport type { AuthTokenIssuerBackendService } from '~wildo-backend-lib/security/authentications/services/auth-token-issuer.backend.service';\nimport type { AuthUserLookupBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-user-lookup.backend.service';\nimport { ensureUserProfileFromIdentityProfile } from '~wildo-backend-lib/security/authentications/services/utils/ensure-user-profile.backend.utils';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { grantUserTypesOnOrgJoin } from '~wildo-backend-lib/organizations/services/user-org-type-grant.backend.utils';\nimport { applyInvitationAcceptanceCore } from '~wildo-backend-lib/organizations/services/invitation-acceptance.backend.utils';\nimport { validateOrgMemberRoles } from '~wildo-backend-lib/organizations/services/org-member-roles-validation.backend.utils';\nimport { revokeUserTypesOnOrgLeave } from '~wildo-backend-lib/organizations/services/user-type-revocation-on-org-leave.backend.utils';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { isOrgActivelyDirectoryManaged } from '~wildo-backend-lib/organizations/services/scim-provisioning-gate.backend.utils';\nimport type { FeatureResolutionBackendService } from '~wildo-backend-lib/features/services/feature-resolution.backend.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport {\n CoreResourceType,\n CoreAuditableEventType,\n ErrorType,\n ErrorCustomMessageReference,\n ResourceOperationRiskLevel,\n CORE_APP_ROLES,\n SsoConnectionType,\n User,\n UserStatus,\n OrganizationMemberStatus,\n AuthScopeType,\n ExternalIdentitySource,\n RegistrationAcquisitionChannel,\n evaluateUserTypeAcquisition,\n isWildoBackendError,\n} from '@wildo-ai/saas-models';\nimport type { OrganizationMember, UserIdentityLink } from '@wildo-ai/saas-models';\nimport type { EmailVerificationInitiatorBackendService } from '~wildo-backend-lib/security/authentications/services/email-verification-initiator.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n// `EnterpriseProvisioningConfig` now lives in the models layer (sso-connection.backend.schemas) so\n// the connection type can reference it — one shape for the provisioning settings, built once per source.\nimport {\n getApplicationIdFromEnterpriseScope,\n getOrganizationIdFromEnterpriseScope,\n} from '~wildo-backend-lib/security/authentications/models/sso-connection.backend.schemas';\nimport type {\n EnterpriseConnectionScope,\n NormalizedUserProfile,\n ProvisioningConnectionContext,\n EnterpriseProvisioningConfig,\n} from '~wildo-backend-lib/security/authentications/models/sso-connection.backend.schemas';\n\n/* Result of an enterprise user provisioning operation /\nexport interface EnterpriseProvisionResult {\n user: User;\n isNew: boolean;\n /* False for application-scoped provisioning, which never owns organization membership. /\n orgMemberCreated: boolean;\n mappedRoles: string[];\n}\n\n/\n Exact identity target used only when an enterprise connection has no organization-type grants.\n * The caller must derive it from the initiating/default frontend service; it is never selected by\n * scanning for an arbitrary permissive user type.\n /\nexport interface EnterpriseProvisioningTargetContext {\n fallbackUserType?: string;\n}\n\n@injectable()\nexport class EnterpriseUserProvisioningBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory) private readonly authEcFactory: AuthExecutionContextFactoryBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthTokenIssuer) private readonly tokenIssuer: AuthTokenIssuerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) private readonly auditLogsService: AuditLogsBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.AuthUserLookupService) private readonly userLookup: AuthUserLookupBackendService,\n // Trusted in-process writes to system resources whose client-shaped CREATE/UPDATE DTO\n // strips context FKs (`userId`/`organizationId`) and the backend-only `providerRawProfile`:\n // USER_PROFILES, USER_IDENTITY_LINKS, ORGANIZATION_MEMBERS. Enterprise JIT / SCIM / SAML\n // provisioning runs on a synthesised system EC with no HTTP request context to seed the\n // FKs, so `createAsSystem`/`updateAsSystem` re-attach them past the strict-DTO parse\n // (fail-closed `systemAccessPolicy` opt-in). Reads stay on the caller EC.\n @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n // Shared EMAIL_VERIFICATION token+email sender. Used by the SCIM path when the directory's\n // config disables auto-verify: a new user is created PENDING_VERIFICATION and must confirm\n // their email before they can sign in. Appended LAST to keep the test's positional\n // construction stable.\n @inject(SAAS_SERVICE_TYPES.EmailVerificationInitiatorService) private readonly emailVerificationInitiator: EmailVerificationInitiatorBackendService,\n @inject(SAAS_SERVICE_TYPES.ResourcePersistenceUnitOfWorkService)\n private readonly resourcePersistenceUnitOfWork: ResourcePersistenceUnitOfWorkBackendService,\n // AUTH-24 population gate: per-org DIRECTORY_PROVISIONING resolution for\n // `_reconcileLocalCredentialsIfOrgIsDirectoryManaged` (see `isOrgActivelyDirectoryManaged`, and\n // `AuthRegistrationBackendService`, which injects it for the sibling invite-accept gate).\n // Appended LAST: DI binds by token, but the positional-append convention keeps existing test\n // construction — which passes the 11 collaborators above — undisturbed.\n @inject(SAAS_SERVICE_TYPES.FeatureResolutionService) private readonly featureResolution: FeatureResolutionBackendService,\n ) {\n this.logDebug = this.logger.debugByType('EnterpriseUserProvisioning');\n this.logger.setDebugTypeLogging('EnterpriseUserProvisioning', false);\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Create or Link Org User\n // ═══════════════════════════════════════════════════════════════\n\n /\n Create or link a user within an organization from an IdP profile.\n \n Flow:\n * 1. Verify email domain is in allowedDomains (if any)\n * 2. Check if user already exists by email\n * - If exists: verify/add org membership\n * - If not exists: check autoCreateUsers, create user + profile + org member\n * 3. Map IdP roles → org roles\n * 4. Create identity link\n /\n public async provisionEnterpriseUser(\n profile: NormalizedUserProfile,\n connection: ProvisioningConnectionContext,\n provisioningConfig: EnterpriseProvisioningConfig,\n targetContext: EnterpriseProvisioningTargetContext = {},\n ): Promise<EnterpriseProvisionResult> {\n const ec = await this.getInternalExecutionContext();\n const scope = this.requireEnterpriseScope(connection);\n\n // 1. Verify email domain\n if (provisioningConfig.allowedDomains.length > 0) {\n const emailDomain = profile.email.split('@')[1]?.toLowerCase();\n if (!emailDomain \|\| !provisioningConfig.allowedDomains.includes(emailDomain)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n });\n }\n }\n\n // 2. Check if user already exists. `findAnyUserByEmail` spans ALL statuses, so a\n // user invited-but-not-yet-accepted (PENDING_INVITATION, provisioned by the org-admin\n // invite) is found here by the STRICT unique email anchor. There is never a second user\n // for the same email (D8 `.isUnique()`), so SSO/SCIM binds to that single identity.\n const existingUser = await this.userLookup.findAnyUserByEmail(ec, profile.email);\n\n // Map IdP roles\n const mappedRoles = this.mapRoles(\n profile.roles \|\| [],\n provisioningConfig.roleMapping \|\| {},\n provisioningConfig.allowedOrgRoles,\n );\n const effectiveRoles = mappedRoles.length > 0\n ? mappedRoles\n : (provisioningConfig.defaultRole ? [provisioningConfig.defaultRole] : []);\n const targetUserTypes = await this.resolveProvisioningTargetTypes(\n scope,\n targetContext,\n );\n const defaultAcquisitionChannel = connection.source === ExternalIdentitySource.SCIM\n ? RegistrationAcquisitionChannel.ADMINISTRATIVE_PROVISIONING\n : RegistrationAcquisitionChannel.ENTERPRISE_SSO_JIT;\n\n if (existingUser) {\n return this.provisionExistingUser(\n ec,\n existingUser,\n profile,\n connection,\n provisioningConfig,\n effectiveRoles,\n targetUserTypes,\n defaultAcquisitionChannel,\n );\n }\n\n // Registration policy governs acquisition, not authentication by an existing account. Resolve\n // every type the new account will actually receive and require the canonical channel matrix\n // before `autoCreateUsers` or any irreversible write. SCIM is an administrative directory\n // action; OIDC/SAML are automatic external JIT.\n const acquisition = evaluateUserTypeAcquisition(\n this.appConfigService.isInitialized()\n ? this.appConfigService.config.userTypes\n : undefined,\n targetUserTypes,\n [],\n defaultAcquisitionChannel,\n );\n if (\n acquisition.newlyAcquiredUserTypes.length === 0\n \|\| !acquisition.allowed\n ) {\n // A concurrent invitation/provision may have created the identity after the first lookup.\n // Re-read once before returning the new-user denial so an INVITED race winner is evaluated\n // with invitation semantics and an existing holder is evaluated only for its real delta.\n const concurrentExistingUser = await this.userLookup.findAnyUserByEmail(\n ec,\n profile.email,\n );\n if (concurrentExistingUser) {\n return this.provisionExistingUser(\n ec,\n concurrentExistingUser,\n profile,\n connection,\n provisioningConfig,\n effectiveRoles,\n targetUserTypes,\n defaultAcquisitionChannel,\n );\n }\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n context: {\n channel: defaultAcquisitionChannel,\n deniedUserTypes: acquisition.deniedUserTypes,\n targetUserTypes,\n },\n });\n }\n\n // User doesn't exist — check autoCreateUsers\n if (!provisioningConfig.autoCreateUsers) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_FOUND,\n });\n }\n\n // AUTH-21: SCIM directories can require email verification (`autoVerifyEmail: false` on the\n // SCIM provisioning config) even though the IdP vouches for the user. When set, a NEW user is\n // created PENDING_VERIFICATION and must confirm ownership via the emailed link before they can\n // sign in — the S0.7 gate above hard-stops PENDING_VERIFICATION on every subsequent provision/\n // login until they do. Scoped to the SCIM source ONLY: the interactive SSO/OIDC/SAML paths log\n // the user in synchronously, so downgrading them to PENDING_VERIFICATION would lock out an\n // in-flight login. `autoVerifyEmail` defaults true everywhere, so this is inert unless a SCIM\n // admin explicitly opts in.\n const requiresEmailVerification =\n connection.source === ExternalIdentitySource.SCIM && provisioningConfig.autoVerifyEmail === false;\n\n // 3. Create the identity, its scope-owned relationship, its grants, and its\n // identity link as one database unit of work. Organization-derived types\n // are deliberately absent from the initial user insert and become visible\n // only after membership exists in the same transaction.\n const creationUnitOfWork =\n scope.scopeType === AuthScopeType.ORGANIZATION\n ? ORGANIZATION_USER_CREATION_UNIT_OF_WORK\n : APPLICATION_USER_CREATION_UNIT_OF_WORK;\n let result: EnterpriseProvisionResult;\n try {\n result = await this.resourcePersistenceUnitOfWork.executeTransaction(\n creationUnitOfWork,\n async (serviceOptions) => {\n let newUser = await this.servicesRegistryHandler.create<User>(\n CoreResourceType.USERS,\n ec,\n {\n email: profile.email.toLowerCase(),\n status: requiresEmailVerification\n ? UserStatus.PENDING_VERIFICATION\n : UserStatus.ACTIVE,\n appRoles: [CORE_APP_ROLES.APP_USER],\n userTypes: scope.scopeType === AuthScopeType.APPLICATION\n ? targetUserTypes\n : [],\n },\n serviceOptions,\n );\n\n let orgMemberCreated = false;\n if (scope.scopeType === AuthScopeType.ORGANIZATION) {\n orgMemberCreated = await this.ensureOrgMembership(\n ec,\n newUser,\n scope.organizationId,\n effectiveRoles,\n serviceOptions,\n );\n\n // The member-create postfix owns typed-organization grants. An\n // untyped organization instead uses the exact fallback type resolved\n // above; apply it only after membership has been proven.\n newUser = await this.ensureAuthorizedTypesAssigned(\n ec,\n newUser,\n targetUserTypes,\n serviceOptions,\n );\n }\n\n await this.createIdentityLink(\n ec,\n newUser._id,\n profile,\n connection,\n serviceOptions,\n );\n\n const persistedUser = await this.servicesRegistryHandler.read<User>(\n CoreResourceType.USERS,\n ec,\n { _id: newUser._id },\n serviceOptions,\n );\n if (!persistedUser) {\n throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {\n context: { reason: 'enterprise_provisioned_user_missing_before_commit' },\n });\n }\n\n return {\n user: persistedUser,\n isNew: true,\n orgMemberCreated,\n mappedRoles: effectiveRoles,\n };\n },\n {\n // The parent user mutation owns profile composition. The registry\n // queues that child seed after commit, but it must still receive the\n // original IdP name input through the adapter-neutral ServiceOptions.\n compositionSeedRequestInput: {\n firstName: profile.firstName,\n lastName: profile.lastName,\n displayName: profile.displayName,\n },\n },\n );\n } catch (error) {\n if (isWildoBackendError(error) && error.statusCode === 409) {\n // Concurrent request created the user first — re-read and link\n const raceWinner = await this.userLookup.findAnyUserByEmail(ec, profile.email);\n if (!raceWinner) throw error;\n return this.provisionExistingUser(\n ec,\n raceWinner,\n profile,\n connection,\n provisioningConfig,\n effectiveRoles,\n targetUserTypes,\n defaultAcquisitionChannel,\n );\n }\n throw error;\n }\n\n // AUTH-21: for a SCIM user created PENDING_VERIFICATION, send the verification email now that\n // the user + membership + identity link exist. Request-less context ⇒ the initiator resolves\n // the app's primary frontend URL from config for the `/confirm-email` link. Fail-safe: a send\n // failure is logged (not thrown) — the user is still created and can trigger a resend.\n if (requiresEmailVerification) {\n await this.emailVerificationInitiator.sendVerificationEmail({\n userId: result.user._id,\n email: result.user.email,\n firstName: profile.firstName,\n });\n this.logDebug('SCIM user created PENDING_VERIFICATION — verification email dispatched', {\n userId: result.user._id,\n scopeType: scope.scopeType,\n scopeId: scope.scopeId,\n });\n }\n\n // Audit log — only for SSO JIT provisioning (SCIM has its own audit at the controller level)\n if (connection.source !== ExternalIdentitySource.SCIM) {\n try {\n await this.auditLogsService.logUserSSOLogin({\n userId: result.user._id,\n email: profile.email,\n providerRef: connection.providerRef,\n connectionType: SsoConnectionType.ENTERPRISE,\n authSource: connection.source,\n scopeType: scope.scopeType,\n organizationId: getOrganizationIdFromEnterpriseScope(scope),\n applicationId: getApplicationIdFromEnterpriseScope(scope),\n ipAddress: 'system',\n userAgent: 'enterprise-provisioning',\n sessionId: `enterprise:${connection.providerRef}:${result.user._id}`,\n }, await this.authEcFactory.createForAuditRoutingOrFallback(\n ec,\n getOrganizationIdFromEnterpriseScope(scope),\n result.user._id,\n ));\n } catch {\n this.logDebug('Audit log for JIT provisioning failed (non-fatal)', {\n userId: result.user._id,\n });\n }\n }\n\n this.logDebug('New user provisioned via enterprise SSO JIT', {\n userId: result.user._id,\n scopeType: scope.scopeType,\n scopeId: scope.scopeId,\n roles: effectiveRoles,\n });\n\n return result;\n }\n\n /\n Resolve the exact types this enterprise provisioning operation may grant.\n \n Organization-type grants are authoritative and may contain several types. The exact caller\n * fallback is used only when no grant exists (including application-scoped SSO, whose scope id\n * is not an organization id). An empty result fails closed in the caller.\n /\n private async resolveProvisioningTargetTypes(\n scope: EnterpriseConnectionScope,\n targetContext: EnterpriseProvisioningTargetContext,\n ): Promise<string[]> {\n if (scope.scopeType === AuthScopeType.APPLICATION) {\n return targetContext.fallbackUserType ? [targetContext.fallbackUserType] : [];\n }\n\n const organization = await this.systemAccessService.readAsSystem<{\n type?: string;\n }>(CoreResourceType.ORGANIZATIONS, { _id: scope.organizationId });\n if (!organization) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n reason: 'enterprise_organization_scope_not_found',\n organizationId: scope.organizationId,\n },\n });\n }\n\n const organizationTypes = this.appConfigService.isInitialized()\n ? this.appConfigService.config.organizationTypes\n : undefined;\n if (organization.type && !organizationTypes?.[organization.type]) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n reason: 'enterprise_organization_type_definition_not_found',\n organizationId: scope.organizationId,\n organizationType: organization.type,\n },\n });\n }\n\n const orgGrantedUserTypes = organization.type\n ? organizationTypes?.[organization.type]?.userTypes ?? []\n : [];\n\n if (orgGrantedUserTypes.length > 0) {\n return [...new Set(orgGrantedUserTypes)];\n }\n return targetContext.fallbackUserType ? [targetContext.fallbackUserType] : [];\n }\n\n /\n Completes every existing-identity path through one policy and mutation sequence.\n \n The initial lookup, a second lookup after a denied new-user policy, and the duplicate-create\n * 409 recovery all converge here. This prevents race recovery from silently dropping status,\n * acquisition-channel, application-fallback, invitation, profile, membership, or link behavior.\n /\n private async provisionExistingUser(\n ec: ExecutionContext<any>,\n existingUserInput: User,\n profile: NormalizedUserProfile,\n connection: ProvisioningConnectionContext,\n _provisioningConfig: EnterpriseProvisioningConfig,\n effectiveRoles: string[],\n targetUserTypes: readonly string[],\n defaultAcquisitionChannel: RegistrationAcquisitionChannel,\n ): Promise<EnterpriseProvisionResult> {\n this.assertExistingUserProvisionable(existingUserInput, connection.source);\n const scope = this.requireEnterpriseScope(connection);\n\n const existingUserUnitOfWork =\n scope.scopeType === AuthScopeType.ORGANIZATION\n ? ORGANIZATION_EXISTING_USER_LINK_UNIT_OF_WORK\n : APPLICATION_EXISTING_USER_LINK_UNIT_OF_WORK;\n const result = await this.resourcePersistenceUnitOfWork.executeTransaction(\n existingUserUnitOfWork,\n async (serviceOptions) => {\n let existingUser = await this.servicesRegistryHandler.read<User>(\n CoreResourceType.USERS,\n ec,\n { _id: existingUserInput._id },\n serviceOptions,\n );\n if (!existingUser) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_FOUND,\n });\n }\n this.assertExistingUserProvisionable(existingUser, connection.source);\n\n let existingMembership: OrganizationMember \| null = null;\n if (scope.scopeType === AuthScopeType.ORGANIZATION) {\n existingMembership = await this.systemAccessService.readAsSystem<OrganizationMember>(\n CoreResourceType.ORGANIZATION_MEMBERS,\n {\n userId: existingUser._id,\n organizationId: scope.organizationId,\n },\n serviceOptions,\n );\n }\n\n const consumesInvitation =\n connection.source !== ExternalIdentitySource.SCIM\n && existingUser.status === UserStatus.PENDING_INVITATION;\n if (\n consumesInvitation\n && (\n scope.scopeType !== AuthScopeType.ORGANIZATION\n \|\| existingMembership?.status !== OrganizationMemberStatus.INVITED\n )\n ) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n context: {\n userStatus: existingUser.status,\n reason: 'enterprise_invitation_not_active_at_target_scope',\n },\n });\n }\n\n const acquisitionChannel = consumesInvitation\n ? RegistrationAcquisitionChannel.INVITATION\n : defaultAcquisitionChannel;\n const acquisition = evaluateUserTypeAcquisition(\n this.appConfigService.isInitialized()\n ? this.appConfigService.config.userTypes\n : undefined,\n targetUserTypes,\n existingUser.userTypes ?? [],\n acquisitionChannel,\n );\n if (!acquisition.allowed) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n context: {\n channel: acquisitionChannel,\n deniedUserTypes: acquisition.deniedUserTypes,\n targetUserTypes,\n },\n });\n }\n\n let orgMemberCreated = false;\n if (scope.scopeType === AuthScopeType.ORGANIZATION) {\n orgMemberCreated = await this.ensureOrgMembership(\n ec,\n existingUser,\n scope.organizationId,\n effectiveRoles,\n serviceOptions,\n acquisitionChannel,\n );\n }\n\n existingUser = await this.ensureAuthorizedTypesAssigned(\n ec,\n existingUser,\n targetUserTypes,\n serviceOptions,\n );\n\n if (existingUser.status === UserStatus.PENDING_INVITATION) {\n // SYSTEM door: `status` is `.excludeFromUpdate()`, so a handler write is stripped by the\n // repository's strict re-parse — the filter matches, the row comes back, and NOTHING is\n // persisted. The account stays PENDING_INVITATION while the caller sees success.\n // Enumerated with the sibling activations (email verification, invitation accept) per\n // `.claude/rules/invariant-call-site-enumeration.md`: the invariant is \"a `status` write\n // goes through the system door\", and it holds at every site or none. The compare-and-swap\n // is preserved — the filter still pins the observed status, so a concurrent activation\n // still loses the race below.\n const activated = await this.systemAccessService.updateAsSystem<User>(\n CoreResourceType.USERS,\n {\n _id: existingUser._id,\n status: UserStatus.PENDING_INVITATION,\n },\n { status: UserStatus.ACTIVE },\n serviceOptions,\n );\n if (!activated) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n context: { reason: 'enterprise_user_activation_race_lost' },\n });\n }\n existingUser = activated;\n }\n\n await this.createIdentityLink(\n ec,\n existingUser._id,\n profile,\n connection,\n serviceOptions,\n );\n\n return {\n user: existingUser,\n isNew: false,\n orgMemberCreated,\n mappedRoles: effectiveRoles,\n };\n },\n );\n\n await ensureUserProfileFromIdentityProfile(ec, {\n userId: result.user._id,\n profile,\n servicesRegistryHandler: this.servicesRegistryHandler,\n systemAccessService: this.systemAccessService,\n logger: this.logger,\n });\n this.logDebug('Existing user linked via enterprise provisioning', {\n userId: result.user._id,\n scopeType: scope.scopeType,\n scopeId: scope.scopeId,\n orgMemberCreated: result.orgMemberCreated,\n });\n await this._reconcileLocalCredentialsIfOrgIsDirectoryManaged(scope, result.user._id);\n\n return result;\n }\n\n /\n The population gate in front of the destructive per-user credential clear: reconcile ONLY when\n * the user was just provisioned into an org that is ACTIVELY directory-managed.\n \n ### Why the gate exists, measured rather than assumed\n * `provisionExistingUser` is the shared seam for THREE surfaces — SCIM push, enterprise SAML ACS,\n * and enterprise OIDC JIT — and until this gate the clear fired on all of them, unconditionally.\n * So an ordinary enterprise-SSO login into an org with no directory integration at all silently\n * destroyed that user's password and every enrolled passkey, on every login, while the method's own\n * docstring described a population (\"a user provisioned into a directory-MANAGED org\") that no code\n * anywhere checked. The obligation is real for a managed org and does not exist for an unmanaged\n * one; the reconciliation sweep this sits beside is only as sound as the rule that says who owes it.\n \n ### Only an ORGANIZATION scope can be directory-managed\n * An APPLICATION-scoped enterprise connection has no organization, hence no SCIM token and no\n * per-org `DIRECTORY_PROVISIONING` feature, hence no directory doing the deprovisioning that makes\n * a local first factor a bypass. It is skipped, not defaulted.\n \n ### A failed posture read SKIPS the clear, which is the opposite of the invite-accept gate\n * `isOrgActivelyDirectoryManaged` deliberately propagates read errors so that its usual caller —\n * the invite-accept credential BLOCK — fails closed. Here \"closed\" points the other way: the\n * dangerous act is the irreversible DESTRUCTION of a live user's only credential, so an\n * unanswerable posture question must not authorise it. Skipping is safe because nothing is lost by\n * waiting: the effective policy (`resolveEffectiveAuthPolicy`) already refuses the local method for\n * a managed user meanwhile, and the clear is retried on this user's next provision and on the org's\n * next SCIM token mint (see {@link sweepDirectoryManagedCredentialsForOrg}). That is the whole\n * argument for building the reconciliation first: it is what makes the conservative choice here\n * affordable.\n /\n private async _reconcileLocalCredentialsIfOrgIsDirectoryManaged(\n scope: EnterpriseConnectionScope,\n userId: string,\n ): Promise<void> {\n const organizationId = getOrganizationIdFromEnterpriseScope(scope);\n if (!organizationId) return;\n\n let orgIsDirectoryManaged: boolean;\n try {\n orgIsDirectoryManaged = await isOrgActivelyDirectoryManaged({\n organizationId,\n featureResolution: this.featureResolution,\n systemAccessService: this.systemAccessService,\n });\n } catch (error) {\n this.logger.warn('AUTH-24: could not resolve directory-management posture — skipping the local credential clear', {\n organizationId,\n userId,\n ...projectCaughtErrorLogFields(error),\n });\n return;\n }\n\n if (!orgIsDirectoryManaged) return;\n await this._reconcileLocalCredentialsForDirectoryManaged(userId);\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Private: Fail-Closed Status Gate (S0.7 — enterprise sibling)\n // ═══════════════════════════════════════════════════════════════\n\n /\n Fail-closed status gate for an existing user resolved by email during enterprise\n * provisioning — the shared guard for every {@link provisionEnterpriseUser} entry point (enterprise\n * SSO/OIDC JIT, SAML ACS, and SCIM `POST /Users` + bulk).\n \n Only two statuses may proceed:\n * - `ACTIVE` — link the enterprise identity and (re)assert org membership directly.\n * - `PENDING_INVITATION` — the org-admin-provisioned invitee's first IdP login; the caller\n * activates the account (`PENDING_INVITATION → ACTIVE`) and consumes the `INVITED` membership.\n \n Every other status is a hard stop, thrown BEFORE any membership or identity-link side effect:\n * - `INACTIVE` / `SUSPENDED` / `DELETED` — a deprovisioned account must not regain an active\n * organization membership, an IdP identity link, or (via SAML/OIDC token issuance) a session\n * by re-authenticating through the IdP or being re-pushed by SCIM.\n * - `PENDING_VERIFICATION` — self-registration email verification is a separate flow; the\n * invite gate is deliberately not widened to it (mirrors the social-OAuth S0.7 gate).\n \n ### Why the gate lives HERE, not only in the callers\n * This service is the single choke point all three surfaces funnel through, and the downstream\n * token issuer is NOT a gate: `AuthTokenIssuerBackendService` reads `user.status` only to derive\n * the `emailVerified` claim and mints tokens for whatever `userId` it is handed. Placing the\n * gate at this shared seam closes the sibling gap on all three surfaces at once, where the\n * caller-side guards do not:\n * - SAML's own post-provision status check fires only AFTER `provisionEnterpriseUser` already created the\n * membership + identity link — so without this gate the token is blocked but the side effects leak.\n * - SCIM has no status gate at all.\n * - The OIDC callback issues tokens without re-checking status, and its pre-provision gate is\n * skipped entirely when `autoLinkByEmail` is disabled for all user types.\n \n Mirrors the fail-closed gate in `OAuth2AuthenticationBackendService.provisionOrLinkUser`.\n \n @throws AUTHENTICATION / `AUTHENTICATION_ACCOUNT_LOCKED` when the status is not provisionable.\n /\n private assertExistingUserProvisionable(existingUser: User, source: ProvisioningConnectionContext['source']): void {\n if (existingUser.status !== UserStatus.ACTIVE && existingUser.status !== UserStatus.PENDING_INVITATION) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n context: { userStatus: existingUser.status, source },\n });\n }\n }\n\n /\n AUTH-24 reconciliation: a user provisioned into a directory-MANAGED org (the SCIM push implies a live\n * SCIM token + DIRECTORY_PROVISIONING for the org) must not retain a LOCAL first-factor credential — a\n * password or an enrolled passkey would survive IdP deprovisioning (the deprovisioning bypass). Physically\n * clear BOTH on the user's `USER_CREDENTIALS` row. TOTP / backup codes are SECOND factors (they sit ON TOP\n * of the IdP first factor) and are intentionally left intact. `updateAsSystem` re-attaches the cleared\n * backend-only fields past the strict request-DTO parse (mirrors the TOTP-disable clear in\n * `auth-method-management`), and `passwordHash` is `.nullish()` in `UserCredentialsSchema` so the `null`\n * destroy-write ALSO round-trips the service-layer OUTPUT projection (`transformOutput` →\n * `internalDto.parse`, which re-validates the persisted doc against the full schema) instead of throwing\n * `service_resource_transformation_failed` on the after-image. No-ops when the user has no credential\n * row. Best-effort: a failure is logged, NEVER thrown —\n * reconciliation must not fail the SCIM provisioning that added the user. The effective policy already\n * renders these methods DORMANT for a managed user (`resolveEffectiveAuthPolicy`); this is the\n * compliance-grade DESTRUCTION on top (chosen over dormant-only). See\n * `.claude/plans/auth-24-credential-lifecycle.md`.\n \n ### It clears; it does NOT decide who owes the clear\n * This is a destructive PRIMITIVE. Whether the user's org is actually directory-managed is the\n * CALLER's question, because only the caller knows the scope the provision happened in — see the\n * `isOrgActivelyDirectoryManaged` gate at the {@link provisionExistingUser} call site, and\n * {@link sweepDirectoryManagedCredentialsForOrg} for the bulk one. Naming the population here\n * would put a feature + token read inside a method that is called in a loop.\n \n ### Why it still swallows, and what changed\n * The swallow is right and stays: a failed clear must not fail the SCIM provisioning that added\n * the user, and the effective policy already refuses the local method meanwhile. What was wrong is\n * that the failure went nowhere — a warn line, and no second attempt, ever. It now RETURNS its\n * outcome, so the bulk caller can retry and can say out loud which users are still carrying a\n * first factor in an org that deprovisions through a directory.\n \n @returns `true` when the clear landed, `false` when it failed (already logged).\n /\n private async _reconcileLocalCredentialsForDirectoryManaged(userId: string): Promise<boolean> {\n try {\n await this.systemAccessService.updateAsSystem(CoreResourceType.USER_CREDENTIALS, { userId }, {\n passwordHash: null,\n passkeyCredentials: [],\n });\n return true;\n } catch (error) {\n // Best-effort reconciliation: never throws. Project the caught value into flat,\n // structured, raw-JSON log fields — the thrown error here is a `WildoError_Backend`\n // (a plain object, NOT an `Error` instance), so `JSON.stringify(error)` would have\n // emitted a doubly-escaped, un-greppable blob under a single `error` key.\n this.logger.warn('AUTH-24: failed to reconcile local credentials for a directory-managed user', {\n userId,\n ...projectCaughtErrorLogFields(error),\n });\n return false;\n }\n }\n\n /\n AUTH-24 bulk reconciliation: when an org ACTIVATES SCIM (mints a live token → becomes actively\n * directory-managed), reconcile the local credentials of every ALREADY-IdP-PROVISIONED member now, rather\n * than waiting for each user's next SCIM sync. \"Provisioned\" = has a `USER_IDENTITY_LINKS` row for this org\n * (SSO-JIT users who predate the SCIM token are the realistic set; a locally-invited member has no link and\n * is EXEMPT — the provisioned-only decision). Idempotent (re-sweeping an already-cleared user is a no-op)\n * and best-effort (logged, never thrown — must not fail the token mint). Part 1 (`resolveEffectiveAuthPolicy`)\n * already renders these members dormant the moment the org is managed; this brings the physical DESTRUCTION\n * forward to activation time. See `.claude/plans/auth-24-credential-lifecycle.md`.\n \n ### The reconciliation contract (what a partial sweep now does instead of nothing)\n * A member whose clear fails is a LIVE deprovisioning bypass sitting in a now-managed org, and\n * until this change the whole record of it was one `warn` per user with no second attempt. The\n * sweep now:\n \n 1. Retries the failed set once, in the same pass. The dominant failure mode at this seam is\n * a transient repository/transaction error, and the clear is idempotent — re-issuing\n * `{ passwordHash: null, passkeyCredentials: [] }` against an already-cleared row is a no-op\n * write, never a second destruction. One retry is what turns \"recorded that it stopped\" into\n * \"finished\"; a loop is not, because a persistent failure is a defect and must surface, not spin.\n * 2. Reports the residual at ERROR, naming every user. A `warn` is where a security finding\n * goes to die: it is below a level-60 gate and it aggregates nothing. The residual is the whole\n * point of the sweep, so it is the loud line, with the ids an operator needs to act.\n * 3. Returns a structured result, so a caller that CAN block on it (a future admin-triggered\n * re-sweep) is able to; today's caller deliberately does not.\n \n ### Rejected: verifying convergence by reading the credential rows back\n * The honest check would be \"re-read each row and count who still carries local first-factor\n * material\". It is not available and must not be made available cheaply: `USER_CREDENTIALS` opts\n * into `systemAccessPolicy` `create` + `update` ONLY, so `readAsSystem` fails closed by design —\n * that row holds the password hash, the TOTP secret and the hashed backup codes, and opening a\n * trusted system READ door onto it for every future caller is a worse trade than living with a\n * write-outcome-only signal. The write's own success is therefore the observation, and the\n * re-run below is what covers the case where the write lied.\n \n ### Rejected: throwing on a non-converged sweep\n * The caller is the SCIM token mint — the act that MAKES the org directory-managed. Refusing it\n * because some member's old password could not be destroyed would block the activation whose\n * safety this exists to improve, and would leave the org unmanaged with every local credential\n * intact: strictly the worse state. Proceed-and-record is the correct posture, the same shape\n * `.claude/rules/administrative-continuity-floors.md` prescribes for an acknowledged floor breach —\n * the RECORD is the control.\n \n ### Where the re-run comes from\n * This pass is safe to repeat, so it does not need a scheduler of its own. It re-runs on every\n * SCIM token mint for the org (rotation included), and each individual member is re-reconciled on\n * their next enterprise provision through the gated {@link provisionExistingUser} call site. What\n * remains uncovered is a member who is never re-provisioned and whose org never rotates its token;\n * for them the effective-policy block (part 1) is the standing control, and the ERROR line above is\n * the operator's cue.\n /\n public async sweepDirectoryManagedCredentialsForOrg(\n organizationId: string,\n ): Promise<{ membersExamined: number; cleared: number; stillCarryingLocalCredentials: string[] }> {\n const outcome = { membersExamined: 0, cleared: 0, stillCarryingLocalCredentials: [] as string[] };\n try {\n const links = await this.systemAccessService.listAsSystem<{ userId: string }>(\n CoreResourceType.USER_IDENTITY_LINKS,\n { organizationId },\n );\n const linkArr = Array.isArray(links) ? links : links.data;\n const userIds = [...new Set(linkArr.map((l) => l.userId).filter((id): id is string => !!id))];\n outcome.membersExamined = userIds.length;\n\n const failedFirstAttempt: string[] = [];\n for (const userId of userIds) {\n if (await this._reconcileLocalCredentialsForDirectoryManaged(userId)) outcome.cleared++;\n else failedFirstAttempt.push(userId);\n }\n\n // The single retry. Idempotent by construction (see the contract above), so this cannot\n // destroy anything twice; it only finishes the users a transient error dropped.\n for (const userId of failedFirstAttempt) {\n if (await this._reconcileLocalCredentialsForDirectoryManaged(userId)) outcome.cleared++;\n else outcome.stillCarryingLocalCredentials.push(userId);\n }\n\n if (outcome.stillCarryingLocalCredentials.length > 0) {\n // assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — a member of an actively\n // directory-managed org whose local first factor could not be destroyed can still\n // authenticate around IdP deprovisioning at the credential layer. The effective-policy block\n // is what stops them today; this line is what tells someone the physical destruction is owed.\n this.logger.error('AUTH-24: local credentials still present after the directory-managed sweep and its retry', {\n organizationId,\n userIds: outcome.stillCarryingLocalCredentials,\n membersExamined: outcome.membersExamined,\n });\n } else if (userIds.length > 0) {\n this.logDebug('AUTH-24: swept local credentials on SCIM activation', { organizationId, memberCount: userIds.length });\n }\n } catch (error) {\n // The LIST (or the container resolution behind it) failed, so not one member was examined —\n // a materially worse outcome than a per-user failure, and the reason this stays ERROR rather\n // than the previous `warn`. Still not thrown: see \"Rejected: throwing\" above. Structured,\n // raw-JSON fields so a thrown `WildoError_Backend` (a plain object, not an `Error`) keeps its\n // full detail instead of collapsing to `String(error)` (`'[object Object]'`).\n this.logger.error('AUTH-24: bulk credential sweep on SCIM activation failed — no member was reconciled', {\n organizationId,\n ...projectCaughtErrorLogFields(error),\n });\n }\n return outcome;\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Update Org User (used by SCIM Step 20)\n // ═══════════════════════════════════════════════════════════════\n\n /\n Update an existing org user's profile attributes.\n * FUTURE: Called by SCIM PATCH/PUT handlers (Step 20).\n /\n public async updateOrgUser(\n userId: string,\n attrs: Partial<{ firstName: string; lastName: string; displayName: string; avatarUrl: string }>,\n _orgConfig: EnterpriseProvisioningConfig,\n ): Promise<void> {\n const ec = await this.getInternalExecutionContext();\n\n try {\n const existingProfile = await this.servicesRegistryHandler.read(CoreResourceType.USER_PROFILES, ec, { userId });\n if (existingProfile) {\n await this.systemAccessService.updateAsSystem(CoreResourceType.USER_PROFILES, (existingProfile as any)._id, attrs);\n return;\n }\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n this.logDebug('User profile update failed (non-fatal)', { userId });\n return;\n }\n\n // AUTH-18 (SCIM upsert / reconcile-on-every-provision): no profile exists yet, so a SCIM PUT/PATCH\n // that would otherwise SILENTLY NO-OP (there is nothing to update) instead CREATES the profile from\n // the pushed attributes — correct PUT semantics, and the convergence path for a SCIM-managed user\n // who never authenticates interactively (so never hits the login reconcile). Name-guarded +\n // best-effort via the shared ensure util (create-if-absent; the primary UPDATE above still surfaces\n // structured errors to the SCIM caller — only the convergence create is best-effort).\n await ensureUserProfileFromIdentityProfile(ec, {\n userId,\n profile: attrs,\n servicesRegistryHandler: this.servicesRegistryHandler,\n systemAccessService: this.systemAccessService,\n logger: this.logger,\n });\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Deactivate Org User (used by SCIM Step 20)\n // ═══════════════════════════════════════════════════════════════\n\n /\n Deactivate an org user (set status to INACTIVE).\n * FUTURE: Called by SCIM DELETE or status-change handlers (Step 20).\n /\n public async deactivateOrgUser(\n userId: string,\n organizationId: string,\n provisioningConfig: EnterpriseProvisioningConfig,\n ): Promise<void> {\n // Honor the SCIM config's `autoDeactivateUsers`. `undefined` (SSO/SAML paths, and any config\n // that predates the field) means \"deactivate\" — the historical unconditional behaviour — so\n // only an explicit `false` (a deliberate SCIM-admin choice: the directory pushes removals but\n // the org offboards elsewhere) turns a directory removal into a no-op.\n if (provisioningConfig.autoDeactivateUsers === false) {\n this.logDebug('SCIM deactivation skipped — autoDeactivateUsers is disabled for this scope', {\n userId,\n organizationId,\n });\n return;\n }\n\n const ec = await this.getInternalExecutionContext();\n\n const user = await this.servicesRegistryHandler.read<User>(CoreResourceType.USERS, ec, { _id: userId });\n if (user) {\n // `status` is `.excludeFromUpdate()`; a handler write is stripped by the repository's strict\n // re-parse, which would leave a deprovisioned directory user fully ACTIVE. The system door\n // re-attaches it.\n await this.systemAccessService.updateAsSystem(CoreResourceType.USERS, userId, { status: UserStatus.INACTIVE });\n\n // M9 fix: Also deactivate the org membership so the user loses org roles\n try {\n const membership = await this.servicesRegistryHandler.read(\n CoreResourceType.ORGANIZATION_MEMBERS,\n ec,\n { userId, organizationId },\n );\n if (membership) {\n // `updateAsSystem`, NOT the plain service-tier `update`. `OrganizationMemberSchema.status`\n // is `.excludeFromCreate().excludeFromUpdate()`, so the strict update DTO drops it — the\n // plain door persisted NOTHING here while still returning a row and logging success, and\n // the offboarded user kept an ACTIVE membership and therefore every organization role\n // (`execution-context-creator` builds `initiatorRoles` from ACTIVE memberships). Only\n // `updateAsSystem` re-attaches `.excludeFromUpdate()` fields past that strip, via\n // `deriveWritePreserveFields` — the same reason the identity-link update below uses it,\n // and the door invitation acceptance already uses to flip this very field.\n // Pinned by `scim-deprovision-membership-status-write.mongo.integration.test.ts`.\n //\n // NOTE the sibling `USERS` write above is correct as-is: `User.status` carries no\n // `.excludeFromUpdate()`, so the plain door persists it.\n await this.systemAccessService.updateAsSystem(\n CoreResourceType.ORGANIZATION_MEMBERS,\n (membership as any)._id,\n { status: OrganizationMemberStatus.INACTIVE },\n { scopeContext: { organizationId } },\n );\n this.logDebug('Org membership deactivated', { userId, organizationId });\n }\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n this.logDebug('Org membership deactivation skipped (ORGANIZATION_MEMBERS repo may not exist)', { userId });\n }\n\n // W5.12: Revoke user types granted by this org when deprovisioned\n try {\n if (this.appConfigService.isInitialized()) {\n const organizationTypes = (this.appConfigService.config as { organizationTypes?: Record<string, { userTypes?: string[] }> })?.organizationTypes;\n const userTypesConfig = (this.appConfigService.config as { userTypes?: Record<string, { requiresOrgMembership?: { orgTypes: string[] } }> })?.userTypes;\n await revokeUserTypesOnOrgLeave(ec, {\n userId,\n organizationId,\n organizationTypes,\n userTypesConfig,\n servicesRegistryHandler: this.servicesRegistryHandler,\n onUserTypesRevoked: async (uid) => {\n await this.tokenIssuer.invalidateAllTokensForUser(uid);\n },\n });\n }\n } catch (revokeError) {\n if (isWildoBackendError(revokeError)) throw revokeError;\n this.logDebug('User type revocation on deactivation skipped (non-fatal)', { userId });\n }\n\n this.logDebug('User deactivated via enterprise provisioning', { userId });\n }\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Role Mapping\n // ═══════════════════════════════════════════════════════════════\n\n /\n Map IdP role claims to organization roles using the org's roleMapping configuration.\n \n L9 fix: Added optional `allowedOrgRoles` parameter. When provided, mapped roles\n * that are not in the allowed list are silently dropped and logged. This prevents\n * a misconfigured role mapping from assigning arbitrary role identifiers (e.g., SUPER_ADMIN).\n \n @param idpRoles - Roles from the IdP claims (OIDC roles claim or SAML attribute)\n * @param roleMapping - Org's IdP role → org role mapping (e.g., { \"admin\": \"ORG_ADMIN\", \"viewer\": \"VIEWER\" })\n * @param allowedOrgRoles - Optional allowlist of valid org roles. If provided, mapped roles not in this list are rejected.\n * @returns Mapped org role identifiers\n /\n public mapRoles(idpRoles: string[], roleMapping: Record<string, string>, allowedOrgRoles?: string[]): string[] {\n if (!idpRoles.length \|\| !Object.keys(roleMapping).length) return [];\n\n const mappedRoles: string[] = [];\n for (const idpRole of idpRoles) {\n const orgRole = roleMapping[idpRole];\n if (orgRole && !mappedRoles.includes(orgRole)) {\n if (allowedOrgRoles && !allowedOrgRoles.includes(orgRole)) {\n this.logDebug('Mapped role rejected — not in allowed org roles', { idpRole, mappedRole: orgRole });\n continue;\n }\n mappedRoles.push(orgRole);\n }\n }\n return mappedRoles;\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Private: Org Membership\n // ═══════════════════════════════════════════════════════════════\n\n /\n Ensure the user is a member of the organization.\n * If they're already a member, no-op. If not, create the membership.\n \n @returns true if a new membership was created\n /\n private async ensureOrgMembership(\n ec: ExecutionContext<any>,\n user: User,\n organizationId: string,\n roles: string[],\n serviceOptions: ServiceOptions,\n acquisitionChannel: RegistrationAcquisitionChannel =\n RegistrationAcquisitionChannel.ADMINISTRATIVE_PROVISIONING,\n ): Promise<boolean> {\n const existingMember = await this.systemAccessService.readAsSystem<OrganizationMember>(\n CoreResourceType.ORGANIZATION_MEMBERS,\n { userId: user._id, organizationId },\n serviceOptions,\n );\n if (existingMember) {\n if (existingMember.status === OrganizationMemberStatus.ACTIVE) {\n this.logDebug('User already has an active organization membership', {\n userId: user._id,\n organizationId,\n });\n return false;\n }\n\n if (existingMember.status !== OrganizationMemberStatus.INVITED) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n context: {\n reason: 'enterprise_membership_not_activatable',\n membershipId: existingMember._id,\n membershipStatus: existingMember.status,\n userId: user._id,\n organizationId,\n },\n });\n }\n\n if (acquisitionChannel === RegistrationAcquisitionChannel.INVITATION) {\n const acceptance = await applyInvitationAcceptanceCore(ec, {\n membership: existingMember,\n user,\n appConfigService: this.appConfigService,\n errorBuilder: this.errorBuilder,\n servicesRegistryHandler: this.servicesRegistryHandler,\n systemAccessService: this.systemAccessService,\n serviceOptions,\n logDebug: this.logDebug,\n });\n if (!acceptance.membershipActivated) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n context: {\n reason: 'enterprise_invitation_revoked_during_acceptance',\n membershipId: existingMember._id,\n userId: user._id,\n organizationId,\n },\n });\n }\n } else {\n const activated = await this.systemAccessService.updateAsSystem<OrganizationMember>(\n CoreResourceType.ORGANIZATION_MEMBERS,\n {\n _id: existingMember._id,\n status: OrganizationMemberStatus.INVITED,\n },\n { status: OrganizationMemberStatus.ACTIVE },\n serviceOptions,\n );\n if (!activated) {\n throw this.errorBuilder.buildError(ErrorType.CONFLICT, undefined, {\n context: {\n reason: 'enterprise_membership_activation_race_lost',\n membershipId: existingMember._id,\n userId: user._id,\n organizationId,\n },\n });\n }\n await grantUserTypesOnOrgJoin(ec, {\n userId: user._id,\n organizationId,\n organizationTypes: this.appConfigService.isInitialized()\n ? this.appConfigService.config.organizationTypes\n : undefined,\n servicesRegistryHandler: this.servicesRegistryHandler,\n systemAccessService: this.systemAccessService,\n serviceOptions,\n });\n }\n\n this.logDebug('Pending organization membership activated via enterprise provisioning', {\n userId: user._id,\n organizationId,\n acquisitionChannel,\n });\n return true;\n }\n\n let effectiveRoles = [...roles];\n const organizationTypes = this.appConfigService.isInitialized()\n ? this.appConfigService.config.organizationTypes\n : undefined;\n if (effectiveRoles.length === 0 && organizationTypes) {\n const organization = await this.systemAccessService.readAsSystem<{ type?: string }>(\n CoreResourceType.ORGANIZATIONS,\n { _id: organizationId },\n serviceOptions,\n );\n const defaultRole = organization?.type\n ? organizationTypes[organization.type]?.defaultMemberRole\n : undefined;\n if (defaultRole) effectiveRoles = [defaultRole];\n }\n if (effectiveRoles.length > 0 && organizationTypes) {\n await validateOrgMemberRoles(ec, {\n organizationId,\n roles: effectiveRoles,\n organizationTypes,\n servicesRegistryHandler: this.servicesRegistryHandler,\n errorBuilder: this.errorBuilder,\n serviceOptions,\n });\n }\n\n // The system-access write preserves the context foreign keys that the\n // client-shaped CREATE DTO intentionally strips.\n await this.systemAccessService.createAsSystem<OrganizationMember>(\n CoreResourceType.ORGANIZATION_MEMBERS,\n {\n userId: user._id,\n organizationId,\n roles: effectiveRoles.length > 0 ? effectiveRoles : undefined,\n status: OrganizationMemberStatus.ACTIVE,\n },\n serviceOptions,\n );\n\n this.logDebug('Organization membership created', {\n userId: user._id,\n organizationId,\n roles: effectiveRoles,\n });\n return true;\n }\n\n /\n Add only the policy-authorized acquisition delta inside the caller's transaction.\n \n The re-read prevents a stale caller snapshot from overwriting grants applied by\n * the membership-create postfix in the same database unit of work.\n /\n private async ensureAuthorizedTypesAssigned(\n ec: ExecutionContext<any>,\n user: User,\n authorizedUserTypes: readonly string[],\n serviceOptions: ServiceOptions,\n ): Promise<User> {\n const currentUser = await this.servicesRegistryHandler.read<User>(\n CoreResourceType.USERS,\n ec,\n { _id: user._id },\n serviceOptions,\n );\n if (!currentUser) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n context: {\n reason: 'enterprise_user_missing_during_type_assignment',\n userId: user._id,\n },\n });\n }\n\n const currentTypes = currentUser.userTypes ?? [];\n const missingTypes = [...new Set(authorizedUserTypes)]\n .filter((userType) => !currentTypes.includes(userType));\n if (missingTypes.length === 0) return currentUser;\n\n const updatedUser = await this.servicesRegistryHandler.update<User>(\n CoreResourceType.USERS,\n ec,\n currentUser._id,\n { userTypes: [...currentTypes, ...missingTypes] },\n serviceOptions,\n );\n if (!updatedUser) {\n throw this.errorBuilder.buildError(ErrorType.CONFLICT, undefined, {\n context: {\n reason: 'enterprise_user_type_assignment_failed',\n userId: user._id,\n missingTypes,\n },\n });\n }\n return updatedUser;\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Private: Identity Link\n // ═══════════════════════════════════════════════════════════════\n\n private async createIdentityLink(\n ec: ExecutionContext<any>,\n userId: string,\n profile: NormalizedUserProfile,\n connection: ProvisioningConnectionContext,\n serviceOptions: ServiceOptions,\n ): Promise<void> {\n const scope = this.requireEnterpriseScope(connection);\n const scopeFilter = scope.scopeType === AuthScopeType.ORGANIZATION\n ? { organizationId: scope.organizationId }\n : { applicationId: scope.applicationId };\n const existingLink = await this.systemAccessService.readAsSystem<UserIdentityLink>(\n CoreResourceType.USER_IDENTITY_LINKS,\n {\n providerRef: connection.providerRef,\n providerUserId: profile.providerUserId,\n connectionType: SsoConnectionType.ENTERPRISE,\n scopeType: scope.scopeType,\n connectionId: scope.connectionId,\n ...scopeFilter,\n },\n serviceOptions,\n );\n\n if (existingLink) {\n if (existingLink.userId !== userId) {\n throw this.errorBuilder.buildError(ErrorType.CONFLICT, undefined, {\n context: {\n reason: 'enterprise_identity_already_linked_to_another_user',\n identityLinkId: existingLink._id,\n linkedUserId: existingLink.userId,\n attemptedUserId: userId,\n scopeType: scope.scopeType,\n scopeId: scope.scopeId,\n connectionId: scope.connectionId,\n },\n });\n }\n const previousEmail = existingLink.providerEmail?.toLowerCase();\n const newEmail = profile.email?.toLowerCase();\n const emailChanged = previousEmail != null && newEmail != null && previousEmail !== newEmail;\n\n // `lastUsedAt` (`.excludeFromUpdate()`) and `providerRawProfile` (`.isBackendOnly()`)\n // are re-attached past the strict-DTO strip automatically by `updateAsSystem`\n // (`deriveTrustedSystemWritePreservedFields` preserves authored excludeFromUpdate +\n // backend-only fields), so the \"last used\" timestamp advances without a manual\n // `preserveServerInjectedFields`.\n await this.systemAccessService.updateAsSystem(\n CoreResourceType.USER_IDENTITY_LINKS,\n existingLink._id,\n {\n lastUsedAt: new Date(),\n providerEmail: profile.email,\n providerDisplayName: profile.displayName,\n providerAvatarUrl: profile.avatarUrl,\n providerRawProfile: profile.rawClaims,\n },\n serviceOptions,\n );\n\n if (emailChanged && connection.source === ExternalIdentitySource.SAML) {\n const organizationId = getOrganizationIdFromEnterpriseScope(scope);\n this.auditLogsService.logSAMLEvent(\n CoreAuditableEventType.SAML_EMAIL_CHANGED,\n ResourceOperationRiskLevel.MEDIUM,\n {\n userId: existingLink.userId,\n organizationId,\n applicationId: getApplicationIdFromEnterpriseScope(scope),\n connectionId: scope.connectionId,\n providerRef: connection.providerRef,\n previousEmail,\n newEmail,\n },\n await this.authEcFactory.createForAuditRoutingOrFallback(ec, organizationId, existingLink.userId),\n ).catch(() => { / fire-and-forget / });\n }\n return;\n }\n\n await this.systemAccessService.createAsSystem(\n CoreResourceType.USER_IDENTITY_LINKS,\n {\n userId,\n connectionType: SsoConnectionType.ENTERPRISE,\n providerRef: connection.providerRef,\n providerUserId: profile.providerUserId,\n providerEmail: profile.email,\n providerDisplayName: profile.displayName,\n providerAvatarUrl: profile.avatarUrl,\n providerRawProfile: profile.rawClaims,\n scopeType: scope.scopeType,\n organizationId: getOrganizationIdFromEnterpriseScope(scope),\n applicationId: getApplicationIdFromEnterpriseScope(scope),\n connectionId: scope.connectionId,\n source: connection.source,\n },\n serviceOptions,\n );\n }\n\n /\n Enterprise provisioning is never meaningful without the exact connection scope.\n * Rejecting a missing scope here prevents a resolver defect from degrading into an\n * application-wide identity link or an organization-free membership mutation.\n /\n private requireEnterpriseScope(\n connection: ProvisioningConnectionContext,\n ): EnterpriseConnectionScope {\n if (!connection.scope) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n reason: 'enterprise_connection_scope_missing',\n providerRef: connection.providerRef,\n source: connection.source,\n },\n });\n }\n return connection.scope;\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Private: Execution Context\n // ═══════════════════════════════════════════════════════════════\n\n /\n System-level EC for enterprise user provisioning (SCIM/JIT).\n * Uses INTERNALLY_INITIATED_REQUEST with APP_ADMIN_SUPER_ADMIN —\n * these operations act on behalf of the system, not a specific user.\n * Primary intent: user creation/provisioning from enterprise IdP.\n */\n private async getInternalExecutionContext(): Promise<ExecutionContext<any>> {\n return this.authEcFactory.createForSystemAuthOperation(this.authEcFactory.getUsersCreateOperationPath());\n }\n}\n"]}