npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.2 → 1.1.3 - Mend

@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (853) hide show

package/dist/esm/security/authentications/services/auth-methods/auth-registration.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-registration.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/auth-registration.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,gFAAgF,CAAC;AAE/H,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AAExI,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AACvI,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,gCAAgC,EAAE,MAAM,iGAAiG,CAAC;AACnJ,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAChJ,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AACzJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAIzH,OAAO,EACL,6BAA6B,EAC7B,0CAA0C,GAC3C,MAAM,+EAA+E,CAAC;AACvF,OAAO,EACL,uBAAuB,EACvB,0CAA0C,EAC1C,iCAAiC,EACjC,oCAAoC,GACrC,MAAM,sFAAsF,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,2EAA2E,CAAC;AAC9G,OAAO,EACL,yDAAyD,EACzD,kDAAkD,EAClD,wCAAwC,GACzC,MAAM,4FAA4F,CAAC;AACpG,OAAO,EAAE,wCAAwC,EAAE,MAAM,kGAAkG,CAAC;AAK5J,OAAO,EACL,wBAAwB,EAExB,gBAAgB,EAChB,SAAS,EACT,2BAA2B,EAG3B,UAAU,EACV,cAAc,EACd,UAAU,EACV,YAAY,EACZ,kBAAkB,EAClB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EACxB,8BAA8B,EAC9B,wBAAwB,EACxB,gCAAgC,EAChC,iBAAiB,EACjB,aAAa,EACb,8BAA8B,EAC9B,gBAAgB,EAChB,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAqB,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAsDhG;;;;;GAKG;AACH,MAAM,CAAN,IAAY,uBAKX;AALD,WAAY,uBAAuB;IACjC,mGAAmG;IACnG,8CAAmB,CAAA;IACnB,uEAAuE;IACvE,8DAAmC,CAAA;AACrC,CAAC,EALW,uBAAuB,KAAvB,uBAAuB,QAKlC;AAsDM,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;IAIa;IACa;IACH;IACM;IACA;IACP;IACM;IACI;IACD;IACR;IACc;IACG;IAKd;IAMQ;IAIZ;IAIkB;IAIT;IAErD;IAvCF,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EAC3C,gBAAyC,EACnC,sBAAqD,EACrD,kBAAwD,EAC/D,WAA0C,EACpC,UAAwC,EACpC,kBAAoD,EACrD,YAA6C,EACrD,gBAAyC,EAC3B,uBAA8D,EAC3D,gBAA0D,EAKxE,mBAA+C,EAMvC,aAAwD,EAIpE,eAAuC,EAIrB,0BAAoE,EAI7E,iBAAkD,EAEvG,6BAC4B;QArCO,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC3C,qBAAgB,GAAhB,gBAAgB,CAAyB;QACnC,2BAAsB,GAAtB,sBAAsB,CAA+B;QACrD,uBAAkB,GAAlB,kBAAkB,CAAsC;QAC/D,gBAAW,GAAX,WAAW,CAA+B;QACpC,eAAU,GAAV,UAAU,CAA8B;QACpC,uBAAkB,GAAlB,kBAAkB,CAAkC;QACrD,iBAAY,GAAZ,YAAY,CAAiC;QACrD,qBAAgB,GAAhB,gBAAgB,CAAyB;QAC3B,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC3D,qBAAgB,GAAhB,gBAAgB,CAA0C;QAKxE,wBAAmB,GAAnB,mBAAmB,CAA4B;QAMvC,kBAAa,GAAb,aAAa,CAA2C;QAIpE,oBAAe,GAAf,eAAe,CAAwB;QAIrB,+BAA0B,GAA1B,0BAA0B,CAA0C;QAI7E,sBAAiB,GAAjB,iBAAiB,CAAiC;QAEvG,kCAA6B,GAA7B,6BAA6B,CACD;QAE7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,iBAAiB,CACrB,EAAyB,EACzB,eAAuB;QAEvB,oFAAoF;QACpF,8FAA8F;QAC9F,kGAAkG;QAClG,uGAAuG;QACvG,sEAAsE;QACtE,IAAI,WAAW,CAAC;QAChB,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAC3D,eAAe,EACf,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,CAC1D,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,CAAC;QAC3C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,+EAA+E;QAC/E,2EAA2E;QAC3E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACxD,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,CACjE,CAAC;QACF,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,wBAAwB,CAAC,OAAO,EAAE,CAAC;YAC1E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QACjD,MAAM,YAAY,GAAG,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAEhE,6FAA6F;QAC7F,4FAA4F;QAC5F,kGAAkG;QAClG,mGAAmG;QACnG,iGAAiG;QACjG,+FAA+F;QAC/F,EAAE;QACF,gGAAgG;QAChG,sFAAsF;QACtF,uFAAuF;QACvF,4FAA4F;QAC5F,+CAA+C;QAC/C,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;QACvH,MAAM,gBAAgB,GAAG,eAAe,IAAI,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,kBAAkB,GAAG,eAAe,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QAEtE,gFAAgF;QAChF,oFAAoF;QACpF,4EAA4E;QAC5E,kFAAkF;QAClF,8DAA8D;QAC9D,MAAM,cAAc,GAAG,kBAAkB;YACvC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,2BAA2B,CAAC,kBAAkB,EAAE,OAAO,CAAC;YAC1E,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,gBAAgB,GAAG,CACvB,cAAc;eACX,CAAC,cAAc,CAAC,YAAY,CAAC,cAAc,CAAC,QAAQ,CACrD,UAAU,CAAC,QAAQ,CACpB,CACF;YACC,CAAC,CAAC;gBACE,GAAG,cAAc;gBACjB,kBAAkB,EAAE;oBAClB,GAAG,cAAc,CAAC,kBAAkB;oBACpC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,KAAK;iBAC7B;aACF;YACH,CAAC,CAAC,cAAc,CAAC;QACnB,MAAM,cAAc,GAAG,gBAAgB;YACrC,CAAC,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;YACxD,CAAC,CAAC,IAAI,GAAG,EAAc,CAAC;QAE1B,2EAA2E;QAC3E,gFAAgF;QAChF,oFAAoF;QACpF,kFAAkF;QAClF,oFAAoF;QACpF,oFAAoF;QACpF,oFAAoF;QACpF,MAAM,YAAY,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;YACjH,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,EAAE,EAAE,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC;YAC7F,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,2BAA2B,GAAG,gBAAgB;YAClD,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,gCAAgC,CAAC,EAAE,EAAE,gBAAgB,EAAE,YAAY,CAAC;YAClG,CAAC,CAAC,EAAE,CAAC;QAEP,mFAAmF;QACnF,wFAAwF;QACxF,mFAAmF;QACnF,wFAAwF;QACxF,qFAAqF;QACrF,wFAAwF;QACxF,qFAAqF;QACrF,4FAA4F;QAC5F,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,6BAA6B,CAAC;gBAChD,cAAc;gBACd,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;gBACzC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,KAAK,CAAC;QACtB,CAAC;QACD,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;QAC/G,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,cAAc,GAAG,WAAW;YAChC,CAAC,CAAC,wBAAwB,CAAC,IAAI;YAC/B,CAAC,CAAC,SAAS,IAAI,CAAC,WAAW;gBACzB,CAAC,CAAC,wBAAwB,CAAC,GAAG;gBAC9B,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC;QAEpC,kFAAkF;QAClF,oFAAoF;QACpF,sFAAsF;QACtF,wFAAwF;QACxF,wFAAwF;QACxF,qFAAqF;QACrF,OAAO,gCAAgC,CAAC,KAAK,CAAC;YAC5C,YAAY;YACZ,gBAAgB;YAChB,2BAA2B;YAC3B,cAAc;YACd,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;gBACrD,CAAC,CAAC,gBAAgB,EAAE,cAAc;gBAClC,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAChB,EAAyB,EACzB,MAA0B,EAC1B,GAAwB;QAExB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;QAC1E,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,mBAAmB,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC;QACvF,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,CAAC;QAE7G,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAEjE,2DAA2D;QAC3D,yDAAyD;QACzD,uDAAuD;QACvD,6DAA6D;QAC7D,+DAA+D;QAC/D,6DAA6D;QAC7D,yDAAyD;QACzD,gEAAgE;QAChE,8DAA8D;QAC9D,8DAA8D;QAC9D,oDAAoD;QACpD,+DAA+D;QAC/D,4DAA4D;QAC5D,0DAA0D;QAC1D,eAAe;QAEf,2FAA2F;QAC3F,MAAM,kBAAkB,GAAG,cAAc;YACvC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,cAAc,CAAC;YAC7D,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,mBAAmB,IAAI,cAAc,EAAE,CAAC;YAC1C,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,CAAC,qCAAqC,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC;YACxH,IAAI,cAAc,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;oBACzE,OAAO,EAAE;wBACP,mEAAmE;wBACnE,mBAAmB;wBACnB,cAAc;qBACf;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAE5C,MAAM,kBAAkB,GAAG,kBAAkB,EAAE,YAAY,CAAC;QAC5D,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;aAC1E,CAAC,CAAC;QACL,CAAC;QAED,yFAAyF;QACzF,0FAA0F;QAC1F,4FAA4F;QAC5F,4FAA4F;QAC5F,gGAAgG;QAChG,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,IAAI,CAAC;QACjD,IAAI,CAAC,gCAAgC,CACnC,gBAAgB,EAChB,8BAA8B,CAAC,mBAAmB,CACnD,EAAE,CAAC;YACF,oGAAoG;YACpG,MAAM,4BAA4B,GAA0D;gBAC1F,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,2BAA2B,CAAC,qBAAqB;gBAC1E,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,2BAA2B,CAAC,4BAA4B;gBAC5F,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,2BAA2B,CAAC,uBAAuB;gBAClF,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,2BAA2B,CAAC,qBAAqB;aAC/E,CAAC;YACF,8FAA8F;YAC9F,gGAAgG;YAChG,0FAA0F;YAC1F,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EACpB,4BAA4B,CAAC,gBAAgB,CAAC,IAAI,2BAA2B,CAAC,qBAAqB;aACtG,CAAC,CAAC;QACL,CAAC;QAED,uEAAuE;QACvE,2EAA2E;QAC3E,MAAM,2BAA2B,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE;YACvE,CAAC,CAAC,MAAM,CAAC,iBAAiB;YAC1B,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,eAAe,GAAG,cAAc;YACpC,CAAC,CAAC,oCAAoC,CAAC;gBACnC,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE;gBAC9B,cAAc;gBACd,gBAAgB;gBAChB,iBAAiB,EAAE,2BAA2B;aAC/C,CAAC;YACJ,CAAC,CAAC;gBACE,IAAI,EAAE,iCAAiC,CAAC,IAAI;aACpC,CAAC;QACf,IAAI,eAAe,CAAC,IAAI,KAAK,iCAAiC,CAAC,OAAO,EAAE,CAAC;YACvE,IACE,eAAe,CAAC,MAAM;oBAClB,0CAA0C;qBAC3C,kCAAkC,EACrC,CAAC;gBACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,iBAAiB;oBACrE,OAAO,EAAE;wBACP,gBAAgB,EAAE,eAAe,CAAC,OAAO;qBAC1C;iBACF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,MAAM,EACJ,mEAAmE;oBACrE,cAAc;oBACd,gBAAgB,EAAE,eAAe,CAAC,gBAAgB;iBACnD;aACF,CAAC,CAAC;QACL,CAAC;QAED,kEAAkE;QAClE,2EAA2E;QAC3E,uCAAuC;QACvC,MAAM,uBAAuB,GAC3B,eAAe,CAAC,IAAI,KAAK,iCAAiC,CAAC,IAAI;YAC7D,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,2BAA2B,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,4BAA4B,GAAG,2BAA2B,CAC9D,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EACpE,uBAAuB,EAAE,SAAS,IAAI,EAAE,EACxC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,EACtC,8BAA8B,CAAC,mBAAmB,CACnD,CAAC;QACF,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;gBACzE,OAAO,EAAE;oBACP,OAAO,EAAE,8BAA8B,CAAC,mBAAmB;oBAC3D,eAAe,EAAE,4BAA4B,CAAC,eAAe;iBAC9D;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,cAAc,CAAC;QACzD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;gBACvF,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,cAAc,EAAE;aACzD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EACpB,2BAA2B,CAAC,8BAA8B;aAC7D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,cAAc,GAAG,kBAAkB,EAAE,cAAc,CAAC;QAC1D,MAAM,gBAAgB,GACpB,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAC5C,QAAQ,EACR,cAAc,CACf,CAAC;QACJ,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EACpB,2BAA2B;qBACxB,oCAAoC;gBACzC,OAAO,EAAE;oBACP,UAAU,EAAE,gBAAgB,CAAC,UAAU;oBACvC,SAAS,EAAE,cAAc,EAAE,SAAS;oBACpC,SAAS,EAAE,cAAc,EAAE,SAAS;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAClE,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,8EAA8E,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACzG,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,yDAAyD;QACzD,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBACzE,IAAI,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;oBAC1C,IAAI,CAAC,QAAQ,CAAC,2CAA2C,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC9E,OAAO,EAAE,GAAG,eAAe,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;gBACvD,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAC7D,QAAQ,EACR,MAAM,CAAC,IAAI,CAAC,eAAe,CAC5B,CAAC;QAEF,8EAA8E;QAC9E,MAAM,sBAAsB,GAAG,kBAAkB,CAAC,iBAAiB,KAAK,qBAAqB,CAAC,QAAQ,CAAC;QACvG,MAAM,aAAa,GAAG,sBAAsB,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC;QAEnG,mFAAmF;QACnF,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,kBAAkB,GAAG,cAAc;YACvC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,cAAc,CAAC;YACpC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,eAAe,GAAG,kBAAkB,EAAE,eAAe,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACzF,IAAI,OAAa,CAAC;QAClB,IAAI,cAAkC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,uBAAuB,GAC3B,MAAM,IAAI,CAAC,6BAA6B,CAAC,kBAAkB,CACzD,wCAAwC,CAAC;gBACvC,kBAAkB,EAAE,YAAY,KAAK,SAAS;gBAC9C,sCAAsC,EACpC,eAAe,CAAC,IAAI;wBAChB,iCAAiC,CAAC,WAAW;aACpD,CAAC,EACF,KAAK,EAAC,cAAc,EAAC,EAAE;gBACzB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAC3D,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF;oBACE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;oBAC1B,MAAM,EAAE,aAAa;oBACrB,QAAQ,EAAE,eAAe;oBACzB,SAAS;iBACV,EACD;oBACE,GAAG,cAAc;oBACjB,wEAAwE;oBACxE,0FAA0F;oBAC1F,wFAAwF;oBACxF,kFAAkF;oBAClF,sFAAsF;oBACtF,gFAAgF;oBAChF,EAAE;oBACF,yFAAyF;oBACzF,yFAAyF;oBACzF,yFAAyF;oBACzF,yFAAyF;oBACzF,yBAAyB;oBACzB,4BAA4B,EAAE;wBAC5B,GAAG,CAAC,cAAc,EAAE,4BAA4B,IAAI,EAAE,CAAC;wBACvD,UAAU;qBACX;iBACF,CACF,CAAC;gBAEF,IAAI,YAAY,EAAE,CAAC;oBACjB,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC3C,gBAAgB,CAAC,gBAAgB,EACjC;wBACE,MAAM,EAAE,WAAW,CAAC,GAAG;wBACvB,YAAY;qBACb,EACD,cAAc,CACf,CAAC;gBACJ,CAAC;gBAED,IAAI,eAAmC,CAAC;gBACxC,IAAI,cAAc,IAAI,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAAC;oBAC5D,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,CAAC;oBACzE,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,EAAE,EAAE;wBAClD,MAAM,EAAE,WAAW,CAAC,GAAG;wBACvB,SAAS,EAAE,WAAW,CAAC,KAAK;wBAC5B,cAAc;wBACd,gBAAgB;wBAChB,iBAAiB;wBACjB,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;wBACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;wBAC7C,cAAc;wBACd,IAAI,EAAE,eAAe;qBACtB,CAAC,CAAC;oBACH,IAAI,SAAS,CAAC,iBAAiB,EAAE,CAAC;wBAChC,eAAe,GAAG,SAAS,CAAC,OAAO,CAAC;oBACtC,CAAC;gBACH,CAAC;gBACD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;YACtC,CAAC,EACD;gBACE,4DAA4D;gBAC5D,oEAAoE;gBACpE,oEAAoE;gBACpE,2BAA2B,EAAE;oBAC3B,SAAS;oBACT,QAAQ;oBACR,WAAW,EAAE,GAAG,SAAS,IAAI,QAAQ,EAAE;iBACxC;aACF,CACF,CAAC;YACJ,OAAO,GAAG,uBAAuB,CAAC,WAAW,CAAC;YAC9C,cAAc,GAAG,uBAAuB,CAAC,eAAe,CAAC;QAC3D,CAAC;QAAC,OAAO,WAAgB,EAAE,CAAC;YAC1B,IACE,CAAC,mBAAmB,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,UAAU,KAAK,GAAG,CAAC;mBACjE,WAAW,EAAE,IAAI,KAAK,KAAK;mBAC3B,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,eAAe,CAAC;mBAC/C,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAC3C,CAAC;gBACD,uEAAuE;gBACvE,yEAAyE;gBACzE,qEAAqE;gBACrE,wEAAwE;gBACxE,8BAA8B;gBAC9B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAC1D,EAAE,EACF,KAAK,CACN,CAAC;gBACF,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,CAAC,QAAQ,CACX,qFAAqF,EACrF;wBACE,KAAK;wBACL,aAAa,EAAE,WAAW,CAAC,GAAG;qBAC/B,CACF,CAAC;oBACF,OAAO,eAAe,CAAC;gBACzB,CAAC;YACH,CAAC;YACD,MAAM,WAAW,CAAC;QACpB,CAAC;QAED,uEAAuE;QACvE,6DAA6D;QAC7D,2EAA2E;QAC3E,6EAA6E;QAC7E,+EAA+E;QAE/E,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,CAAC,qCAAqC,EAAE;gBACnD,MAAM,EAAE,OAAO,CAAC,GAAG;gBACnB,OAAO,EAAE,cAAc;aACxB,CAAC,CAAC;QACL,CAAC;QAED,2FAA2F;QAC3F,0FAA0F;QAC1F,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,0BAA0B,CAAC,qBAAqB,CAAC;gBAC1D,MAAM,EAAE,OAAO,CAAC,GAAG;gBACnB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS;gBACT,eAAe,EAAE,WAAW;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAEjI,+EAA+E;QAC/E,+EAA+E;QAC/E,qEAAqE;QACrE,IAAI,sBAAsB,EAAE,CAAC;YAC3B,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAC1E,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,cAAc,EAC9C,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,kBAAkB,CAAC,YAAY,CAC1D,CAAC;YAEF,IAAI,eAAe,CAAC,KAAK,KAAK,0BAA0B,CAAC,SAAS,IAAI,eAAe,CAAC,KAAK,KAAK,0BAA0B,CAAC,oBAAoB,EAAE,CAAC;gBAChJ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE;oBACpF,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;iBACnD,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,+DAA+D,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBACxG,OAAO;oBACL,GAAG,eAAe;oBAClB,SAAS,EAAE,eAAe,CAAC,SAAS;oBACpC,KAAK,EAAE,eAAe,CAAC,KAAK;oBAC5B,OAAO,EAAE,eAAe,CAAC,OAAO;oBAChC,oEAAoE;oBACpE,iEAAiE;oBACjE,6DAA6D;oBAC7D,qEAAqE;oBACrE,qDAAqD;oBACrD,MAAM,EAAE,OAAO,CAAC,GAAG;oBACnB,WAAW,EAAE,WAAW,CAAC,WAAW;oBACpC,YAAY,EAAE,WAAW,CAAC,YAAY;oBACtC,SAAS,EAAE,WAAW,CAAC,SAAS;iBACjC,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,iFAAiF,EAAE;gBAC/F,MAAM,EAAE,OAAO,CAAC,GAAG;gBACnB,KAAK,EAAE,eAAe,CAAC,KAAK;gBAC5B,QAAQ,EAAE,eAAe,CAAC,QAAQ;aACnC,CAAC,CAAC;YACH,OAAO;gBACL,GAAG,eAAe;gBAClB,SAAS,EAAE,eAAe,CAAC,SAAS;gBACpC,KAAK,EAAE,eAAe,CAAC,KAAK;gBAC5B,OAAO,EAAE,eAAe,CAAC,OAAO;gBAChC,QAAQ,EAAE,eAAe,CAAC,QAAQ;aACnC,CAAC;QACJ,CAAC;QAED,+EAA+E;QAC/E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CACtE,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,KAAK,EACb;YACE,cAAc;YACd,OAAO,EAAE,kBAAkB,CAAC,YAAY;YACxC,UAAU,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE;YACpC,cAAc;SACf,CACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,sDAAsD,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;QAChI,OAAO;YACL,GAAG,eAAe;YAClB,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,OAAO,EAAE,UAAU,CAAC,OAAO;SAC5B,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CACf,EAAyB,EACzB,MAAyB;QAczB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;QAEpE,IAAI,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC;QAE9C,IAAI,aAAa,CAAC;QAClB,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,aAAa,CAAC,SAAS,KAAK,wBAAwB,CAAC,kBAAkB,EAAE,CAAC;YAC5E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC;QAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,aAAa,CAAC,QAA+C,CAAC;QAC/E,MAAM,aAAa,GAAG,QAAQ,EAAE,KAA2B,CAAC;QAE5D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wEAAwE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACvG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/D,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC;QAChE,IAAI,aAAa,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;YAC/G,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACzG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAE/F,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;aAClF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,yCAAyC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACvE,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,oBAAoB,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;aACnF,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,6FAA6F;YAC7F,8FAA8F;YAC9F,8FAA8F;YAC9F,kFAAkF;YAClF,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7G,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,IAAI,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,MAAM,EAAE,wBAAwB,CAAC,kBAAkB,CAAC,CAAC;QAE/G,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAE9H,gFAAgF;QAChF,sEAAsE;QACtE,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAClE,EAAE,EACF,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,KAAK,EACV,cAAc,EACd,EAAE,SAAS,EAAE,SAAS,EAAE,CACzB,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,iDAAiD,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAE/H,wDAAwD;QACxD,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,IAAI,OAAO,CAAC,KAAK,KAAK,sBAAsB,EAAE,CAAC;YAC9E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE;gBACjF,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;aACnD,CAAC,CAAC;YACH,OAAO;gBACL,MAAM;gBACN,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,YAAY,CAAC,QAAQ;gBACnD,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,YAAY,EAAE,WAAW,CAAC,YAAY,IAAI,EAAE;gBAC5C,SAAS,EAAE,WAAW,CAAC,SAAS,IAAI,IAAI;gBACxC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;aAC7C,CAAC;QACJ,CAAC;QAED,oFAAoF;QACpF,OAAO;YACL,MAAM;YACN,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,YAAY,CAAC,cAAc;YACzD,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,uBAAuB,CAC3B,EAAyB,EACzB,MAAgC;QAEhC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;QAC5D,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,CAAC;QAEpH,IAAI,CAAC,QAAQ,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAEhE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAEjE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,oBAAoB,EAAE,CAAC;gBAC7D,IAAI,CAAC,QAAQ,CAAC,4FAA4F,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvH,OAAO,eAAe,CAAC;YACzB,CAAC;YAED,2FAA2F;YAC3F,MAAM,IAAI,CAAC,0BAA0B,CAAC,qBAAqB,CAAC;gBAC1D,MAAM,EAAE,IAAI,CAAC,GAAG;gBAChB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,eAAe,EAAE,WAAW;gBAC5B,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;YAEH,IAAI,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtI,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE;gBACrE,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,KAAK,CAAC,gBAAgB,CACpB,EAAyB,EACzB,MAA8B;QAE9B,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;QAE1G,2FAA2F;QAC3F,0FAA0F;QAC1F,0FAA0F;QAC1F,sFAAsF;QACtF,mFAAmF;QACnF,+FAA+F;QAC/F,EAAE;QACF,mGAAmG;QACnG,uGAAuG;QACvG,oGAAoG;QACpG,oGAAoG;QACpG,qGAAqG;QACrG,mGAAmG;QACnG,8FAA8F;QAC9F,iGAAiG;QACjG,kGAAkG;QAClG,gDAAgD;QAChD,EAAE;QACF,8FAA8F;QAC9F,4FAA4F;QAC5F,sGAAsG;QACtG,yFAAyF;QACzF,EAAE;QACF,kGAAkG;QAClG,oGAAoG;QACpG,kGAAkG;QAClG,kGAAkG;QAClG,6FAA6F;QAC7F,kGAAkG;QAClG,sGAAsG;QACtG,oGAAoG;QACpG,sGAAsG;QACtG,qGAAqG;QACrG,oGAAoG;QACpG,qEAAqE;QACrE,+FAA+F;QAC/F,yFAAyF;QACzF,uGAAuG;QACvG,qGAAqG;QACrG,uGAAuG;QACvG,qGAAqG;QACrG,sGAAsG;QACtG,qGAAqG;QACrG,gGAAgG;QAChG,uGAAuG;QACvG,6FAA6F;QAC7F,qBAAqB;QACrB,IAAI,WAAW,CAAC;QAChB,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAC3D,eAAe,EACf,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,CAC1D,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,IAAI,WAAW,CAAC,SAAS,KAAK,wBAAwB,CAAC,8BAA8B,EAAE,CAAC;YACtF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,CAAC;QAC3C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,8EAA8E;QAC9E,8EAA8E;QAC9E,MAAM,YAAY,GAAG,YAAY,CAAC;QAClC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAqB,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;QACjJ,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,wBAAwB,CAAC,OAAO,EAAE,CAAC;YAC1E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QACjD,MAAM,eAAe,GAAG,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAEnE,wFAAwF;QACxF,iFAAiF;QACjF,IAAI,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,+EAA+E;YAC/E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,yFAAyF;QACzF,uFAAuF;QACvF,IACE,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;YACjC,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,oBAAoB;YAC/C,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,kBAAkB,EAC7C,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;gBAClF,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE;aACvD,CAAC,CAAC;QACL,CAAC;QAED,oFAAoF;QACpF,mFAAmF;QACnF,4BAA4B;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,kBAAkB,CAAC;QAEhE,mGAAmG;QACnG,mGAAmG;QACnG,kGAAkG;QAClG,oGAAoG;QACpG,gGAAgG;QAChG,gGAAgG;QAChG,oGAAoG;QACpG,+FAA+F;QAC/F,2FAA2F;QAC3F,IAAI,CAAC,SAAS,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE;oBACP,mFAAmF;oBACnF,cAAc;iBACf;aACF,CAAC,CAAC;QACL,CAAC;QAED,8FAA8F;QAC9F,kFAAkF;QAClF,0FAA0F;QAC1F,+EAA+E;QAC/E,iGAAiG;QACjG,kGAAkG;QAClG,kGAAkG;QAClG,oGAAoG;QACpG,oGAAoG;QACpG,oFAAoF;QACpF,gGAAgG;QAChG,kEAAkE;QAClE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;QACnG,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QAE9D,iGAAiG;QACjG,mGAAmG;QACnG,qGAAqG;QACrG,sGAAsG;QACtG,qEAAqE;QACrE,oGAAoG;QACpG,+FAA+F;QAC/F,oGAAoG;QACpG,gFAAgF;QAChF,sGAAsG;QACtG,2BAA2B;QAC3B,6FAA6F;QAC7F,+EAA+E;QAC/E,mGAAmG;QACnG,oFAAoF;QACpF,MAAM,2BAA2B,GAC/B,gBAAgB,KAAK,UAAU,CAAC,UAAU,IAAI,gBAAgB,KAAK,UAAU,CAAC,OAAO;YACnF,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,2BAA2B,EAAE,CAAC;YAChC,IAAI,aAAa,EAAE,CAAC;gBAClB,2FAA2F;gBAC3F,gGAAgG;gBAChG,iGAAiG;gBACjG,mGAAmG;gBACnG,gGAAgG;gBAChG,wFAAwF;gBACxF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;oBAChE,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;oBACtF,OAAO,EAAE;wBACP,gFAAgF;wBAChF,8EAA8E;wBAC9E,cAAc;qBACf;iBACF,CAAC,CAAC;YACL,CAAC;YACD,kFAAkF;YAClF,6DAA6D;YAC7D,kEAAkE;YAClE,4EAA4E;YAC5E,gFAAgF;YAChF,gFAAgF;YAChF,4EAA4E;YAC5E,mEAAmE;YACnE,IAAI,wBAAiC,CAAC;YACtC,IAAI,CAAC;gBACH,wBAAwB,GAAG,MAAM,6BAA6B,CAAC;oBAC7D,cAAc;oBACd,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;oBACzC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;iBAC9C,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,4EAA4E;gBAC5E,+EAA+E;gBAC/E,6EAA6E;gBAC7E,8EAA8E;gBAC9E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iEAAiE,EAAE;oBAClF,cAAc;oBACd,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;oBAChE,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;oBACtF,OAAO,EAAE,EAAE,cAAc,EAAE;iBAC5B,CAAC,CAAC;YACL,CAAC;YACD,IAAI,wBAAwB,EAAE,CAAC;gBAC7B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,sBAAsB,EAAE,2BAA2B,CAAC,4CAA4C;oBAChG,OAAO,EAAE;wBACP,qFAAqF;wBACrF,cAAc;qBACf;iBACF,CAAC,CAAC;YACL,CAAC;YACD,6FAA6F;YAC7F,4FAA4F;YAC5F,MAAM,kBAAkB,GAAG,eAAe,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC,wCAAwC,CAAC,cAAc,EAAE,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,CAAC,CAAC;QAC1H,CAAC;QAED,+FAA+F;QAC/F,4FAA4F;QAC5F,4FAA4F;QAC5F,+FAA+F;QAC/F,iGAAiG;QACjG,yFAAyF;QACzF,oFAAoF;QACpF,6CAA6C;QAC7C,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;YAC1B,MAAM,cAAc,GAAG,CAAC,cAAc;gBACpC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,2BAA2B,CAAC,cAAc,EAAE,OAAO,CAAC;gBACtE,CAAC,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC;YAC1B,MAAM,gBAAgB,GAAG,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;YAClG,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;oBACxF,OAAO,EAAE,EAAE,UAAU,EAAE,gBAAgB,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;iBACjI,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4FAA4F;QAC5F,8FAA8F;QAC9F,gCAAgC;QAChC,MAAM,0CAA0C,CAAC;YAC/C,IAAI;YACJ,cAAc;YACd,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;SAC9C,CAAC,CAAC;QAEH,2EAA2E;QAC3E,2EAA2E;QAC3E,MAAM,cAAc,GAAG,SAAS,IAAI,QAAQ;YAC1C,CAAC,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAC1C,QAAQ,EACR,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAClD;YACD,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,kBAAkB,CAChE,kDAAkD,CAAC;gBACjD,kBAAkB,EAAE,cAAc,KAAK,SAAS;aACjD,CAAC,EACF,KAAK,EAAC,cAAc,EAAC,EAAE;gBACvB,wEAAwE;gBACxE,0EAA0E;gBAC1E,0EAA0E;gBAC1E,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAC5C,eAAe,EACf,cAAc,CAAC,WAAY,CAC5B,CAAC;gBAEF,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CACnE,gBAAgB,CAAC,oBAAoB,EACrC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,EACvB,cAAc,CACf,CAAC;gBACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACzD,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EACjB,cAAc,CACf,CAAC;gBACF,IACE,CAAC,iBAAiB;uBACf,CACD,iBAAiB,CAAC,MAAM,KAAK,wBAAwB,CAAC,OAAO;2BAC1D,iBAAiB,CAAC,MAAM,KAAK,wBAAwB,CAAC,MAAM,CAChE;uBACE,iBAAiB,CAAC,MAAM,KAAK,IAAI,CAAC,GAAG;uBACrC,CAAC,WAAW;uBACZ,WAAW,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EACrC,CAAC;oBACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;qBAC/E,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,cAAc,EAAE,CAAC;oBACnB,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAChE,gBAAgB,CAAC,gBAAgB,EACjC,EAAE,EACF,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,EAC3B,cAAc,CACf,CAAC;oBACF,IAAI,kBAAkB,EAAE,CAAC;wBACvB,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAC9C,EAAE,EACF,WAAW,CAAC,GAAG,EACf,cAAc,EACd,cAAc,CACf,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC3C,gBAAgB,CAAC,gBAAgB,EACjC;4BACE,MAAM,EAAE,WAAW,CAAC,GAAG;4BACvB,YAAY,EAAE,cAAc;yBAC7B,EACD,cAAc,CACf,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,IAAI,aAAa,GAAG,WAAW,CAAC;gBAChC,IACE,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC,kBAAkB;uBACjD,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC,oBAAoB,EACzD,CAAC;oBACD,yFAAyF;oBACzF,wFAAwF;oBACxF,sFAAsF;oBACtF,gFAAgF;oBAChF,EAAE;oBACF,0FAA0F;oBAC1F,2FAA2F;oBAC3F,4FAA4F;oBAC5F,0FAA0F;oBAC1F,YAAY;oBACZ,EAAE;oBACF,yFAAyF;oBACzF,oEAAoE;oBACpE,wFAAwF;oBACxF,uFAAuF;oBACvF,EAAE;oBACF,2FAA2F;oBAC3F,oFAAoF;oBACpF,qBAAqB;oBACrB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC3D,gBAAgB,CAAC,KAAK,EACtB,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,EACpD,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,EAC7B,cAAc,CACf,CAAC;oBACF,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;4BAChE,OAAO,EAAE;gCACP,MAAM,EAAE,sCAAsC;gCAC9C,MAAM,EAAE,WAAW,CAAC,GAAG;6BACxB;yBACF,CAAC,CAAC;oBACL,CAAC;oBACD,aAAa,GAAG,OAAO,CAAC;gBAC1B,CAAC;gBAED,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,6BAA6B,CAAC,EAAE,EAAE;oBACtE,UAAU,EAAE,iBAAiB;oBAC7B,IAAI,EAAE,aAAa;oBACnB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;oBACvC,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;oBACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;oBAC7C,cAAc;oBACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC,CAAC;gBACH,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBACzB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;qBAC/E,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,aAAa,CAAC;YACrB,CAAC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;gBAChE,YAAY,EAAE,UAAU,CAAC,GAAG;gBAC5B,MAAM,EAAE,IAAI,CAAC,GAAG;gBAChB,cAAc;gBACd,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC;oBAC5B,CAAC,CAAC;wBACA,SAAS,EAAE,KAAK,CAAC,IAAI;wBACrB,eAAe,EAAE,KAAK,CAAC,UAAU;wBACjC,YAAY,EAAE,KAAK,CAAC,OAAO;qBAC5B;oBACD,CAAC,CAAC;wBACA,YAAY,EAAE,mBAAmB,CAAC,KAAK,CAAC;qBACzC,CAAC;aACL,CAAC,CAAC;YACH,yEAAyE;YACzE,wEAAwE;YACxE,6EAA6E;YAC7E,mEAAmE;YACnE,IACE,mBAAmB,CAAC,KAAK,CAAC;mBACvB,CACD,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,cAAc;uBACpC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,QAAQ,CACrC,EACD,CAAC;gBACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;oBACE,sBAAsB,EACpB,2BAA2B,CAAC,0BAA0B;iBACzD,CACF,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,wEAAwE;YACxE,0EAA0E;YAC1E,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,aAAa,EAAE;oBAC5E,MAAM,EAAE,IAAI,CAAC,GAAG;oBAChB,SAAS;oBACT,QAAQ;oBACR,WAAW,EAAE,GAAG,SAAS,IAAI,QAAQ,EAAE;iBACxC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,YAAY,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wEAAwE,EAAE;oBAC1F,MAAM,EAAE,IAAI,CAAC,GAAG;oBAChB,GAAG,2BAA2B,CAAC,YAAY,CAAC;iBAC7C,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,qDAAqD,EAAE;gBACnE,MAAM,EAAE,IAAI,CAAC,GAAG;gBAChB,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QAED,0FAA0F;QAC1F,uFAAuF;QACvF,uFAAuF;QACvF,0FAA0F;QAC1F,+FAA+F;QAC/F,4FAA4F;QAC5F,8FAA8F;QAC9F,IAAI,gBAAgB,KAAK,UAAU,CAAC,UAAU,EAAE,CAAC;YAC/C,0FAA0F;YAC1F,8FAA8F;YAC9F,+FAA+F;YAC/F,6FAA6F;YAC7F,4DAA4D;YAC5D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;YACxH,IAAI,CAAC,QAAQ,CAAC,+DAA+D,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;YACrH,OAAO;gBACL,OAAO,EAAE,uBAAuB,CAAC,eAAe;gBAChD,iBAAiB,EAAE;oBACjB,mFAAmF;oBACnF,mFAAmF;oBACnF,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;oBACxB,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,KAAK,EAAE,eAAe;oBACtB,MAAM,EAAE,IAAI,CAAC,GAAG;oBAChB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;iBACzC;aACF,CAAC;QACJ,CAAC;QAED,iGAAiG;QACjG,8FAA8F;QAC9F,+FAA+F;QAC/F,kGAAkG;QAClG,iFAAiF;QACjF,IAAI,gBAAgB,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;YAC5C,4FAA4F;YAC5F,4FAA4F;YAC5F,0FAA0F;YAC1F,gCAAgC;YAChC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,mCAAmC,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gFAAgF,EAAE;oBAClG,MAAM,EAAE,IAAI,CAAC,GAAG;oBAChB,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CACnE,IAAI,CAAC,GAAG,EACR,eAAe,EACf;YACE,cAAc;YACd,OAAO,EAAE,kBAAkB,CAAC,UAAU;YACtC,UAAU,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE;SACrC,CACF,CAAC;QAEF,MAAM,eAAe,GAAG,SAAS;YAC/B,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,qBAAqB,CAAC;YAC5E,CAAC,CAAC,iBAAiB,CAAC,eAAe,CAAC;QACtC,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC;YACjC,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,KAAK,EAAE,eAAe;YACtB,UAAU,EAAE,eAAe;YAC3B,SAAS;YACT,SAAS;YACT,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;SACf,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,+BAA+B,CAAC,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAE3G,+CAA+C;QAC/C,sFAAsF;QACtF,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAC1E,EAAE,EACF,IAAI,CAAC,GAAG,EACR,eAAe,EACf,cAAc,EACd,EAAE,SAAS,EAAE,SAAS,EAAE,EACxB,kBAAkB,CAAC,UAAU,CAC9B,CAAC;QAEF,yCAAyC;QACzC,IAAI,eAAe,CAAC,KAAK,KAAK,WAAW,IAAI,eAAe,CAAC,KAAK,KAAK,sBAAsB,EAAE,CAAC;YAC9F,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE;gBACjF,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;aACnD,CAAC,CAAC;YAEH,4FAA4F;YAC5F,yFAAyF;YACzF,wFAAwF;YACxF,uFAAuF;YACvF,uFAAuF;YACvF,0FAA0F;YAC1F,sFAAsF;YACtF,wEAAwE;YACxE,IAAI,0BAA8E,CAAC;YACnF,IAAI,gBAAgB,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC5C,IAAI,CAAC;oBACH,0BAA0B,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,2BAA2B,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;gBACrH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8GAA8G,EAAE;wBAChI,MAAM,EAAE,IAAI,CAAC,GAAG;wBAChB,GAAG,2BAA2B,CAAC,KAAK,CAAC;qBACtC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,uBAAuB,CAAC,OAAO;gBACxC,SAAS,EAAE,eAAe,CAAC,SAAS;gBACpC,KAAK,EAAE,eAAe,CAAC,KAAK;gBAC5B,OAAO,EAAE,kBAAkB,CAAC,UAAU;gBACtC,QAAQ,EAAE,eAAe,CAAC,QAAQ;gBAClC,MAAM,EAAE,IAAI,CAAC,GAAG;gBAChB,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,YAAY,EAAE,WAAW,CAAC,YAAY;gBACtC,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,0BAA0B;aAC3B,CAAC;QACJ,CAAC;QAED,0FAA0F;QAC1F,6FAA6F;QAC7F,8FAA8F;QAC9F,mFAAmF;QACnF,OAAO;YACL,OAAO,EAAE,uBAAuB,CAAC,OAAO;YACxC,SAAS,EAAE,eAAe,CAAC,SAAS;YACpC,KAAK,EAAE,eAAe,CAAC,KAAK;YAC5B,OAAO,EAAE,kBAAkB,CAAC,UAAU;YACtC,QAAQ,EAAE,eAAe,CAAC,QAAQ;YAClC,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,WAAW,EAAE,IAAI;YACjB,0BAA0B,EAAE,eAAe,CAAC,0BAA0B;SACvE,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACK,KAAK,CAAC,uBAAuB,CACnC,UAAsD;QAEtD,IAAI,OAA2B,CAAC;QAChC,IAAI,gBAAoC,CAAC;QACzC,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CACrD,gBAAgB,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,cAAc,EAAE,CACnE,CAAC;YACF,OAAO,GAAG,GAAG,EAAE,IAAI,CAAC;YACpB,gBAAgB,GAAG,GAAG,EAAE,WAAW,IAAI,GAAG,EAAE,IAAI,IAAI,SAAS,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mGAAmG;YACnG,4FAA4F;YAC5F,kGAAkG;YAClG,yFAAyF;YACzF,+FAA+F;YAC/F,gGAAgG;YAChG,0DAA0D;YAC1D,aAAa,GAAG,IAAI,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,mGAAmG,EAAE;gBACjH,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,eAAe,GAAG,OAAO;YAC7B,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YAC3E,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC;IACvE,CAAC;IAED;;;;;;;;;OASG;IACK,wCAAwC,CAC9C,cAAsB,EACtB,OAA2B,EAC3B,kBAAsC,EACtC,gBAA4B;QAE5B,MAAM,cAAc,GAAG,kBAAkB;YACvC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,2BAA2B,CAAC,kBAAkB,EAAE,OAAO,CAAC;YAC1E,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,cAAc,GAAG,cAAc;YACnC,CAAC,CAAC,iBAAiB,CAAC,cAAc,CAAC,kBAAkB,CAAC;YACtD,CAAC,CAAC,IAAI,GAAG,EAAc,CAAC;QAC1B,MAAM,yBAAyB,GAC7B,gBAAgB,KAAK,UAAU,CAAC,QAAQ;eACrC,cAAc,EAAE,YAAY,CAAC,cAAc,CAAC,QAAQ,CACrD,UAAU,CAAC,QAAQ,CACpB,KAAK,IAAI,CAAC;QAEb,IACE,CAAC,yBAAyB;eACvB,CAAC,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,EACxC,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;gBACvF,OAAO,EAAE;oBACP,oFAAoF;oBACpF,MAAM,EAAE,gBAAgB;oBACxB,cAAc;iBACf;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,mCAAmC,CAAC,EAAyB,EAAE,MAAc;QACzF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACtD,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAClD,CAAC;QACF,IAAI,QAAQ;YAAE,OAAO;QAErB,gGAAgG;QAChG,gGAAgG;QAChG,6FAA6F;QAC7F,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,QAAQ,CAAC,oEAAoE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAClG,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CACpB,EAAyB,EACzB,MAGC;QAED,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;QAEpD,sGAAsG;QACtG,mGAAmG;QACnG,+FAA+F;QAC/F,IAAI,WAAW,CAAC;QAChB,IAAI,CAAC;YACH,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,oDAAoD;YACpD,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAC3D,eAAe,EACf,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,CAC1D,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,CAAC;QAC3C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAC5D,gBAAgB,CAAC,oBAAoB,EACrC,EAAE,GAAG,EAAE,YAAY,EAAE,CACtB,CAAC;QACF,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,wBAAwB,CAAC,OAAO,EAAE,CAAC;YAC1E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,4BAA4B,CAAC,EAAE,EAAE;gBAC1C,UAAU;gBACV,eAAe;aAChB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,IACE,mBAAmB,CAAC,KAAK,CAAC;mBACvB,CACD,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,cAAc;uBACpC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,aAAa;uBACtC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,SAAS;uBAClC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,QAAQ,CACrC,EACD,CAAC;gBACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;oBACE,sBAAsB,EACpB,2BAA2B,CAAC,0BAA0B;iBACzD,CACF,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACK,KAAK,CAAC,4BAA4B,CACxC,GAA0B,EAC1B,EAAE,UAAU,EAAE,eAAe,EAAgE;QAE7F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,4BAA4B,CACpE,IAAI,CAAC,aAAa,CAAC,yCAAyC,EAAE,EAC9D,EAAE,gBAAgB,EAAE,UAAU,CAAC,MAAM,EAAE,CACxC,CAAC;QACF,MAAM,IAAI,CAAC,uBAAuB,CAAC,sBAAsB,CACvD,gBAAgB,CAAC,oBAAoB,EACrC,8BAA8B,CAAC,MAAM,EACrC,QAAQ,EACR,UAAU,CAAC,GAAG,EACd;YACE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,SAAS;SAC7C,CACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,kDAAkD,EAAE;YAChE,YAAY,EAAE,UAAU,CAAC,GAAG;YAC5B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,eAAe,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,SAAS;SACtD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,wBAAwB,CAC5B,GAA0B,EAC1B,MAAgC;QAEhC,sFAAsF;QACtF,0FAA0F;QAC1F,oFAAoF;QACpF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CACxD,gBAAgB,CAAC,oBAAoB,EACrC,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE,CAC1E,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QAEjE,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAgC,EAAE;YACpF,IAAI,gBAAoC,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CACrD,gBAAgB,CAAC,aAAa,EAC9B,EAAE,GAAG,EAAE,UAAU,CAAC,cAAc,EAAE,CACnC,CAAC;gBACF,gBAAgB,GAAG,GAAG,EAAE,WAAW,IAAI,GAAG,EAAE,IAAI,IAAI,SAAS,CAAC;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB,GAAG,SAAS,CAAC;YAC/B,CAAC;YACD,OAAO;gBACL,YAAY,EAAE,UAAU,CAAC,GAAG;gBAC5B,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,gBAAgB;gBAChB,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,EAAE;gBAC7B,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;aAC3F,CAAC;QACJ,CAAC,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CACtB,EAAyB,EACzB,MAAsD;QAEtD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAEnH,MAAM,IAAI,CAAC,6BAA6B,CAAC,kBAAkB,CACzD,yDAAyD,EAAE,EAC3D,KAAK,EAAC,cAAc,EAAC,EAAE;YACvB,sEAAsE;YACtE,gEAAgE;YAChE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC3D,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACnB,cAAc,CACf,CAAC;YACF,MAAM,iBAAiB,GACrB,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CACzC,gBAAgB,CAAC,oBAAoB,EACrC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,EACvB,cAAc,CACf,CAAC;YACJ,IACE,CAAC,aAAa;mBACX,CAAC,iBAAiB;mBAClB,iBAAiB,CAAC,MAAM,KAAK,aAAa,CAAC,GAAG;mBAC9C,iBAAiB,CAAC,MAAM,KAAK,wBAAwB,CAAC,OAAO,EAChE,CAAC;gBACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;iBAC/E,CAAC,CAAC;YACL,CAAC;YAED,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,6BAA6B,CAAC,EAAE,EAAE;gBACtE,UAAU,EAAE,iBAAiB;gBAC7B,IAAI,EAAE,aAAa;gBACnB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;gBACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,cAAc;gBACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YACH,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;iBAC/E,CAAC,CAAC;YACL,CAAC;QACD,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE;YAC1C,YAAY,EAAE,UAAU,CAAC,GAAG;YAC5B,MAAM,EAAE,MAAM,CAAC,GAAG;YAClB,cAAc,EAAE,UAAU,CAAC,cAAc;SAC1C,CAAC,CAAC;QAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CACtB,EAAyB,EACzB,MAAgF;QAEhF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAE3G,MAAM,IAAI,CAAC,4BAA4B,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;QAErG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC;IACvE,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,0BAA0B,CACtC,EAAyB,EACzB,YAAoB,EACpB,YAAoB;QAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE;gBAC/D,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;aAClF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAC5D,gBAAgB,CAAC,oBAAoB,EACrC,EAAE,GAAG,EAAE,YAAY,EAAE,CACtB,CAAC;QAEF,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;YACpD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE;gBAC9D,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;aACvF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,wBAAwB,CAAC,OAAO,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE;gBAC/D,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,qBAAqB,CACzB,EAAyB,EACzB,MAGC;QAUD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAC/D,EAAE,EACF,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,gBAAgB,CACxB,CAAC;QAEF,IAAI,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAC7E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE;gBACvF,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;aACnD,CAAC,CAAC;YACH,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,YAAY,EAAE,WAAW,CAAC,YAAY;gBACtC,SAAS,EAAE,WAAW,CAAC,SAAS;aACjC,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC;IACJ,CAAC;CACF,CAAA;AA14DY,8BAA8B;IAD1C,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAC1C,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAChD,WAAA,MAAM,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAA;IACpD,WAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,YAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,YAAA,MAAM,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,CAAA;IAK5D,YAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAM9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IAItD,YAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAI1C,YAAA,MAAM,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,CAAA;IAI5D,YAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,YAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;qCAnCJ,aAAa;QACM,0BAA0B;QACzB,uBAAuB;QACX,6BAA6B;QACjC,oCAAoC;QAClD,6BAA6B;QACxB,4BAA4B;QAChB,gCAAgC;QACvC,+BAA+B;QACnC,uBAAuB,YAEN,wCAAwC;GAfhI,8BAA8B,CA04D1C","sourcesContent":["import 'reflect-metadata';\nimport crypto from 'crypto';\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { isOrgActivelyDirectoryManaged } from '~wildo-backend-lib/organizations/services/scim-provisioning-gate.backend.utils';\nimport type { FeatureResolutionBackendService } from '~wildo-backend-lib/features/services/feature-resolution.backend.service';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { ConsumableTokenBackendService } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport type { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport { AuthCredentialVerifierBackendService } from '~wildo-backend-lib/security/authentications/services/auth-credential-verifier.backend.service';\nimport { AuthTokenIssuerBackendService } from '~wildo-backend-lib/security/authentications/services/auth-token-issuer.backend.service';\nimport { AuthUserLookupBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-user-lookup.backend.service';\nimport { AuthResponseHelperBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-response-helper.backend.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { DomainToOrgLookupBackendService } from '~wildo-backend-lib/security/authentications/services/admin-config/domain-to-org-lookup.backend.service';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { ResourcePersistenceUnitOfWorkBackendService } from '~wildo-backend-lib/databases/services/resource-persistence-unit-of-work.backend.service';\nimport {\n applyInvitationAcceptanceCore,\n assertInvitationUserTypeAcquisitionAllowed,\n} from '~wildo-backend-lib/organizations/services/invitation-acceptance.backend.utils';\nimport {\n createOrgOnRegistration,\n OrgCreationOnRegistrationPlanInvalidReason,\n OrgCreationOnRegistrationPlanMode,\n resolveOrgCreationOnRegistrationPlan,\n} from '~wildo-backend-lib/organizations/services/org-creation-on-registration.backend.utils';\nimport { AUTH_AUDIT_METHOD } from '~wildo-backend-lib/security/authentications/models/auth-constants.backend';\nimport {\n createAuthenticatedInvitationAcceptancePersistenceRequest,\n createPublicInvitationAcceptancePersistenceRequest,\n createSelfRegistrationPersistenceRequest,\n} from '~wildo-backend-lib/security/authentications/models/identity-persistence-boundaries.backend';\nimport { AuthenticationOrchestratorBackendService } from '~wildo-backend-lib/security/authentications/services/authentication-orchestrator.backend.service';\nimport type { EmailVerificationInitiatorBackendService } from '~wildo-backend-lib/security/authentications/services/email-verification-initiator.backend.service';\nimport type { WebAuthnBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/webauthn.backend.service';\nimport type { PublicKeyCredentialCreationOptionsJSON } from '@simplewebauthn/server';\n\nimport {\n CoreConsumableTokenTypes,\n ConsumableToken_ConsumptionMode,\n CoreResourceType,\n ErrorType,\n ErrorCustomMessageReference,\n EmailTemplateType,\n SystemEmailTemplateRef,\n UserStatus,\n CORE_APP_ROLES,\n AuthMethod,\n AuthNextStep,\n AuthSessionPurpose,\n AuthenticationSessionState,\n isWildoBackendError,\n EmailVerificationMode,\n OrganizationMemberStatus,\n OrganizationMembers_Operations,\n InvitationManagementMode,\n AuthInvitationInfoResponseSchema,\n getEnabledMethods,\n AuthScopeType,\n RegistrationAcquisitionChannel,\n RegistrationMode,\n evaluateUserTypeAcquisition,\n isRegistrationAcquisitionAllowed,\n} from '@wildo-ai/saas-models';\nimport type { User, OrganizationMember, AuthInvitationInfoResponse, UserCredentials, InvitationAcceptCredentialMethod } from '@wildo-ai/saas-models';\nimport { AvailableLanguage, AuthResponseMessageRef } from '@wildo-ai/presets-components-models';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\nexport interface RegisterUserParams {\n email: string;\n firstName: string;\n lastName: string;\n password?: string;\n /** W5.5: Org name provided during registration when orgNameSource is 'ask'. /\n organizationName?: string;\n}\n\nexport interface RegisterUserContext {\n frontendUrl: string;\n ipAddress: string;\n userAgent: string;\n frontendServiceName?: string;\n /* W3.4: Resolved from X-Frontend-Service-Name → frontendServices → userType. Determines userTypes and defaultAppRoles on new user. /\n activeUserType?: string;\n}\n\nexport interface VerifyEmailParams {\n token: string;\n email: string;\n ipAddress: string;\n userAgent: string;\n}\n\nexport interface ResendVerificationParams {\n email: string;\n frontendUrl: string;\n ipAddress: string;\n userAgent: string;\n}\n\nexport interface AcceptInvitationParams {\n invitationToken: string;\n password?: string;\n /* Required at acceptance (mirrors registration) — seeds the profile's first/last name. /\n firstName: string;\n lastName: string;\n ipAddress: string;\n userAgent: string;\n /\n The first-factor credential the invitee chose to establish (from the multi-method accept\n * screen). Absent intentionally means password-or-none acceptance: set\n * `password` when provided, otherwise activate with no local credential.\n * Only `PASSWORD` / `MAGIC_LINK` / `PASSKEY` are handled\n * here; enterprise-SSO invitees are routed to the IdP authorize flow, not this endpoint. Typed as\n * the DTO-derived subset (not the full `AuthMethod`) so it can never widen past the wire contract.\n /\n credentialMethod?: InvitationAcceptCredentialMethod;\n}\n\n/\n Discriminates the two shapes an accept can resolve to. The password / no-password / passkey\n * paths issue a session (the invitation token bootstraps it — a set password or an enrolled\n * passkey is the GO-FORWARD credential, not this session's authenticator); the magic-link path\n * issues NO session — a link is emailed and the session is established when the invitee clicks it.\n /\nexport enum AcceptInvitationOutcome {\n /* A session was issued (or is gated behind MFA enrollment) — password / no-password / passkey. /\n SESSION = 'session',\n /* No session; a magic link was minted for the controller to email. /\n MAGIC_LINK_SENT = 'magic-link-sent',\n}\n\n/* Session-issuing accept result (password / no-password / passkey). /\nexport interface AcceptInvitationSessionResult {\n outcome: AcceptInvitationOutcome.SESSION;\n sessionId: string;\n state: string;\n purpose: string;\n nextStep?: string;\n userId?: string;\n accessToken?: string;\n refreshToken?: string;\n expiresIn?: number;\n requiresMFA?: boolean;\n availableEnrollmentMethods?: string[];\n /\n PASSKEY-enroll-at-accept: the pre-generated WebAuthn registration challenge. Present ONLY\n * on the passkey path AND only once a session was issued (the frontend runs the ceremony and\n * completes it against the existing authenticated `/auth/passkey/register/verify` route). Omitted\n * on the MFA-gated branch — no session yet, so the invitee enrolls post-MFA via the same route.\n /\n passkeyRegistrationOptions?: PublicKeyCredentialCreationOptionsJSON;\n}\n\n/\n Magic-link accept result — carries the minted token back to the controller for email dispatch\n * (the URL needs the request-derived frontend origin, an HTTP-layer concern). The `token` is NEVER\n * serialized to the client; the controller consumes it to send the email and responds with a\n * generic \"check your email\" message (anti-enumeration, identical to `POST /auth/magic-link/send`).\n /\nexport interface AcceptInvitationMagicLinkResult {\n outcome: AcceptInvitationOutcome.MAGIC_LINK_SENT;\n magicLinkDelivery: {\n token: string;\n submissionId?: string;\n email: string;\n userId: string;\n expiresInMinutes?: number;\n };\n}\n\nexport type AcceptInvitationResult = AcceptInvitationSessionResult \| AcceptInvitationMagicLinkResult;\n\n/* A pending invitation addressed to the authenticated caller, for the in-app surface. /\nexport interface MyPendingInvitation {\n /* The INVITED membership row id — the accept/reject target (was the invitation id). /\n membershipId: string;\n organizationId: string;\n organizationName?: string;\n roles: string[];\n createdAt?: string;\n}\n\n@injectable()\nexport class AuthRegistrationBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.ConsumableTokenService) private readonly consumableTokenService: ConsumableTokenBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthCredentialVerifier) private readonly credentialVerifier: AuthCredentialVerifierBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthTokenIssuer) private readonly tokenIssuer: AuthTokenIssuerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthUserLookupService) private readonly userLookup: AuthUserLookupBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthResponseHelperService) private readonly authResponseHelper: AuthResponseHelperBackendService,\n @inject(SAAS_SERVICE_TYPES.DomainToOrgLookupService) private readonly domainLookup: DomainToOrgLookupBackendService,\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) private readonly auditLogsService: AuditLogsBackendService,\n @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthenticationOrchestratorService) private readonly authOrchestrator: AuthenticationOrchestratorBackendService,\n // Guard 3: the ACL-bypassing system reads (invitation list/read across orgs)\n // come from the dedicated, deliberately-injected SystemAccessService — the\n // handler above no longer exposes readAsSystem/listAsSystem. (Appended LAST to\n // keep the test's positional construction stable.)\n @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n // Invitee-driven invitation REVOKE needs a super-admin EC: the invitee is\n // not an org admin, so the ORG_ADMIN-gated REVOKE runs under a synthesised system\n // context (same pattern as EnterpriseUserProvisioning). Appended LAST to keep the\n // test's positional construction stable. (A dedicated `deleteAsSystem` primitive would\n // be cleaner — noted as a follow-up; today only create/read/list/update AsSystem exist.)\n @inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory) private readonly authEcFactory: AuthExecutionContextFactoryBackendService,\n // Passkey-enroll-at-accept reuses the shared WebAuthn ceremony service to mint the\n // registration challenge bound to the just-activated invitee. Appended LAST to keep the\n // test's positional construction stable.\n @inject(SAAS_SERVICE_TYPES.WebAuthnService) private readonly webAuthnService: WebAuthnBackendService,\n // Shared EMAIL_VERIFICATION token+email sender (also used by SCIM provisioning). Registration\n // and resend delegate their verification send here so the flow has ONE implementation.\n // Appended LAST to keep the test's positional construction stable.\n @inject(SAAS_SERVICE_TYPES.EmailVerificationInitiatorService) private readonly emailVerificationInitiator: EmailVerificationInitiatorBackendService,\n // Per-org DIRECTORY_PROVISIONING resolution for the invite-accept credential block\n // (Concern B — see `isOrgActivelyDirectoryManaged`). Appended LAST: DI binds by token,\n // but the positional-append convention keeps existing wiring undisturbed.\n @inject(SAAS_SERVICE_TYPES.FeatureResolutionService) private readonly featureResolution: FeatureResolutionBackendService,\n @inject(SAAS_SERVICE_TYPES.ResourcePersistenceUnitOfWorkService)\n private readonly resourcePersistenceUnitOfWork:\n ResourcePersistenceUnitOfWorkBackendService,\n ) {\n this.logDebug = this.logger.debugByType('AuthRegistration');\n this.logger.setDebugTypeLogging('AuthRegistration', false);\n }\n\n /\n Invitation-accept DISCOVERY (Phase 1b) — the PUBLIC, NON-consuming read the\n * multi-method accept screen calls to learn what the invited org allows.\n \n Distinct from `acceptInvitation` (which CONSUMES the token and mutates state):\n * this only VALIDATES the token (`validateToken` — no consume) and reads. It\n * returns the invitee's email, the org name, the org's available first-factor\n * methods (resolved for the invitee's user type via the ORG-KEYED policy\n * resolver — the invitee's INVITED membership is excluded from the ACTIVE-\n * membership-based `resolveEffectiveAuthPolicy`, hence the org-keyed variant),\n * and the org's identity-management posture:\n * - `scim` → directory-managed; the screen shows an informational state, NO\n * local credential (locked product decision).\n * - `sso` → the org ENFORCES enterprise SSO (an org-SSO method is available\n * and PASSWORD is not) — route the invitee to the IdP (JIT consumes the invite).\n * - `open` → full method chooser.\n \n `managementMode` (incl. SSO-enforced) is derived from the resolved POLICY.\n * SSO-org invitees get enriched ORG_SAML/ORG_OPENID_CONNECT entries (per-connection\n * `ssoIds`/`config`), resolved via an org-keyed SSO lookup (`buildLookupForScope`) —\n * identical to `identify()`, but keyed by the invitation's `organizationId` instead\n * of an email domain.\n \n PASSKEY, if policy-enabled, appears as an ENROLL-at-accept option — NOT a login of\n * an existing credential — so `identify()`'s no-enrolled-credential filter\n * deliberately does not apply here; the frontend renders it disabled until the\n * passkey-enroll-at-accept backend (Phase 3) lands.\n /\n async getInvitationInfo(\n ec: ExecutionContext<any>,\n invitationToken: string,\n ): Promise<AuthInvitationInfoResponse> {\n // 1. Validate the token WITHOUT consuming it (accept consumes; discovery must not).\n // NO TOKEN ORACLE + RESIDUAL TIMING CHANNEL: every rejection below throws the SAME uniform\n // `INVITATION_NO_LONGER_VALID`; the fast (validateToken-fail) vs slow (membership-read) timing\n // residual is ASSESSED WONTFIX. See the canonical rationale on `acceptInvitation` (review FU-4/5/6)\n // before adding a per-cause message or a constant-time \"fix\" here.\n let tokenResult;\n try {\n tokenResult = await this.consumableTokenService.validateToken(\n invitationToken,\n [CoreConsumableTokenTypes.ORGANIZATION_MEMBER_INVITATION],\n );\n } catch {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n const membershipId = tokenResult.relatedId;\n if (!membershipId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n // 2. Read the INVITED membership (mirrors acceptInvitation). The invite IS the\n // membership in the junction model; the token's relatedId points at it.\n const membership = await this.servicesRegistryHandler.read<OrganizationMember>(\n CoreResourceType.ORGANIZATION_MEMBERS, ec, { _id: membershipId },\n );\n if (!membership \|\| membership.status !== OrganizationMemberStatus.INVITED) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n const organizationId = membership.organizationId;\n const inviteeEmail = (membership.userEmail ?? '').toLowerCase();\n\n // 3-4. Org join-context (display name + type + org-join user type) via the SHARED resolver —\n // one system-access-door read (`readAsSystem(ORGANIZATIONS, { _id })`; the endpoint runs\n // under an UNAUTHENTICATED pre-auth EC, so a plain ACL-scoped read would fail-closed). This is\n // the SAME org-join projection `acceptInvitation` uses — single source, no drift. LOAD-BEARING:\n // `orgType` drives the method resolution in step 5, so a failed read empties the method list,\n // not just the name (the resolver degrades name → undefined and org-join type → undefined).\n //\n // Method resolution keys off the org-join user type the accept WILL grant, NOT the invitee's\n // CURRENT types (provisioned `userTypes: []`, grant DEFERRED to INVITED→ACTIVE, so\n // `invitee.userTypes[0]` would be `undefined` → an EMPTY method list). Discovery is\n // ORG-JOIN-FIRST (mirrors the accept-time enablement guard), falling back to an existing\n // invitee's own first type, then undefined.\n const { orgType, orgJoinUserType, organizationName: resolvedOrgName } = await this._resolveOrgJoinUserType(membership);\n const organizationName = resolvedOrgName ?? '';\n const invitee = await this.userLookup.findUserById(ec, membership.userId);\n const resolutionUserType = orgJoinUserType ?? invitee?.userTypes?.[0];\n\n // 5. Available first-factor methods — resolve the policy from the org-join user\n // type + the org TYPE already read in step 3-4. `resolveAuthPolicyForOrgType` is\n // PURE (no ORGANIZATIONS read): the pre-auth `APP_PUBLIC` EC cannot read\n // ORGANIZATIONS, so a per-call org re-read would fail-closed and silently drop\n // the org's auth overrides (SSO-only / password-disabled).\n const resolvedPolicy = resolutionUserType\n ? this.userLookup.resolveAuthPolicyForOrgType(resolutionUserType, orgType)\n : null;\n const invitationPolicy = (\n resolvedPolicy\n && !resolvedPolicy.registration.allowedMethods.includes(\n AuthMethod.PASSWORD,\n )\n )\n ? {\n ...resolvedPolicy,\n authMethodsEnabled: {\n ...resolvedPolicy.authMethodsEnabled,\n [AuthMethod.PASSWORD]: false,\n },\n }\n : resolvedPolicy;\n const enabledMethods = invitationPolicy\n ? getEnabledMethods(invitationPolicy.authMethodsEnabled)\n : new Set<AuthMethod>();\n\n // Enrich org-SSO methods (ORG_SAML/ORG_OPENID_CONNECT) with per-connection\n // ssoIds/config — IDENTICALLY to identify() — by resolving the invite's org SSO\n // connection by ORGANIZATION ID (not email domain). Only when the policy enables an\n // org-SSO method (a non-SSO org pays no extra reads). `buildLookupForScope` reads\n // via the system-access door; a null result (no SSO config/connection) simply drops\n // the SSO methods, as before. (Passing the lookup also lets the OAuth arm honor the\n // org's `oauth2ProviderRestrictions` — resolved via the same ACL-independent door.)\n const orgSsoLookup = (enabledMethods.has(AuthMethod.ORG_SAML) \|\| enabledMethods.has(AuthMethod.ORG_OPENID_CONNECT))\n ? await this.domainLookup.buildLookupForScope(ec, AuthScopeType.ORGANIZATION, organizationId)\n : undefined;\n\n const availableFirstFactorMethods = invitationPolicy\n ? await this.authOrchestrator.buildFirstFactorMethodsForPolicy(ec, invitationPolicy, orgSsoLookup)\n : [];\n\n // 6. Management mode — strongest identity authority wins. SCIM now reflects ACTIVE\n // directory management (DIRECTORY_PROVISIONING feature + a live SCIM token), NOT the\n // org-TYPE mount flag — kept COHERENT with the accept-mutation credential block\n // (AUTH-23 / .claude/plans/scim-vs-auth-authority-axis.md) so the UI never hides the\n // credential chooser for a SCIM-capable-but-not-actually-managed org whose accept\n // WOULD allow a local credential. SSO enforcement is read from the resolved POLICY's\n // enabled methods. This is the LENIENT display path: a token/feature read failure\n // degrades to \"not actively managed\" and lets the MUTATION path be the fail-closed gate.\n let scimEnabled = false;\n try {\n scimEnabled = await isOrgActivelyDirectoryManaged({\n organizationId,\n featureResolution: this.featureResolution,\n systemAccessService: this.systemAccessService,\n });\n } catch {\n scimEnabled = false;\n }\n const hasOrgSso = enabledMethods.has(AuthMethod.ORG_SAML) \|\| enabledMethods.has(AuthMethod.ORG_OPENID_CONNECT);\n const hasPassword = enabledMethods.has(AuthMethod.PASSWORD);\n const managementMode = scimEnabled\n ? InvitationManagementMode.SCIM\n : hasOrgSso && !hasPassword\n ? InvitationManagementMode.SSO\n : InvitationManagementMode.OPEN;\n\n // Validate the response against its schema before returning (matches `identify`).\n // `passwordPolicy` carries the SAME org-merged policy the accept endpoint validates\n // against (`resolveAuthPolicyForOrgType` above), so the chooser's PASSWORD form shows\n // the invitee the org's real requirements. `PasswordPolicyConfig` is field-identical to\n // the DTO's `PasswordPolicyRulesSchema`, so `.parse` carries it through losslessly (and\n // strips any extra keys); absent policy ⇒ `undefined` ⇒ frontend app-level fallback.\n return AuthInvitationInfoResponseSchema.parse({\n inviteeEmail,\n organizationName,\n availableFirstFactorMethods,\n managementMode,\n passwordPolicy: enabledMethods.has(AuthMethod.PASSWORD)\n ? invitationPolicy?.passwordPolicy\n : undefined,\n });\n }\n\n /\n User registration.\n * Returns generic success on email collision (anti-enumeration).\n /\n async registerUser(\n ec: ExecutionContext<any>,\n params: RegisterUserParams,\n ctx: RegisterUserContext,\n ): Promise<{ messageRef: string; message: string; ssoRedirectHint?: boolean; sessionId?: string; state?: string; purpose?: string; nextStep?: string; userId?: string; accessToken?: string; refreshToken?: string; expiresIn?: number }> {\n const { email, firstName, lastName, password, organizationName } = params;\n const { frontendUrl, ipAddress, userAgent, frontendServiceName, activeUserType } = ctx;\n const successResponse = this.authResponseHelper.getAuthResponse(AuthResponseMessageRef.REGISTRATION_SUCCESS);\n\n this.logDebug('Registration attempt', { email, activeUserType });\n\n // PR 8a (rate-limit unification, Step 5 — Option D / first\n // service-layer lift): the per-domain 50/hour rate-limit\n // (formerly `AUTH_REDIS_KEYS.REGISTER_DOMAIN` keyed on\n // `email.split('@')[1].toLowerCase()`, raw `checkRateLimit`)\n // moved UP to `AuthenticationController.register` as the third\n // declarative `checkPolicy` companion alongside the existing\n // per-email + per-IP buckets. Rationale: rate limits are\n // intrinsically HTTP concerns — bucket keys (email, IP, derived\n // domain) all live at the HTTP layer, the 429 feedback signal\n // (`X-RateLimit-` + `Retry-After` headers) is HTTP-only, and\n // service contracts must remain free of HTTP types.\n // `RateLimitBackendService` and `AUTH_REDIS_KEYS` imports also\n // removed — domain throttle was their sole consumer in this\n // file. See plan body for the full Option D architectural\n // re-analysis.\n\n // W3.4: Resolve per-user-type auth policy (for registration config, password policy, etc.)\n const userTypeAuthPolicy = activeUserType\n ? this.appConfigService.getUserTypeAuthPolicy(activeUserType)\n : null;\n\n if (frontendServiceName && activeUserType) {\n const userManagement = this.appConfigService.getFrontendServiceUserManagementEntry(frontendServiceName, activeUserType);\n if (userManagement?.register !== true) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n context: {\n // Diagnostic (log-only): AUTHORIZATION strips context at the wire.\n frontendServiceName,\n activeUserType,\n },\n });\n }\n }\n\n const config = this.appConfigService.config;\n\n const registrationConfig = userTypeAuthPolicy?.registration;\n if (!registrationConfig) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n });\n }\n\n // Gate self-service registration through the canonical acquisition matrix. The map below\n // selects only the mode-specific client message; it does not own the allow/deny semantics\n // (that stays with `isRegistrationAcquisitionAllowed`). Typed `Record<RegistrationMode, …>`\n // so a newly added mode cannot ship without deciding its self-service denial message here —\n // the message stays exhaustive alongside the matrix instead of silently defaulting to DISABLED.\n const registrationMode = registrationConfig.mode;\n if (!isRegistrationAcquisitionAllowed(\n registrationMode,\n RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n )) {\n // OPEN is unreachable here (it is always self-service-allowed) but is listed to satisfy the Record.\n const denialMessageReferenceByMode: Record<RegistrationMode, ErrorCustomMessageReference> = {\n [RegistrationMode.OPEN]: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n [RegistrationMode.INVITATION_ONLY]: ErrorCustomMessageReference.REGISTRATION_INVITATION_ONLY,\n [RegistrationMode.ADMIN_ONLY]: ErrorCustomMessageReference.REGISTRATION_ADMIN_ONLY,\n [RegistrationMode.DISABLED]: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n };\n // `mode` is typed RegistrationMode, but the runtime boundary is untrusted (an unparsed config\n // object can carry no/unknown mode — the same stance `isRegistrationAcquisitionAllowed` takes),\n // so fall back to the generic denial message rather than emitting an undefined reference.\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference:\n denialMessageReferenceByMode[registrationMode] ?? ErrorCustomMessageReference.REGISTRATION_DISABLED,\n });\n }\n\n // Resolve organization creation once, before authorization and adapter\n // selection. The same immutable plan drives prospective grants and writes.\n const configuredOrganizationTypes = this.appConfigService.isInitialized()\n ? config.organizationTypes\n : undefined;\n const orgCreationPlan = activeUserType\n ? resolveOrgCreationOnRegistrationPlan({\n userEmail: email.toLowerCase(),\n activeUserType,\n organizationName,\n organizationTypes: configuredOrganizationTypes,\n })\n : {\n mode: OrgCreationOnRegistrationPlanMode.NONE,\n } as const;\n if (orgCreationPlan.mode === OrgCreationOnRegistrationPlanMode.INVALID) {\n if (\n orgCreationPlan.reason\n === OrgCreationOnRegistrationPlanInvalidReason\n .MISSING_REQUIRED_ORGANIZATION_NAME\n ) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.ORG_NAME_REQUIRED,\n context: {\n organizationType: orgCreationPlan.orgType,\n },\n });\n }\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n reason:\n 'registration_user_type_has_ambiguous_organization_creation_policy',\n activeUserType,\n matchingOrgTypes: orgCreationPlan.matchingOrgTypes,\n },\n });\n }\n\n // Synchronous and deferred creation both later grant the selected\n // organization type's user types, so authorize those prospective additions\n // before any user/org/member mutation.\n const plannedOrganizationType =\n orgCreationPlan.mode === OrgCreationOnRegistrationPlanMode.NONE\n ? undefined\n : configuredOrganizationTypes?.[orgCreationPlan.orgType];\n const automaticOrgGrantAcquisition = evaluateUserTypeAcquisition(\n this.appConfigService.isInitialized() ? config.userTypes : undefined,\n plannedOrganizationType?.userTypes ?? [],\n activeUserType ? [activeUserType] : [],\n RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n );\n if (!automaticOrgGrantAcquisition.allowed) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n context: {\n channel: RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n deniedUserTypes: automaticOrgGrantAcquisition.deniedUserTypes,\n },\n });\n }\n\n const allowedMethods = registrationConfig.allowedMethods;\n if (!allowedMethods.includes(AuthMethod.PASSWORD)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_METHOD_NOT_SUPPORTED,\n context: { method: AuthMethod.PASSWORD, allowedMethods },\n });\n }\n\n if (!password) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference:\n ErrorCustomMessageReference.REGISTRATION_PASSWORD_REQUIRED,\n });\n }\n const passwordPolicy = userTypeAuthPolicy?.passwordPolicy;\n const policyValidation =\n this.credentialVerifier.validatePasswordPolicy(\n password,\n passwordPolicy,\n );\n if (!policyValidation.valid) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference:\n ErrorCustomMessageReference\n .VALIDATION_PASSWORD_POLICY_VIOLATION,\n context: {\n violations: policyValidation.violations,\n minLength: passwordPolicy?.minLength,\n maxLength: passwordPolicy?.maxLength,\n },\n });\n }\n\n const existing = await this.userLookup.findUserByEmail(ec, email);\n if (existing) {\n this.logDebug('Registration: email already in use, returning success to prevent enumeration', { email });\n return successResponse;\n }\n\n // W2.7: Block self-registration for SSO-managed domains.\n if (registrationConfig.blockForSSODomains) {\n const domain = email.split('@')[1];\n if (domain) {\n const domainResult = await this.domainLookup.findOrgByDomain(ec, domain);\n if (domainResult?.enforcement?.requireSSO) {\n this.logDebug('Registration blocked: SSO-enforced domain', { email, domain });\n return { ...successResponse, ssoRedirectHint: true };\n }\n }\n }\n\n const passwordHash = await this.credentialVerifier.hashPassword(\n password,\n config.auth.passwordHashing,\n );\n\n // W2.6: Email verification mode — DEFERRED creates user as ACTIVE immediately\n const isDeferredVerification = registrationConfig.emailVerification === EmailVerificationMode.DEFERRED;\n const initialStatus = isDeferredVerification ? UserStatus.ACTIVE : UserStatus.PENDING_VERIFICATION;\n\n // W3.4: Resolve userTypes and defaultAppRoles from the active user type definition\n const userTypes = activeUserType ? [activeUserType] : [];\n const userTypeDefinition = activeUserType\n ? config.userTypes?.[activeUserType]\n : undefined;\n const defaultAppRoles = userTypeDefinition?.defaultAppRoles ?? [CORE_APP_ROLES.APP_USER];\n let newUser: User;\n let pendingOrgType: string \| undefined;\n try {\n const registrationPersistence =\n await this.resourcePersistenceUnitOfWork.executeTransaction(\n createSelfRegistrationPersistenceRequest({\n includeCredentials: passwordHash !== undefined,\n includeSynchronousOrganizationCreation:\n orgCreationPlan.mode\n === OrgCreationOnRegistrationPlanMode.SYNCHRONOUS,\n }),\n async serviceOptions => {\n const createdUser = await this.servicesRegistryHandler.create<User>(\n CoreResourceType.USERS,\n ec,\n {\n email: email.toLowerCase(),\n status: initialStatus,\n appRoles: defaultAppRoles,\n userTypes,\n },\n {\n ...serviceOptions,\n // `defaultAppRoles` is resolved from the ACTIVE USER-TYPE CONFIGURATION\n // (`userTypeDefinition.defaultAppRoles ?? [APP_USER]`) — it is never read from the signup\n // payload. Declaring it server-injected is what tells the `users \| create` role-ceiling\n // gate not to measure it against the caller, whose roles here are `APP_PUBLIC` by\n // definition: an anonymous registrant cannot \"hold\" the role self-registration grants\n // them. Without this the gate denied every signup with `role_ceiling_exceeded`.\n //\n // This does NOT weaken the gate. `users \| create` stays `APP_ADMIN_SUPER_ADMIN`-gated as\n // an API operation, and a genuine client call still has its authored `appRoles` measured\n // — `preserveServerInjectedFields` is a trusted-server option that no client payload can\n // reach. Sign-up is a different mechanism from administrative user creation, and this is\n // the seam that says so.\n preserveServerInjectedFields: [\n ...(serviceOptions?.preserveServerInjectedFields ?? []),\n 'appRoles',\n ],\n },\n );\n\n if (passwordHash) {\n await this.systemAccessService.createAsSystem(\n CoreResourceType.USER_CREDENTIALS,\n {\n userId: createdUser._id,\n passwordHash,\n },\n serviceOptions,\n );\n }\n\n let deferredOrgType: string \| undefined;\n if (activeUserType && this.appConfigService.isInitialized()) {\n const organizationTypes = this.appConfigService.config.organizationTypes;\n const orgResult = await createOrgOnRegistration(ec, {\n userId: createdUser._id,\n userEmail: createdUser.email,\n activeUserType,\n organizationName,\n organizationTypes,\n servicesRegistryHandler: this.servicesRegistryHandler,\n systemAccessService: this.systemAccessService,\n serviceOptions,\n plan: orgCreationPlan,\n });\n if (orgResult.pendingOnboarding) {\n deferredOrgType = orgResult.orgType;\n }\n }\n return { createdUser, deferredOrgType };\n },\n {\n // Tier-2 input-derived composition seed: the profile fields\n // originate outside the USERS payload. The service layer queues the\n // profile seed on this unit of work and emits it only after commit.\n compositionSeedRequestInput: {\n firstName,\n lastName,\n displayName: `${firstName} ${lastName}`,\n },\n },\n );\n newUser = registrationPersistence.createdUser;\n pendingOrgType = registrationPersistence.deferredOrgType;\n } catch (createError: any) {\n if (\n (isWildoBackendError(createError) && createError.statusCode === 409)\n \|\| createError?.code === 11000\n \|\| createError?.message?.includes('duplicate key')\n \|\| createError?.message?.includes('E11000')\n ) {\n // A duplicate from USERS.email is the expected concurrent-registration\n // race and must retain the anti-enumeration response. A duplicate from a\n // different participant (for example an organization slug) is a real\n // failure; treating every 409 as an email race would silently discard a\n // valid registration attempt.\n const winningUser = await this.userLookup.findAnyUserByEmail(\n ec,\n email,\n );\n if (winningUser) {\n this.logDebug(\n 'Registration: concurrent email registration won, returning anti-enumeration success',\n {\n email,\n winningUserId: winningUser._id,\n },\n );\n return successResponse;\n }\n }\n throw createError;\n }\n\n // USER_PROFILES is now seeded declaratively by the USERS→USER_PROFILES\n // `onParentCreate` composition lifecycle (input threaded via\n // `compositionSeedRequestInput` on the create above), replacing the former\n // best-effort hand-seed here. The seed is idempotent (unique `userId` index)\n // and swallow-on-failure, so registration is never blocked by a profile write.\n\n if (pendingOrgType) {\n this.logDebug('Org creation deferred to onboarding', {\n userId: newUser._id,\n orgType: pendingOrgType,\n });\n }\n\n // W2.6: Only send verification email when emailVerification !== DEFERRED. Delegated to the\n // shared initiator (one implementation across registration / resend / SCIM provisioning).\n if (!isDeferredVerification) {\n await this.emailVerificationInitiator.sendVerificationEmail({\n userId: newUser._id,\n email: newUser.email,\n firstName,\n frontendBaseUrl: frontendUrl,\n });\n }\n\n this.auditLogsService.logUserRegistered({ userId: newUser._id, email: newUser.email, ipAddress, userAgent }, ec).catch(() => {});\n\n // F7 fix: When email verification is deferred, the user is ACTIVE immediately.\n // Process through the registration pipeline (MFA check, etc.) and issue tokens\n // so the user can start using the app without a separate login step.\n if (isDeferredVerification) {\n const pipelineSession = await this.authOrchestrator.processEmailVerification(\n ec, newUser._id, newUser.email, activeUserType,\n { ipAddress, userAgent }, AuthSessionPurpose.REGISTRATION,\n );\n\n if (pipelineSession.state === AuthenticationSessionState.COMPLETED \|\| pipelineSession.state === AuthenticationSessionState.MFA_ENROLLMENT_GRACE) {\n const tokenResult = await this.tokenIssuer.issueTokensForUser(newUser._id, undefined, {\n lastAuthenticatedAt: Math.floor(Date.now() / 1000),\n });\n\n this.logDebug('Registration completed — deferred verification, tokens issued', { userId: newUser._id });\n return {\n ...successResponse,\n sessionId: pipelineSession.sessionId,\n state: pipelineSession.state,\n purpose: pipelineSession.purpose,\n // Expose `userId` so the controller can transpose anonymous website\n // captures onto this account. Deferred-verification registration\n // issues real tokens right here (immediate login) — the same\n // anonymous→authenticated conversion moment that `verifyEmail()` and\n // `acceptInvitation()` already surface `userId` for.\n userId: newUser._id,\n accessToken: tokenResult.accessToken,\n refreshToken: tokenResult.refreshToken,\n expiresIn: tokenResult.expiresIn,\n };\n }\n\n this.logDebug('Registration completed — deferred verification, pipeline requires further steps', {\n userId: newUser._id,\n state: pipelineSession.state,\n nextStep: pipelineSession.nextStep,\n });\n return {\n ...successResponse,\n sessionId: pipelineSession.sessionId,\n state: pipelineSession.state,\n purpose: pipelineSession.purpose,\n nextStep: pipelineSession.nextStep,\n };\n }\n\n // W4.1: Create registration session to track the pipeline state (non-deferred)\n const regSession = await this.authOrchestrator.createRegistrationSession(\n newUser._id,\n newUser.email,\n {\n activeUserType,\n purpose: AuthSessionPurpose.REGISTRATION,\n deviceInfo: { ipAddress, userAgent },\n pendingOrgType,\n },\n );\n\n this.logDebug('Registration completed — awaiting email verification', { userId: newUser._id, sessionId: regSession.sessionId });\n return {\n ...successResponse,\n sessionId: regSession.sessionId,\n state: regSession.state,\n purpose: regSession.purpose,\n };\n }\n\n /*\n W4.1: Consumes EMAIL_VERIFICATION token, activates user, processes through registration pipeline.\n * Instead of issuing tokens directly, creates/resumes an auth session and advances through\n * the pipeline (email verified → MFA check → enrollment/grace/complete).\n * Returns session state with nextStep for frontend routing.\n /\n async verifyEmail(\n ec: ExecutionContext<any>,\n params: VerifyEmailParams,\n ): Promise<{\n userId?: string;\n sessionId: string;\n state: string;\n nextStep?: string;\n accessToken?: string;\n refreshToken?: string;\n expiresIn?: number;\n mfaGraceExpiresAt?: string;\n requiresMFA?: boolean;\n availableEnrollmentMethods?: string[];\n requireStrongMFA?: boolean;\n }> {\n const { token, email: requestEmail, ipAddress, userAgent } = params;\n\n this.logDebug('Email verification attempted');\n\n let consumedToken;\n try {\n consumedToken = await this.consumableTokenService.consumeToken(token);\n } catch {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n });\n }\n\n if (consumedToken.tokenType !== CoreConsumableTokenTypes.EMAIL_VERIFICATION) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n });\n }\n\n const userId = consumedToken.userId \|\| consumedToken.relatedId;\n if (!userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n });\n }\n\n const metadata = consumedToken.metadata as Record<string, unknown> \| undefined;\n const metadataEmail = metadata?.email as string \| undefined;\n\n if (!metadataEmail) {\n this.logger.warn('Email verification token metadata missing email — data integrity issue', { userId });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n });\n }\n\n const tokenEmailBuf = Buffer.from(metadataEmail.toLowerCase());\n const requestEmailBuf = Buffer.from(requestEmail.toLowerCase());\n if (tokenEmailBuf.length !== requestEmailBuf.length \|\| !crypto.timingSafeEqual(tokenEmailBuf, requestEmailBuf)) {\n this.logger.warn('Email verification email mismatch — possible URL tampering', { userId, requestEmail });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n });\n }\n\n const user = await this.servicesRegistryHandler.read<User>(CoreResourceType.USERS, ec, userId);\n\n if (!user) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_FOUND,\n });\n }\n\n if (user.status === UserStatus.ACTIVE) {\n this.logDebug('Email verification: user already active', { userId });\n } else if (user.status !== UserStatus.PENDING_VERIFICATION) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.ACCOUNT_ACTIVATION_NOT_ALLOWED,\n });\n } else {\n // `status` is `.excludeFromUpdate()` — the client-facing UPDATE contract cannot carry it, so\n // a handler write is stripped by the repository's strict re-parse and the account would never\n // activate, with no error. The system door re-attaches it. Deliberately NOT a lifecycle verb:\n // activation here follows from a confirmed email, not an administrative decision.\n await this.systemAccessService.updateAsSystem(CoreResourceType.USERS, userId, { status: UserStatus.ACTIVE });\n this.logDebug('User activated via email verification', { userId });\n }\n\n await this.consumableTokenService.revokeTokensByRelatedId(userId, CoreConsumableTokenTypes.EMAIL_VERIFICATION);\n\n this.auditLogsService.logUserEmailVerified({ userId: user._id, email: user.email, ipAddress, userAgent }, ec).catch(() => {});\n\n // W4.1: Process through registration pipeline instead of direct token issuance.\n // Resolve activeUserType from user's userTypes (first entry, if any).\n const activeUserType = user.userTypes?.[0] ?? undefined;\n const session = await this.authOrchestrator.processEmailVerification(\n ec,\n user._id,\n user.email,\n activeUserType,\n { ipAddress, userAgent },\n );\n\n this.logDebug('Email verification complete — pipeline advanced', { userId, state: session.state, nextStep: session.nextStep });\n\n // If pipeline completed (no MFA required), issue tokens\n if (session.state === 'COMPLETED' \|\| session.state === 'MFA_ENROLLMENT_GRACE') {\n const tokenResult = await this.tokenIssuer.issueTokensForUser(user._id, undefined, {\n lastAuthenticatedAt: Math.floor(Date.now() / 1000),\n });\n return {\n userId,\n sessionId: session.sessionId,\n state: session.state,\n nextStep: session.nextStep ?? AuthNextStep.COMPLETE,\n accessToken: tokenResult.accessToken,\n refreshToken: tokenResult.refreshToken ?? '',\n expiresIn: tokenResult.expiresIn ?? 3600,\n mfaGraceExpiresAt: session.mfaGraceExpiresAt,\n };\n }\n\n // MFA enrollment required — return session info for frontend to route to enrollment\n return {\n userId,\n sessionId: session.sessionId,\n state: session.state,\n nextStep: session.nextStep ?? AuthNextStep.MFA_ENROLLMENT,\n requiresMFA: session.requiresMFA,\n availableEnrollmentMethods: session.availableEnrollmentMethods,\n requireStrongMFA: session.requireStrongMFA,\n };\n }\n\n /\n Resend verification email. Returns generic success (anti-enumeration).\n /\n async resendVerificationEmail(\n ec: ExecutionContext<any>,\n params: ResendVerificationParams,\n ): Promise<{ messageRef: string; message: string }> {\n const { email, frontendUrl, ipAddress, userAgent } = params;\n const successResponse = this.authResponseHelper.getAuthResponse(AuthResponseMessageRef.RESEND_VERIFICATION_SUCCESS);\n\n this.logDebug('Resend verification email requested', { email });\n\n try {\n const user = await this.userLookup.findAnyUserByEmail(ec, email);\n\n if (!user \|\| user.status !== UserStatus.PENDING_VERIFICATION) {\n this.logDebug('Resend verification: user not found or not PENDING_VERIFICATION, returning generic success', { email });\n return successResponse;\n }\n\n // Delegated to the shared initiator (revokes the stale token + mints a fresh one + sends).\n await this.emailVerificationInitiator.sendVerificationEmail({\n userId: user._id,\n email: user.email,\n frontendBaseUrl: frontendUrl,\n revokeExisting: true,\n });\n\n this.auditLogsService.logUserVerificationEmailResent({ userId: user._id, email: user.email, ipAddress, userAgent }).catch(() => {});\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n this.logger.error('Unexpected error during resend verification email', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n\n return successResponse;\n }\n\n /\n W4.4: Accept an organization member invitation.\n \n The token→membership→user resolution, the INVITED→ACTIVE flip (via the shared\n * `applyInvitationAcceptanceCore`), and the org-join user-type grant are IDENTICAL across every\n * `credentialMethod`; only the credential step + session issuance differ:\n \n - `PASSWORD` / absent: set the password if one was provided, else\n * intentionally activate with no local credential. The invitation token bootstraps a session (tokens issued unless\n * MFA enrollment gates them).\n * - `MAGIC_LINK`: activate with no local credential, then mint + email a magic link (reusing\n * `AuthenticationOrchestrator.sendMagicLink`). NO session is issued here — the invitee clicks the\n * link and the existing `verifyMagicLink` establishes the session. Returns `MAGIC_LINK_SENT`.\n * - `PASSKEY`: enroll a NEW WebAuthn credential. The invitation token bootstraps the session\n * exactly like the password path (a passkey, like a password, is the GO-FORWARD credential — not\n * this session's authenticator); the pre-generated registration challenge rides back on the\n * result and the frontend completes the ceremony against the existing authenticated\n * `/auth/passkey/register/verify` route.\n \n `MAGIC_LINK` / `PASSKEY` are fail-closed against the invited org's effective auth policy (a\n * method the org disabled is rejected — never trust the client's choice).\n \n The effective user type governing the password + MFA policies is resolved by\n * `_resolveOrgJoinUserType` with deliberately split precedence (OWN-first for the pipeline,\n * ORG-JOIN-first for the method-enablement guard) — see that helper for the rationale.\n /\n async acceptInvitation(\n ec: ExecutionContext<any>,\n params: AcceptInvitationParams,\n ): Promise<AcceptInvitationResult> {\n const { invitationToken, password, firstName, lastName, ipAddress, userAgent, credentialMethod } = params;\n\n // 1. VALIDATE the invitation token — do NOT consume it yet. The consume is DEFERRED to the\n // point of no return (just before the first mutation, below) so a validation failure —\n // a non-INVITED membership, a locked user status, a disabled credential method, a weak\n // password — does NOT spend the single-use token and strand the invitee (who could\n // otherwise never retry the same link). The deferred `consumeToken` is also the\n // concurrency guard: a racing second accept of the same token fails there, before mutating.\n //\n // NO TOKEN ORACLE (review FU-4/FU-5, finding #5 — TREATED): every unusable-invitation rejection on\n // the THREE PUBLIC token-based endpoints (`getInvitationInfo`, `acceptInvitation`, `rejectInvitation`)\n // throws the SAME `ErrorType.AUTHENTICATION` with the SAME `INVITATION_NO_LONGER_VALID` reference —\n // deliberately UNIFORM, regardless of cause (unrecognised / expired / already-consumed token, wrong\n // token type, missing invitation reference, non-INVITED membership, orphaned membership, or a revoke\n // that raced the accept). Rationale: a `customMessageReference` is a TOP-LEVEL field that SURVIVES\n // `sanitizeErrorForClient` (which strips `context` for AUTHENTICATION errors), so a per-cause\n // reference IS client-visible and would let a token holder distinguish \"unrecognised token\" from\n // \"recognised-but-superseded invite\". The status code is already uniform (AUTHENTICATION), so the\n // reference was the last distinguishing signal.\n //\n // Keep the granular cause in the LOGS (the throw site + surrounding `logDebug`), NEVER in the\n // reference. DO NOT re-split this into per-cause references — that re-opens the oracle. The\n // AUTHENTICATED in-app paths (`acceptMyInvitation` / `loadOwnedPendingInvitation`) MAY stay granular:\n // they are gated by userId-ownership rather than token possession, so they leak nothing.\n //\n // RESIDUAL TIMING CHANNEL (review FU-6 — ASSESSED, WONTFIX): the uniform error closes the MESSAGE\n // oracle but not a TIMING one. An unrecognised/expired/consumed token fails FAST at `validateToken`\n // (one indexed `findOne({ token })`, no membership read); a token that PASSES `validateToken` but\n // whose membership is non-INVITED does the extra `ORGANIZATION_MEMBERS` read before the IDENTICAL\n // rejection — so response latency can distinguish the two branches. This is deliberately NOT\n // equalized, and MUST NOT be \"fixed\" with a compensating read or a normalizing delay. Reason: the\n // branch bit is observable ONLY by presenting a token that passes `validateToken`, and the token is a\n // 256-bit crypto-random single-use secret (`crypto.randomBytes(32)`) delivered only to the invitee.\n // • An attacker ENUMERATING tokens never reaches the slow branch — every probe misses `findOne`, so\n // latency is a CONSTANT (fast) independent of any server-side secret → zero bits leaked (and the\n // endpoints are per-IP rate-limited, blunting the many-sample averaging a network timing attack\n // needs). The channel cannot even be actuated without the token.\n // • A LEGITIMATE holder only ever learns the state of THEIR OWN invite (INVITED vs consumed/\n // superseded/orphaned) — which they already possess and the endpoint reports anyway.\n // The channel is therefore SELF-REFERENTIAL (its only output is a fact about the very token you had to\n // already hold to read it) — NOT a cross-user / cross-tenant oracle, unlike a password/HMAC/account-\n // existence compare where the branch is gated on a SERVER secret the caller is guessing. Constant-time\n // equalization would add real complexity + steady-state DB load to protect a non-secret, and MongoDB\n // read latency is itself too high-variance (cache warmth, working-set residency, pool contention, GC)\n // to actually flatten the distribution — while risking a NEW leak via metrics/traces. See the review\n // doc FU-6 for the full weighing. (`acceptInvitation`'s deeper rejections — user status, method\n // enablement, password policy — extend this into a GRADUATED profile, but every step past the first is\n // gated behind BOTH a valid token AND a valid INVITED membership, so the whole profile stays\n // self-referential.)\n let tokenResult;\n try {\n tokenResult = await this.consumableTokenService.validateToken(\n invitationToken,\n [CoreConsumableTokenTypes.ORGANIZATION_MEMBER_INVITATION],\n );\n } catch {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n if (tokenResult.tokenType !== CoreConsumableTokenTypes.ORGANIZATION_MEMBER_INVITATION) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n const invitationId = tokenResult.relatedId;\n if (!invitationId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n // 2. Read the INVITED membership row. In the junction model the invite IS the\n // membership (status INVITED); the token's `relatedId` points at THIS row.\n const membershipId = invitationId;\n const membership = await this.servicesRegistryHandler.read<OrganizationMember>(CoreResourceType.ORGANIZATION_MEMBERS, ec, { _id: membershipId });\n if (!membership \|\| membership.status !== OrganizationMemberStatus.INVITED) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n const organizationId = membership.organizationId;\n const invitationEmail = (membership.userEmail ?? '').toLowerCase();\n\n // 3. Resolve the invitee user. The invite eagerly provisioned it (PENDING_INVITATION if\n // brand-new, or an existing account), so `membership.userId` always resolves.\n let user = await this.userLookup.findUserById(ec, membership.userId);\n if (!user) {\n // Orphaned membership (user reaped) — surface as an invalid invite, not a 500.\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n // Only a not-yet-activated invitee (PENDING_INVITATION), a pending-verification account,\n // or an already-ACTIVE user may accept. INACTIVE / SUSPENDED / DELETED is a hard stop.\n if (\n user.status !== UserStatus.ACTIVE &&\n user.status !== UserStatus.PENDING_VERIFICATION &&\n user.status !== UserStatus.PENDING_INVITATION\n ) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_ACTIVE,\n context: { userId: user._id, userStatus: user.status },\n });\n }\n\n // First activation = the invite-provisioned PENDING_INVITATION account claiming its\n // identity for the first time — where password + profile are set. (Also drives the\n // audit auth-method below.)\n const isNewUser = user.status === UserStatus.PENDING_INVITATION;\n\n // CONTRACT (review FU-4, finding F): `firstName` / `lastName` / `password` are applied ONLY on the\n // first-activation branch below (a brand-new invitee). An EXISTING (ACTIVE / PENDING_VERIFICATION)\n // invitee already has a profile, so their submitted names are harmlessly ignored — the invitation\n // token still bootstraps a session (email-possession auth, like a magic link). A submitted PASSWORD\n // is NOT harmless to drop, though: the credential write is gated on `isNewUser`, so an existing\n // user would BELIEVE they set a login credential that was never persisted. REJECT it explicitly\n // rather than silently no-op. The password field is OPTIONAL, so this does NOT block the legitimate\n // existing-user accept — they accept WITHOUT a password and continue with their existing login\n // method (password / SSO / social); a new password can be added later in account settings.\n if (!isNewUser && password) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_EXISTING_ACCOUNT_NO_PASSWORD,\n context: {\n // organizationId is diagnostic (log-only); not in the VALIDATION client allowlist.\n organizationId,\n },\n });\n }\n\n // Resolve the invited org's ORG-JOIN user type ONCE (the type the accept will grant). Its two\n // consumers apply OPPOSITE precedence on purpose (see `_resolveOrgJoinUserType`):\n // • `activeUserType` for the password/MFA pipeline is OWN-FIRST. A brand-new invitee is\n // provisioned with `userTypes: []` (the grant is DEFERRED to activation by\n // `applyInvitationAcceptanceCore` below), so `user.userTypes[0]` is `undefined` and it falls\n // through to the org-join type — closing the weak-password + MFA hole. An EXISTING user keeps\n // their OWN type: a weaker org-join type must NOT re-govern them and silently reset their MFA\n // enrollment state (`_advanceRegistrationPipeline` persists `mfaEnrollmentState → NOT_REQUIRED`\n // when the resolved policy drops the requirement). Org overrides still merge for existing users\n // via `resolveEffectiveAuthPolicy` (which reads the just-activated membership).\n // • the fail-closed method-enablement guard is ORG-JOIN-FIRST — the org's method restrictions\n // must gate the choice even for an existing user (see below).\n const { orgType, orgJoinUserType, orgReadFailed } = await this._resolveOrgJoinUserType(membership);\n const activeUserType = user.userTypes?.[0] ?? orgJoinUserType;\n\n // Fail-closed method-enablement + directory-management enforcement, BEFORE the consume/mutation.\n // `getInvitationInfo` gates the UI, but the accept endpoint must NEVER trust the client — a DIRECT\n // API call could name a method (or set a password) the org disabled, or set a local credential on an\n // actively directory-managed org. So whenever the accept ESTABLISHES A LOCAL CREDENTIAL — a password,\n // an enrolled passkey, or an emailed magic link — enforce BOTH axes:\n // (1) DEPROVISIONING integrity: an ACTIVELY directory-managed org (DIRECTORY_PROVISIONING feature\n // + a live SCIM token — the IdP provisions AND deprovisions, so a local credential would\n // survive deprovisioning) rejects ANY local credential. Re-keyed 2026-07-18 from the org-TYPE\n // `scimProvisioning.enabled` MOUNT flag to this per-org signal (AUTH-23 /\n // .claude/plans/scim-vs-auth-authority-axis.md), which stopped over-blocking password orgs of a\n // SCIM-capable type;\n // (2) AUTH AUTHORITY (SSO): the method must be in the org's effective `authMethodsEnabled`\n // (ORG-JOIN-FIRST, mirroring `getInvitationInfo` — covers PASSWORD too).\n // A password-less activation (no `password`, no `credentialMethod`) sets NO credential and is left\n // open — an SSO/SCIM invitee may activate here and then authenticate via their IdP.\n const establishedCredentialMethod: AuthMethod \| undefined =\n credentialMethod === AuthMethod.MAGIC_LINK \|\| credentialMethod === AuthMethod.PASSKEY\n ? credentialMethod\n : (password ? AuthMethod.PASSWORD : undefined);\n if (establishedCredentialMethod) {\n if (orgReadFailed) {\n // The org read FAILED (transient) — its type / `managementMode` and enabled-method set are\n // UNKNOWN. Fail CLOSED: never establish a local credential on an org we could not classify (the\n // downstream directory-management and effective-policy checks below BOTH need a classified org —\n // `_assertInvitationCredentialMethodEnabled` in particular keys on `orgType`). `getInvitationInfo`\n // stays lenient for display; the MUTATION path must not. INTERNAL (retryable) — the invitee can\n // retry once the read recovers; the single-use token is NOT yet consumed at this point.\n throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_ORG_VERIFICATION_FAILED,\n context: {\n // organizationId is diagnostic (log-only): INTERNAL strips context at the wire.\n // The user-facing text is now localized via the customMessageReference above.\n organizationId,\n },\n });\n }\n // Concern B (deprovisioning integrity): refuse a local credential when the org is\n // ACTIVELY directory-managed. Re-keyed 2026-07-18 (AUTH-23 /\n // .claude/plans/scim-vs-auth-authority-axis.md) from the org-TYPE\n // `scimProvisioning.enabled` MOUNT flag — which over-blocked EVERY org of a\n // SCIM-capable type (stranding password-based test/non-directory orgs) — to the\n // honest per-org signal (DIRECTORY_PROVISIONING feature AND a live SCIM token).\n // Concern A (the org's effective policy disallowing the method) is enforced\n // immediately below by `_assertInvitationCredentialMethodEnabled`.\n let activelyDirectoryManaged: boolean;\n try {\n activelyDirectoryManaged = await isOrgActivelyDirectoryManaged({\n organizationId,\n featureResolution: this.featureResolution,\n systemAccessService: this.systemAccessService,\n });\n } catch (error) {\n // Could not classify the org's directory-management posture (transient read\n // failure). Fail CLOSED exactly like the `orgReadFailed` branch above: throw a\n // RETRYABLE INTERNAL error rather than establish a local credential we might\n // regret. The single-use token is NOT yet consumed, so the invitee can retry.\n this.logger.warn('Failed to resolve directory-management posture at invite-accept', {\n organizationId,\n ...projectCaughtErrorLogFields(error),\n });\n throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_ORG_VERIFICATION_FAILED,\n context: { organizationId },\n });\n }\n if (activelyDirectoryManaged) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SCIM_LOCAL_CREDENTIAL_BLOCKED,\n context: {\n // organizationId is diagnostic (log-only): AUTHORIZATION strips context at the wire.\n organizationId,\n },\n });\n }\n // ORG-JOIN-FIRST (opposite of `activeUserType`): the org's method restrictions must gate the\n // choice even for an existing user who carries their own type. Mirrors `getInvitationInfo`.\n const enablementUserType = orgJoinUserType ?? user.userTypes?.[0];\n this._assertInvitationCredentialMethodEnabled(organizationId, orgType, enablementUserType, establishedCredentialMethod);\n }\n\n // Validate the initial password against the ORG-MERGED policy (new invitee setting one) BEFORE\n // consuming the token — a policy rejection must NOT spend the single-use token (else a weak\n // password strands the invitee, unable to retry). `resolveAuthPolicyForOrgType` applies the\n // org's `authOverrides` most-restrictively (consistent with the enablement guard above, the M1\n // discovery policy, and the MFA path), so an org that STRENGTHENS `passwordPolicy` is honored. A\n // brand-new invitee's `activeUserType` IS the org-join type (own `userTypes: []`) so the\n // single-org resolver is exact; an unresolvable type degrades to the schema default\n // (`validatePasswordPolicy(pw, undefined)`).\n if (isNewUser && password) {\n const passwordPolicy = (activeUserType\n ? this.userLookup.resolveAuthPolicyForOrgType(activeUserType, orgType)\n : null)?.passwordPolicy;\n const policyValidation = this.credentialVerifier.validatePasswordPolicy(password, passwordPolicy);\n if (!policyValidation.valid) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION_PASSWORD_POLICY_VIOLATION,\n context: { violations: policyValidation.violations, minLength: passwordPolicy?.minLength, maxLength: passwordPolicy?.maxLength },\n });\n }\n }\n\n // Registration policy is checked before the token point-of-no-return. The shared acceptance\n // core repeats this check immediately before membership mutation for policy drift and for the\n // tokenless/OAuth entry points.\n await assertInvitationUserTypeAcquisitionAllowed({\n user,\n organizationId,\n appConfigService: this.appConfigService,\n errorBuilder: this.errorBuilder,\n systemAccessService: this.systemAccessService,\n });\n\n // Hash outside the transaction: Argon2 is CPU work and must not extend the\n // database lock window. The policy validation above has already succeeded.\n const hashedPassword = isNewUser && password\n ? await this.credentialVerifier.hashPassword(\n password,\n this.appConfigService.config.auth.passwordHashing,\n )\n : undefined;\n\n try {\n user = await this.resourcePersistenceUnitOfWork.executeTransaction(\n createPublicInvitationAcceptancePersistenceRequest({\n includeCredentials: hashedPassword !== undefined,\n }),\n async serviceOptions => {\n // Token consumption, membership activation, user activation, credential\n // persistence, and org-type grants are one commit. Any revoked membership\n // or later write failure rolls the single-use token back to usable state.\n await this.consumableTokenService.consumeToken(\n invitationToken,\n serviceOptions.transaction!,\n );\n\n const currentMembership = await this.systemAccessService.readAsSystem<OrganizationMember>(\n CoreResourceType.ORGANIZATION_MEMBERS,\n { _id: membership._id },\n serviceOptions,\n );\n const currentUser = await this.servicesRegistryHandler.read<User>(\n CoreResourceType.USERS,\n ec,\n { _id: user._id },\n serviceOptions,\n );\n if (\n !currentMembership\n \|\| (\n currentMembership.status !== OrganizationMemberStatus.INVITED\n && currentMembership.status !== OrganizationMemberStatus.ACTIVE\n )\n \|\| currentMembership.userId !== user._id\n \|\| !currentUser\n \|\| currentUser.status !== user.status\n ) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n if (hashedPassword) {\n const existingCredential = await this.servicesRegistryHandler.read<UserCredentials>(\n CoreResourceType.USER_CREDENTIALS,\n ec,\n { userId: currentUser._id },\n serviceOptions,\n );\n if (existingCredential) {\n await this.credentialVerifier.updatePasswordHash(\n ec,\n currentUser._id,\n hashedPassword,\n serviceOptions,\n );\n } else {\n await this.systemAccessService.createAsSystem(\n CoreResourceType.USER_CREDENTIALS,\n {\n userId: currentUser._id,\n passwordHash: hashedPassword,\n },\n serviceOptions,\n );\n }\n }\n\n let activatedUser = currentUser;\n if (\n currentUser.status === UserStatus.PENDING_INVITATION\n \|\| currentUser.status === UserStatus.PENDING_VERIFICATION\n ) {\n // SYSTEM door, not the handler: `status` is `.excludeFromUpdate()`, so the client-facing\n // UPDATE contract cannot carry it and the repository's strict re-parse STRIPS it from a\n // handler write. The row still comes back — the filter matched — so the write reports\n // success while persisting nothing, and the invitee is left PENDING_INVITATION.\n //\n // That silence is what made this expensive to find. Nothing threw; `accept` answered 200;\n // and the failure surfaced two steps later as a magic link that was never emailed, because\n // `sendMagicLink` resolves the user BY EMAIL and takes its anti-enumeration no-op when that\n // user is not ACTIVE. An e2e scenario reported \"no email arrived\" for a defect three hops\n // upstream.\n //\n // The sibling activation (email verification, ~line 900) was moved to the system door on\n // 2026-08-06; this call site was missed, which is the failure shape\n // `.claude/rules/invariant-call-site-enumeration.md` exists to catch — the invariant is\n // \"a `status` write goes through the system door\", and it holds at every site or none.\n //\n // The compare-and-swap is PRESERVED: the filter still pins the status observed above, so a\n // concurrent activation still loses the race and is still refused below rather than\n // blind-overwriting.\n const updated = await this.systemAccessService.updateAsSystem<User>(\n CoreResourceType.USERS,\n { _id: currentUser._id, status: currentUser.status },\n { status: UserStatus.ACTIVE },\n serviceOptions,\n );\n if (!updated) {\n throw this.errorBuilder.buildError(ErrorType.CONFLICT, undefined, {\n context: {\n reason: 'invitation_user_activation_race_lost',\n userId: currentUser._id,\n },\n });\n }\n activatedUser = updated;\n }\n\n const { membershipActivated } = await applyInvitationAcceptanceCore(ec, {\n membership: currentMembership,\n user: activatedUser,\n appConfigService: this.appConfigService,\n errorBuilder: this.errorBuilder,\n servicesRegistryHandler: this.servicesRegistryHandler,\n systemAccessService: this.systemAccessService,\n serviceOptions,\n logDebug: this.logDebug,\n });\n if (!membershipActivated) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n return activatedUser;\n },\n );\n } catch (error) {\n this.logger.warn('Invitation acceptance transaction rolled back', {\n membershipId: membership._id,\n userId: user._id,\n organizationId,\n ...(isWildoBackendError(error)\n ? {\n errorType: error.type,\n errorStatusCode: error.statusCode,\n errorContext: error.context,\n }\n : {\n errorMessage: describeCaughtError(error),\n }),\n });\n // Preserve the public no-oracle contract for expected token/state races,\n // but never relabel infrastructure, database, or configuration failures\n // as an invalid invitation. Those failures are retryable/operator-actionable\n // and masking them would strand a valid invite behind a false 401.\n if (\n isWildoBackendError(error)\n && (\n error.type === ErrorType.AUTHENTICATION\n \|\| error.type === ErrorType.CONFLICT\n )\n ) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n },\n );\n }\n throw error;\n }\n\n if (isNewUser) {\n // Profile enrichment is not an authorization precondition. It runs only\n // after the durable acceptance commit and remains idempotent/best-effort.\n try {\n await this.systemAccessService.createAsSystem(CoreResourceType.USER_PROFILES, {\n userId: user._id,\n firstName,\n lastName,\n displayName: `${firstName} ${lastName}`,\n });\n } catch (profileError) {\n this.logger.error('Failed to create user profile during invitation acceptance (non-fatal)', {\n userId: user._id,\n ...projectCaughtErrorLogFields(profileError),\n });\n }\n this.logDebug('Invitee account activated via invitation acceptance', {\n userId: user._id,\n organizationId,\n });\n }\n\n // MAGIC_LINK path — the invitee established NO local credential and gets NO session here.\n // Mint a magic link (reusing the shared token machinery, `sendMagicLink`) bound to the\n // just-activated invitee and hand it back for the controller to email. `sendMagicLink`\n // resolves the user BY EMAIL — which now resolves to THIS ACTIVE account — so the token's\n // `relatedId` IS the invitee's userId and its `metadata.email` the invitee email; the eventual\n // `verifyMagicLink` click (which hard-rejects non-ACTIVE users) establishes the session. No\n // login is audited here: `sendMagicLink` audits the send, `verifyMagicLink` audits the login.\n if (credentialMethod === AuthMethod.MAGIC_LINK) {\n // `skipGlobalEnablementCheck: true` — MAGIC_LINK was ALREADY authorized above against the\n // invited org's precise, org-EXPANDED policy (`_assertInvitationCredentialMethodEnabled`). We\n // are PAST the mutations (activate + membership flip + token consume), so `sendMagicLink` must\n // NOT re-reject on its coarse base-policy global gate — that would strand the just-activated\n // invitee (see the reconciliation note on `sendMagicLink`).\n const magic = await this.authOrchestrator.sendMagicLink(ec, { email: invitationEmail }, { ipAddress, userAgent }, true);\n this.logDebug('Invitation accepted via magic link — link minted for delivery', { userId: user._id, organizationId });\n return {\n outcome: AcceptInvitationOutcome.MAGIC_LINK_SENT,\n magicLinkDelivery: {\n // Empty only in the (post-activation) anti-enumeration no-op — the controller then\n // simply sends no email; the invitee we just activated always resolves to a token.\n token: magic.token ?? '',\n submissionId: magic.submissionId,\n email: invitationEmail,\n userId: user._id,\n expiresInMinutes: magic.expiresInMinutes,\n },\n };\n }\n\n // PASSKEY path — the invitee will enroll a NEW WebAuthn credential. `passkeyCredentials` live on\n // the USER_CREDENTIALS document, and both the challenge generation below and the later verify\n // require that row to EXIST — so ensure a password-less row now (a brand-new invitee has none;\n // an existing user may already have one). Runs on BOTH the token-issued and MFA-gated branches so\n // a post-MFA enrollment via the existing authenticated route also finds the row.\n if (credentialMethod === AuthMethod.PASSKEY) {\n // NON-FATAL: the token is already consumed + the membership flipped, so a failure here must\n // NOT 500 and strand the invitee (activated but session-less). A missing row just means the\n // challenge below no-ops (also non-fatal) and the invitee enrolls a passkey later via the\n // authenticated register route.\n try {\n await this._ensurePasswordlessCredentialRecord(ec, user._id);\n } catch (error) {\n this.logger.error('Password-less credential row provisioning failed at passkey accept (non-fatal)', {\n userId: user._id,\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n // 6. Create registration session with purpose 'invitation'\n const session = await this.authOrchestrator.createRegistrationSession(\n user._id,\n invitationEmail,\n {\n activeUserType,\n purpose: AuthSessionPurpose.INVITATION,\n deviceInfo: { ipAddress, userAgent },\n },\n );\n\n const auditAuthMethod = isNewUser\n ? (password ? AuthMethod.PASSWORD : AUTH_AUDIT_METHOD.INVITATION_ACCEPTANCE)\n : AUTH_AUDIT_METHOD.INVITATION_LINK;\n this.auditLogsService.logUserLogin({\n userId: user._id,\n email: invitationEmail,\n authMethod: auditAuthMethod,\n ipAddress,\n userAgent,\n sessionId: session.sessionId,\n organizationId,\n }, await this.authEcFactory.createForAuditRoutingOrFallback(ec, organizationId, user._id)).catch(() => {});\n\n // 7. Process through the registration pipeline\n // Invitations from trusted source → skip email verification, go straight to MFA check\n const pipelineSession = await this.authOrchestrator.processEmailVerification(\n ec,\n user._id,\n invitationEmail,\n activeUserType,\n { ipAddress, userAgent },\n AuthSessionPurpose.INVITATION,\n );\n\n // 8. If pipeline completed, issue tokens\n if (pipelineSession.state === 'COMPLETED' \|\| pipelineSession.state === 'MFA_ENROLLMENT_GRACE') {\n const tokenResult = await this.tokenIssuer.issueTokensForUser(user._id, undefined, {\n lastAuthenticatedAt: Math.floor(Date.now() / 1000),\n });\n\n // PASSKEY: with a session now issued, generate the WebAuthn registration challenge bound to\n // the invitee and ride it back on the result. The frontend runs the browser ceremony and\n // completes it against the EXISTING authenticated `/auth/passkey/register/verify` route\n // (authenticated by the access token just issued) — no bespoke accept-verify endpoint.\n // NON-FATAL: the session is ALREADY issued (the invitation token bootstrapped it + was\n // consumed), so a challenge-generation failure must NOT 500 and strand the invitee — they\n // proceed signed in (no challenge on the wire) and enroll a passkey later in security\n // settings, exactly like the frontend's own swallowed ceremony failure.\n let passkeyRegistrationOptions: PublicKeyCredentialCreationOptionsJSON \| undefined;\n if (credentialMethod === AuthMethod.PASSKEY) {\n try {\n passkeyRegistrationOptions = await this.webAuthnService.generateRegistrationOptions(ec, user._id, invitationEmail);\n } catch (error) {\n this.logger.error('Passkey challenge generation failed at accept — returning the issued session without a challenge (non-fatal)', {\n userId: user._id,\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n return {\n outcome: AcceptInvitationOutcome.SESSION,\n sessionId: pipelineSession.sessionId,\n state: pipelineSession.state,\n purpose: AuthSessionPurpose.INVITATION,\n nextStep: pipelineSession.nextStep,\n userId: user._id,\n accessToken: tokenResult.accessToken,\n refreshToken: tokenResult.refreshToken,\n expiresIn: tokenResult.expiresIn,\n passkeyRegistrationOptions,\n };\n }\n\n // MFA enrollment required — return session info for frontend routing. Passkey options are\n // deliberately NOT generated here: there is no session yet, and the 5-minute challenge would\n // likely expire before MFA enrollment finishes. The frontend enrolls the passkey post-MFA via\n // the existing authenticated route (the credential row was already ensured above).\n return {\n outcome: AcceptInvitationOutcome.SESSION,\n sessionId: pipelineSession.sessionId,\n state: pipelineSession.state,\n purpose: AuthSessionPurpose.INVITATION,\n nextStep: pipelineSession.nextStep,\n userId: user._id,\n requiresMFA: true,\n availableEnrollmentMethods: pipelineSession.availableEnrollmentMethods,\n };\n }\n\n /\n Resolve the invited organization's join context in a SINGLE system read: its `type`, the\n * ORG-JOIN user type the accept will GRANT (`organizationTypes[orgType].userTypes[0]`), and its\n * display name. The one read is shared by `acceptInvitation` (uses `orgType` + `orgJoinUserType`)\n * and `getInvitationInfo` (uses all three), so the org-join projection lives in ONE place — no\n * drift between the accept path and its public discovery counterpart.\n \n Why `[0]` — `grantUserTypesOnOrgJoin` grants ALL of `organizationTypes[orgType].userTypes`\n * ADDITIVELY, but `[0]` is the PRIMARY (governing) type: it matches the `userTypes[0]` convention\n * every auth surface uses (orchestrator, token issuer, password reset, method-management), and a\n * brand-new invitee's additive grant appends to `[]` so their post-grant `userTypes[0]` IS this\n * `[0]`. Resolving the accept-time policy against `[0]` therefore matches the invitee's\n * steady-state login policy EXACTLY. The remaining granted types are supplementary capabilities,\n * not the governing auth type — validating against the most-restrictive of ALL granted types would\n * make accept STRICTER than every subsequent login (an accept-vs-steady-state discrepancy).\n \n Returns the RAW org-join type — deliberately NOT pre-merged with the invitee's own type —\n * because the two accept consumers need OPPOSITE precedence:\n * - the effective `activeUserType` for the password/MFA pipeline is OWN-FIRST\n * (`user.userTypes[0] ?? orgJoinUserType`): a brand-new invitee (own `userTypes: []`, grant\n * deferred) falls through to the org-join type — closing the weak-password + MFA hole — while\n * an EXISTING user keeps their own type so a weaker org-join type cannot re-govern them or\n * reset their MFA enrollment state;\n * - the fail-closed method-enablement guard is ORG-JOIN-FIRST\n * (`orgJoinUserType ?? user.userTypes[0]`): the org's method restrictions must gate the choice\n * even for an existing user.\n \n Read via the system-access door because both callers run under a pre-auth `APP_PUBLIC` EC that\n * cannot ACL-read ORGANIZATIONS. `organizationName` is `displayName ?? name` (`undefined` if the\n * org is unreadable — callers coalesce). (A full accept performs ~3 org reads; the org-type grant\n * and `resolveEffectiveAuthPolicy` read it too — this read is shared by the guard + the\n * initial-password policy + discovery.)\n /\n private async _resolveOrgJoinUserType(\n membership: Pick<OrganizationMember, 'organizationId'>,\n ): Promise<{ orgType: string \| undefined; orgJoinUserType: string \| undefined; organizationName: string \| undefined; orgReadFailed: boolean }> {\n let orgType: string \| undefined;\n let organizationName: string \| undefined;\n let orgReadFailed = false;\n try {\n const org = await this.systemAccessService.readAsSystem<{ _id: string; type?: string; name?: string; displayName?: string }>(\n CoreResourceType.ORGANIZATIONS, { _id: membership.organizationId },\n );\n orgType = org?.type;\n organizationName = org?.displayName ?? org?.name ?? undefined;\n } catch (error) {\n // Non-fatal read failure → orgType/name stay undefined → org-join type unresolved. `orgReadFailed`\n // DISAMBIGUATES this from a genuinely type-less org (both leave `orgType` undefined). For a\n // brand-new invitee (own `userTypes: []`) an unresolved type degrades the initial-password policy\n // to the schema default and the MFA policy to FALLBACK — acceptable for DISPLAY. But the\n // credential-establishment guard fail-CLOSES on `orgReadFailed` (a degraded read must never be\n // mistaken for a non-SCIM / unrestricted org and let a local credential slip past enforcement).\n // Logged so the degrade is observable rather than silent.\n orgReadFailed = true;\n this.logDebug('Invitation accept: ORGANIZATIONS read failed — org-join user type unresolved, policy will degrade', {\n organizationId: membership.organizationId,\n ...projectCaughtErrorLogFields(error),\n });\n }\n\n const orgJoinUserType = orgType\n ? this.appConfigService.config.organizationTypes?.[orgType]?.userTypes?.[0]\n : undefined;\n\n return { orgType, orgJoinUserType, organizationName, orgReadFailed };\n }\n\n /\n Fail-closed check that a chosen accept-time credential method is enabled by the invited\n * organization's EFFECTIVE auth policy. Receives the ORG-JOIN-FIRST resolved user type + the org\n * type (both from `_resolveOrgJoinUserType`, resolved once per accept); the PURE\n * `resolveAuthPolicyForOrgType` merges the org overrides (most-restrictive-wins) and\n * `getEnabledMethods` projects the enabled set.\n \n Throws `AUTHORIZATION` when the method is not enabled (or the org type / policy cannot be\n * resolved — fail-closed: an unresolvable policy never silently permits a password-less method).\n /\n private _assertInvitationCredentialMethodEnabled(\n organizationId: string,\n orgType: string \| undefined,\n resolutionUserType: string \| undefined,\n credentialMethod: AuthMethod,\n ): void {\n const resolvedPolicy = resolutionUserType\n ? this.userLookup.resolveAuthPolicyForOrgType(resolutionUserType, orgType)\n : null;\n const enabledMethods = resolvedPolicy\n ? getEnabledMethods(resolvedPolicy.authMethodsEnabled)\n : new Set<AuthMethod>();\n const registrationMethodAllowed =\n credentialMethod !== AuthMethod.PASSWORD\n \|\| resolvedPolicy?.registration.allowedMethods.includes(\n AuthMethod.PASSWORD,\n ) === true;\n\n if (\n !registrationMethodAllowed\n \|\| !enabledMethods.has(credentialMethod)\n ) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_METHOD_NOT_SUPPORTED,\n context: {\n // Diagnostic (log-only): AUTHENTICATION strips non-allowlisted context at the wire.\n method: credentialMethod,\n organizationId,\n },\n });\n }\n }\n\n /\n Ensure a USER_CREDENTIALS document exists for a user, creating a PASSWORD-LESS one if absent.\n * Passkey-enroll-at-accept needs the credential row to exist BEFORE the WebAuthn ceremony (the\n * challenge generation + verify both resolve it, and a brand-new invitee has none). `passwordHash`\n * is optional precisely so this row is creatable with no password. Idempotent: an existing row\n * (e.g. an already-registered user accepting a further invite) is left untouched.\n /\n private async _ensurePasswordlessCredentialRecord(ec: ExecutionContext<any>, userId: string): Promise<void> {\n const existing = await this.servicesRegistryHandler.read<UserCredentials>(\n CoreResourceType.USER_CREDENTIALS, ec, { userId },\n );\n if (existing) return;\n\n // Trusted system write: USER_CREDENTIALS is INTERNAL_CALL-only and its `userId` (context FK) is\n // stripped from the client-shaped request DTO; `createAsSystem` re-attaches it after the strict\n // parse (systemAccessPolicy.create opt-in). No `passwordHash` — this is a password-less row.\n await this.systemAccessService.createAsSystem(CoreResourceType.USER_CREDENTIALS, { userId });\n this.logDebug('Password-less credential record provisioned for passkey enrollment', { userId });\n }\n\n /\n W4.4: Reject an organization member invitation through the public token-based auth flow.\n \n The junction row is the invitation, so rejection and admin revocation have\n * distinct authorization/audit intent but the same terminal persistence:\n * atomically revoke the accept token and delete the still-INVITED row.\n /\n async rejectInvitation(\n ec: ExecutionContext<any>,\n params: {\n invitationToken: string;\n rejectionReason?: string;\n },\n ): Promise<{ rejected: true }> {\n const { invitationToken, rejectionReason } = params;\n\n // NO TOKEN ORACLE + RESIDUAL TIMING CHANNEL: rejection is uniform (`INVITATION_NO_LONGER_VALID`); the\n // fast (validateToken-fail) vs slow (membership-read) timing residual is ASSESSED WONTFIX. See the\n // canonical rationale on `acceptInvitation` (review FU-4/5/6) before \"fixing\" the timing here.\n let tokenResult;\n try {\n // Preflight is deliberately read-only. The invited-only REVOKE mutation\n // revokes this token by membership relatedId in the same transaction as\n // deleting the row. Consuming here would strand a valid INVITED row if\n // the process crashed or deletion failed afterward.\n tokenResult = await this.consumableTokenService.validateToken(\n invitationToken,\n [CoreConsumableTokenTypes.ORGANIZATION_MEMBER_INVITATION],\n );\n } catch {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n const invitationId = tokenResult.relatedId;\n if (!invitationId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n const membership = await this.systemAccessService.readAsSystem<OrganizationMember>(\n CoreResourceType.ORGANIZATION_MEMBERS,\n { _id: invitationId },\n );\n if (!membership \|\| membership.status !== OrganizationMemberStatus.INVITED) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n try {\n await this.applyInvitationRejectionCore(ec, {\n membership,\n rejectionReason,\n });\n } catch (error) {\n // Acceptance/revocation may win after the read-only preflight. Preserve\n // the public no-oracle contract for those expected state races, while\n // leaving infrastructure/configuration failures visible and retryable.\n if (\n isWildoBackendError(error)\n && (\n error.type === ErrorType.AUTHENTICATION\n \|\| error.type === ErrorType.AUTHORIZATION\n \|\| error.type === ErrorType.NOT_FOUND\n \|\| error.type === ErrorType.CONFLICT\n )\n ) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n },\n );\n }\n throw error;\n }\n\n return { rejected: true };\n }\n\n /\n Shared rejection core — REVOKE the pending membership (decline). Reused by the\n * token-based `rejectInvitation` and the authenticated in-app `rejectMyInvitation`.\n \n In the junction model there is no `REJECTED` status to set: a declined invite leaves no\n * membership. Revoking the INVITED row uses the exact invited-only REVOKE\n * implementation, whose declarative token contract revokes the accept token\n * inside the same transaction. The invitee\n * is not an org admin, so the ORG_ADMIN-gated DELETE runs under a synthesised super-admin EC.\n \n ## The decline IS audited — as the invitee, not as the system\n \n REVOKE emits `ORGANIZATION_MEMBER_REMOVED` from a post-commit effect, carrying `operation`,\n * `previousStatus`, `roles` and this `reason`. What that event could not say, until the\n * `onBehalfOfUserId` below, was WHO declined: a borrowed-authority context carries no\n * `initiatorIds.userId` (the `ExecutionContext` constructor rejects one), so the actor resolved to\n * `SYSTEM` — the identical row the stale-invitation sweep writes when it reaps an invitation nobody\n * answered. An access review could not tell an active refusal from silence.\n \n `membership.userId` is the right source for BOTH callers rather than the caller id: the token\n * path identifies the invitee through the token, the in-app path has already verified the caller\n * owns this row, and taking it from the row keeps the two from drifting.\n \n With the actor recorded, the three REVOKE causes are distinguishable with no new event type:\n * a self-decline is `removedBy === removedUserId`, an administrative cancellation is a different\n * real user id, and the expiry sweep remains `SYSTEM`.\n /\n private async applyInvitationRejectionCore(\n _ec: ExecutionContext<any>,\n { membership, rejectionReason }: { membership: OrganizationMember; rejectionReason?: string },\n ): Promise<void> {\n const systemEc = await this.authEcFactory.createForSystemAuthOperation(\n this.authEcFactory.getOrganizationMembersRevokeOperationPath(),\n { onBehalfOfUserId: membership.userId },\n );\n await this.servicesRegistryHandler.executeCustomOperation(\n CoreResourceType.ORGANIZATION_MEMBERS,\n OrganizationMembers_Operations.REVOKE,\n systemEc,\n membership._id,\n {\n reason: rejectionReason?.trim() \|\| undefined,\n },\n );\n\n this.logDebug('Invitation declined — pending membership removed', {\n membershipId: membership._id,\n userId: membership.userId,\n organizationId: membership.organizationId,\n rejectionReason: rejectionReason?.trim() \|\| undefined,\n });\n }\n\n /\n In-app authenticated accept (Approach P) — list the caller's OWN pending\n * invitations across every organization, matched by their `userId`.\n \n Since the invitation→membership collapse, the invite binds the pending\n * `ORGANIZATION_MEMBERS` row to the invitee's `userId` (an eagerly-created\n * `PENDING_INVITATION` user), so the inbox is a direct userId-owned query — no\n * email round-trip. Cross-org by construction (the invitee is not yet a scoped\n * member of the inviting orgs), so invitations + org names are read via the\n * system-context primitives (`listAsSystem`/`readAsSystem`). Authorization is\n * the userId-ownership match: only INVITED rows bound to the caller's `userId`\n * are returned. The caller's identity comes from the authenticated route\n * (`callerUserId`).\n /\n async listMyPendingInvitations(\n _ec: ExecutionContext<any>,\n params: { callerUserId: string },\n ): Promise<MyPendingInvitation[]> {\n // The invite bound the pending membership to the caller's `userId`, so the inbox is a\n // direct userId-owned query — no email round-trip. Cross-org by construction (the invitee\n // is not yet a scoped member of the inviting orgs), so read via the system context.\n const result = await this.systemAccessService.listAsSystem<OrganizationMember>(\n CoreResourceType.ORGANIZATION_MEMBERS,\n { userId: params.callerUserId, status: OrganizationMemberStatus.INVITED },\n );\n const memberships = Array.isArray(result) ? result : result.data;\n\n return Promise.all(memberships.map(async (membership): Promise<MyPendingInvitation> => {\n let organizationName: string \| undefined;\n try {\n const org = await this.systemAccessService.readAsSystem<{ displayName?: string; name?: string }>(\n CoreResourceType.ORGANIZATIONS,\n { _id: membership.organizationId },\n );\n organizationName = org?.displayName ?? org?.name ?? undefined;\n } catch {\n organizationName = undefined;\n }\n return {\n membershipId: membership._id,\n organizationId: membership.organizationId,\n organizationName,\n roles: membership.roles ?? [],\n createdAt: membership.createdAt ? new Date(membership.createdAt).toISOString() : undefined,\n };\n }));\n }\n\n /\n In-app authenticated accept (Approach P) — accept ONE of the caller's own pending\n * invitations by membership id, WITHOUT a token and WITHOUT issuing a new session (the\n * caller is already authenticated). Authorization = userId-ownership of the INVITED row.\n * The shared `applyInvitationAcceptanceCore` flips it to ACTIVE + grants org-join types.\n /\n async acceptMyInvitation(\n ec: ExecutionContext<any>,\n params: { callerUserId: string; membershipId: string },\n ): Promise<{ accepted: true; organizationId: string }> {\n const { caller, membership } = await this.loadOwnedPendingInvitation(ec, params.callerUserId, params.membershipId);\n\n await this.resourcePersistenceUnitOfWork.executeTransaction(\n createAuthenticatedInvitationAcceptancePersistenceRequest(),\n async serviceOptions => {\n // MongoDB does not support concurrent operations on the same session.\n // Sequential reads are portable across both supported adapters.\n const currentCaller = await this.servicesRegistryHandler.read<User>(\n CoreResourceType.USERS,\n ec,\n { _id: caller._id },\n serviceOptions,\n );\n const currentMembership =\n await this.systemAccessService.readAsSystem<OrganizationMember>(\n CoreResourceType.ORGANIZATION_MEMBERS,\n { _id: membership._id },\n serviceOptions,\n );\n if (\n !currentCaller\n \|\| !currentMembership\n \|\| currentMembership.userId !== currentCaller._id\n \|\| currentMembership.status !== OrganizationMemberStatus.INVITED\n ) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n const { membershipActivated } = await applyInvitationAcceptanceCore(ec, {\n membership: currentMembership,\n user: currentCaller,\n appConfigService: this.appConfigService,\n errorBuilder: this.errorBuilder,\n servicesRegistryHandler: this.servicesRegistryHandler,\n systemAccessService: this.systemAccessService,\n serviceOptions,\n logDebug: this.logDebug,\n });\n if (!membershipActivated) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n },\n );\n\n this.logDebug('Invitation accepted in-app', {\n membershipId: membership._id,\n userId: caller._id,\n organizationId: membership.organizationId,\n });\n\n return { accepted: true, organizationId: membership.organizationId };\n }\n\n /\n In-app authenticated reject (Approach P) — decline ONE of the caller's own pending\n * invitations by membership id. Same userId-ownership gate as `acceptMyInvitation`. In the\n * junction model the decline REVOKEs the INVITED row (which revokes its accept token via\n * the invitation-cancellation prefix) rather than setting a terminal status.\n /\n async rejectMyInvitation(\n ec: ExecutionContext<any>,\n params: { callerUserId: string; membershipId: string; rejectionReason?: string },\n ): Promise<{ rejected: true; organizationId: string }> {\n const { membership } = await this.loadOwnedPendingInvitation(ec, params.callerUserId, params.membershipId);\n\n await this.applyInvitationRejectionCore(ec, { membership, rejectionReason: params.rejectionReason });\n\n return { rejected: true, organizationId: membership.organizationId };\n }\n\n /\n Load + authorize one of the caller's own pending invitations (INVITED membership rows)\n * for the in-app (authenticated, tokenless) accept/reject flow. Reads the caller + the\n * membership via the cross-org system context, then enforces:\n * 1. userId-ownership — `membership.userId === caller._id` (else 403 AUTHORIZATION);\n * 2. INVITED status (else AUTHENTICATION \"no longer valid\", matching the token flow).\n \n \"Not found\" and \"not addressed to you\" deliberately surface the SAME ownership error so\n * a caller cannot probe for the existence of other people's invitations.\n /\n private async loadOwnedPendingInvitation(\n ec: ExecutionContext<any>,\n callerUserId: string,\n membershipId: string,\n ): Promise<{ caller: User; membership: OrganizationMember }> {\n const caller = await this.userLookup.findUserById(ec, callerUserId);\n if (!caller) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, ec, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_FOUND,\n });\n }\n\n const membership = await this.systemAccessService.readAsSystem<OrganizationMember>(\n CoreResourceType.ORGANIZATION_MEMBERS,\n { _id: membershipId },\n );\n\n if (!membership \|\| membership.userId !== caller._id) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, ec, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NOT_ADDRESSED_TO_CALLER,\n });\n }\n\n if (membership.status !== OrganizationMemberStatus.INVITED) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, ec, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n return { caller, membership };\n }\n\n /\n W5.7: Complete org onboarding — called by the guidance/onboarding flow\n * after collecting the organization name from the user.\n * Creates the deferred org, grants user types, issues tokens, transitions session to COMPLETED.\n */\n async completeOrgOnboarding(\n ec: ExecutionContext<any>,\n params: {\n sessionId: string;\n organizationName: string;\n },\n ): Promise<{\n sessionId: string;\n state: string;\n nextStep?: string;\n organizationId?: string;\n accessToken?: string;\n refreshToken?: string;\n expiresIn?: number;\n }> {\n const session = await this.authOrchestrator.completeOrgOnboarding(\n ec,\n params.sessionId,\n params.organizationName,\n );\n\n if (session.state === AuthenticationSessionState.COMPLETED && session.userId) {\n const tokenResult = await this.tokenIssuer.issueTokensForUser(session.userId, undefined, {\n lastAuthenticatedAt: Math.floor(Date.now() / 1000),\n });\n return {\n sessionId: session.sessionId,\n state: session.state,\n nextStep: session.nextStep,\n organizationId: session.organizationId,\n accessToken: tokenResult.accessToken,\n refreshToken: tokenResult.refreshToken,\n expiresIn: tokenResult.expiresIn,\n };\n }\n\n return {\n sessionId: session.sessionId,\n state: session.state,\n nextStep: session.nextStep,\n organizationId: session.organizationId,\n };\n }\n}\n"]}
1	+ {"version":3,"file":"auth-registration.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/auth-registration.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,gFAAgF,CAAC;AAE/H,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AAExI,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AACvI,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,gCAAgC,EAAE,MAAM,iGAAiG,CAAC;AACnJ,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAChJ,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AACzJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAIzH,OAAO,EACL,6BAA6B,EAC7B,0CAA0C,GAC3C,MAAM,+EAA+E,CAAC;AACvF,OAAO,EACL,uBAAuB,EACvB,0CAA0C,EAC1C,iCAAiC,EACjC,oCAAoC,GACrC,MAAM,sFAAsF,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,2EAA2E,CAAC;AAC9G,OAAO,EACL,yDAAyD,EACzD,kDAAkD,EAClD,wCAAwC,GACzC,MAAM,4FAA4F,CAAC;AACpG,OAAO,EAAE,wCAAwC,EAAE,MAAM,kGAAkG,CAAC;AAK5J,OAAO,EACL,wBAAwB,EAExB,gBAAgB,EAChB,SAAS,EACT,2BAA2B,EAG3B,UAAU,EACV,cAAc,EACd,UAAU,EACV,YAAY,EACZ,kBAAkB,EAClB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EACxB,8BAA8B,EAC9B,wBAAwB,EACxB,gCAAgC,EAChC,iBAAiB,EACjB,aAAa,EACb,8BAA8B,EAC9B,gBAAgB,EAChB,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAqB,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AA8DhG;;;;;GAKG;AACH,MAAM,CAAN,IAAY,uBAKX;AALD,WAAY,uBAAuB;IACjC,mGAAmG;IACnG,8CAAmB,CAAA;IACnB,uEAAuE;IACvE,8DAAmC,CAAA;AACrC,CAAC,EALW,uBAAuB,KAAvB,uBAAuB,QAKlC;AAsDM,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;IAIa;IACa;IACH;IACM;IACA;IACP;IACM;IACI;IACD;IACR;IACc;IACG;IAKd;IAMQ;IAIZ;IAIkB;IAIT;IAErD;IAvCF,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EAC3C,gBAAyC,EACnC,sBAAqD,EACrD,kBAAwD,EAC/D,WAA0C,EACpC,UAAwC,EACpC,kBAAoD,EACrD,YAA6C,EACrD,gBAAyC,EAC3B,uBAA8D,EAC3D,gBAA0D,EAKxE,mBAA+C,EAMvC,aAAwD,EAIpE,eAAuC,EAIrB,0BAAoE,EAI7E,iBAAkD,EAEvG,6BAC4B;QArCO,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC3C,qBAAgB,GAAhB,gBAAgB,CAAyB;QACnC,2BAAsB,GAAtB,sBAAsB,CAA+B;QACrD,uBAAkB,GAAlB,kBAAkB,CAAsC;QAC/D,gBAAW,GAAX,WAAW,CAA+B;QACpC,eAAU,GAAV,UAAU,CAA8B;QACpC,uBAAkB,GAAlB,kBAAkB,CAAkC;QACrD,iBAAY,GAAZ,YAAY,CAAiC;QACrD,qBAAgB,GAAhB,gBAAgB,CAAyB;QAC3B,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC3D,qBAAgB,GAAhB,gBAAgB,CAA0C;QAKxE,wBAAmB,GAAnB,mBAAmB,CAA4B;QAMvC,kBAAa,GAAb,aAAa,CAA2C;QAIpE,oBAAe,GAAf,eAAe,CAAwB;QAIrB,+BAA0B,GAA1B,0BAA0B,CAA0C;QAI7E,sBAAiB,GAAjB,iBAAiB,CAAiC;QAEvG,kCAA6B,GAA7B,6BAA6B,CACD;QAE7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,iBAAiB,CACrB,EAAyB,EACzB,eAAuB;QAEvB,oFAAoF;QACpF,8FAA8F;QAC9F,kGAAkG;QAClG,uGAAuG;QACvG,sEAAsE;QACtE,IAAI,WAAW,CAAC;QAChB,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAC3D,eAAe,EACf,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,CAC1D,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,CAAC;QAC3C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,+EAA+E;QAC/E,2EAA2E;QAC3E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACxD,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,CACjE,CAAC;QACF,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,wBAAwB,CAAC,OAAO,EAAE,CAAC;YAC1E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QACjD,MAAM,YAAY,GAAG,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAEhE,6FAA6F;QAC7F,4FAA4F;QAC5F,kGAAkG;QAClG,mGAAmG;QACnG,iGAAiG;QACjG,+FAA+F;QAC/F,EAAE;QACF,gGAAgG;QAChG,sFAAsF;QACtF,uFAAuF;QACvF,4FAA4F;QAC5F,+CAA+C;QAC/C,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;QACvH,MAAM,gBAAgB,GAAG,eAAe,IAAI,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,kBAAkB,GAAG,eAAe,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QAEtE,gFAAgF;QAChF,oFAAoF;QACpF,4EAA4E;QAC5E,kFAAkF;QAClF,8DAA8D;QAC9D,MAAM,cAAc,GAAG,kBAAkB;YACvC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,2BAA2B,CAAC,kBAAkB,EAAE,OAAO,CAAC;YAC1E,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,gBAAgB,GAAG,CACvB,cAAc;eACX,CAAC,cAAc,CAAC,YAAY,CAAC,cAAc,CAAC,QAAQ,CACrD,UAAU,CAAC,QAAQ,CACpB,CACF;YACC,CAAC,CAAC;gBACE,GAAG,cAAc;gBACjB,kBAAkB,EAAE;oBAClB,GAAG,cAAc,CAAC,kBAAkB;oBACpC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,KAAK;iBAC7B;aACF;YACH,CAAC,CAAC,cAAc,CAAC;QACnB,MAAM,cAAc,GAAG,gBAAgB;YACrC,CAAC,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;YACxD,CAAC,CAAC,IAAI,GAAG,EAAc,CAAC;QAE1B,2EAA2E;QAC3E,gFAAgF;QAChF,oFAAoF;QACpF,kFAAkF;QAClF,oFAAoF;QACpF,oFAAoF;QACpF,oFAAoF;QACpF,MAAM,YAAY,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;YACjH,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,EAAE,EAAE,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC;YAC7F,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,2BAA2B,GAAG,gBAAgB;YAClD,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,gCAAgC,CAAC,EAAE,EAAE,gBAAgB,EAAE,YAAY,CAAC;YAClG,CAAC,CAAC,EAAE,CAAC;QAEP,mFAAmF;QACnF,wFAAwF;QACxF,mFAAmF;QACnF,wFAAwF;QACxF,qFAAqF;QACrF,wFAAwF;QACxF,qFAAqF;QACrF,4FAA4F;QAC5F,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,6BAA6B,CAAC;gBAChD,cAAc;gBACd,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;gBACzC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,KAAK,CAAC;QACtB,CAAC;QACD,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;QAC/G,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,cAAc,GAAG,WAAW;YAChC,CAAC,CAAC,wBAAwB,CAAC,IAAI;YAC/B,CAAC,CAAC,SAAS,IAAI,CAAC,WAAW;gBACzB,CAAC,CAAC,wBAAwB,CAAC,GAAG;gBAC9B,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC;QAEpC,kFAAkF;QAClF,oFAAoF;QACpF,sFAAsF;QACtF,wFAAwF;QACxF,wFAAwF;QACxF,qFAAqF;QACrF,OAAO,gCAAgC,CAAC,KAAK,CAAC;YAC5C,YAAY;YACZ,gBAAgB;YAChB,2BAA2B;YAC3B,cAAc;YACd,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;gBACrD,CAAC,CAAC,gBAAgB,EAAE,cAAc;gBAClC,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,KAAK,CAAC,YAAY,CAChB,EAAyB,EACzB,MAA0B,EAC1B,GAAwB;QAExB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;QAC1E;;;WAGG;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC;QACpD;;;;;;;;;;;WAWG;QACH,MAAM,oBAAoB,GAAG,MAAM,KAAK,UAAU,CAAC,UAAU,IAAI,MAAM,KAAK,UAAU,CAAC,OAAO,CAAC;QAC/F,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,mBAAmB,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC;QACvF,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,CAAC;QAE7G,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAEjE,2DAA2D;QAC3D,yDAAyD;QACzD,uDAAuD;QACvD,6DAA6D;QAC7D,+DAA+D;QAC/D,6DAA6D;QAC7D,yDAAyD;QACzD,gEAAgE;QAChE,8DAA8D;QAC9D,8DAA8D;QAC9D,oDAAoD;QACpD,+DAA+D;QAC/D,4DAA4D;QAC5D,0DAA0D;QAC1D,eAAe;QAEf,2FAA2F;QAC3F,MAAM,kBAAkB,GAAG,cAAc;YACvC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,cAAc,CAAC;YAC7D,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,mBAAmB,IAAI,cAAc,EAAE,CAAC;YAC1C,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,CAAC,qCAAqC,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC;YACxH,IAAI,cAAc,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;oBACzE,OAAO,EAAE;wBACP,mEAAmE;wBACnE,mBAAmB;wBACnB,cAAc;qBACf;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAE5C,MAAM,kBAAkB,GAAG,kBAAkB,EAAE,YAAY,CAAC;QAC5D,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;aAC1E,CAAC,CAAC;QACL,CAAC;QAED,yFAAyF;QACzF,0FAA0F;QAC1F,4FAA4F;QAC5F,4FAA4F;QAC5F,gGAAgG;QAChG,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,IAAI,CAAC;QACjD,IAAI,CAAC,gCAAgC,CACnC,gBAAgB,EAChB,8BAA8B,CAAC,mBAAmB,CACnD,EAAE,CAAC;YACF,oGAAoG;YACpG,MAAM,4BAA4B,GAA0D;gBAC1F,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,2BAA2B,CAAC,qBAAqB;gBAC1E,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,2BAA2B,CAAC,4BAA4B;gBAC5F,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,2BAA2B,CAAC,uBAAuB;gBAClF,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,2BAA2B,CAAC,qBAAqB;aAC/E,CAAC;YACF,8FAA8F;YAC9F,gGAAgG;YAChG,0FAA0F;YAC1F,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EACpB,4BAA4B,CAAC,gBAAgB,CAAC,IAAI,2BAA2B,CAAC,qBAAqB;aACtG,CAAC,CAAC;QACL,CAAC;QAED,uEAAuE;QACvE,2EAA2E;QAC3E,MAAM,2BAA2B,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE;YACvE,CAAC,CAAC,MAAM,CAAC,iBAAiB;YAC1B,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,eAAe,GAAG,cAAc;YACpC,CAAC,CAAC,oCAAoC,CAAC;gBACnC,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE;gBAC9B,cAAc;gBACd,gBAAgB;gBAChB,iBAAiB,EAAE,2BAA2B;aAC/C,CAAC;YACJ,CAAC,CAAC;gBACE,IAAI,EAAE,iCAAiC,CAAC,IAAI;aACpC,CAAC;QACf,IAAI,eAAe,CAAC,IAAI,KAAK,iCAAiC,CAAC,OAAO,EAAE,CAAC;YACvE,IACE,eAAe,CAAC,MAAM;oBAClB,0CAA0C;qBAC3C,kCAAkC,EACrC,CAAC;gBACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,iBAAiB;oBACrE,OAAO,EAAE;wBACP,gBAAgB,EAAE,eAAe,CAAC,OAAO;qBAC1C;iBACF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,MAAM,EACJ,mEAAmE;oBACrE,cAAc;oBACd,gBAAgB,EAAE,eAAe,CAAC,gBAAgB;iBACnD;aACF,CAAC,CAAC;QACL,CAAC;QAED,kEAAkE;QAClE,2EAA2E;QAC3E,uCAAuC;QACvC,MAAM,uBAAuB,GAC3B,eAAe,CAAC,IAAI,KAAK,iCAAiC,CAAC,IAAI;YAC7D,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,2BAA2B,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,4BAA4B,GAAG,2BAA2B,CAC9D,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EACpE,uBAAuB,EAAE,SAAS,IAAI,EAAE,EACxC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,EACtC,8BAA8B,CAAC,mBAAmB,CACnD,CAAC;QACF,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;gBACzE,OAAO,EAAE;oBACP,OAAO,EAAE,8BAA8B,CAAC,mBAAmB;oBAC3D,eAAe,EAAE,4BAA4B,CAAC,eAAe;iBAC9D;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,cAAc,CAAC;QACzD,gGAAgG;QAChG,6DAA6D;QAC7D,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;gBACvF,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;QAED;;;;WAIG;QACH,IAAI,MAAM,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EACpB,2BAA2B,CAAC,8BAA8B;iBAC7D,CAAC,CAAC;YACL,CAAC;YACD,MAAM,cAAc,GAAG,kBAAkB,EAAE,cAAc,CAAC;YAC1D,MAAM,gBAAgB,GACpB,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAC5C,QAAQ,EACR,cAAc,CACf,CAAC;YACJ,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EACpB,2BAA2B;yBACxB,oCAAoC;oBACzC,OAAO,EAAE;wBACP,UAAU,EAAE,gBAAgB,CAAC,UAAU;wBACvC,SAAS,EAAE,cAAc,EAAE,SAAS;wBACpC,SAAS,EAAE,cAAc,EAAE,SAAS;qBACrC;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAClE,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,8EAA8E,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACzG,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,yDAAyD;QACzD,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBACzE,IAAI,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;oBAC1C,IAAI,CAAC,QAAQ,CAAC,2CAA2C,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC9E,OAAO,EAAE,GAAG,eAAe,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;gBACvD,CAAC;YACH,CAAC;QACH,CAAC;QAED,2FAA2F;QAC3F,6FAA6F;QAC7F,MAAM,YAAY,GAAG,MAAM,KAAK,UAAU,CAAC,QAAQ,IAAI,QAAQ;YAC7D,CAAC,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;YACnF,CAAC,CAAC,SAAS,CAAC;QAEd,+EAA+E;QAC/E,MAAM,sBAAsB,GAAG,kBAAkB,CAAC,iBAAiB,KAAK,qBAAqB,CAAC,QAAQ,CAAC;QAEvG;;;;;;;;;;;;;;;;;;;WAmBG;QACH,MAAM,sBAAsB,GAAG,oBAAoB;YACjD,CAAC,CAAC,UAAU,CAAC,MAAM;YACnB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;QACnF,MAAM,aAAa,GAAG,sBAAsB,CAAC;QAE7C,mFAAmF;QACnF,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,kBAAkB,GAAG,cAAc;YACvC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,cAAc,CAAC;YACpC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,eAAe,GAAG,kBAAkB,EAAE,eAAe,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACzF,IAAI,OAAa,CAAC;QAClB,IAAI,cAAkC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,uBAAuB,GAC3B,MAAM,IAAI,CAAC,6BAA6B,CAAC,kBAAkB,CACzD,wCAAwC,CAAC;gBACvC,kBAAkB,EAAE,YAAY,KAAK,SAAS;gBAC9C,sCAAsC,EACpC,eAAe,CAAC,IAAI;wBAChB,iCAAiC,CAAC,WAAW;aACpD,CAAC,EACF,KAAK,EAAC,cAAc,EAAC,EAAE;gBACzB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAC3D,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF;oBACE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;oBAC1B,MAAM,EAAE,aAAa;oBACrB,QAAQ,EAAE,eAAe;oBACzB,SAAS;iBACV,EACD;oBACE,GAAG,cAAc;oBACjB,wEAAwE;oBACxE,0FAA0F;oBAC1F,wFAAwF;oBACxF,kFAAkF;oBAClF,sFAAsF;oBACtF,gFAAgF;oBAChF,EAAE;oBACF,yFAAyF;oBACzF,yFAAyF;oBACzF,yFAAyF;oBACzF,yFAAyF;oBACzF,yBAAyB;oBACzB,4BAA4B,EAAE;wBAC5B,GAAG,CAAC,cAAc,EAAE,4BAA4B,IAAI,EAAE,CAAC;wBACvD,UAAU;qBACX;iBACF,CACF,CAAC;gBAEF,IAAI,YAAY,EAAE,CAAC;oBACjB,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC3C,gBAAgB,CAAC,gBAAgB,EACjC;wBACE,MAAM,EAAE,WAAW,CAAC,GAAG;wBACvB,YAAY;qBACb,EACD,cAAc,CACf,CAAC;gBACJ,CAAC;gBAED,IAAI,eAAmC,CAAC;gBACxC,IAAI,cAAc,IAAI,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAAC;oBAC5D,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,CAAC;oBACzE,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,EAAE,EAAE;wBAClD,MAAM,EAAE,WAAW,CAAC,GAAG;wBACvB,SAAS,EAAE,WAAW,CAAC,KAAK;wBAC5B,cAAc;wBACd,gBAAgB;wBAChB,iBAAiB;wBACjB,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;wBACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;wBAC7C,cAAc;wBACd,IAAI,EAAE,eAAe;qBACtB,CAAC,CAAC;oBACH,IAAI,SAAS,CAAC,iBAAiB,EAAE,CAAC;wBAChC,eAAe,GAAG,SAAS,CAAC,OAAO,CAAC;oBACtC,CAAC;gBACH,CAAC;gBACD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;YACtC,CAAC,EACD;gBACE,4DAA4D;gBAC5D,oEAAoE;gBACpE,oEAAoE;gBACpE,2BAA2B,EAAE;oBAC3B,SAAS;oBACT,QAAQ;oBACR,WAAW,EAAE,GAAG,SAAS,IAAI,QAAQ,EAAE;iBACxC;aACF,CACF,CAAC;YACJ,OAAO,GAAG,uBAAuB,CAAC,WAAW,CAAC;YAC9C,cAAc,GAAG,uBAAuB,CAAC,eAAe,CAAC;QAC3D,CAAC;QAAC,OAAO,WAAgB,EAAE,CAAC;YAC1B,IACE,CAAC,mBAAmB,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,UAAU,KAAK,GAAG,CAAC;mBACjE,WAAW,EAAE,IAAI,KAAK,KAAK;mBAC3B,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,eAAe,CAAC;mBAC/C,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAC3C,CAAC;gBACD,uEAAuE;gBACvE,yEAAyE;gBACzE,qEAAqE;gBACrE,wEAAwE;gBACxE,8BAA8B;gBAC9B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAC1D,EAAE,EACF,KAAK,CACN,CAAC;gBACF,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,CAAC,QAAQ,CACX,qFAAqF,EACrF;wBACE,KAAK;wBACL,aAAa,EAAE,WAAW,CAAC,GAAG;qBAC/B,CACF,CAAC;oBACF,OAAO,eAAe,CAAC;gBACzB,CAAC;YACH,CAAC;YACD,MAAM,WAAW,CAAC;QACpB,CAAC;QAED,uEAAuE;QACvE,6DAA6D;QAC7D,2EAA2E;QAC3E,6EAA6E;QAC7E,+EAA+E;QAE/E,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,CAAC,qCAAqC,EAAE;gBACnD,MAAM,EAAE,OAAO,CAAC,GAAG;gBACnB,OAAO,EAAE,cAAc;aACxB,CAAC,CAAC;QACL,CAAC;QAED,2FAA2F;QAC3F,0FAA0F;QAC1F,gGAAgG;QAChG,gGAAgG;QAChG,mCAAmC;QACnC,IAAI,CAAC,sBAAsB,IAAI,CAAC,oBAAoB,EAAE,CAAC;YACrD,MAAM,IAAI,CAAC,0BAA0B,CAAC,qBAAqB,CAAC;gBAC1D,MAAM,EAAE,OAAO,CAAC,GAAG;gBACnB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS;gBACT,eAAe,EAAE,WAAW;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAEjI;;;;;;;;;;;;WAYG;QACH,IAAI,oBAAoB,EAAE,CAAC;YACzB;;;;;;eAMG;YACH,IAAI,MAAM,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,mCAAmC,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;gBAClE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sFAAsF,EAAE;wBACxG,MAAM,EAAE,OAAO,CAAC,GAAG;wBACnB,GAAG,2BAA2B,CAAC,KAAK,CAAC;qBACtC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED;;;;;eAKG;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CACrD,EAAE,EACF,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EACxB,EAAE,SAAS,EAAE,SAAS,EAAE,EACxB,IAAI,CACL,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,uEAAuE,EAAE;gBACrF,MAAM,EAAE,OAAO,CAAC,GAAG;gBACnB,MAAM;gBACN,6FAA6F;gBAC7F,8FAA8F;gBAC9F,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;aAC/B,CAAC,CAAC;YAEH,OAAO;gBACL,GAAG,eAAe;gBAClB;;;;mBAIG;gBACH,QAAQ,EAAE,MAAM,KAAK,UAAU,CAAC,OAAO;oBACrC,CAAC,CAAC,YAAY,CAAC,kBAAkB;oBACjC,CAAC,CAAC,YAAY,CAAC,eAAe;aACjC,CAAC;QACJ,CAAC;QAED,+EAA+E;QAC/E,+EAA+E;QAC/E,qEAAqE;QACrE,IAAI,sBAAsB,EAAE,CAAC;YAC3B,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAC1E,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,cAAc,EAC9C,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,kBAAkB,CAAC,YAAY,CAC1D,CAAC;YAEF,IAAI,eAAe,CAAC,KAAK,KAAK,0BAA0B,CAAC,SAAS,IAAI,eAAe,CAAC,KAAK,KAAK,0BAA0B,CAAC,oBAAoB,EAAE,CAAC;gBAChJ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE;oBACpF,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;iBACnD,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,+DAA+D,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBACxG,OAAO;oBACL,GAAG,eAAe;oBAClB,SAAS,EAAE,eAAe,CAAC,SAAS;oBACpC,KAAK,EAAE,eAAe,CAAC,KAAK;oBAC5B,OAAO,EAAE,eAAe,CAAC,OAAO;oBAChC,oEAAoE;oBACpE,iEAAiE;oBACjE,6DAA6D;oBAC7D,qEAAqE;oBACrE,qDAAqD;oBACrD,MAAM,EAAE,OAAO,CAAC,GAAG;oBACnB,WAAW,EAAE,WAAW,CAAC,WAAW;oBACpC,YAAY,EAAE,WAAW,CAAC,YAAY;oBACtC,SAAS,EAAE,WAAW,CAAC,SAAS;iBACjC,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,iFAAiF,EAAE;gBAC/F,MAAM,EAAE,OAAO,CAAC,GAAG;gBACnB,KAAK,EAAE,eAAe,CAAC,KAAK;gBAC5B,QAAQ,EAAE,eAAe,CAAC,QAAQ;aACnC,CAAC,CAAC;YACH,OAAO;gBACL,GAAG,eAAe;gBAClB,SAAS,EAAE,eAAe,CAAC,SAAS;gBACpC,KAAK,EAAE,eAAe,CAAC,KAAK;gBAC5B,OAAO,EAAE,eAAe,CAAC,OAAO;gBAChC,QAAQ,EAAE,eAAe,CAAC,QAAQ;aACnC,CAAC;QACJ,CAAC;QAED,+EAA+E;QAC/E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CACtE,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,KAAK,EACb;YACE,cAAc;YACd,OAAO,EAAE,kBAAkB,CAAC,YAAY;YACxC,UAAU,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE;YACpC,cAAc;SACf,CACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,sDAAsD,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;QAChI,OAAO;YACL,GAAG,eAAe;YAClB,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,OAAO,EAAE,UAAU,CAAC,OAAO;SAC5B,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CACf,EAAyB,EACzB,MAAyB;QAczB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;QAEpE,IAAI,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC;QAE9C,IAAI,aAAa,CAAC;QAClB,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,aAAa,CAAC,SAAS,KAAK,wBAAwB,CAAC,kBAAkB,EAAE,CAAC;YAC5E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC;QAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,aAAa,CAAC,QAA+C,CAAC;QAC/E,MAAM,aAAa,GAAG,QAAQ,EAAE,KAA2B,CAAC;QAE5D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wEAAwE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACvG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/D,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC;QAChE,IAAI,aAAa,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;YAC/G,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACzG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAE/F,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;aAClF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,yCAAyC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACvE,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,oBAAoB,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;aACnF,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,6FAA6F;YAC7F,8FAA8F;YAC9F,8FAA8F;YAC9F,kFAAkF;YAClF,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7G,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,IAAI,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,MAAM,EAAE,wBAAwB,CAAC,kBAAkB,CAAC,CAAC;QAE/G,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAE9H,gFAAgF;QAChF,sEAAsE;QACtE,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAClE,EAAE,EACF,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,KAAK,EACV,cAAc,EACd,EAAE,SAAS,EAAE,SAAS,EAAE,CACzB,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,iDAAiD,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAE/H,wDAAwD;QACxD,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,IAAI,OAAO,CAAC,KAAK,KAAK,sBAAsB,EAAE,CAAC;YAC9E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE;gBACjF,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;aACnD,CAAC,CAAC;YACH,OAAO;gBACL,MAAM;gBACN,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,YAAY,CAAC,QAAQ;gBACnD,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,YAAY,EAAE,WAAW,CAAC,YAAY,IAAI,EAAE;gBAC5C,SAAS,EAAE,WAAW,CAAC,SAAS,IAAI,IAAI;gBACxC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;aAC7C,CAAC;QACJ,CAAC;QAED,oFAAoF;QACpF,OAAO;YACL,MAAM;YACN,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,YAAY,CAAC,cAAc;YACzD,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,uBAAuB,CAC3B,EAAyB,EACzB,MAAgC;QAEhC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;QAC5D,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,sBAAsB,CAAC,2BAA2B,CAAC,CAAC;QAEpH,IAAI,CAAC,QAAQ,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAEhE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAEjE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,oBAAoB,EAAE,CAAC;gBAC7D,IAAI,CAAC,QAAQ,CAAC,4FAA4F,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvH,OAAO,eAAe,CAAC;YACzB,CAAC;YAED,2FAA2F;YAC3F,MAAM,IAAI,CAAC,0BAA0B,CAAC,qBAAqB,CAAC;gBAC1D,MAAM,EAAE,IAAI,CAAC,GAAG;gBAChB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,eAAe,EAAE,WAAW;gBAC5B,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;YAEH,IAAI,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtI,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE;gBACrE,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,KAAK,CAAC,gBAAgB,CACpB,EAAyB,EACzB,MAA8B;QAE9B,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;QAE1G,2FAA2F;QAC3F,0FAA0F;QAC1F,0FAA0F;QAC1F,sFAAsF;QACtF,mFAAmF;QACnF,+FAA+F;QAC/F,EAAE;QACF,mGAAmG;QACnG,uGAAuG;QACvG,oGAAoG;QACpG,oGAAoG;QACpG,qGAAqG;QACrG,mGAAmG;QACnG,8FAA8F;QAC9F,iGAAiG;QACjG,kGAAkG;QAClG,gDAAgD;QAChD,EAAE;QACF,8FAA8F;QAC9F,4FAA4F;QAC5F,sGAAsG;QACtG,yFAAyF;QACzF,EAAE;QACF,kGAAkG;QAClG,oGAAoG;QACpG,kGAAkG;QAClG,kGAAkG;QAClG,6FAA6F;QAC7F,kGAAkG;QAClG,sGAAsG;QACtG,oGAAoG;QACpG,sGAAsG;QACtG,qGAAqG;QACrG,oGAAoG;QACpG,qEAAqE;QACrE,+FAA+F;QAC/F,yFAAyF;QACzF,uGAAuG;QACvG,qGAAqG;QACrG,uGAAuG;QACvG,qGAAqG;QACrG,sGAAsG;QACtG,qGAAqG;QACrG,gGAAgG;QAChG,uGAAuG;QACvG,6FAA6F;QAC7F,qBAAqB;QACrB,IAAI,WAAW,CAAC;QAChB,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAC3D,eAAe,EACf,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,CAC1D,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,IAAI,WAAW,CAAC,SAAS,KAAK,wBAAwB,CAAC,8BAA8B,EAAE,CAAC;YACtF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,CAAC;QAC3C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,8EAA8E;QAC9E,8EAA8E;QAC9E,MAAM,YAAY,GAAG,YAAY,CAAC;QAClC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAqB,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;QACjJ,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,wBAAwB,CAAC,OAAO,EAAE,CAAC;YAC1E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QACjD,MAAM,eAAe,GAAG,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAEnE,wFAAwF;QACxF,iFAAiF;QACjF,IAAI,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,+EAA+E;YAC/E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,yFAAyF;QACzF,uFAAuF;QACvF,IACE,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;YACjC,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,oBAAoB;YAC/C,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,kBAAkB,EAC7C,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;gBAClF,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE;aACvD,CAAC,CAAC;QACL,CAAC;QAED,oFAAoF;QACpF,mFAAmF;QACnF,4BAA4B;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,kBAAkB,CAAC;QAEhE,mGAAmG;QACnG,mGAAmG;QACnG,kGAAkG;QAClG,oGAAoG;QACpG,gGAAgG;QAChG,gGAAgG;QAChG,oGAAoG;QACpG,+FAA+F;QAC/F,2FAA2F;QAC3F,IAAI,CAAC,SAAS,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE;oBACP,mFAAmF;oBACnF,cAAc;iBACf;aACF,CAAC,CAAC;QACL,CAAC;QAED,8FAA8F;QAC9F,kFAAkF;QAClF,0FAA0F;QAC1F,+EAA+E;QAC/E,iGAAiG;QACjG,kGAAkG;QAClG,kGAAkG;QAClG,oGAAoG;QACpG,oGAAoG;QACpG,oFAAoF;QACpF,gGAAgG;QAChG,kEAAkE;QAClE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;QACnG,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QAE9D,iGAAiG;QACjG,mGAAmG;QACnG,qGAAqG;QACrG,sGAAsG;QACtG,qEAAqE;QACrE,oGAAoG;QACpG,+FAA+F;QAC/F,oGAAoG;QACpG,gFAAgF;QAChF,sGAAsG;QACtG,2BAA2B;QAC3B,6FAA6F;QAC7F,+EAA+E;QAC/E,mGAAmG;QACnG,oFAAoF;QACpF,MAAM,2BAA2B,GAC/B,gBAAgB,KAAK,UAAU,CAAC,UAAU,IAAI,gBAAgB,KAAK,UAAU,CAAC,OAAO;YACnF,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,2BAA2B,EAAE,CAAC;YAChC,IAAI,aAAa,EAAE,CAAC;gBAClB,2FAA2F;gBAC3F,gGAAgG;gBAChG,iGAAiG;gBACjG,mGAAmG;gBACnG,gGAAgG;gBAChG,wFAAwF;gBACxF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;oBAChE,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;oBACtF,OAAO,EAAE;wBACP,gFAAgF;wBAChF,8EAA8E;wBAC9E,cAAc;qBACf;iBACF,CAAC,CAAC;YACL,CAAC;YACD,kFAAkF;YAClF,6DAA6D;YAC7D,kEAAkE;YAClE,4EAA4E;YAC5E,gFAAgF;YAChF,gFAAgF;YAChF,4EAA4E;YAC5E,mEAAmE;YACnE,IAAI,wBAAiC,CAAC;YACtC,IAAI,CAAC;gBACH,wBAAwB,GAAG,MAAM,6BAA6B,CAAC;oBAC7D,cAAc;oBACd,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;oBACzC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;iBAC9C,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,4EAA4E;gBAC5E,+EAA+E;gBAC/E,6EAA6E;gBAC7E,8EAA8E;gBAC9E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iEAAiE,EAAE;oBAClF,cAAc;oBACd,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;oBAChE,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;oBACtF,OAAO,EAAE,EAAE,cAAc,EAAE;iBAC5B,CAAC,CAAC;YACL,CAAC;YACD,IAAI,wBAAwB,EAAE,CAAC;gBAC7B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,sBAAsB,EAAE,2BAA2B,CAAC,4CAA4C;oBAChG,OAAO,EAAE;wBACP,qFAAqF;wBACrF,cAAc;qBACf;iBACF,CAAC,CAAC;YACL,CAAC;YACD,6FAA6F;YAC7F,4FAA4F;YAC5F,MAAM,kBAAkB,GAAG,eAAe,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC,wCAAwC,CAAC,cAAc,EAAE,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,CAAC,CAAC;QAC1H,CAAC;QAED,+FAA+F;QAC/F,4FAA4F;QAC5F,4FAA4F;QAC5F,+FAA+F;QAC/F,iGAAiG;QACjG,yFAAyF;QACzF,oFAAoF;QACpF,6CAA6C;QAC7C,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;YAC1B,MAAM,cAAc,GAAG,CAAC,cAAc;gBACpC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,2BAA2B,CAAC,cAAc,EAAE,OAAO,CAAC;gBACtE,CAAC,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC;YAC1B,MAAM,gBAAgB,GAAG,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;YAClG,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;oBACxF,OAAO,EAAE,EAAE,UAAU,EAAE,gBAAgB,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;iBACjI,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4FAA4F;QAC5F,8FAA8F;QAC9F,gCAAgC;QAChC,MAAM,0CAA0C,CAAC;YAC/C,IAAI;YACJ,cAAc;YACd,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;SAC9C,CAAC,CAAC;QAEH,2EAA2E;QAC3E,2EAA2E;QAC3E,MAAM,cAAc,GAAG,SAAS,IAAI,QAAQ;YAC1C,CAAC,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAC1C,QAAQ,EACR,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAClD;YACD,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,kBAAkB,CAChE,kDAAkD,CAAC;gBACjD,kBAAkB,EAAE,cAAc,KAAK,SAAS;aACjD,CAAC,EACF,KAAK,EAAC,cAAc,EAAC,EAAE;gBACvB,wEAAwE;gBACxE,0EAA0E;gBAC1E,0EAA0E;gBAC1E,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAC5C,eAAe,EACf,cAAc,CAAC,WAAY,CAC5B,CAAC;gBAEF,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CACnE,gBAAgB,CAAC,oBAAoB,EACrC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,EACvB,cAAc,CACf,CAAC;gBACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACzD,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EACjB,cAAc,CACf,CAAC;gBACF,IACE,CAAC,iBAAiB;uBACf,CACD,iBAAiB,CAAC,MAAM,KAAK,wBAAwB,CAAC,OAAO;2BAC1D,iBAAiB,CAAC,MAAM,KAAK,wBAAwB,CAAC,MAAM,CAChE;uBACE,iBAAiB,CAAC,MAAM,KAAK,IAAI,CAAC,GAAG;uBACrC,CAAC,WAAW;uBACZ,WAAW,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EACrC,CAAC;oBACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;qBAC/E,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,cAAc,EAAE,CAAC;oBACnB,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAChE,gBAAgB,CAAC,gBAAgB,EACjC,EAAE,EACF,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,EAC3B,cAAc,CACf,CAAC;oBACF,IAAI,kBAAkB,EAAE,CAAC;wBACvB,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAC9C,EAAE,EACF,WAAW,CAAC,GAAG,EACf,cAAc,EACd,cAAc,CACf,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC3C,gBAAgB,CAAC,gBAAgB,EACjC;4BACE,MAAM,EAAE,WAAW,CAAC,GAAG;4BACvB,YAAY,EAAE,cAAc;yBAC7B,EACD,cAAc,CACf,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,IAAI,aAAa,GAAG,WAAW,CAAC;gBAChC,IACE,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC,kBAAkB;uBACjD,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC,oBAAoB,EACzD,CAAC;oBACD,yFAAyF;oBACzF,wFAAwF;oBACxF,sFAAsF;oBACtF,gFAAgF;oBAChF,EAAE;oBACF,0FAA0F;oBAC1F,2FAA2F;oBAC3F,4FAA4F;oBAC5F,0FAA0F;oBAC1F,YAAY;oBACZ,EAAE;oBACF,yFAAyF;oBACzF,oEAAoE;oBACpE,wFAAwF;oBACxF,uFAAuF;oBACvF,EAAE;oBACF,2FAA2F;oBAC3F,oFAAoF;oBACpF,qBAAqB;oBACrB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC3D,gBAAgB,CAAC,KAAK,EACtB,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,EACpD,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,EAC7B,cAAc,CACf,CAAC;oBACF,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;4BAChE,OAAO,EAAE;gCACP,MAAM,EAAE,sCAAsC;gCAC9C,MAAM,EAAE,WAAW,CAAC,GAAG;6BACxB;yBACF,CAAC,CAAC;oBACL,CAAC;oBACD,aAAa,GAAG,OAAO,CAAC;gBAC1B,CAAC;gBAED,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,6BAA6B,CAAC,EAAE,EAAE;oBACtE,UAAU,EAAE,iBAAiB;oBAC7B,IAAI,EAAE,aAAa;oBACnB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;oBACvC,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;oBACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;oBAC7C,cAAc;oBACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC,CAAC;gBACH,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBACzB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;qBAC/E,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,aAAa,CAAC;YACrB,CAAC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;gBAChE,YAAY,EAAE,UAAU,CAAC,GAAG;gBAC5B,MAAM,EAAE,IAAI,CAAC,GAAG;gBAChB,cAAc;gBACd,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC;oBAC5B,CAAC,CAAC;wBACA,SAAS,EAAE,KAAK,CAAC,IAAI;wBACrB,eAAe,EAAE,KAAK,CAAC,UAAU;wBACjC,YAAY,EAAE,KAAK,CAAC,OAAO;qBAC5B;oBACD,CAAC,CAAC;wBACA,YAAY,EAAE,mBAAmB,CAAC,KAAK,CAAC;qBACzC,CAAC;aACL,CAAC,CAAC;YACH,yEAAyE;YACzE,wEAAwE;YACxE,6EAA6E;YAC7E,mEAAmE;YACnE,IACE,mBAAmB,CAAC,KAAK,CAAC;mBACvB,CACD,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,cAAc;uBACpC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,QAAQ,CACrC,EACD,CAAC;gBACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;oBACE,sBAAsB,EACpB,2BAA2B,CAAC,0BAA0B;iBACzD,CACF,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,wEAAwE;YACxE,0EAA0E;YAC1E,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,aAAa,EAAE;oBAC5E,MAAM,EAAE,IAAI,CAAC,GAAG;oBAChB,SAAS;oBACT,QAAQ;oBACR,WAAW,EAAE,GAAG,SAAS,IAAI,QAAQ,EAAE;iBACxC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,YAAY,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wEAAwE,EAAE;oBAC1F,MAAM,EAAE,IAAI,CAAC,GAAG;oBAChB,GAAG,2BAA2B,CAAC,YAAY,CAAC;iBAC7C,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,qDAAqD,EAAE;gBACnE,MAAM,EAAE,IAAI,CAAC,GAAG;gBAChB,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QAED,0FAA0F;QAC1F,uFAAuF;QACvF,uFAAuF;QACvF,0FAA0F;QAC1F,+FAA+F;QAC/F,4FAA4F;QAC5F,8FAA8F;QAC9F,IAAI,gBAAgB,KAAK,UAAU,CAAC,UAAU,EAAE,CAAC;YAC/C,0FAA0F;YAC1F,8FAA8F;YAC9F,+FAA+F;YAC/F,6FAA6F;YAC7F,4DAA4D;YAC5D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;YACxH,IAAI,CAAC,QAAQ,CAAC,+DAA+D,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;YACrH,OAAO;gBACL,OAAO,EAAE,uBAAuB,CAAC,eAAe;gBAChD,iBAAiB,EAAE;oBACjB,mFAAmF;oBACnF,mFAAmF;oBACnF,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;oBACxB,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,KAAK,EAAE,eAAe;oBACtB,MAAM,EAAE,IAAI,CAAC,GAAG;oBAChB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;iBACzC;aACF,CAAC;QACJ,CAAC;QAED,iGAAiG;QACjG,8FAA8F;QAC9F,+FAA+F;QAC/F,kGAAkG;QAClG,iFAAiF;QACjF,IAAI,gBAAgB,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;YAC5C,4FAA4F;YAC5F,4FAA4F;YAC5F,0FAA0F;YAC1F,gCAAgC;YAChC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,mCAAmC,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gFAAgF,EAAE;oBAClG,MAAM,EAAE,IAAI,CAAC,GAAG;oBAChB,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CACnE,IAAI,CAAC,GAAG,EACR,eAAe,EACf;YACE,cAAc;YACd,OAAO,EAAE,kBAAkB,CAAC,UAAU;YACtC,UAAU,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE;SACrC,CACF,CAAC;QAEF,MAAM,eAAe,GAAG,SAAS;YAC/B,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,qBAAqB,CAAC;YAC5E,CAAC,CAAC,iBAAiB,CAAC,eAAe,CAAC;QACtC,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC;YACjC,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,KAAK,EAAE,eAAe;YACtB,UAAU,EAAE,eAAe;YAC3B,SAAS;YACT,SAAS;YACT,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;SACf,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,+BAA+B,CAAC,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAE3G,+CAA+C;QAC/C,sFAAsF;QACtF,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAC1E,EAAE,EACF,IAAI,CAAC,GAAG,EACR,eAAe,EACf,cAAc,EACd,EAAE,SAAS,EAAE,SAAS,EAAE,EACxB,kBAAkB,CAAC,UAAU,CAC9B,CAAC;QAEF,yCAAyC;QACzC,IAAI,eAAe,CAAC,KAAK,KAAK,WAAW,IAAI,eAAe,CAAC,KAAK,KAAK,sBAAsB,EAAE,CAAC;YAC9F,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE;gBACjF,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;aACnD,CAAC,CAAC;YAEH,4FAA4F;YAC5F,yFAAyF;YACzF,wFAAwF;YACxF,uFAAuF;YACvF,uFAAuF;YACvF,0FAA0F;YAC1F,sFAAsF;YACtF,wEAAwE;YACxE,IAAI,0BAA8E,CAAC;YACnF,IAAI,gBAAgB,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC5C,IAAI,CAAC;oBACH,0BAA0B,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,2BAA2B,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;gBACrH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8GAA8G,EAAE;wBAChI,MAAM,EAAE,IAAI,CAAC,GAAG;wBAChB,GAAG,2BAA2B,CAAC,KAAK,CAAC;qBACtC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,uBAAuB,CAAC,OAAO;gBACxC,SAAS,EAAE,eAAe,CAAC,SAAS;gBACpC,KAAK,EAAE,eAAe,CAAC,KAAK;gBAC5B,OAAO,EAAE,kBAAkB,CAAC,UAAU;gBACtC,QAAQ,EAAE,eAAe,CAAC,QAAQ;gBAClC,MAAM,EAAE,IAAI,CAAC,GAAG;gBAChB,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,YAAY,EAAE,WAAW,CAAC,YAAY;gBACtC,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,0BAA0B;aAC3B,CAAC;QACJ,CAAC;QAED,0FAA0F;QAC1F,6FAA6F;QAC7F,8FAA8F;QAC9F,mFAAmF;QACnF,OAAO;YACL,OAAO,EAAE,uBAAuB,CAAC,OAAO;YACxC,SAAS,EAAE,eAAe,CAAC,SAAS;YACpC,KAAK,EAAE,eAAe,CAAC,KAAK;YAC5B,OAAO,EAAE,kBAAkB,CAAC,UAAU;YACtC,QAAQ,EAAE,eAAe,CAAC,QAAQ;YAClC,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,WAAW,EAAE,IAAI;YACjB,0BAA0B,EAAE,eAAe,CAAC,0BAA0B;SACvE,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACK,KAAK,CAAC,uBAAuB,CACnC,UAAsD;QAEtD,IAAI,OAA2B,CAAC;QAChC,IAAI,gBAAoC,CAAC;QACzC,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CACrD,gBAAgB,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,cAAc,EAAE,CACnE,CAAC;YACF,OAAO,GAAG,GAAG,EAAE,IAAI,CAAC;YACpB,gBAAgB,GAAG,GAAG,EAAE,WAAW,IAAI,GAAG,EAAE,IAAI,IAAI,SAAS,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mGAAmG;YACnG,4FAA4F;YAC5F,kGAAkG;YAClG,yFAAyF;YACzF,+FAA+F;YAC/F,gGAAgG;YAChG,0DAA0D;YAC1D,aAAa,GAAG,IAAI,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,mGAAmG,EAAE;gBACjH,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,eAAe,GAAG,OAAO;YAC7B,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YAC3E,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC;IACvE,CAAC;IAED;;;;;;;;;OASG;IACK,wCAAwC,CAC9C,cAAsB,EACtB,OAA2B,EAC3B,kBAAsC,EACtC,gBAA4B;QAE5B,MAAM,cAAc,GAAG,kBAAkB;YACvC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,2BAA2B,CAAC,kBAAkB,EAAE,OAAO,CAAC;YAC1E,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,cAAc,GAAG,cAAc;YACnC,CAAC,CAAC,iBAAiB,CAAC,cAAc,CAAC,kBAAkB,CAAC;YACtD,CAAC,CAAC,IAAI,GAAG,EAAc,CAAC;QAC1B,MAAM,yBAAyB,GAC7B,gBAAgB,KAAK,UAAU,CAAC,QAAQ;eACrC,cAAc,EAAE,YAAY,CAAC,cAAc,CAAC,QAAQ,CACrD,UAAU,CAAC,QAAQ,CACpB,KAAK,IAAI,CAAC;QAEb;;;;;;;;;;;;;;;;WAgBG;QACH,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE;oBACP,mFAAmF;oBACnF,cAAc;oBACd,OAAO;oBACP,kBAAkB;oBAClB,MAAM,EAAE,gBAAgB;oBACxB,IAAI,EAAE,OAAO;wBACX,CAAC,CAAC,sIAAsI;wBACxI,CAAC,CAAC,oLAAoL;iBACzL;aACF,CAAC,CAAC;QACL,CAAC;QAED,IACE,CAAC,yBAAyB;eACvB,CAAC,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,EACxC,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;gBACvF,OAAO,EAAE;oBACP,oFAAoF;oBACpF,MAAM,EAAE,gBAAgB;oBACxB,cAAc;iBACf;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,mCAAmC,CAAC,EAAyB,EAAE,MAAc;QACzF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACtD,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAClD,CAAC;QACF,IAAI,QAAQ;YAAE,OAAO;QAErB,gGAAgG;QAChG,gGAAgG;QAChG,6FAA6F;QAC7F,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,QAAQ,CAAC,oEAAoE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAClG,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CACpB,EAAyB,EACzB,MAGC;QAED,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;QAEpD,sGAAsG;QACtG,mGAAmG;QACnG,+FAA+F;QAC/F,IAAI,WAAW,CAAC;QAChB,IAAI,CAAC;YACH,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,oDAAoD;YACpD,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAC3D,eAAe,EACf,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,CAC1D,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,CAAC;QAC3C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAC5D,gBAAgB,CAAC,oBAAoB,EACrC,EAAE,GAAG,EAAE,YAAY,EAAE,CACtB,CAAC;QACF,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,wBAAwB,CAAC,OAAO,EAAE,CAAC;YAC1E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,4BAA4B,CAAC,EAAE,EAAE;gBAC1C,UAAU;gBACV,eAAe;aAChB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,IACE,mBAAmB,CAAC,KAAK,CAAC;mBACvB,CACD,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,cAAc;uBACpC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,aAAa;uBACtC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,SAAS;uBAClC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,QAAQ,CACrC,EACD,CAAC;gBACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;oBACE,sBAAsB,EACpB,2BAA2B,CAAC,0BAA0B;iBACzD,CACF,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACK,KAAK,CAAC,4BAA4B,CACxC,GAA0B,EAC1B,EAAE,UAAU,EAAE,eAAe,EAAgE;QAE7F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,4BAA4B,CACpE,IAAI,CAAC,aAAa,CAAC,yCAAyC,EAAE,EAC9D,EAAE,gBAAgB,EAAE,UAAU,CAAC,MAAM,EAAE,CACxC,CAAC;QACF,MAAM,IAAI,CAAC,uBAAuB,CAAC,sBAAsB,CACvD,gBAAgB,CAAC,oBAAoB,EACrC,8BAA8B,CAAC,MAAM,EACrC,QAAQ,EACR,UAAU,CAAC,GAAG,EACd;YACE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,SAAS;SAC7C,CACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,kDAAkD,EAAE;YAChE,YAAY,EAAE,UAAU,CAAC,GAAG;YAC5B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,eAAe,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,SAAS;SACtD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,wBAAwB,CAC5B,GAA0B,EAC1B,MAAgC;QAEhC,sFAAsF;QACtF,0FAA0F;QAC1F,oFAAoF;QACpF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CACxD,gBAAgB,CAAC,oBAAoB,EACrC,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE,CAC1E,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QAEjE,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAgC,EAAE;YACpF,IAAI,gBAAoC,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CACrD,gBAAgB,CAAC,aAAa,EAC9B,EAAE,GAAG,EAAE,UAAU,CAAC,cAAc,EAAE,CACnC,CAAC;gBACF,gBAAgB,GAAG,GAAG,EAAE,WAAW,IAAI,GAAG,EAAE,IAAI,IAAI,SAAS,CAAC;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB,GAAG,SAAS,CAAC;YAC/B,CAAC;YACD,OAAO;gBACL,YAAY,EAAE,UAAU,CAAC,GAAG;gBAC5B,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,gBAAgB;gBAChB,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,EAAE;gBAC7B,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;aAC3F,CAAC;QACJ,CAAC,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CACtB,EAAyB,EACzB,MAAsD;QAEtD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAEnH,MAAM,IAAI,CAAC,6BAA6B,CAAC,kBAAkB,CACzD,yDAAyD,EAAE,EAC3D,KAAK,EAAC,cAAc,EAAC,EAAE;YACvB,sEAAsE;YACtE,gEAAgE;YAChE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC3D,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACnB,cAAc,CACf,CAAC;YACF,MAAM,iBAAiB,GACrB,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CACzC,gBAAgB,CAAC,oBAAoB,EACrC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,EACvB,cAAc,CACf,CAAC;YACJ,IACE,CAAC,aAAa;mBACX,CAAC,iBAAiB;mBAClB,iBAAiB,CAAC,MAAM,KAAK,aAAa,CAAC,GAAG;mBAC9C,iBAAiB,CAAC,MAAM,KAAK,wBAAwB,CAAC,OAAO,EAChE,CAAC;gBACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;iBAC/E,CAAC,CAAC;YACL,CAAC;YAED,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,6BAA6B,CAAC,EAAE,EAAE;gBACtE,UAAU,EAAE,iBAAiB;gBAC7B,IAAI,EAAE,aAAa;gBACnB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;gBACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,cAAc;gBACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YACH,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;iBAC/E,CAAC,CAAC;YACL,CAAC;QACD,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE;YAC1C,YAAY,EAAE,UAAU,CAAC,GAAG;YAC5B,MAAM,EAAE,MAAM,CAAC,GAAG;YAClB,cAAc,EAAE,UAAU,CAAC,cAAc;SAC1C,CAAC,CAAC;QAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CACtB,EAAyB,EACzB,MAAgF;QAEhF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAE3G,MAAM,IAAI,CAAC,4BAA4B,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;QAErG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC;IACvE,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,0BAA0B,CACtC,EAAyB,EACzB,YAAoB,EACpB,YAAoB;QAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE;gBAC/D,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;aAClF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAC5D,gBAAgB,CAAC,oBAAoB,EACrC,EAAE,GAAG,EAAE,YAAY,EAAE,CACtB,CAAC;QAEF,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;YACpD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE;gBAC9D,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;aACvF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,wBAAwB,CAAC,OAAO,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE;gBAC/D,sBAAsB,EAAE,2BAA2B,CAAC,0BAA0B;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,qBAAqB,CACzB,EAAyB,EACzB,MAGC;QAUD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAC/D,EAAE,EACF,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,gBAAgB,CACxB,CAAC;QAEF,IAAI,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAC7E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE;gBACvF,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;aACnD,CAAC,CAAC;YACH,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,YAAY,EAAE,WAAW,CAAC,YAAY;gBACtC,SAAS,EAAE,WAAW,CAAC,SAAS;aACjC,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC;IACJ,CAAC;CACF,CAAA;AApkEY,8BAA8B;IAD1C,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAC1C,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAChD,WAAA,MAAM,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAA;IACpD,WAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,YAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,YAAA,MAAM,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,CAAA;IAK5D,YAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAM9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IAItD,YAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAI1C,YAAA,MAAM,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,CAAA;IAI5D,YAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,YAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;qCAnCJ,aAAa;QACM,0BAA0B;QACzB,uBAAuB;QACX,6BAA6B;QACjC,oCAAoC;QAClD,6BAA6B;QACxB,4BAA4B;QAChB,gCAAgC;QACvC,+BAA+B;QACnC,uBAAuB,YAEN,wCAAwC;GAfhI,8BAA8B,CAokE1C","sourcesContent":["import 'reflect-metadata';\nimport crypto from 'crypto';\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { isOrgActivelyDirectoryManaged } from '~wildo-backend-lib/organizations/services/scim-provisioning-gate.backend.utils';\nimport type { FeatureResolutionBackendService } from '~wildo-backend-lib/features/services/feature-resolution.backend.service';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { ConsumableTokenBackendService } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport type { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport { AuthCredentialVerifierBackendService } from '~wildo-backend-lib/security/authentications/services/auth-credential-verifier.backend.service';\nimport { AuthTokenIssuerBackendService } from '~wildo-backend-lib/security/authentications/services/auth-token-issuer.backend.service';\nimport { AuthUserLookupBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-user-lookup.backend.service';\nimport { AuthResponseHelperBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-response-helper.backend.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { DomainToOrgLookupBackendService } from '~wildo-backend-lib/security/authentications/services/admin-config/domain-to-org-lookup.backend.service';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { ResourcePersistenceUnitOfWorkBackendService } from '~wildo-backend-lib/databases/services/resource-persistence-unit-of-work.backend.service';\nimport {\n applyInvitationAcceptanceCore,\n assertInvitationUserTypeAcquisitionAllowed,\n} from '~wildo-backend-lib/organizations/services/invitation-acceptance.backend.utils';\nimport {\n createOrgOnRegistration,\n OrgCreationOnRegistrationPlanInvalidReason,\n OrgCreationOnRegistrationPlanMode,\n resolveOrgCreationOnRegistrationPlan,\n} from '~wildo-backend-lib/organizations/services/org-creation-on-registration.backend.utils';\nimport { AUTH_AUDIT_METHOD } from '~wildo-backend-lib/security/authentications/models/auth-constants.backend';\nimport {\n createAuthenticatedInvitationAcceptancePersistenceRequest,\n createPublicInvitationAcceptancePersistenceRequest,\n createSelfRegistrationPersistenceRequest,\n} from '~wildo-backend-lib/security/authentications/models/identity-persistence-boundaries.backend';\nimport { AuthenticationOrchestratorBackendService } from '~wildo-backend-lib/security/authentications/services/authentication-orchestrator.backend.service';\nimport type { EmailVerificationInitiatorBackendService } from '~wildo-backend-lib/security/authentications/services/email-verification-initiator.backend.service';\nimport type { WebAuthnBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/webauthn.backend.service';\nimport type { PublicKeyCredentialCreationOptionsJSON } from '@simplewebauthn/server';\n\nimport {\n CoreConsumableTokenTypes,\n ConsumableToken_ConsumptionMode,\n CoreResourceType,\n ErrorType,\n ErrorCustomMessageReference,\n EmailTemplateType,\n SystemEmailTemplateRef,\n UserStatus,\n CORE_APP_ROLES,\n AuthMethod,\n AuthNextStep,\n AuthSessionPurpose,\n AuthenticationSessionState,\n isWildoBackendError,\n EmailVerificationMode,\n OrganizationMemberStatus,\n OrganizationMembers_Operations,\n InvitationManagementMode,\n AuthInvitationInfoResponseSchema,\n getEnabledMethods,\n AuthScopeType,\n RegistrationAcquisitionChannel,\n RegistrationMode,\n evaluateUserTypeAcquisition,\n isRegistrationAcquisitionAllowed,\n} from '@wildo-ai/saas-models';\nimport type { User, OrganizationMember, AuthInvitationInfoResponse, UserCredentials, InvitationAcceptCredentialMethod } from '@wildo-ai/saas-models';\nimport { AvailableLanguage, AuthResponseMessageRef } from '@wildo-ai/presets-components-models';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\nexport interface RegisterUserParams {\n email: string;\n firstName: string;\n lastName: string;\n password?: string;\n /** W5.5: Org name provided during registration when orgNameSource is 'ask'. /\n organizationName?: string;\n /\n How the registrant will authenticate afterwards. Absent ⇒ {@link AuthMethod.PASSWORD}, which is\n * what every caller meant before there was a choice (#463).\n \n Only a method the user type lists in `registration.allowedMethods` is accepted, and only\n * PASSWORD, MAGIC_LINK and PASSKEY have a public-signup implementation.\n /\n method?: AuthMethod;\n}\n\nexport interface RegisterUserContext {\n frontendUrl: string;\n ipAddress: string;\n userAgent: string;\n frontendServiceName?: string;\n /* W3.4: Resolved from X-Frontend-Service-Name → frontendServices → userType. Determines userTypes and defaultAppRoles on new user. /\n activeUserType?: string;\n}\n\nexport interface VerifyEmailParams {\n token: string;\n email: string;\n ipAddress: string;\n userAgent: string;\n}\n\nexport interface ResendVerificationParams {\n email: string;\n frontendUrl: string;\n ipAddress: string;\n userAgent: string;\n}\n\nexport interface AcceptInvitationParams {\n invitationToken: string;\n password?: string;\n /* Required at acceptance (mirrors registration) — seeds the profile's first/last name. /\n firstName: string;\n lastName: string;\n ipAddress: string;\n userAgent: string;\n /\n The first-factor credential the invitee chose to establish (from the multi-method accept\n * screen). Absent intentionally means password-or-none acceptance: set\n * `password` when provided, otherwise activate with no local credential.\n * Only `PASSWORD` / `MAGIC_LINK` / `PASSKEY` are handled\n * here; enterprise-SSO invitees are routed to the IdP authorize flow, not this endpoint. Typed as\n * the DTO-derived subset (not the full `AuthMethod`) so it can never widen past the wire contract.\n /\n credentialMethod?: InvitationAcceptCredentialMethod;\n}\n\n/\n Discriminates the two shapes an accept can resolve to. The password / no-password / passkey\n * paths issue a session (the invitation token bootstraps it — a set password or an enrolled\n * passkey is the GO-FORWARD credential, not this session's authenticator); the magic-link path\n * issues NO session — a link is emailed and the session is established when the invitee clicks it.\n /\nexport enum AcceptInvitationOutcome {\n /* A session was issued (or is gated behind MFA enrollment) — password / no-password / passkey. /\n SESSION = 'session',\n /* No session; a magic link was minted for the controller to email. /\n MAGIC_LINK_SENT = 'magic-link-sent',\n}\n\n/* Session-issuing accept result (password / no-password / passkey). /\nexport interface AcceptInvitationSessionResult {\n outcome: AcceptInvitationOutcome.SESSION;\n sessionId: string;\n state: string;\n purpose: string;\n nextStep?: string;\n userId?: string;\n accessToken?: string;\n refreshToken?: string;\n expiresIn?: number;\n requiresMFA?: boolean;\n availableEnrollmentMethods?: string[];\n /\n PASSKEY-enroll-at-accept: the pre-generated WebAuthn registration challenge. Present ONLY\n * on the passkey path AND only once a session was issued (the frontend runs the ceremony and\n * completes it against the existing authenticated `/auth/passkey/register/verify` route). Omitted\n * on the MFA-gated branch — no session yet, so the invitee enrolls post-MFA via the same route.\n /\n passkeyRegistrationOptions?: PublicKeyCredentialCreationOptionsJSON;\n}\n\n/\n Magic-link accept result — carries the minted token back to the controller for email dispatch\n * (the URL needs the request-derived frontend origin, an HTTP-layer concern). The `token` is NEVER\n * serialized to the client; the controller consumes it to send the email and responds with a\n * generic \"check your email\" message (anti-enumeration, identical to `POST /auth/magic-link/send`).\n /\nexport interface AcceptInvitationMagicLinkResult {\n outcome: AcceptInvitationOutcome.MAGIC_LINK_SENT;\n magicLinkDelivery: {\n token: string;\n submissionId?: string;\n email: string;\n userId: string;\n expiresInMinutes?: number;\n };\n}\n\nexport type AcceptInvitationResult = AcceptInvitationSessionResult \| AcceptInvitationMagicLinkResult;\n\n/* A pending invitation addressed to the authenticated caller, for the in-app surface. /\nexport interface MyPendingInvitation {\n /* The INVITED membership row id — the accept/reject target (was the invitation id). /\n membershipId: string;\n organizationId: string;\n organizationName?: string;\n roles: string[];\n createdAt?: string;\n}\n\n@injectable()\nexport class AuthRegistrationBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.ConsumableTokenService) private readonly consumableTokenService: ConsumableTokenBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthCredentialVerifier) private readonly credentialVerifier: AuthCredentialVerifierBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthTokenIssuer) private readonly tokenIssuer: AuthTokenIssuerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthUserLookupService) private readonly userLookup: AuthUserLookupBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthResponseHelperService) private readonly authResponseHelper: AuthResponseHelperBackendService,\n @inject(SAAS_SERVICE_TYPES.DomainToOrgLookupService) private readonly domainLookup: DomainToOrgLookupBackendService,\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) private readonly auditLogsService: AuditLogsBackendService,\n @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthenticationOrchestratorService) private readonly authOrchestrator: AuthenticationOrchestratorBackendService,\n // Guard 3: the ACL-bypassing system reads (invitation list/read across orgs)\n // come from the dedicated, deliberately-injected SystemAccessService — the\n // handler above no longer exposes readAsSystem/listAsSystem. (Appended LAST to\n // keep the test's positional construction stable.)\n @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n // Invitee-driven invitation REVOKE needs a super-admin EC: the invitee is\n // not an org admin, so the ORG_ADMIN-gated REVOKE runs under a synthesised system\n // context (same pattern as EnterpriseUserProvisioning). Appended LAST to keep the\n // test's positional construction stable. (A dedicated `deleteAsSystem` primitive would\n // be cleaner — noted as a follow-up; today only create/read/list/update AsSystem exist.)\n @inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory) private readonly authEcFactory: AuthExecutionContextFactoryBackendService,\n // Passkey-enroll-at-accept reuses the shared WebAuthn ceremony service to mint the\n // registration challenge bound to the just-activated invitee. Appended LAST to keep the\n // test's positional construction stable.\n @inject(SAAS_SERVICE_TYPES.WebAuthnService) private readonly webAuthnService: WebAuthnBackendService,\n // Shared EMAIL_VERIFICATION token+email sender (also used by SCIM provisioning). Registration\n // and resend delegate their verification send here so the flow has ONE implementation.\n // Appended LAST to keep the test's positional construction stable.\n @inject(SAAS_SERVICE_TYPES.EmailVerificationInitiatorService) private readonly emailVerificationInitiator: EmailVerificationInitiatorBackendService,\n // Per-org DIRECTORY_PROVISIONING resolution for the invite-accept credential block\n // (Concern B — see `isOrgActivelyDirectoryManaged`). Appended LAST: DI binds by token,\n // but the positional-append convention keeps existing wiring undisturbed.\n @inject(SAAS_SERVICE_TYPES.FeatureResolutionService) private readonly featureResolution: FeatureResolutionBackendService,\n @inject(SAAS_SERVICE_TYPES.ResourcePersistenceUnitOfWorkService)\n private readonly resourcePersistenceUnitOfWork:\n ResourcePersistenceUnitOfWorkBackendService,\n ) {\n this.logDebug = this.logger.debugByType('AuthRegistration');\n this.logger.setDebugTypeLogging('AuthRegistration', false);\n }\n\n /\n Invitation-accept DISCOVERY (Phase 1b) — the PUBLIC, NON-consuming read the\n * multi-method accept screen calls to learn what the invited org allows.\n \n Distinct from `acceptInvitation` (which CONSUMES the token and mutates state):\n * this only VALIDATES the token (`validateToken` — no consume) and reads. It\n * returns the invitee's email, the org name, the org's available first-factor\n * methods (resolved for the invitee's user type via the ORG-KEYED policy\n * resolver — the invitee's INVITED membership is excluded from the ACTIVE-\n * membership-based `resolveEffectiveAuthPolicy`, hence the org-keyed variant),\n * and the org's identity-management posture:\n * - `scim` → directory-managed; the screen shows an informational state, NO\n * local credential (locked product decision).\n * - `sso` → the org ENFORCES enterprise SSO (an org-SSO method is available\n * and PASSWORD is not) — route the invitee to the IdP (JIT consumes the invite).\n * - `open` → full method chooser.\n \n `managementMode` (incl. SSO-enforced) is derived from the resolved POLICY.\n * SSO-org invitees get enriched ORG_SAML/ORG_OPENID_CONNECT entries (per-connection\n * `ssoIds`/`config`), resolved via an org-keyed SSO lookup (`buildLookupForScope`) —\n * identical to `identify()`, but keyed by the invitation's `organizationId` instead\n * of an email domain.\n \n PASSKEY, if policy-enabled, appears as an ENROLL-at-accept option — NOT a login of\n * an existing credential — so `identify()`'s no-enrolled-credential filter\n * deliberately does not apply here; the frontend renders it disabled until the\n * passkey-enroll-at-accept backend (Phase 3) lands.\n /\n async getInvitationInfo(\n ec: ExecutionContext<any>,\n invitationToken: string,\n ): Promise<AuthInvitationInfoResponse> {\n // 1. Validate the token WITHOUT consuming it (accept consumes; discovery must not).\n // NO TOKEN ORACLE + RESIDUAL TIMING CHANNEL: every rejection below throws the SAME uniform\n // `INVITATION_NO_LONGER_VALID`; the fast (validateToken-fail) vs slow (membership-read) timing\n // residual is ASSESSED WONTFIX. See the canonical rationale on `acceptInvitation` (review FU-4/5/6)\n // before adding a per-cause message or a constant-time \"fix\" here.\n let tokenResult;\n try {\n tokenResult = await this.consumableTokenService.validateToken(\n invitationToken,\n [CoreConsumableTokenTypes.ORGANIZATION_MEMBER_INVITATION],\n );\n } catch {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n const membershipId = tokenResult.relatedId;\n if (!membershipId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n // 2. Read the INVITED membership (mirrors acceptInvitation). The invite IS the\n // membership in the junction model; the token's relatedId points at it.\n const membership = await this.servicesRegistryHandler.read<OrganizationMember>(\n CoreResourceType.ORGANIZATION_MEMBERS, ec, { _id: membershipId },\n );\n if (!membership \|\| membership.status !== OrganizationMemberStatus.INVITED) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n const organizationId = membership.organizationId;\n const inviteeEmail = (membership.userEmail ?? '').toLowerCase();\n\n // 3-4. Org join-context (display name + type + org-join user type) via the SHARED resolver —\n // one system-access-door read (`readAsSystem(ORGANIZATIONS, { _id })`; the endpoint runs\n // under an UNAUTHENTICATED pre-auth EC, so a plain ACL-scoped read would fail-closed). This is\n // the SAME org-join projection `acceptInvitation` uses — single source, no drift. LOAD-BEARING:\n // `orgType` drives the method resolution in step 5, so a failed read empties the method list,\n // not just the name (the resolver degrades name → undefined and org-join type → undefined).\n //\n // Method resolution keys off the org-join user type the accept WILL grant, NOT the invitee's\n // CURRENT types (provisioned `userTypes: []`, grant DEFERRED to INVITED→ACTIVE, so\n // `invitee.userTypes[0]` would be `undefined` → an EMPTY method list). Discovery is\n // ORG-JOIN-FIRST (mirrors the accept-time enablement guard), falling back to an existing\n // invitee's own first type, then undefined.\n const { orgType, orgJoinUserType, organizationName: resolvedOrgName } = await this._resolveOrgJoinUserType(membership);\n const organizationName = resolvedOrgName ?? '';\n const invitee = await this.userLookup.findUserById(ec, membership.userId);\n const resolutionUserType = orgJoinUserType ?? invitee?.userTypes?.[0];\n\n // 5. Available first-factor methods — resolve the policy from the org-join user\n // type + the org TYPE already read in step 3-4. `resolveAuthPolicyForOrgType` is\n // PURE (no ORGANIZATIONS read): the pre-auth `APP_PUBLIC` EC cannot read\n // ORGANIZATIONS, so a per-call org re-read would fail-closed and silently drop\n // the org's auth overrides (SSO-only / password-disabled).\n const resolvedPolicy = resolutionUserType\n ? this.userLookup.resolveAuthPolicyForOrgType(resolutionUserType, orgType)\n : null;\n const invitationPolicy = (\n resolvedPolicy\n && !resolvedPolicy.registration.allowedMethods.includes(\n AuthMethod.PASSWORD,\n )\n )\n ? {\n ...resolvedPolicy,\n authMethodsEnabled: {\n ...resolvedPolicy.authMethodsEnabled,\n [AuthMethod.PASSWORD]: false,\n },\n }\n : resolvedPolicy;\n const enabledMethods = invitationPolicy\n ? getEnabledMethods(invitationPolicy.authMethodsEnabled)\n : new Set<AuthMethod>();\n\n // Enrich org-SSO methods (ORG_SAML/ORG_OPENID_CONNECT) with per-connection\n // ssoIds/config — IDENTICALLY to identify() — by resolving the invite's org SSO\n // connection by ORGANIZATION ID (not email domain). Only when the policy enables an\n // org-SSO method (a non-SSO org pays no extra reads). `buildLookupForScope` reads\n // via the system-access door; a null result (no SSO config/connection) simply drops\n // the SSO methods, as before. (Passing the lookup also lets the OAuth arm honor the\n // org's `oauth2ProviderRestrictions` — resolved via the same ACL-independent door.)\n const orgSsoLookup = (enabledMethods.has(AuthMethod.ORG_SAML) \|\| enabledMethods.has(AuthMethod.ORG_OPENID_CONNECT))\n ? await this.domainLookup.buildLookupForScope(ec, AuthScopeType.ORGANIZATION, organizationId)\n : undefined;\n\n const availableFirstFactorMethods = invitationPolicy\n ? await this.authOrchestrator.buildFirstFactorMethodsForPolicy(ec, invitationPolicy, orgSsoLookup)\n : [];\n\n // 6. Management mode — strongest identity authority wins. SCIM now reflects ACTIVE\n // directory management (DIRECTORY_PROVISIONING feature + a live SCIM token), NOT the\n // org-TYPE mount flag — kept COHERENT with the accept-mutation credential block\n // (AUTH-23 / .claude/plans/scim-vs-auth-authority-axis.md) so the UI never hides the\n // credential chooser for a SCIM-capable-but-not-actually-managed org whose accept\n // WOULD allow a local credential. SSO enforcement is read from the resolved POLICY's\n // enabled methods. This is the LENIENT display path: a token/feature read failure\n // degrades to \"not actively managed\" and lets the MUTATION path be the fail-closed gate.\n let scimEnabled = false;\n try {\n scimEnabled = await isOrgActivelyDirectoryManaged({\n organizationId,\n featureResolution: this.featureResolution,\n systemAccessService: this.systemAccessService,\n });\n } catch {\n scimEnabled = false;\n }\n const hasOrgSso = enabledMethods.has(AuthMethod.ORG_SAML) \|\| enabledMethods.has(AuthMethod.ORG_OPENID_CONNECT);\n const hasPassword = enabledMethods.has(AuthMethod.PASSWORD);\n const managementMode = scimEnabled\n ? InvitationManagementMode.SCIM\n : hasOrgSso && !hasPassword\n ? InvitationManagementMode.SSO\n : InvitationManagementMode.OPEN;\n\n // Validate the response against its schema before returning (matches `identify`).\n // `passwordPolicy` carries the SAME org-merged policy the accept endpoint validates\n // against (`resolveAuthPolicyForOrgType` above), so the chooser's PASSWORD form shows\n // the invitee the org's real requirements. `PasswordPolicyConfig` is field-identical to\n // the DTO's `PasswordPolicyRulesSchema`, so `.parse` carries it through losslessly (and\n // strips any extra keys); absent policy ⇒ `undefined` ⇒ frontend app-level fallback.\n return AuthInvitationInfoResponseSchema.parse({\n inviteeEmail,\n organizationName,\n availableFirstFactorMethods,\n managementMode,\n passwordPolicy: enabledMethods.has(AuthMethod.PASSWORD)\n ? invitationPolicy?.passwordPolicy\n : undefined,\n });\n }\n\n /\n User registration.\n * Returns generic success on email collision (anti-enumeration).\n \n ## Password-less registration, and the three questions it owed (#463)\n \n `params.method` selects how the registrant will authenticate afterwards. PASSWORD is unchanged\n * and is the default. MAGIC_LINK and PASSKEY create the account with NO credential and hand back a\n * magic link; there is no session at signup, because nothing has been proven yet.\n \n Verification. The link IS the proof — clicking it establishes both the address and the first\n * session, so a magic-link registration cannot reach an authenticated state without verifying. For\n * PASSKEY this is the only available proof: a passkey attests possession of an authenticator and\n * says nothing whatsoever about an email address, and enrolling one needs a session bound to a\n * user, which public signup has no invitation token to stand in for. So a public passkey signup\n * necessarily routes through the link.\n \n Anti-enumeration. Unchanged and load-bearing: an address already in use returns the same\n * success response and sends nothing. The observable a magic-link signup adds — whether a mail\n * arrives — is exactly the one the existing password flow already exposes through its verification\n * mail, so the surface is not widened. No `userId` is returned for a password-less registration,\n * which the password path does return under DEFERRED: handing an unauthenticated caller an\n * identifier for an account they have not shown they own would be a new disclosure.\n \n Recovery — the question this issue said to settle first, and the design answers it. A\n * passkey-only account that loses its authenticator is NOT locked out, because the account always\n * has a proven address and the magic link is a standing way in. The registrant requests a link,\n * signs in, and enrolls a replacement passkey through the authenticated route. No separate recovery\n * mechanism was needed, and none was invented — which is the strongest form the answer could take,\n * because a recovery path that exists only for one method is a path nobody maintains.\n \n The corollary is worth stating so it is not weakened later: *a passkey-only account must keep a\n usable email address*, and anything that would let an application disable magic links for a user\n type while allowing passkey registration would recreate the lockout. That pairing belongs in\n * `registration.allowedMethods` validation the day such a switch exists.\n /\n async registerUser(\n ec: ExecutionContext<any>,\n params: RegisterUserParams,\n ctx: RegisterUserContext,\n ): Promise<{ messageRef: string; message: string; ssoRedirectHint?: boolean; sessionId?: string; state?: string; purpose?: string; nextStep?: string; userId?: string; accessToken?: string; refreshToken?: string; expiresIn?: number }> {\n const { email, firstName, lastName, password, organizationName } = params;\n /\n * PASSWORD when unstated — every caller predating #463 meant that, and defaulting keeps a\n * registration that omits the field behaving exactly as it did.\n /\n const method = params.method ?? AuthMethod.PASSWORD;\n /\n * MAGIC_LINK and PASSKEY both establish the account WITHOUT a local credential and prove the\n * address by a link the registrant must click. So neither can issue a session at signup — there\n * is nothing yet to authenticate — and both are handled by one branch below.\n \n PASSKEY is that branch plus an enrollment step, and the reason is worth stating because it was\n * the design question this issue said to settle first: a passkey proves possession of an\n * authenticator and says NOTHING about an email address, and enrolling one needs a session bound\n * to a user. Public signup has no invitation token to stand in for that proof. So a passkey\n * registration necessarily routes through an address proof, which is the magic link — and that\n * is also what answers the recovery question, below.\n /\n const isPasswordlessMethod = method === AuthMethod.MAGIC_LINK \|\| method === AuthMethod.PASSKEY;\n const { frontendUrl, ipAddress, userAgent, frontendServiceName, activeUserType } = ctx;\n const successResponse = this.authResponseHelper.getAuthResponse(AuthResponseMessageRef.REGISTRATION_SUCCESS);\n\n this.logDebug('Registration attempt', { email, activeUserType });\n\n // PR 8a (rate-limit unification, Step 5 — Option D / first\n // service-layer lift): the per-domain 50/hour rate-limit\n // (formerly `AUTH_REDIS_KEYS.REGISTER_DOMAIN` keyed on\n // `email.split('@')[1].toLowerCase()`, raw `checkRateLimit`)\n // moved UP to `AuthenticationController.register` as the third\n // declarative `checkPolicy` companion alongside the existing\n // per-email + per-IP buckets. Rationale: rate limits are\n // intrinsically HTTP concerns — bucket keys (email, IP, derived\n // domain) all live at the HTTP layer, the 429 feedback signal\n // (`X-RateLimit-` + `Retry-After` headers) is HTTP-only, and\n // service contracts must remain free of HTTP types.\n // `RateLimitBackendService` and `AUTH_REDIS_KEYS` imports also\n // removed — domain throttle was their sole consumer in this\n // file. See plan body for the full Option D architectural\n // re-analysis.\n\n // W3.4: Resolve per-user-type auth policy (for registration config, password policy, etc.)\n const userTypeAuthPolicy = activeUserType\n ? this.appConfigService.getUserTypeAuthPolicy(activeUserType)\n : null;\n\n if (frontendServiceName && activeUserType) {\n const userManagement = this.appConfigService.getFrontendServiceUserManagementEntry(frontendServiceName, activeUserType);\n if (userManagement?.register !== true) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n context: {\n // Diagnostic (log-only): AUTHORIZATION strips context at the wire.\n frontendServiceName,\n activeUserType,\n },\n });\n }\n }\n\n const config = this.appConfigService.config;\n\n const registrationConfig = userTypeAuthPolicy?.registration;\n if (!registrationConfig) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n });\n }\n\n // Gate self-service registration through the canonical acquisition matrix. The map below\n // selects only the mode-specific client message; it does not own the allow/deny semantics\n // (that stays with `isRegistrationAcquisitionAllowed`). Typed `Record<RegistrationMode, …>`\n // so a newly added mode cannot ship without deciding its self-service denial message here —\n // the message stays exhaustive alongside the matrix instead of silently defaulting to DISABLED.\n const registrationMode = registrationConfig.mode;\n if (!isRegistrationAcquisitionAllowed(\n registrationMode,\n RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n )) {\n // OPEN is unreachable here (it is always self-service-allowed) but is listed to satisfy the Record.\n const denialMessageReferenceByMode: Record<RegistrationMode, ErrorCustomMessageReference> = {\n [RegistrationMode.OPEN]: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n [RegistrationMode.INVITATION_ONLY]: ErrorCustomMessageReference.REGISTRATION_INVITATION_ONLY,\n [RegistrationMode.ADMIN_ONLY]: ErrorCustomMessageReference.REGISTRATION_ADMIN_ONLY,\n [RegistrationMode.DISABLED]: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n };\n // `mode` is typed RegistrationMode, but the runtime boundary is untrusted (an unparsed config\n // object can carry no/unknown mode — the same stance `isRegistrationAcquisitionAllowed` takes),\n // so fall back to the generic denial message rather than emitting an undefined reference.\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference:\n denialMessageReferenceByMode[registrationMode] ?? ErrorCustomMessageReference.REGISTRATION_DISABLED,\n });\n }\n\n // Resolve organization creation once, before authorization and adapter\n // selection. The same immutable plan drives prospective grants and writes.\n const configuredOrganizationTypes = this.appConfigService.isInitialized()\n ? config.organizationTypes\n : undefined;\n const orgCreationPlan = activeUserType\n ? resolveOrgCreationOnRegistrationPlan({\n userEmail: email.toLowerCase(),\n activeUserType,\n organizationName,\n organizationTypes: configuredOrganizationTypes,\n })\n : {\n mode: OrgCreationOnRegistrationPlanMode.NONE,\n } as const;\n if (orgCreationPlan.mode === OrgCreationOnRegistrationPlanMode.INVALID) {\n if (\n orgCreationPlan.reason\n === OrgCreationOnRegistrationPlanInvalidReason\n .MISSING_REQUIRED_ORGANIZATION_NAME\n ) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.ORG_NAME_REQUIRED,\n context: {\n organizationType: orgCreationPlan.orgType,\n },\n });\n }\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n reason:\n 'registration_user_type_has_ambiguous_organization_creation_policy',\n activeUserType,\n matchingOrgTypes: orgCreationPlan.matchingOrgTypes,\n },\n });\n }\n\n // Synchronous and deferred creation both later grant the selected\n // organization type's user types, so authorize those prospective additions\n // before any user/org/member mutation.\n const plannedOrganizationType =\n orgCreationPlan.mode === OrgCreationOnRegistrationPlanMode.NONE\n ? undefined\n : configuredOrganizationTypes?.[orgCreationPlan.orgType];\n const automaticOrgGrantAcquisition = evaluateUserTypeAcquisition(\n this.appConfigService.isInitialized() ? config.userTypes : undefined,\n plannedOrganizationType?.userTypes ?? [],\n activeUserType ? [activeUserType] : [],\n RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n );\n if (!automaticOrgGrantAcquisition.allowed) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n context: {\n channel: RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n deniedUserTypes: automaticOrgGrantAcquisition.deniedUserTypes,\n },\n });\n }\n\n const allowedMethods = registrationConfig.allowedMethods;\n // The requested method, not a hardcoded PASSWORD. An application that lists only MAGIC_LINK now\n // refuses a password signup, which is the point of the list.\n if (!allowedMethods.includes(method)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_METHOD_NOT_SUPPORTED,\n context: { method, allowedMethods },\n });\n }\n\n /\n The credential the method requires, and ONLY for the method that requires one. A password sent\n * alongside `method: MAGIC_LINK` is ignored rather than refused: the registrant's client may\n * carry a stale field, and refusing would fail a signup for a value that changes nothing.\n /\n if (method === AuthMethod.PASSWORD) {\n if (!password) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference:\n ErrorCustomMessageReference.REGISTRATION_PASSWORD_REQUIRED,\n });\n }\n const passwordPolicy = userTypeAuthPolicy?.passwordPolicy;\n const policyValidation =\n this.credentialVerifier.validatePasswordPolicy(\n password,\n passwordPolicy,\n );\n if (!policyValidation.valid) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference:\n ErrorCustomMessageReference\n .VALIDATION_PASSWORD_POLICY_VIOLATION,\n context: {\n violations: policyValidation.violations,\n minLength: passwordPolicy?.minLength,\n maxLength: passwordPolicy?.maxLength,\n },\n });\n }\n }\n\n const existing = await this.userLookup.findUserByEmail(ec, email);\n if (existing) {\n this.logDebug('Registration: email already in use, returning success to prevent enumeration', { email });\n return successResponse;\n }\n\n // W2.7: Block self-registration for SSO-managed domains.\n if (registrationConfig.blockForSSODomains) {\n const domain = email.split('@')[1];\n if (domain) {\n const domainResult = await this.domainLookup.findOrgByDomain(ec, domain);\n if (domainResult?.enforcement?.requireSSO) {\n this.logDebug('Registration blocked: SSO-enforced domain', { email, domain });\n return { ...successResponse, ssoRedirectHint: true };\n }\n }\n }\n\n // Undefined for a password-less method, which the persistence request already understands:\n // `includeCredentials: passwordHash !== undefined` below was written for exactly this shape.\n const passwordHash = method === AuthMethod.PASSWORD && password\n ? await this.credentialVerifier.hashPassword(password, config.auth.passwordHashing)\n : undefined;\n\n // W2.6: Email verification mode — DEFERRED creates user as ACTIVE immediately.\n const isDeferredVerification = registrationConfig.emailVerification === EmailVerificationMode.DEFERRED;\n\n /\n * A PASSWORD-LESS registrant is created ACTIVE whatever the verification mode says, and the\n * status is what makes the flow work at all (#463).\n \n `verifyMagicLink` REFUSES any non-ACTIVE user (generically, as an invalid link — the status is\n * recorded in the audit trail rather than told to the caller). So a magic-link or passkey\n * registrant created `PENDING_VERIFICATION` would be sent a link that is rejected the moment they\n * click it — an account reachable by nobody, created by the flow meant to reach it. The\n * invitation-accept path already does exactly this: it ACTIVATES the invitee and only then mints\n * the link.\n \n ACTIVE here does not mean \"access granted\". A password-less account holds no credential, so\n * possession of the emailed link is the ONLY way in, and clicking it is what proves the address.\n * The status gate and the verification gate are not the same gate, and conflating them is what\n * makes this look wrong at first glance.\n \n Recorded because the first version of this code had it exactly inverted — it forced\n * `PENDING_VERIFICATION` reasoning that \"an ACTIVE account with an unproven address is worse\",\n * which reads well and would have shipped a flow that could not complete.\n /\n const initialStatusForMethod = isPasswordlessMethod\n ? UserStatus.ACTIVE\n : (isDeferredVerification ? UserStatus.ACTIVE : UserStatus.PENDING_VERIFICATION);\n const initialStatus = initialStatusForMethod;\n\n // W3.4: Resolve userTypes and defaultAppRoles from the active user type definition\n const userTypes = activeUserType ? [activeUserType] : [];\n const userTypeDefinition = activeUserType\n ? config.userTypes?.[activeUserType]\n : undefined;\n const defaultAppRoles = userTypeDefinition?.defaultAppRoles ?? [CORE_APP_ROLES.APP_USER];\n let newUser: User;\n let pendingOrgType: string \| undefined;\n try {\n const registrationPersistence =\n await this.resourcePersistenceUnitOfWork.executeTransaction(\n createSelfRegistrationPersistenceRequest({\n includeCredentials: passwordHash !== undefined,\n includeSynchronousOrganizationCreation:\n orgCreationPlan.mode\n === OrgCreationOnRegistrationPlanMode.SYNCHRONOUS,\n }),\n async serviceOptions => {\n const createdUser = await this.servicesRegistryHandler.create<User>(\n CoreResourceType.USERS,\n ec,\n {\n email: email.toLowerCase(),\n status: initialStatus,\n appRoles: defaultAppRoles,\n userTypes,\n },\n {\n ...serviceOptions,\n // `defaultAppRoles` is resolved from the ACTIVE USER-TYPE CONFIGURATION\n // (`userTypeDefinition.defaultAppRoles ?? [APP_USER]`) — it is never read from the signup\n // payload. Declaring it server-injected is what tells the `users \| create` role-ceiling\n // gate not to measure it against the caller, whose roles here are `APP_PUBLIC` by\n // definition: an anonymous registrant cannot \"hold\" the role self-registration grants\n // them. Without this the gate denied every signup with `role_ceiling_exceeded`.\n //\n // This does NOT weaken the gate. `users \| create` stays `APP_ADMIN_SUPER_ADMIN`-gated as\n // an API operation, and a genuine client call still has its authored `appRoles` measured\n // — `preserveServerInjectedFields` is a trusted-server option that no client payload can\n // reach. Sign-up is a different mechanism from administrative user creation, and this is\n // the seam that says so.\n preserveServerInjectedFields: [\n ...(serviceOptions?.preserveServerInjectedFields ?? []),\n 'appRoles',\n ],\n },\n );\n\n if (passwordHash) {\n await this.systemAccessService.createAsSystem(\n CoreResourceType.USER_CREDENTIALS,\n {\n userId: createdUser._id,\n passwordHash,\n },\n serviceOptions,\n );\n }\n\n let deferredOrgType: string \| undefined;\n if (activeUserType && this.appConfigService.isInitialized()) {\n const organizationTypes = this.appConfigService.config.organizationTypes;\n const orgResult = await createOrgOnRegistration(ec, {\n userId: createdUser._id,\n userEmail: createdUser.email,\n activeUserType,\n organizationName,\n organizationTypes,\n servicesRegistryHandler: this.servicesRegistryHandler,\n systemAccessService: this.systemAccessService,\n serviceOptions,\n plan: orgCreationPlan,\n });\n if (orgResult.pendingOnboarding) {\n deferredOrgType = orgResult.orgType;\n }\n }\n return { createdUser, deferredOrgType };\n },\n {\n // Tier-2 input-derived composition seed: the profile fields\n // originate outside the USERS payload. The service layer queues the\n // profile seed on this unit of work and emits it only after commit.\n compositionSeedRequestInput: {\n firstName,\n lastName,\n displayName: `${firstName} ${lastName}`,\n },\n },\n );\n newUser = registrationPersistence.createdUser;\n pendingOrgType = registrationPersistence.deferredOrgType;\n } catch (createError: any) {\n if (\n (isWildoBackendError(createError) && createError.statusCode === 409)\n \|\| createError?.code === 11000\n \|\| createError?.message?.includes('duplicate key')\n \|\| createError?.message?.includes('E11000')\n ) {\n // A duplicate from USERS.email is the expected concurrent-registration\n // race and must retain the anti-enumeration response. A duplicate from a\n // different participant (for example an organization slug) is a real\n // failure; treating every 409 as an email race would silently discard a\n // valid registration attempt.\n const winningUser = await this.userLookup.findAnyUserByEmail(\n ec,\n email,\n );\n if (winningUser) {\n this.logDebug(\n 'Registration: concurrent email registration won, returning anti-enumeration success',\n {\n email,\n winningUserId: winningUser._id,\n },\n );\n return successResponse;\n }\n }\n throw createError;\n }\n\n // USER_PROFILES is now seeded declaratively by the USERS→USER_PROFILES\n // `onParentCreate` composition lifecycle (input threaded via\n // `compositionSeedRequestInput` on the create above), replacing the former\n // best-effort hand-seed here. The seed is idempotent (unique `userId` index)\n // and swallow-on-failure, so registration is never blocked by a profile write.\n\n if (pendingOrgType) {\n this.logDebug('Org creation deferred to onboarding', {\n userId: newUser._id,\n orgType: pendingOrgType,\n });\n }\n\n // W2.6: Only send verification email when emailVerification !== DEFERRED. Delegated to the\n // shared initiator (one implementation across registration / resend / SCIM provisioning).\n // Not for a password-less registration: the magic link below IS the address proof, and a second\n // \"confirm your address\" mail arriving beside it asks the registrant to do the same thing twice\n // through a link that grants less.\n if (!isDeferredVerification && !isPasswordlessMethod) {\n await this.emailVerificationInitiator.sendVerificationEmail({\n userId: newUser._id,\n email: newUser.email,\n firstName,\n frontendBaseUrl: frontendUrl,\n });\n }\n\n this.auditLogsService.logUserRegistered({ userId: newUser._id, email: newUser.email, ipAddress, userAgent }, ec).catch(() => {});\n\n /\n * PASSWORD-LESS REGISTRATION (#463) — the account exists, holds no credential, and its address is\n * still unproven. A magic link is what closes both: clicking it proves the address AND\n * establishes the first session.\n \n No session, no tokens and no `userId` are returned. That is not caution, it is the only honest\n * answer: nothing has been proven yet, and returning a `userId` here would hand an unauthenticated\n * caller a fact about an account they have not shown they own.\n \n No separate verification mail is sent: this link IS the address proof, and a second \"confirm\n * your address\" message beside it would ask the registrant to do the same thing twice through a\n * link that grants less.\n /\n if (isPasswordlessMethod) {\n /\n * PASSKEY only: the WebAuthn challenge and the later verify both require a USER_CREDENTIALS row\n * to exist, and a brand-new registrant has none. Provisioned here for the same reason and in the\n * same non-fatal way as the invitation-accept path — a failure must not strand an account that\n * has already been created, and the registrant can still enroll later through the authenticated\n * route once the magic link has let them in.\n /\n if (method === AuthMethod.PASSKEY) {\n try {\n await this._ensurePasswordlessCredentialRecord(ec, newUser._id);\n } catch (error) {\n this.logger.error('Password-less credential row provisioning failed at passkey registration (non-fatal)', {\n userId: newUser._id,\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n /\n * `skipGlobalEnablementCheck: true`, for the reason the invitation path records: the method was\n * already authorized above against this user type's own `registration.allowedMethods`, and we\n * are PAST the account creation. Re-rejecting on `sendMagicLink`'s coarser base-policy gate\n * would strand an account that now exists and has no other way in.\n /\n const magic = await this.authOrchestrator.sendMagicLink(\n ec,\n { email: newUser.email },\n { ipAddress, userAgent },\n true,\n );\n\n this.logDebug('Password-less registration completed — magic link minted for delivery', {\n userId: newUser._id,\n method,\n // Diagnostic only: an absent token is the anti-enumeration no-op, which cannot happen for an\n // account we have just created and activated-by-construction, so its absence is worth seeing.\n hasToken: Boolean(magic.token),\n });\n\n return {\n ...successResponse,\n /\n * The registrant's next act differs by method and the client cannot infer it: a magic-link\n * signup is finished once they click, a passkey signup has an enrollment step waiting on the\n * other side of the same click.\n /\n nextStep: method === AuthMethod.PASSKEY\n ? AuthNextStep.PASSKEY_ENROLLMENT\n : AuthNextStep.MAGIC_LINK_SENT,\n };\n }\n\n // F7 fix: When email verification is deferred, the user is ACTIVE immediately.\n // Process through the registration pipeline (MFA check, etc.) and issue tokens\n // so the user can start using the app without a separate login step.\n if (isDeferredVerification) {\n const pipelineSession = await this.authOrchestrator.processEmailVerification(\n ec, newUser._id, newUser.email, activeUserType,\n { ipAddress, userAgent }, AuthSessionPurpose.REGISTRATION,\n );\n\n if (pipelineSession.state === AuthenticationSessionState.COMPLETED \|\| pipelineSession.state === AuthenticationSessionState.MFA_ENROLLMENT_GRACE) {\n const tokenResult = await this.tokenIssuer.issueTokensForUser(newUser._id, undefined, {\n lastAuthenticatedAt: Math.floor(Date.now() / 1000),\n });\n\n this.logDebug('Registration completed — deferred verification, tokens issued', { userId: newUser._id });\n return {\n ...successResponse,\n sessionId: pipelineSession.sessionId,\n state: pipelineSession.state,\n purpose: pipelineSession.purpose,\n // Expose `userId` so the controller can transpose anonymous website\n // captures onto this account. Deferred-verification registration\n // issues real tokens right here (immediate login) — the same\n // anonymous→authenticated conversion moment that `verifyEmail()` and\n // `acceptInvitation()` already surface `userId` for.\n userId: newUser._id,\n accessToken: tokenResult.accessToken,\n refreshToken: tokenResult.refreshToken,\n expiresIn: tokenResult.expiresIn,\n };\n }\n\n this.logDebug('Registration completed — deferred verification, pipeline requires further steps', {\n userId: newUser._id,\n state: pipelineSession.state,\n nextStep: pipelineSession.nextStep,\n });\n return {\n ...successResponse,\n sessionId: pipelineSession.sessionId,\n state: pipelineSession.state,\n purpose: pipelineSession.purpose,\n nextStep: pipelineSession.nextStep,\n };\n }\n\n // W4.1: Create registration session to track the pipeline state (non-deferred)\n const regSession = await this.authOrchestrator.createRegistrationSession(\n newUser._id,\n newUser.email,\n {\n activeUserType,\n purpose: AuthSessionPurpose.REGISTRATION,\n deviceInfo: { ipAddress, userAgent },\n pendingOrgType,\n },\n );\n\n this.logDebug('Registration completed — awaiting email verification', { userId: newUser._id, sessionId: regSession.sessionId });\n return {\n ...successResponse,\n sessionId: regSession.sessionId,\n state: regSession.state,\n purpose: regSession.purpose,\n };\n }\n\n /\n W4.1: Consumes EMAIL_VERIFICATION token, activates user, processes through registration pipeline.\n * Instead of issuing tokens directly, creates/resumes an auth session and advances through\n * the pipeline (email verified → MFA check → enrollment/grace/complete).\n * Returns session state with nextStep for frontend routing.\n /\n async verifyEmail(\n ec: ExecutionContext<any>,\n params: VerifyEmailParams,\n ): Promise<{\n userId?: string;\n sessionId: string;\n state: string;\n nextStep?: string;\n accessToken?: string;\n refreshToken?: string;\n expiresIn?: number;\n mfaGraceExpiresAt?: string;\n requiresMFA?: boolean;\n availableEnrollmentMethods?: string[];\n requireStrongMFA?: boolean;\n }> {\n const { token, email: requestEmail, ipAddress, userAgent } = params;\n\n this.logDebug('Email verification attempted');\n\n let consumedToken;\n try {\n consumedToken = await this.consumableTokenService.consumeToken(token);\n } catch {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n });\n }\n\n if (consumedToken.tokenType !== CoreConsumableTokenTypes.EMAIL_VERIFICATION) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n });\n }\n\n const userId = consumedToken.userId \|\| consumedToken.relatedId;\n if (!userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n });\n }\n\n const metadata = consumedToken.metadata as Record<string, unknown> \| undefined;\n const metadataEmail = metadata?.email as string \| undefined;\n\n if (!metadataEmail) {\n this.logger.warn('Email verification token metadata missing email — data integrity issue', { userId });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n });\n }\n\n const tokenEmailBuf = Buffer.from(metadataEmail.toLowerCase());\n const requestEmailBuf = Buffer.from(requestEmail.toLowerCase());\n if (tokenEmailBuf.length !== requestEmailBuf.length \|\| !crypto.timingSafeEqual(tokenEmailBuf, requestEmailBuf)) {\n this.logger.warn('Email verification email mismatch — possible URL tampering', { userId, requestEmail });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n });\n }\n\n const user = await this.servicesRegistryHandler.read<User>(CoreResourceType.USERS, ec, userId);\n\n if (!user) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_FOUND,\n });\n }\n\n if (user.status === UserStatus.ACTIVE) {\n this.logDebug('Email verification: user already active', { userId });\n } else if (user.status !== UserStatus.PENDING_VERIFICATION) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.ACCOUNT_ACTIVATION_NOT_ALLOWED,\n });\n } else {\n // `status` is `.excludeFromUpdate()` — the client-facing UPDATE contract cannot carry it, so\n // a handler write is stripped by the repository's strict re-parse and the account would never\n // activate, with no error. The system door re-attaches it. Deliberately NOT a lifecycle verb:\n // activation here follows from a confirmed email, not an administrative decision.\n await this.systemAccessService.updateAsSystem(CoreResourceType.USERS, userId, { status: UserStatus.ACTIVE });\n this.logDebug('User activated via email verification', { userId });\n }\n\n await this.consumableTokenService.revokeTokensByRelatedId(userId, CoreConsumableTokenTypes.EMAIL_VERIFICATION);\n\n this.auditLogsService.logUserEmailVerified({ userId: user._id, email: user.email, ipAddress, userAgent }, ec).catch(() => {});\n\n // W4.1: Process through registration pipeline instead of direct token issuance.\n // Resolve activeUserType from user's userTypes (first entry, if any).\n const activeUserType = user.userTypes?.[0] ?? undefined;\n const session = await this.authOrchestrator.processEmailVerification(\n ec,\n user._id,\n user.email,\n activeUserType,\n { ipAddress, userAgent },\n );\n\n this.logDebug('Email verification complete — pipeline advanced', { userId, state: session.state, nextStep: session.nextStep });\n\n // If pipeline completed (no MFA required), issue tokens\n if (session.state === 'COMPLETED' \|\| session.state === 'MFA_ENROLLMENT_GRACE') {\n const tokenResult = await this.tokenIssuer.issueTokensForUser(user._id, undefined, {\n lastAuthenticatedAt: Math.floor(Date.now() / 1000),\n });\n return {\n userId,\n sessionId: session.sessionId,\n state: session.state,\n nextStep: session.nextStep ?? AuthNextStep.COMPLETE,\n accessToken: tokenResult.accessToken,\n refreshToken: tokenResult.refreshToken ?? '',\n expiresIn: tokenResult.expiresIn ?? 3600,\n mfaGraceExpiresAt: session.mfaGraceExpiresAt,\n };\n }\n\n // MFA enrollment required — return session info for frontend to route to enrollment\n return {\n userId,\n sessionId: session.sessionId,\n state: session.state,\n nextStep: session.nextStep ?? AuthNextStep.MFA_ENROLLMENT,\n requiresMFA: session.requiresMFA,\n availableEnrollmentMethods: session.availableEnrollmentMethods,\n requireStrongMFA: session.requireStrongMFA,\n };\n }\n\n /\n Resend verification email. Returns generic success (anti-enumeration).\n /\n async resendVerificationEmail(\n ec: ExecutionContext<any>,\n params: ResendVerificationParams,\n ): Promise<{ messageRef: string; message: string }> {\n const { email, frontendUrl, ipAddress, userAgent } = params;\n const successResponse = this.authResponseHelper.getAuthResponse(AuthResponseMessageRef.RESEND_VERIFICATION_SUCCESS);\n\n this.logDebug('Resend verification email requested', { email });\n\n try {\n const user = await this.userLookup.findAnyUserByEmail(ec, email);\n\n if (!user \|\| user.status !== UserStatus.PENDING_VERIFICATION) {\n this.logDebug('Resend verification: user not found or not PENDING_VERIFICATION, returning generic success', { email });\n return successResponse;\n }\n\n // Delegated to the shared initiator (revokes the stale token + mints a fresh one + sends).\n await this.emailVerificationInitiator.sendVerificationEmail({\n userId: user._id,\n email: user.email,\n frontendBaseUrl: frontendUrl,\n revokeExisting: true,\n });\n\n this.auditLogsService.logUserVerificationEmailResent({ userId: user._id, email: user.email, ipAddress, userAgent }).catch(() => {});\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n this.logger.error('Unexpected error during resend verification email', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n\n return successResponse;\n }\n\n /\n W4.4: Accept an organization member invitation.\n \n The token→membership→user resolution, the INVITED→ACTIVE flip (via the shared\n * `applyInvitationAcceptanceCore`), and the org-join user-type grant are IDENTICAL across every\n * `credentialMethod`; only the credential step + session issuance differ:\n \n - `PASSWORD` / absent: set the password if one was provided, else\n * intentionally activate with no local credential. The invitation token bootstraps a session (tokens issued unless\n * MFA enrollment gates them).\n * - `MAGIC_LINK`: activate with no local credential, then mint + email a magic link (reusing\n * `AuthenticationOrchestrator.sendMagicLink`). NO session is issued here — the invitee clicks the\n * link and the existing `verifyMagicLink` establishes the session. Returns `MAGIC_LINK_SENT`.\n * - `PASSKEY`: enroll a NEW WebAuthn credential. The invitation token bootstraps the session\n * exactly like the password path (a passkey, like a password, is the GO-FORWARD credential — not\n * this session's authenticator); the pre-generated registration challenge rides back on the\n * result and the frontend completes the ceremony against the existing authenticated\n * `/auth/passkey/register/verify` route.\n \n `MAGIC_LINK` / `PASSKEY` are fail-closed against the invited org's effective auth policy (a\n * method the org disabled is rejected — never trust the client's choice).\n \n The effective user type governing the password + MFA policies is resolved by\n * `_resolveOrgJoinUserType` with deliberately split precedence (OWN-first for the pipeline,\n * ORG-JOIN-first for the method-enablement guard) — see that helper for the rationale.\n /\n async acceptInvitation(\n ec: ExecutionContext<any>,\n params: AcceptInvitationParams,\n ): Promise<AcceptInvitationResult> {\n const { invitationToken, password, firstName, lastName, ipAddress, userAgent, credentialMethod } = params;\n\n // 1. VALIDATE the invitation token — do NOT consume it yet. The consume is DEFERRED to the\n // point of no return (just before the first mutation, below) so a validation failure —\n // a non-INVITED membership, a locked user status, a disabled credential method, a weak\n // password — does NOT spend the single-use token and strand the invitee (who could\n // otherwise never retry the same link). The deferred `consumeToken` is also the\n // concurrency guard: a racing second accept of the same token fails there, before mutating.\n //\n // NO TOKEN ORACLE (review FU-4/FU-5, finding #5 — TREATED): every unusable-invitation rejection on\n // the THREE PUBLIC token-based endpoints (`getInvitationInfo`, `acceptInvitation`, `rejectInvitation`)\n // throws the SAME `ErrorType.AUTHENTICATION` with the SAME `INVITATION_NO_LONGER_VALID` reference —\n // deliberately UNIFORM, regardless of cause (unrecognised / expired / already-consumed token, wrong\n // token type, missing invitation reference, non-INVITED membership, orphaned membership, or a revoke\n // that raced the accept). Rationale: a `customMessageReference` is a TOP-LEVEL field that SURVIVES\n // `sanitizeErrorForClient` (which strips `context` for AUTHENTICATION errors), so a per-cause\n // reference IS client-visible and would let a token holder distinguish \"unrecognised token\" from\n // \"recognised-but-superseded invite\". The status code is already uniform (AUTHENTICATION), so the\n // reference was the last distinguishing signal.\n //\n // Keep the granular cause in the LOGS (the throw site + surrounding `logDebug`), NEVER in the\n // reference. DO NOT re-split this into per-cause references — that re-opens the oracle. The\n // AUTHENTICATED in-app paths (`acceptMyInvitation` / `loadOwnedPendingInvitation`) MAY stay granular:\n // they are gated by userId-ownership rather than token possession, so they leak nothing.\n //\n // RESIDUAL TIMING CHANNEL (review FU-6 — ASSESSED, WONTFIX): the uniform error closes the MESSAGE\n // oracle but not a TIMING one. An unrecognised/expired/consumed token fails FAST at `validateToken`\n // (one indexed `findOne({ token })`, no membership read); a token that PASSES `validateToken` but\n // whose membership is non-INVITED does the extra `ORGANIZATION_MEMBERS` read before the IDENTICAL\n // rejection — so response latency can distinguish the two branches. This is deliberately NOT\n // equalized, and MUST NOT be \"fixed\" with a compensating read or a normalizing delay. Reason: the\n // branch bit is observable ONLY by presenting a token that passes `validateToken`, and the token is a\n // 256-bit crypto-random single-use secret (`crypto.randomBytes(32)`) delivered only to the invitee.\n // • An attacker ENUMERATING tokens never reaches the slow branch — every probe misses `findOne`, so\n // latency is a CONSTANT (fast) independent of any server-side secret → zero bits leaked (and the\n // endpoints are per-IP rate-limited, blunting the many-sample averaging a network timing attack\n // needs). The channel cannot even be actuated without the token.\n // • A LEGITIMATE holder only ever learns the state of THEIR OWN invite (INVITED vs consumed/\n // superseded/orphaned) — which they already possess and the endpoint reports anyway.\n // The channel is therefore SELF-REFERENTIAL (its only output is a fact about the very token you had to\n // already hold to read it) — NOT a cross-user / cross-tenant oracle, unlike a password/HMAC/account-\n // existence compare where the branch is gated on a SERVER secret the caller is guessing. Constant-time\n // equalization would add real complexity + steady-state DB load to protect a non-secret, and MongoDB\n // read latency is itself too high-variance (cache warmth, working-set residency, pool contention, GC)\n // to actually flatten the distribution — while risking a NEW leak via metrics/traces. See the review\n // doc FU-6 for the full weighing. (`acceptInvitation`'s deeper rejections — user status, method\n // enablement, password policy — extend this into a GRADUATED profile, but every step past the first is\n // gated behind BOTH a valid token AND a valid INVITED membership, so the whole profile stays\n // self-referential.)\n let tokenResult;\n try {\n tokenResult = await this.consumableTokenService.validateToken(\n invitationToken,\n [CoreConsumableTokenTypes.ORGANIZATION_MEMBER_INVITATION],\n );\n } catch {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n if (tokenResult.tokenType !== CoreConsumableTokenTypes.ORGANIZATION_MEMBER_INVITATION) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n const invitationId = tokenResult.relatedId;\n if (!invitationId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n // 2. Read the INVITED membership row. In the junction model the invite IS the\n // membership (status INVITED); the token's `relatedId` points at THIS row.\n const membershipId = invitationId;\n const membership = await this.servicesRegistryHandler.read<OrganizationMember>(CoreResourceType.ORGANIZATION_MEMBERS, ec, { _id: membershipId });\n if (!membership \|\| membership.status !== OrganizationMemberStatus.INVITED) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n const organizationId = membership.organizationId;\n const invitationEmail = (membership.userEmail ?? '').toLowerCase();\n\n // 3. Resolve the invitee user. The invite eagerly provisioned it (PENDING_INVITATION if\n // brand-new, or an existing account), so `membership.userId` always resolves.\n let user = await this.userLookup.findUserById(ec, membership.userId);\n if (!user) {\n // Orphaned membership (user reaped) — surface as an invalid invite, not a 500.\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n // Only a not-yet-activated invitee (PENDING_INVITATION), a pending-verification account,\n // or an already-ACTIVE user may accept. INACTIVE / SUSPENDED / DELETED is a hard stop.\n if (\n user.status !== UserStatus.ACTIVE &&\n user.status !== UserStatus.PENDING_VERIFICATION &&\n user.status !== UserStatus.PENDING_INVITATION\n ) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_ACTIVE,\n context: { userId: user._id, userStatus: user.status },\n });\n }\n\n // First activation = the invite-provisioned PENDING_INVITATION account claiming its\n // identity for the first time — where password + profile are set. (Also drives the\n // audit auth-method below.)\n const isNewUser = user.status === UserStatus.PENDING_INVITATION;\n\n // CONTRACT (review FU-4, finding F): `firstName` / `lastName` / `password` are applied ONLY on the\n // first-activation branch below (a brand-new invitee). An EXISTING (ACTIVE / PENDING_VERIFICATION)\n // invitee already has a profile, so their submitted names are harmlessly ignored — the invitation\n // token still bootstraps a session (email-possession auth, like a magic link). A submitted PASSWORD\n // is NOT harmless to drop, though: the credential write is gated on `isNewUser`, so an existing\n // user would BELIEVE they set a login credential that was never persisted. REJECT it explicitly\n // rather than silently no-op. The password field is OPTIONAL, so this does NOT block the legitimate\n // existing-user accept — they accept WITHOUT a password and continue with their existing login\n // method (password / SSO / social); a new password can be added later in account settings.\n if (!isNewUser && password) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_EXISTING_ACCOUNT_NO_PASSWORD,\n context: {\n // organizationId is diagnostic (log-only); not in the VALIDATION client allowlist.\n organizationId,\n },\n });\n }\n\n // Resolve the invited org's ORG-JOIN user type ONCE (the type the accept will grant). Its two\n // consumers apply OPPOSITE precedence on purpose (see `_resolveOrgJoinUserType`):\n // • `activeUserType` for the password/MFA pipeline is OWN-FIRST. A brand-new invitee is\n // provisioned with `userTypes: []` (the grant is DEFERRED to activation by\n // `applyInvitationAcceptanceCore` below), so `user.userTypes[0]` is `undefined` and it falls\n // through to the org-join type — closing the weak-password + MFA hole. An EXISTING user keeps\n // their OWN type: a weaker org-join type must NOT re-govern them and silently reset their MFA\n // enrollment state (`_advanceRegistrationPipeline` persists `mfaEnrollmentState → NOT_REQUIRED`\n // when the resolved policy drops the requirement). Org overrides still merge for existing users\n // via `resolveEffectiveAuthPolicy` (which reads the just-activated membership).\n // • the fail-closed method-enablement guard is ORG-JOIN-FIRST — the org's method restrictions\n // must gate the choice even for an existing user (see below).\n const { orgType, orgJoinUserType, orgReadFailed } = await this._resolveOrgJoinUserType(membership);\n const activeUserType = user.userTypes?.[0] ?? orgJoinUserType;\n\n // Fail-closed method-enablement + directory-management enforcement, BEFORE the consume/mutation.\n // `getInvitationInfo` gates the UI, but the accept endpoint must NEVER trust the client — a DIRECT\n // API call could name a method (or set a password) the org disabled, or set a local credential on an\n // actively directory-managed org. So whenever the accept ESTABLISHES A LOCAL CREDENTIAL — a password,\n // an enrolled passkey, or an emailed magic link — enforce BOTH axes:\n // (1) DEPROVISIONING integrity: an ACTIVELY directory-managed org (DIRECTORY_PROVISIONING feature\n // + a live SCIM token — the IdP provisions AND deprovisions, so a local credential would\n // survive deprovisioning) rejects ANY local credential. Re-keyed 2026-07-18 from the org-TYPE\n // `scimProvisioning.enabled` MOUNT flag to this per-org signal (AUTH-23 /\n // .claude/plans/scim-vs-auth-authority-axis.md), which stopped over-blocking password orgs of a\n // SCIM-capable type;\n // (2) AUTH AUTHORITY (SSO): the method must be in the org's effective `authMethodsEnabled`\n // (ORG-JOIN-FIRST, mirroring `getInvitationInfo` — covers PASSWORD too).\n // A password-less activation (no `password`, no `credentialMethod`) sets NO credential and is left\n // open — an SSO/SCIM invitee may activate here and then authenticate via their IdP.\n const establishedCredentialMethod: AuthMethod \| undefined =\n credentialMethod === AuthMethod.MAGIC_LINK \|\| credentialMethod === AuthMethod.PASSKEY\n ? credentialMethod\n : (password ? AuthMethod.PASSWORD : undefined);\n if (establishedCredentialMethod) {\n if (orgReadFailed) {\n // The org read FAILED (transient) — its type / `managementMode` and enabled-method set are\n // UNKNOWN. Fail CLOSED: never establish a local credential on an org we could not classify (the\n // downstream directory-management and effective-policy checks below BOTH need a classified org —\n // `_assertInvitationCredentialMethodEnabled` in particular keys on `orgType`). `getInvitationInfo`\n // stays lenient for display; the MUTATION path must not. INTERNAL (retryable) — the invitee can\n // retry once the read recovers; the single-use token is NOT yet consumed at this point.\n throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_ORG_VERIFICATION_FAILED,\n context: {\n // organizationId is diagnostic (log-only): INTERNAL strips context at the wire.\n // The user-facing text is now localized via the customMessageReference above.\n organizationId,\n },\n });\n }\n // Concern B (deprovisioning integrity): refuse a local credential when the org is\n // ACTIVELY directory-managed. Re-keyed 2026-07-18 (AUTH-23 /\n // .claude/plans/scim-vs-auth-authority-axis.md) from the org-TYPE\n // `scimProvisioning.enabled` MOUNT flag — which over-blocked EVERY org of a\n // SCIM-capable type (stranding password-based test/non-directory orgs) — to the\n // honest per-org signal (DIRECTORY_PROVISIONING feature AND a live SCIM token).\n // Concern A (the org's effective policy disallowing the method) is enforced\n // immediately below by `_assertInvitationCredentialMethodEnabled`.\n let activelyDirectoryManaged: boolean;\n try {\n activelyDirectoryManaged = await isOrgActivelyDirectoryManaged({\n organizationId,\n featureResolution: this.featureResolution,\n systemAccessService: this.systemAccessService,\n });\n } catch (error) {\n // Could not classify the org's directory-management posture (transient read\n // failure). Fail CLOSED exactly like the `orgReadFailed` branch above: throw a\n // RETRYABLE INTERNAL error rather than establish a local credential we might\n // regret. The single-use token is NOT yet consumed, so the invitee can retry.\n this.logger.warn('Failed to resolve directory-management posture at invite-accept', {\n organizationId,\n ...projectCaughtErrorLogFields(error),\n });\n throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_ORG_VERIFICATION_FAILED,\n context: { organizationId },\n });\n }\n if (activelyDirectoryManaged) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SCIM_LOCAL_CREDENTIAL_BLOCKED,\n context: {\n // organizationId is diagnostic (log-only): AUTHORIZATION strips context at the wire.\n organizationId,\n },\n });\n }\n // ORG-JOIN-FIRST (opposite of `activeUserType`): the org's method restrictions must gate the\n // choice even for an existing user who carries their own type. Mirrors `getInvitationInfo`.\n const enablementUserType = orgJoinUserType ?? user.userTypes?.[0];\n this._assertInvitationCredentialMethodEnabled(organizationId, orgType, enablementUserType, establishedCredentialMethod);\n }\n\n // Validate the initial password against the ORG-MERGED policy (new invitee setting one) BEFORE\n // consuming the token — a policy rejection must NOT spend the single-use token (else a weak\n // password strands the invitee, unable to retry). `resolveAuthPolicyForOrgType` applies the\n // org's `authOverrides` most-restrictively (consistent with the enablement guard above, the M1\n // discovery policy, and the MFA path), so an org that STRENGTHENS `passwordPolicy` is honored. A\n // brand-new invitee's `activeUserType` IS the org-join type (own `userTypes: []`) so the\n // single-org resolver is exact; an unresolvable type degrades to the schema default\n // (`validatePasswordPolicy(pw, undefined)`).\n if (isNewUser && password) {\n const passwordPolicy = (activeUserType\n ? this.userLookup.resolveAuthPolicyForOrgType(activeUserType, orgType)\n : null)?.passwordPolicy;\n const policyValidation = this.credentialVerifier.validatePasswordPolicy(password, passwordPolicy);\n if (!policyValidation.valid) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION_PASSWORD_POLICY_VIOLATION,\n context: { violations: policyValidation.violations, minLength: passwordPolicy?.minLength, maxLength: passwordPolicy?.maxLength },\n });\n }\n }\n\n // Registration policy is checked before the token point-of-no-return. The shared acceptance\n // core repeats this check immediately before membership mutation for policy drift and for the\n // tokenless/OAuth entry points.\n await assertInvitationUserTypeAcquisitionAllowed({\n user,\n organizationId,\n appConfigService: this.appConfigService,\n errorBuilder: this.errorBuilder,\n systemAccessService: this.systemAccessService,\n });\n\n // Hash outside the transaction: Argon2 is CPU work and must not extend the\n // database lock window. The policy validation above has already succeeded.\n const hashedPassword = isNewUser && password\n ? await this.credentialVerifier.hashPassword(\n password,\n this.appConfigService.config.auth.passwordHashing,\n )\n : undefined;\n\n try {\n user = await this.resourcePersistenceUnitOfWork.executeTransaction(\n createPublicInvitationAcceptancePersistenceRequest({\n includeCredentials: hashedPassword !== undefined,\n }),\n async serviceOptions => {\n // Token consumption, membership activation, user activation, credential\n // persistence, and org-type grants are one commit. Any revoked membership\n // or later write failure rolls the single-use token back to usable state.\n await this.consumableTokenService.consumeToken(\n invitationToken,\n serviceOptions.transaction!,\n );\n\n const currentMembership = await this.systemAccessService.readAsSystem<OrganizationMember>(\n CoreResourceType.ORGANIZATION_MEMBERS,\n { _id: membership._id },\n serviceOptions,\n );\n const currentUser = await this.servicesRegistryHandler.read<User>(\n CoreResourceType.USERS,\n ec,\n { _id: user._id },\n serviceOptions,\n );\n if (\n !currentMembership\n \|\| (\n currentMembership.status !== OrganizationMemberStatus.INVITED\n && currentMembership.status !== OrganizationMemberStatus.ACTIVE\n )\n \|\| currentMembership.userId !== user._id\n \|\| !currentUser\n \|\| currentUser.status !== user.status\n ) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n if (hashedPassword) {\n const existingCredential = await this.servicesRegistryHandler.read<UserCredentials>(\n CoreResourceType.USER_CREDENTIALS,\n ec,\n { userId: currentUser._id },\n serviceOptions,\n );\n if (existingCredential) {\n await this.credentialVerifier.updatePasswordHash(\n ec,\n currentUser._id,\n hashedPassword,\n serviceOptions,\n );\n } else {\n await this.systemAccessService.createAsSystem(\n CoreResourceType.USER_CREDENTIALS,\n {\n userId: currentUser._id,\n passwordHash: hashedPassword,\n },\n serviceOptions,\n );\n }\n }\n\n let activatedUser = currentUser;\n if (\n currentUser.status === UserStatus.PENDING_INVITATION\n \|\| currentUser.status === UserStatus.PENDING_VERIFICATION\n ) {\n // SYSTEM door, not the handler: `status` is `.excludeFromUpdate()`, so the client-facing\n // UPDATE contract cannot carry it and the repository's strict re-parse STRIPS it from a\n // handler write. The row still comes back — the filter matched — so the write reports\n // success while persisting nothing, and the invitee is left PENDING_INVITATION.\n //\n // That silence is what made this expensive to find. Nothing threw; `accept` answered 200;\n // and the failure surfaced two steps later as a magic link that was never emailed, because\n // `sendMagicLink` resolves the user BY EMAIL and takes its anti-enumeration no-op when that\n // user is not ACTIVE. An e2e scenario reported \"no email arrived\" for a defect three hops\n // upstream.\n //\n // The sibling activation (email verification, ~line 900) was moved to the system door on\n // 2026-08-06; this call site was missed, which is the failure shape\n // `.claude/rules/invariant-call-site-enumeration.md` exists to catch — the invariant is\n // \"a `status` write goes through the system door\", and it holds at every site or none.\n //\n // The compare-and-swap is PRESERVED: the filter still pins the status observed above, so a\n // concurrent activation still loses the race and is still refused below rather than\n // blind-overwriting.\n const updated = await this.systemAccessService.updateAsSystem<User>(\n CoreResourceType.USERS,\n { _id: currentUser._id, status: currentUser.status },\n { status: UserStatus.ACTIVE },\n serviceOptions,\n );\n if (!updated) {\n throw this.errorBuilder.buildError(ErrorType.CONFLICT, undefined, {\n context: {\n reason: 'invitation_user_activation_race_lost',\n userId: currentUser._id,\n },\n });\n }\n activatedUser = updated;\n }\n\n const { membershipActivated } = await applyInvitationAcceptanceCore(ec, {\n membership: currentMembership,\n user: activatedUser,\n appConfigService: this.appConfigService,\n errorBuilder: this.errorBuilder,\n servicesRegistryHandler: this.servicesRegistryHandler,\n systemAccessService: this.systemAccessService,\n serviceOptions,\n logDebug: this.logDebug,\n });\n if (!membershipActivated) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n return activatedUser;\n },\n );\n } catch (error) {\n this.logger.warn('Invitation acceptance transaction rolled back', {\n membershipId: membership._id,\n userId: user._id,\n organizationId,\n ...(isWildoBackendError(error)\n ? {\n errorType: error.type,\n errorStatusCode: error.statusCode,\n errorContext: error.context,\n }\n : {\n errorMessage: describeCaughtError(error),\n }),\n });\n // Preserve the public no-oracle contract for expected token/state races,\n // but never relabel infrastructure, database, or configuration failures\n // as an invalid invitation. Those failures are retryable/operator-actionable\n // and masking them would strand a valid invite behind a false 401.\n if (\n isWildoBackendError(error)\n && (\n error.type === ErrorType.AUTHENTICATION\n \|\| error.type === ErrorType.CONFLICT\n )\n ) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n },\n );\n }\n throw error;\n }\n\n if (isNewUser) {\n // Profile enrichment is not an authorization precondition. It runs only\n // after the durable acceptance commit and remains idempotent/best-effort.\n try {\n await this.systemAccessService.createAsSystem(CoreResourceType.USER_PROFILES, {\n userId: user._id,\n firstName,\n lastName,\n displayName: `${firstName} ${lastName}`,\n });\n } catch (profileError) {\n this.logger.error('Failed to create user profile during invitation acceptance (non-fatal)', {\n userId: user._id,\n ...projectCaughtErrorLogFields(profileError),\n });\n }\n this.logDebug('Invitee account activated via invitation acceptance', {\n userId: user._id,\n organizationId,\n });\n }\n\n // MAGIC_LINK path — the invitee established NO local credential and gets NO session here.\n // Mint a magic link (reusing the shared token machinery, `sendMagicLink`) bound to the\n // just-activated invitee and hand it back for the controller to email. `sendMagicLink`\n // resolves the user BY EMAIL — which now resolves to THIS ACTIVE account — so the token's\n // `relatedId` IS the invitee's userId and its `metadata.email` the invitee email; the eventual\n // `verifyMagicLink` click (which hard-rejects non-ACTIVE users) establishes the session. No\n // login is audited here: `sendMagicLink` audits the send, `verifyMagicLink` audits the login.\n if (credentialMethod === AuthMethod.MAGIC_LINK) {\n // `skipGlobalEnablementCheck: true` — MAGIC_LINK was ALREADY authorized above against the\n // invited org's precise, org-EXPANDED policy (`_assertInvitationCredentialMethodEnabled`). We\n // are PAST the mutations (activate + membership flip + token consume), so `sendMagicLink` must\n // NOT re-reject on its coarse base-policy global gate — that would strand the just-activated\n // invitee (see the reconciliation note on `sendMagicLink`).\n const magic = await this.authOrchestrator.sendMagicLink(ec, { email: invitationEmail }, { ipAddress, userAgent }, true);\n this.logDebug('Invitation accepted via magic link — link minted for delivery', { userId: user._id, organizationId });\n return {\n outcome: AcceptInvitationOutcome.MAGIC_LINK_SENT,\n magicLinkDelivery: {\n // Empty only in the (post-activation) anti-enumeration no-op — the controller then\n // simply sends no email; the invitee we just activated always resolves to a token.\n token: magic.token ?? '',\n submissionId: magic.submissionId,\n email: invitationEmail,\n userId: user._id,\n expiresInMinutes: magic.expiresInMinutes,\n },\n };\n }\n\n // PASSKEY path — the invitee will enroll a NEW WebAuthn credential. `passkeyCredentials` live on\n // the USER_CREDENTIALS document, and both the challenge generation below and the later verify\n // require that row to EXIST — so ensure a password-less row now (a brand-new invitee has none;\n // an existing user may already have one). Runs on BOTH the token-issued and MFA-gated branches so\n // a post-MFA enrollment via the existing authenticated route also finds the row.\n if (credentialMethod === AuthMethod.PASSKEY) {\n // NON-FATAL: the token is already consumed + the membership flipped, so a failure here must\n // NOT 500 and strand the invitee (activated but session-less). A missing row just means the\n // challenge below no-ops (also non-fatal) and the invitee enrolls a passkey later via the\n // authenticated register route.\n try {\n await this._ensurePasswordlessCredentialRecord(ec, user._id);\n } catch (error) {\n this.logger.error('Password-less credential row provisioning failed at passkey accept (non-fatal)', {\n userId: user._id,\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n // 6. Create registration session with purpose 'invitation'\n const session = await this.authOrchestrator.createRegistrationSession(\n user._id,\n invitationEmail,\n {\n activeUserType,\n purpose: AuthSessionPurpose.INVITATION,\n deviceInfo: { ipAddress, userAgent },\n },\n );\n\n const auditAuthMethod = isNewUser\n ? (password ? AuthMethod.PASSWORD : AUTH_AUDIT_METHOD.INVITATION_ACCEPTANCE)\n : AUTH_AUDIT_METHOD.INVITATION_LINK;\n this.auditLogsService.logUserLogin({\n userId: user._id,\n email: invitationEmail,\n authMethod: auditAuthMethod,\n ipAddress,\n userAgent,\n sessionId: session.sessionId,\n organizationId,\n }, await this.authEcFactory.createForAuditRoutingOrFallback(ec, organizationId, user._id)).catch(() => {});\n\n // 7. Process through the registration pipeline\n // Invitations from trusted source → skip email verification, go straight to MFA check\n const pipelineSession = await this.authOrchestrator.processEmailVerification(\n ec,\n user._id,\n invitationEmail,\n activeUserType,\n { ipAddress, userAgent },\n AuthSessionPurpose.INVITATION,\n );\n\n // 8. If pipeline completed, issue tokens\n if (pipelineSession.state === 'COMPLETED' \|\| pipelineSession.state === 'MFA_ENROLLMENT_GRACE') {\n const tokenResult = await this.tokenIssuer.issueTokensForUser(user._id, undefined, {\n lastAuthenticatedAt: Math.floor(Date.now() / 1000),\n });\n\n // PASSKEY: with a session now issued, generate the WebAuthn registration challenge bound to\n // the invitee and ride it back on the result. The frontend runs the browser ceremony and\n // completes it against the EXISTING authenticated `/auth/passkey/register/verify` route\n // (authenticated by the access token just issued) — no bespoke accept-verify endpoint.\n // NON-FATAL: the session is ALREADY issued (the invitation token bootstrapped it + was\n // consumed), so a challenge-generation failure must NOT 500 and strand the invitee — they\n // proceed signed in (no challenge on the wire) and enroll a passkey later in security\n // settings, exactly like the frontend's own swallowed ceremony failure.\n let passkeyRegistrationOptions: PublicKeyCredentialCreationOptionsJSON \| undefined;\n if (credentialMethod === AuthMethod.PASSKEY) {\n try {\n passkeyRegistrationOptions = await this.webAuthnService.generateRegistrationOptions(ec, user._id, invitationEmail);\n } catch (error) {\n this.logger.error('Passkey challenge generation failed at accept — returning the issued session without a challenge (non-fatal)', {\n userId: user._id,\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n return {\n outcome: AcceptInvitationOutcome.SESSION,\n sessionId: pipelineSession.sessionId,\n state: pipelineSession.state,\n purpose: AuthSessionPurpose.INVITATION,\n nextStep: pipelineSession.nextStep,\n userId: user._id,\n accessToken: tokenResult.accessToken,\n refreshToken: tokenResult.refreshToken,\n expiresIn: tokenResult.expiresIn,\n passkeyRegistrationOptions,\n };\n }\n\n // MFA enrollment required — return session info for frontend routing. Passkey options are\n // deliberately NOT generated here: there is no session yet, and the 5-minute challenge would\n // likely expire before MFA enrollment finishes. The frontend enrolls the passkey post-MFA via\n // the existing authenticated route (the credential row was already ensured above).\n return {\n outcome: AcceptInvitationOutcome.SESSION,\n sessionId: pipelineSession.sessionId,\n state: pipelineSession.state,\n purpose: AuthSessionPurpose.INVITATION,\n nextStep: pipelineSession.nextStep,\n userId: user._id,\n requiresMFA: true,\n availableEnrollmentMethods: pipelineSession.availableEnrollmentMethods,\n };\n }\n\n /\n Resolve the invited organization's join context in a SINGLE system read: its `type`, the\n * ORG-JOIN user type the accept will GRANT (`organizationTypes[orgType].userTypes[0]`), and its\n * display name. The one read is shared by `acceptInvitation` (uses `orgType` + `orgJoinUserType`)\n * and `getInvitationInfo` (uses all three), so the org-join projection lives in ONE place — no\n * drift between the accept path and its public discovery counterpart.\n \n Why `[0]` — `grantUserTypesOnOrgJoin` grants ALL of `organizationTypes[orgType].userTypes`\n * ADDITIVELY, but `[0]` is the PRIMARY (governing) type: it matches the `userTypes[0]` convention\n * every auth surface uses (orchestrator, token issuer, password reset, method-management), and a\n * brand-new invitee's additive grant appends to `[]` so their post-grant `userTypes[0]` IS this\n * `[0]`. Resolving the accept-time policy against `[0]` therefore matches the invitee's\n * steady-state login policy EXACTLY. The remaining granted types are supplementary capabilities,\n * not the governing auth type — validating against the most-restrictive of ALL granted types would\n * make accept STRICTER than every subsequent login (an accept-vs-steady-state discrepancy).\n \n Returns the RAW org-join type — deliberately NOT pre-merged with the invitee's own type —\n * because the two accept consumers need OPPOSITE precedence:\n * - the effective `activeUserType` for the password/MFA pipeline is OWN-FIRST\n * (`user.userTypes[0] ?? orgJoinUserType`): a brand-new invitee (own `userTypes: []`, grant\n * deferred) falls through to the org-join type — closing the weak-password + MFA hole — while\n * an EXISTING user keeps their own type so a weaker org-join type cannot re-govern them or\n * reset their MFA enrollment state;\n * - the fail-closed method-enablement guard is ORG-JOIN-FIRST\n * (`orgJoinUserType ?? user.userTypes[0]`): the org's method restrictions must gate the choice\n * even for an existing user.\n \n Read via the system-access door because both callers run under a pre-auth `APP_PUBLIC` EC that\n * cannot ACL-read ORGANIZATIONS. `organizationName` is `displayName ?? name` (`undefined` if the\n * org is unreadable — callers coalesce). (A full accept performs ~3 org reads; the org-type grant\n * and `resolveEffectiveAuthPolicy` read it too — this read is shared by the guard + the\n * initial-password policy + discovery.)\n /\n private async _resolveOrgJoinUserType(\n membership: Pick<OrganizationMember, 'organizationId'>,\n ): Promise<{ orgType: string \| undefined; orgJoinUserType: string \| undefined; organizationName: string \| undefined; orgReadFailed: boolean }> {\n let orgType: string \| undefined;\n let organizationName: string \| undefined;\n let orgReadFailed = false;\n try {\n const org = await this.systemAccessService.readAsSystem<{ _id: string; type?: string; name?: string; displayName?: string }>(\n CoreResourceType.ORGANIZATIONS, { _id: membership.organizationId },\n );\n orgType = org?.type;\n organizationName = org?.displayName ?? org?.name ?? undefined;\n } catch (error) {\n // Non-fatal read failure → orgType/name stay undefined → org-join type unresolved. `orgReadFailed`\n // DISAMBIGUATES this from a genuinely type-less org (both leave `orgType` undefined). For a\n // brand-new invitee (own `userTypes: []`) an unresolved type degrades the initial-password policy\n // to the schema default and the MFA policy to FALLBACK — acceptable for DISPLAY. But the\n // credential-establishment guard fail-CLOSES on `orgReadFailed` (a degraded read must never be\n // mistaken for a non-SCIM / unrestricted org and let a local credential slip past enforcement).\n // Logged so the degrade is observable rather than silent.\n orgReadFailed = true;\n this.logDebug('Invitation accept: ORGANIZATIONS read failed — org-join user type unresolved, policy will degrade', {\n organizationId: membership.organizationId,\n ...projectCaughtErrorLogFields(error),\n });\n }\n\n const orgJoinUserType = orgType\n ? this.appConfigService.config.organizationTypes?.[orgType]?.userTypes?.[0]\n : undefined;\n\n return { orgType, orgJoinUserType, organizationName, orgReadFailed };\n }\n\n /\n Fail-closed check that a chosen accept-time credential method is enabled by the invited\n * organization's EFFECTIVE auth policy. Receives the ORG-JOIN-FIRST resolved user type + the org\n * type (both from `_resolveOrgJoinUserType`, resolved once per accept); the PURE\n * `resolveAuthPolicyForOrgType` merges the org overrides (most-restrictive-wins) and\n * `getEnabledMethods` projects the enabled set.\n \n Throws `AUTHORIZATION` when the method is not enabled (or the org type / policy cannot be\n * resolved — fail-closed: an unresolvable policy never silently permits a password-less method).\n /\n private _assertInvitationCredentialMethodEnabled(\n organizationId: string,\n orgType: string \| undefined,\n resolutionUserType: string \| undefined,\n credentialMethod: AuthMethod,\n ): void {\n const resolvedPolicy = resolutionUserType\n ? this.userLookup.resolveAuthPolicyForOrgType(resolutionUserType, orgType)\n : null;\n const enabledMethods = resolvedPolicy\n ? getEnabledMethods(resolvedPolicy.authMethodsEnabled)\n : new Set<AuthMethod>();\n const registrationMethodAllowed =\n credentialMethod !== AuthMethod.PASSWORD\n \|\| resolvedPolicy?.registration.allowedMethods.includes(\n AuthMethod.PASSWORD,\n ) === true;\n\n /\n * An UNRESOLVABLE policy and a DISABLED method are different faults, and they must not share a\n * message (#388).\n \n When no user type resolves for the organization being joined, `resolvedPolicy` is null and the\n * enabled set is EMPTY — so every method fails the check below identically, and reporting that as\n * `AUTHENTICATION_METHOD_NOT_SUPPORTED` names the one thing that is NOT the cause. Measured: an\n * application whose `userTypes.member` enabled PASSWORD and listed it in\n * `registration.allowedMethods` was refused for PASSWORD, MAGIC_LINK and PASSKEY alike, because\n * it declared no `organizationTypes` at all. Three methods were tried before anyone looked one\n * level up, and the first written diagnosis was a false claim that the application had no auth\n * policy.\n \n The refusal itself is unchanged and still fail-closed — an unresolvable policy must never\n * silently permit a method. Only the DIAGNOSTIC is split, so the message names the missing\n * declaration rather than the method that could never have satisfied it.\n /\n if (!resolvedPolicy) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_ORGANIZATION_TYPE_UNRESOLVED,\n context: {\n // Diagnostic (log-only): AUTHORIZATION strips non-allowlisted context at the wire.\n organizationId,\n orgType,\n resolutionUserType,\n method: credentialMethod,\n hint: orgType\n ? 'No user type resolved for this organization type. Declare `organizationTypes[<orgType>].userTypes` in the application configuration.'\n : 'The organization carries no `type`, so no organization-type entry could be looked up. Set the organization type, and declare `organizationTypes` in the application configuration.',\n },\n });\n }\n\n if (\n !registrationMethodAllowed\n \|\| !enabledMethods.has(credentialMethod)\n ) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_METHOD_NOT_SUPPORTED,\n context: {\n // Diagnostic (log-only): AUTHENTICATION strips non-allowlisted context at the wire.\n method: credentialMethod,\n organizationId,\n },\n });\n }\n }\n\n /\n Ensure a USER_CREDENTIALS document exists for a user, creating a PASSWORD-LESS one if absent.\n * Passkey-enroll-at-accept needs the credential row to exist BEFORE the WebAuthn ceremony (the\n * challenge generation + verify both resolve it, and a brand-new invitee has none). `passwordHash`\n * is optional precisely so this row is creatable with no password. Idempotent: an existing row\n * (e.g. an already-registered user accepting a further invite) is left untouched.\n /\n private async _ensurePasswordlessCredentialRecord(ec: ExecutionContext<any>, userId: string): Promise<void> {\n const existing = await this.servicesRegistryHandler.read<UserCredentials>(\n CoreResourceType.USER_CREDENTIALS, ec, { userId },\n );\n if (existing) return;\n\n // Trusted system write: USER_CREDENTIALS is INTERNAL_CALL-only and its `userId` (context FK) is\n // stripped from the client-shaped request DTO; `createAsSystem` re-attaches it after the strict\n // parse (systemAccessPolicy.create opt-in). No `passwordHash` — this is a password-less row.\n await this.systemAccessService.createAsSystem(CoreResourceType.USER_CREDENTIALS, { userId });\n this.logDebug('Password-less credential record provisioned for passkey enrollment', { userId });\n }\n\n /\n W4.4: Reject an organization member invitation through the public token-based auth flow.\n \n The junction row is the invitation, so rejection and admin revocation have\n * distinct authorization/audit intent but the same terminal persistence:\n * atomically revoke the accept token and delete the still-INVITED row.\n /\n async rejectInvitation(\n ec: ExecutionContext<any>,\n params: {\n invitationToken: string;\n rejectionReason?: string;\n },\n ): Promise<{ rejected: true }> {\n const { invitationToken, rejectionReason } = params;\n\n // NO TOKEN ORACLE + RESIDUAL TIMING CHANNEL: rejection is uniform (`INVITATION_NO_LONGER_VALID`); the\n // fast (validateToken-fail) vs slow (membership-read) timing residual is ASSESSED WONTFIX. See the\n // canonical rationale on `acceptInvitation` (review FU-4/5/6) before \"fixing\" the timing here.\n let tokenResult;\n try {\n // Preflight is deliberately read-only. The invited-only REVOKE mutation\n // revokes this token by membership relatedId in the same transaction as\n // deleting the row. Consuming here would strand a valid INVITED row if\n // the process crashed or deletion failed afterward.\n tokenResult = await this.consumableTokenService.validateToken(\n invitationToken,\n [CoreConsumableTokenTypes.ORGANIZATION_MEMBER_INVITATION],\n );\n } catch {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n const invitationId = tokenResult.relatedId;\n if (!invitationId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n const membership = await this.systemAccessService.readAsSystem<OrganizationMember>(\n CoreResourceType.ORGANIZATION_MEMBERS,\n { _id: invitationId },\n );\n if (!membership \|\| membership.status !== OrganizationMemberStatus.INVITED) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n try {\n await this.applyInvitationRejectionCore(ec, {\n membership,\n rejectionReason,\n });\n } catch (error) {\n // Acceptance/revocation may win after the read-only preflight. Preserve\n // the public no-oracle contract for those expected state races, while\n // leaving infrastructure/configuration failures visible and retryable.\n if (\n isWildoBackendError(error)\n && (\n error.type === ErrorType.AUTHENTICATION\n \|\| error.type === ErrorType.AUTHORIZATION\n \|\| error.type === ErrorType.NOT_FOUND\n \|\| error.type === ErrorType.CONFLICT\n )\n ) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n },\n );\n }\n throw error;\n }\n\n return { rejected: true };\n }\n\n /\n Shared rejection core — REVOKE the pending membership (decline). Reused by the\n * token-based `rejectInvitation` and the authenticated in-app `rejectMyInvitation`.\n \n In the junction model there is no `REJECTED` status to set: a declined invite leaves no\n * membership. Revoking the INVITED row uses the exact invited-only REVOKE\n * implementation, whose declarative token contract revokes the accept token\n * inside the same transaction. The invitee\n * is not an org admin, so the ORG_ADMIN-gated DELETE runs under a synthesised super-admin EC.\n \n ## The decline IS audited — as the invitee, not as the system\n \n REVOKE emits `ORGANIZATION_MEMBER_REMOVED` from a post-commit effect, carrying `operation`,\n * `previousStatus`, `roles` and this `reason`. What that event could not say, until the\n * `onBehalfOfUserId` below, was WHO declined: a borrowed-authority context carries no\n * `initiatorIds.userId` (the `ExecutionContext` constructor rejects one), so the actor resolved to\n * `SYSTEM` — the identical row the stale-invitation sweep writes when it reaps an invitation nobody\n * answered. An access review could not tell an active refusal from silence.\n \n `membership.userId` is the right source for BOTH callers rather than the caller id: the token\n * path identifies the invitee through the token, the in-app path has already verified the caller\n * owns this row, and taking it from the row keeps the two from drifting.\n \n With the actor recorded, the three REVOKE causes are distinguishable with no new event type:\n * a self-decline is `removedBy === removedUserId`, an administrative cancellation is a different\n * real user id, and the expiry sweep remains `SYSTEM`.\n /\n private async applyInvitationRejectionCore(\n _ec: ExecutionContext<any>,\n { membership, rejectionReason }: { membership: OrganizationMember; rejectionReason?: string },\n ): Promise<void> {\n const systemEc = await this.authEcFactory.createForSystemAuthOperation(\n this.authEcFactory.getOrganizationMembersRevokeOperationPath(),\n { onBehalfOfUserId: membership.userId },\n );\n await this.servicesRegistryHandler.executeCustomOperation(\n CoreResourceType.ORGANIZATION_MEMBERS,\n OrganizationMembers_Operations.REVOKE,\n systemEc,\n membership._id,\n {\n reason: rejectionReason?.trim() \|\| undefined,\n },\n );\n\n this.logDebug('Invitation declined — pending membership removed', {\n membershipId: membership._id,\n userId: membership.userId,\n organizationId: membership.organizationId,\n rejectionReason: rejectionReason?.trim() \|\| undefined,\n });\n }\n\n /\n In-app authenticated accept (Approach P) — list the caller's OWN pending\n * invitations across every organization, matched by their `userId`.\n \n Since the invitation→membership collapse, the invite binds the pending\n * `ORGANIZATION_MEMBERS` row to the invitee's `userId` (an eagerly-created\n * `PENDING_INVITATION` user), so the inbox is a direct userId-owned query — no\n * email round-trip. Cross-org by construction (the invitee is not yet a scoped\n * member of the inviting orgs), so invitations + org names are read via the\n * system-context primitives (`listAsSystem`/`readAsSystem`). Authorization is\n * the userId-ownership match: only INVITED rows bound to the caller's `userId`\n * are returned. The caller's identity comes from the authenticated route\n * (`callerUserId`).\n /\n async listMyPendingInvitations(\n _ec: ExecutionContext<any>,\n params: { callerUserId: string },\n ): Promise<MyPendingInvitation[]> {\n // The invite bound the pending membership to the caller's `userId`, so the inbox is a\n // direct userId-owned query — no email round-trip. Cross-org by construction (the invitee\n // is not yet a scoped member of the inviting orgs), so read via the system context.\n const result = await this.systemAccessService.listAsSystem<OrganizationMember>(\n CoreResourceType.ORGANIZATION_MEMBERS,\n { userId: params.callerUserId, status: OrganizationMemberStatus.INVITED },\n );\n const memberships = Array.isArray(result) ? result : result.data;\n\n return Promise.all(memberships.map(async (membership): Promise<MyPendingInvitation> => {\n let organizationName: string \| undefined;\n try {\n const org = await this.systemAccessService.readAsSystem<{ displayName?: string; name?: string }>(\n CoreResourceType.ORGANIZATIONS,\n { _id: membership.organizationId },\n );\n organizationName = org?.displayName ?? org?.name ?? undefined;\n } catch {\n organizationName = undefined;\n }\n return {\n membershipId: membership._id,\n organizationId: membership.organizationId,\n organizationName,\n roles: membership.roles ?? [],\n createdAt: membership.createdAt ? new Date(membership.createdAt).toISOString() : undefined,\n };\n }));\n }\n\n /\n In-app authenticated accept (Approach P) — accept ONE of the caller's own pending\n * invitations by membership id, WITHOUT a token and WITHOUT issuing a new session (the\n * caller is already authenticated). Authorization = userId-ownership of the INVITED row.\n * The shared `applyInvitationAcceptanceCore` flips it to ACTIVE + grants org-join types.\n /\n async acceptMyInvitation(\n ec: ExecutionContext<any>,\n params: { callerUserId: string; membershipId: string },\n ): Promise<{ accepted: true; organizationId: string }> {\n const { caller, membership } = await this.loadOwnedPendingInvitation(ec, params.callerUserId, params.membershipId);\n\n await this.resourcePersistenceUnitOfWork.executeTransaction(\n createAuthenticatedInvitationAcceptancePersistenceRequest(),\n async serviceOptions => {\n // MongoDB does not support concurrent operations on the same session.\n // Sequential reads are portable across both supported adapters.\n const currentCaller = await this.servicesRegistryHandler.read<User>(\n CoreResourceType.USERS,\n ec,\n { _id: caller._id },\n serviceOptions,\n );\n const currentMembership =\n await this.systemAccessService.readAsSystem<OrganizationMember>(\n CoreResourceType.ORGANIZATION_MEMBERS,\n { _id: membership._id },\n serviceOptions,\n );\n if (\n !currentCaller\n \|\| !currentMembership\n \|\| currentMembership.userId !== currentCaller._id\n \|\| currentMembership.status !== OrganizationMemberStatus.INVITED\n ) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n const { membershipActivated } = await applyInvitationAcceptanceCore(ec, {\n membership: currentMembership,\n user: currentCaller,\n appConfigService: this.appConfigService,\n errorBuilder: this.errorBuilder,\n servicesRegistryHandler: this.servicesRegistryHandler,\n systemAccessService: this.systemAccessService,\n serviceOptions,\n logDebug: this.logDebug,\n });\n if (!membershipActivated) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n },\n );\n\n this.logDebug('Invitation accepted in-app', {\n membershipId: membership._id,\n userId: caller._id,\n organizationId: membership.organizationId,\n });\n\n return { accepted: true, organizationId: membership.organizationId };\n }\n\n /\n In-app authenticated reject (Approach P) — decline ONE of the caller's own pending\n * invitations by membership id. Same userId-ownership gate as `acceptMyInvitation`. In the\n * junction model the decline REVOKEs the INVITED row (which revokes its accept token via\n * the invitation-cancellation prefix) rather than setting a terminal status.\n /\n async rejectMyInvitation(\n ec: ExecutionContext<any>,\n params: { callerUserId: string; membershipId: string; rejectionReason?: string },\n ): Promise<{ rejected: true; organizationId: string }> {\n const { membership } = await this.loadOwnedPendingInvitation(ec, params.callerUserId, params.membershipId);\n\n await this.applyInvitationRejectionCore(ec, { membership, rejectionReason: params.rejectionReason });\n\n return { rejected: true, organizationId: membership.organizationId };\n }\n\n /\n Load + authorize one of the caller's own pending invitations (INVITED membership rows)\n * for the in-app (authenticated, tokenless) accept/reject flow. Reads the caller + the\n * membership via the cross-org system context, then enforces:\n * 1. userId-ownership — `membership.userId === caller._id` (else 403 AUTHORIZATION);\n * 2. INVITED status (else AUTHENTICATION \"no longer valid\", matching the token flow).\n \n \"Not found\" and \"not addressed to you\" deliberately surface the SAME ownership error so\n * a caller cannot probe for the existence of other people's invitations.\n /\n private async loadOwnedPendingInvitation(\n ec: ExecutionContext<any>,\n callerUserId: string,\n membershipId: string,\n ): Promise<{ caller: User; membership: OrganizationMember }> {\n const caller = await this.userLookup.findUserById(ec, callerUserId);\n if (!caller) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, ec, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_FOUND,\n });\n }\n\n const membership = await this.systemAccessService.readAsSystem<OrganizationMember>(\n CoreResourceType.ORGANIZATION_MEMBERS,\n { _id: membershipId },\n );\n\n if (!membership \|\| membership.userId !== caller._id) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, ec, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NOT_ADDRESSED_TO_CALLER,\n });\n }\n\n if (membership.status !== OrganizationMemberStatus.INVITED) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, ec, {\n customMessageReference: ErrorCustomMessageReference.INVITATION_NO_LONGER_VALID,\n });\n }\n\n return { caller, membership };\n }\n\n /\n W5.7: Complete org onboarding — called by the guidance/onboarding flow\n * after collecting the organization name from the user.\n * Creates the deferred org, grants user types, issues tokens, transitions session to COMPLETED.\n */\n async completeOrgOnboarding(\n ec: ExecutionContext<any>,\n params: {\n sessionId: string;\n organizationName: string;\n },\n ): Promise<{\n sessionId: string;\n state: string;\n nextStep?: string;\n organizationId?: string;\n accessToken?: string;\n refreshToken?: string;\n expiresIn?: number;\n }> {\n const session = await this.authOrchestrator.completeOrgOnboarding(\n ec,\n params.sessionId,\n params.organizationName,\n );\n\n if (session.state === AuthenticationSessionState.COMPLETED && session.userId) {\n const tokenResult = await this.tokenIssuer.issueTokensForUser(session.userId, undefined, {\n lastAuthenticatedAt: Math.floor(Date.now() / 1000),\n });\n return {\n sessionId: session.sessionId,\n state: session.state,\n nextStep: session.nextStep,\n organizationId: session.organizationId,\n accessToken: tokenResult.accessToken,\n refreshToken: tokenResult.refreshToken,\n expiresIn: tokenResult.expiresIn,\n };\n }\n\n return {\n sessionId: session.sessionId,\n state: session.state,\n nextStep: session.nextStep,\n organizationId: session.organizationId,\n };\n }\n}\n"]}