@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

package/dist/esm/security/authentications/services/auth-methods/oauth2-authentication.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2-authentication.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/oauth2-authentication.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAO9G,OAAO,EACL,sCAAsC,EACtC,yCAAyC,EACzC,iCAAiC,GAClC,MAAM,4FAA4F,CAAC;AACpG,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AAExI,OAAO,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AACtG,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AACzJ,OAAO,EAAE,wCAAwC,EAAE,MAAM,gHAAgH,CAAC;AAC1K,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EACL,wBAAwB,EACxB,+BAA+B,EAC/B,gBAAgB,EAChB,SAAS,EACT,2BAA2B,EAC3B,cAAc,EAEd,UAAU,EACV,wBAAwB,EACxB,UAAU,EACV,aAAa,EAEb,iBAAiB,EACjB,8BAA8B,EAC9B,2BAA2B,EAC3B,gCAAgC,EAChC,mBAAmB,EACnB,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,6BAA6B,EAC7B,+CAA+C,GAChD,MAAM,+EAA+E,CAAC;AACvF,OAAO,EAAE,oCAAoC,EAAE,MAAM,8FAA8F,CAAC;AACpJ,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAUxD,OAAO,EAEL,oCAAoC,GACrC,MAAM,mFAAmF,CAAC;AAG3F,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,WAAW;IACX,cAAc;IACd,OAAO;IACP,OAAO;IACP,eAAe;IACf,gBAAgB;IAChB,uBAAuB;CACxB,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,YAAY;IACZ,MAAM;IACN,cAAc;IACd,WAAW;IACX,eAAe;IACf,eAAe;CAChB,CAAC,CAAC;AAEH;;;;;;;GAOG;AAEI,IAAM,kCAAkC,GAAxC,MAAM,kCAAkC;IAYS;IACU;IACG;IACW;IACH;IACL;IACS;IAEP;IAES;IAEjB;IAOG;IAEhD;IAhCF,QAAQ,CAA+D;IAExF;;;;;OAKG;IACc,UAAU,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEzD,YACsD,MAAqB,EACX,gBAAyC,EACtC,YAAwC,EAC7B,uBAA8D,EACjE,aAAwD,EAC7D,sBAAqD,EAC5C,QAAgD,EAEvD,iBAAkD,EAEzC,sBAAgE,EAEjF,gBAAyC,EAOtC,mBAA+C,EAE/F,6BAA0E;QArBvC,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QACtC,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,4BAAuB,GAAvB,uBAAuB,CAAuC;QACjE,kBAAa,GAAb,aAAa,CAA2C;QAC7D,2BAAsB,GAAtB,sBAAsB,CAA+B;QAC5C,aAAQ,GAAR,QAAQ,CAAwC;QAEvD,sBAAiB,GAAjB,iBAAiB,CAAiC;QAEzC,2BAAsB,GAAtB,sBAAsB,CAA0C;QAEjF,qBAAgB,GAAhB,gBAAgB,CAAyB;QAOtC,wBAAmB,GAAnB,mBAAmB,CAA4B;QAE/F,kCAA6B,GAA7B,6BAA6B,CAA6C;QAE3F,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;IAED,kEAAkE;IAClE,6BAA6B;IAC7B,kEAAkE;IAElE;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,qBAAqB,CAChC,UAAoC,EACpC,OAA2G;QAE3G,0CAA0C;QAC1C,IAAI,YAAgC,CAAC;QACrC,IAAI,aAAiC,CAAC;QACtC,IAAI,mBAAuC,CAAC;QAE5C,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YAC1B,YAAY,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC3C,IAAI,UAAU,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;gBACrC,aAAa,GAAG,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;gBACzD,mBAAmB,GAAG,MAAM,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACN,aAAa,GAAG,YAAY,CAAC;gBAC7B,mBAAmB,GAAG,OAAO,CAAC;YAChC,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,MAAM,aAAa,GAA6B;YAC9C,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,YAAY;YACZ,mBAAmB,EAAE,OAAO,EAAE,mBAAmB;YACjD,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,UAAU,CAAC,KAAK,EAAE,SAAS;YAC5D,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,UAAU,CAAC,KAAK,EAAE,OAAO;YACtD,SAAS,EAAE,OAAO,EAAE,SAAS;YAC7B,YAAY,EAAE,UAAU,CAAC,KAAK,EAAE,YAAY;SAC7C,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;YAC/D,SAAS,EAAE,wBAAwB,CAAC,YAAY;YAChD,eAAe,EAAE,+BAA+B,CAAC,eAAe;YAChE,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;YACpD,QAAQ,EAAE,aAA+C;SAC1D,CAAC,CAAC;QAEH,0BAA0B;QAC1B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,UAAU,CAAC,QAAQ;YAC9B,YAAY,EAAE,UAAU,CAAC,WAAW;YACpC,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAClC,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,aAAa,EAAE,MAAM;SACtB,CAAC,CAAC;QAEH,IAAI,aAAa,IAAI,mBAAmB,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;YAC5C,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,mBAAmB,CAAC,CAAC;QAC3D,CAAC;QAED,0BAA0B;QAC1B,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;YAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACtE,IAAI,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wDAAwD,EAAE;wBACzE,WAAW,EAAE,UAAU,CAAC,WAAW;wBACnC,GAAG;qBACJ,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GAAG,GAAG,UAAU,CAAC,gBAAgB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QAE/E,IAAI,CAAC,QAAQ,CAAC,yBAAyB,EAAE;YACvC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,IAAI,EAAE,CAAC,CAAC,YAAY;SACrB,CAAC,CAAC;QAEH,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;IACvD,CAAC;IAED,kEAAkE;IAClE,qBAAqB;IACrB,kEAAkE;IAElE;;;;;;OAMG;IACI,KAAK,CAAC,cAAc,CACzB,cAAoC;QAEpC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC;QAE7C,6EAA6E;QAC7E,IAAI,aAA8B,CAAC;QACnC,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,gFAAgF;QAChF,+EAA+E;QAC/E,IAAI,aAAa,CAAC,SAAS,KAAK,wBAAwB,CAAC,YAAY,EAAE,CAAC;YACtE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAG,aAAa,CAAC,QAA+C,CAAC;QAEpF,uDAAuD;QACvD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;QAE3E,oEAAoE;QACpE,IAAI,UAAU,CAAC,QAAQ,KAAK,aAAa,CAAC,QAAQ,EAAE,CAAC;YACnD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,4CAA4C;QAC5C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,qBAAqB,CACpD,IAAI,EACJ,UAAU,EACV,aAAa,CAAC,YAAY,CAC3B,CAAC;QAEF,kDAAkD;QAClD,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,kBAAkB,CACrD,aAAa,EACb,UAAU,EACV,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,+BAA+B,EAAE;YAC7C,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,KAAK,EAAE,iBAAiB,CAAC,KAAK;YAC9B,aAAa,EAAE,iBAAiB,CAAC,aAAa;SAC/C,CAAC,CAAC;QAEH,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;IAC1D,CAAC;IAED,kEAAkE;IAClE,4BAA4B;IAC5B,kEAAkE;IAElE;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACI,KAAK,CAAC,mBAAmB,CAC9B,OAA8B,EAC9B,UAAqC,EACrC,mBAA4B;QAE5B,OAAO,IAAI,CAAC,0BAA0B,CACpC,OAAO,EACP,UAAU,EACV,mBAAmB,EACnB,IAAI,CACL,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,0BAA0B,CACtC,OAA8B,EAC9B,UAAqC,EACrC,mBAAuC,EACvC,gCAAyC;QAEzC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,IAAI,UAAU,CAAC,cAAc,KAAK,iBAAiB,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACpF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,MAAM,EAAE,qCAAqC;oBAC7C,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B;aACF,CAAC,CAAC;QACL,CAAC;QAED,mDAAmD;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;YAClF,IACE,WAAW,EAAE,WAAW,EAAE,UAAU;mBACjC,UAAU,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM,EACzD,CAAC;gBACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;iBACjF,CAAC,CAAC;YACL,CAAC;YAED,iEAAiE;YACjE,IAAI,WAAW,IAAI,UAAU,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;gBAC1E,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAC/D,EAAE,EACF,WAAW,CAAC,SAAS,EACrB,WAAW,CAAC,OAAO,EACnB,UAAU,CAAC,WAAW,CACvB,CAAC;gBACF,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC;wBACnD,KAAK,EAAE,OAAO,CAAC,KAAK;wBACpB,WAAW,EAAE,UAAU,CAAC,WAAW;wBACnC,SAAS,EAAE,WAAW,CAAC,SAAS;wBAChC,cAAc,EAAE,WAAW,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;4BAClE,CAAC,CAAC,WAAW,CAAC,OAAO;4BACrB,CAAC,CAAC,SAAS;wBACb,aAAa,EAAE,WAAW,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW;4BAChE,CAAC,CAAC,WAAW,CAAC,OAAO;4BACrB,CAAC,CAAC,SAAS;wBACb,MAAM,EAAE,MAAM,IAAI,qBAAqB;wBACvC,SAAS,EAAE,UAAU;wBACrB,SAAS,EAAE,UAAU;qBACtB,CAAC,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;wBAChF,OAAO,EAAE;4BACP,wBAAwB;4BACxB,MAAM,EAAE,MAAM,IAAI,qBAAqB;yBACxC;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,mDAAmD;QACnD,kFAAkF;QAClF,4EAA4E;QAC5E,6EAA6E;QAC7E,gFAAgF;QAChF,MAAM,YAAY,GAAG,UAAU,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM;YACzE,CAAC,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACvC,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF;gBACE,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,cAAc,EAAE,UAAU,CAAC,cAAc;aAC1C,CACF;YACD,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3H,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;oBAChF,OAAO,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE;iBAClD,CAAC,CAAC;YACL,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;gBAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;oBACjF,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE;iBAC3C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,CAAC,0BAA0B,CACnC,EAAE,EACF,YAAY,CAAC,MAAM,EACnB,mBAAmB,EACnB,UAAU,CAAC,cAAc,KAAK,iBAAiB,CAAC,UAAU;gBACxD,CAAC,CAAC,8BAA8B,CAAC,kBAAkB;gBACnD,CAAC,CAAC,8BAA8B,CAAC,gBAAgB,CACpD,CAAC;YAEF,mFAAmF;YACnF,wFAAwF;YACxF,qFAAqF;YACrF,kFAAkF;YAClF,sEAAsE;YACtE,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,YAAY,CAAC,GAAG,EAAE;gBACpG,UAAU,EAAE,IAAI,IAAI,EAAE;gBACtB,aAAa,EAAE,OAAO,CAAC,KAAK;gBAC5B,mBAAmB,EAAE,OAAO,CAAC,WAAW;gBACxC,iBAAiB,EAAE,OAAO,CAAC,SAAS;gBACpC,kBAAkB,EAAE,OAAO,CAAC,SAAS;aACtC,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,mDAAmD,EAAE;gBACjE,MAAM,EAAE,YAAY,CAAC,MAAM;gBAC3B,WAAW,EAAE,UAAU,CAAC,WAAW;aACpC,CAAC,CAAC;YAEH,2FAA2F;YAC3F,6FAA6F;YAC7F,yFAAyF;YACzF,4DAA4D;YAC5D,MAAM,oCAAoC,CAAC,EAAE,EAAE;gBAC7C,MAAM,EAAE,YAAY,CAAC,MAAM;gBAC3B,OAAO;gBACP,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;gBACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;YAEH,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC3D,CAAC;QAED,wEAAwE;QACxE,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QAC/D,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CACnD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,eAAe,KAAK,KAAK,CACtD,CAAC;QAEF,IACE,UAAU,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM;eACnD,eAAe,EAClB,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAEvI,IAAI,YAAY,EAAE,CAAC;gBACjB,2BAA2B;gBAC3B,qFAAqF;gBACrF,kFAAkF;gBAClF,mFAAmF;gBACnF,6EAA6E;gBAC7E,qEAAqE;gBACrE,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,KAAK,UAAU,CAAC,kBAAkB,CAAC;gBACjF,IAAI,YAAY,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBACrE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,MAAM,EAAE;qBAC7C,CAAC,CAAC;gBACL,CAAC;gBAED,mFAAmF;gBACnF,yEAAyE;gBACzE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;oBAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;qBACjF,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBACxB,MAAM,IAAI,CAAC,6BAA6B,CAAC,kBAAkB,CACzD,sCAAsC,EACtC,KAAK,EAAE,cAAc,EAAE,EAAE;wBACvB,MAAM,IAAI,CAAC,0BAA0B,CACnC,EAAE,EACF,YAAY,CAAC,GAAG,EAChB,mBAAmB,EACnB,8BAA8B,CAAC,gBAAgB,EAC/C,cAAc,CACf,CAAC;wBACF,MAAM,IAAI,CAAC,kBAAkB,CAC3B,YAAY,CAAC,GAAG,EAChB,OAAO,EACP,UAAU,EACV,cAAc,CACf,CAAC;oBACJ,CAAC,CACF,CAAC;gBACJ,CAAC;gBAED,wDAAwD;gBACxD,qFAAqF;gBACrF,yFAAyF;gBACzF,sFAAsF;gBACtF,sFAAsF;gBACtF,yDAAyD;gBACzD,IAAI,kBAAkB,EAAE,CAAC;oBACvB,MAAM,IAAI,CAAC,sCAAsC,CAC/C,EAAE,EACF,YAAY,EACZ,OAAO,EACP,UAAU,EACV,mBAAmB,CACpB,CAAC;gBACJ,CAAC;gBAED,2FAA2F;gBAC3F,8FAA8F;gBAC9F,uFAAuF;gBACvF,8FAA8F;gBAC9F,uEAAuE;gBACvE,MAAM,oCAAoC,CAAC,EAAE,EAAE;oBAC7C,MAAM,EAAE,YAAY,CAAC,GAAG;oBACxB,OAAO;oBACP,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;oBACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;oBAC7C,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,sBAAsB,EAAE;oBAClG,MAAM,EAAE,YAAY,CAAC,GAAG;oBACxB,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,KAAK,EAAE,OAAO,CAAC,KAAK;iBACrB,CAAC,CAAC;gBAEH,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACxD,CAAC;QACH,CAAC;QAED,oDAAoD;QACpD,IAAI,UAAU,CAAC,cAAc,KAAK,iBAAiB,CAAC,UAAU,EAAE,CAAC;YAC/D,MAAM,eAAe,GAAG,UAAU,CAAC,KAAK,CAAC;YACzC,2FAA2F;YAC3F,uFAAuF;YACvF,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;gBACnC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,OAAO,EAAE,EAAE,OAAO,EAAE,yEAAyE,EAAE;iBAChG,CAAC,CAAC;YACL,CAAC;YAED,sEAAsE;YACtE,MAAM,oBAAoB,GAAG,oCAAoC,CAAC,eAAe,CAAC,CAAC;YACnF,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAClJ,IAAI,uBAAuB,IAAI,oBAAoB,EAAE,CAAC;gBACpD,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,uBAAuB,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YAC7F,CAAC;YAED,uFAAuF;YACvF,oFAAoF;YACpF,MAAM,qCAAqC,GACzC,mBAAmB,IAAI,IAAI,CAAC,gBAAgB,CAAC,iCAAiC,EAAE,IAAI,SAAS,CAAC;YAChG,MAAM,gBAAgB,GAAG,qCAAqC;gBAC5D,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,sCAAsC,CAC5D,qCAAqC,CACtC,IAAI,SAAS;gBACd,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,uBAAuB,CACtE,OAAO,EACP,UAAU,EACV,UAAU,CAAC,kBAAkB,EAC7B,EAAE,gBAAgB,EAAE,CACrB,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE;gBAClD,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;gBACvB,SAAS,EAAE,eAAe,CAAC,SAAS;gBACpC,OAAO,EAAE,eAAe,CAAC,OAAO;gBAChC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,WAAW;aAC1B,CAAC,CAAC;YAEH,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC9D,CAAC;QAED,wDAAwD;QACxD,6EAA6E;QAC7E,4EAA4E;QAC5E,2EAA2E;QAC3E,8CAA8C;QAC9C,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,0FAA0F;QAC1F,4FAA4F;QAC5F,8FAA8F;QAC9F,qFAAqF;QACrF,MAAM,2BAA2B,GAC/B,mBAAmB,IAAI,IAAI,CAAC,gBAAgB,CAAC,iCAAiC,EAAE,IAAI,SAAS,CAAC;QAChG,MAAM,oBAAoB,GAAG,2BAA2B;YACtD,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,sCAAsC,CAAC,2BAA2B,CAAC;YAC3F,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,kBAAkB,GAAG,oBAAoB;YAC7C,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,YAAY;YACrD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,iCAAiC,GAAG,OAAO,CAC/C,2BAA2B;eACxB,oBAAoB;eACpB,IAAI,CAAC,gBAAgB,CAAC,qCAAqC,CAC5D,2BAA2B,EAC3B,oBAAoB,CACrB,EAAE,QAAQ,KAAK,IAAI,CACrB,CAAC;QACF,MAAM,gBAAgB,GAAG,kBAAkB,KAAK,SAAS;eACpD,iCAAiC;eACjC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC;eAChD,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;eACtE,gCAAgC,CACjC,kBAAkB,CAAC,IAAI,EACvB,8BAA8B,CAAC,gBAAgB,CAChD,CAAC;QAEJ,IAAI,CAAC,gBAAgB,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC/C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;aAClF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAa,CAAC;QAClB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,kBAAkB,CACnE,iCAAiC,EACjC,KAAK,EAAE,cAAc,EAAE,EAAE;gBACvB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAC3D,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF;oBACE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE;oBAClC,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,QAAQ,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBACnC,SAAS,EAAE,CAAC,oBAAoB,CAAC;iBAClC,EACD,cAAc,CACf,CAAC;gBACF,MAAM,IAAI,CAAC,kBAAkB,CAC3B,WAAW,CAAC,GAAG,EACf,OAAO,EACP,UAAU,EACV,cAAc,CACf,CAAC;gBACF,OAAO,WAAW,CAAC;YACrB,CAAC,EACD;gBACE,2BAA2B,EAAE;oBAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC;aACF,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,gBAAgB,GAAG,KAA4C,CAAC;YACtE,MAAM,gBAAgB,GACpB,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,CAAC;mBACrD,gBAAgB,CAAC,IAAI,KAAK,KAAK;mBAC/B,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,eAAe,CAAC,KAAK,IAAI;mBAC5D,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;YAC3D,IAAI,gBAAgB,IAAI,gCAAgC,EAAE,CAAC;gBACzD,IAAI,CAAC,QAAQ,CAAC,mFAAmF,EAAE;oBACjG,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,WAAW,EAAE,UAAU,CAAC,WAAW;iBACpC,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,0BAA0B,CACpC,OAAO,EACP,UAAU,EACV,mBAAmB,EACnB,KAAK,CACN,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE;YAC/C,MAAM,EAAE,OAAO,CAAC,GAAG;YACnB,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QAEH,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACK,KAAK,CAAC,0BAA0B,CACtC,EAAyB,EACzB,MAAc,EACd,mBAAuC,EACvC,kBAAkD,EAClD,cAA+B;QAE/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAClD,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,GAAG,EAAE,MAAM,EAAE,EACf,cAAc,CACf,CAAC;QACF,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM;YAAE,OAAO,CAAC,8DAA8D;QAEnG,MAAM,2BAA2B,GAC/B,mBAAmB,IAAI,IAAI,CAAC,gBAAgB,CAAC,iCAAiC,EAAE,IAAI,SAAS,CAAC;QAChG,MAAM,YAAY,GAAG,2BAA2B;YAC9C,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,sCAAsC,CAAC,2BAA2B,CAAC;YAC3F,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,QAAQ,CAAC,qEAAqE,EAAE;gBACnF,MAAM;gBACN,mBAAmB,EAAE,2BAA2B;aACjD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE;YAC/D,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS;YACxC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,WAAW,GAAG,2BAA2B,CAC7C,mBAAmB,EACnB,CAAC,YAAY,CAAC,EACd,IAAI,EAAE,SAAS,IAAI,EAAE,EACrB,kBAAkB,CACnB,CAAC;QACF,MAAM,kBAAkB,GAAG,mBAAmB,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC;QAClF,MAAM,oBAAoB,GAAG,kBAAkB,KAAK,8BAA8B,CAAC,gBAAgB;eAC9F,CACD,2BAA2B,KAAK,SAAS;mBACtC,IAAI,CAAC,gBAAgB,CAAC,qCAAqC,CAC5D,2BAA2B,EAC3B,YAAY,CACb,EAAE,QAAQ,KAAK,IAAI;mBACjB,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,cAAc,CAAC;mBACjD,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,CAC1E,CAAC;QACJ,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAClD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE;oBACP,OAAO,EAAE,kBAAkB;oBAC3B,eAAe,EAAE,WAAW,CAAC,eAAe;oBAC5C,YAAY;iBACb;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CACvC,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,MAAM,EACN,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,EAC7B,cAAc,CACf,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,qCAAqC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACnI,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACK,KAAK,CAAC,sCAAsC,CAClD,EAAyB,EACzB,IAAU,EACV,OAA8B,EAC9B,UAAqC,EACrC,mBAAuC;QAEvC,MAAM,cAAc,GAClB,MAAM,IAAI,CAAC,6BAA6B,CAAC,kBAAkB,CACzD,yCAAyC,EACzC,KAAK,EAAE,cAAc,EAAE,EAAE;YACvB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACzD,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EACjB,cAAc,CACf,CAAC;YACF,IAAI,WAAW,EAAE,MAAM,KAAK,UAAU,CAAC,kBAAkB,EAAE,CAAC;gBAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;oBACjF,OAAO,EAAE;wBACP,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,MAAM;wBACzC,MAAM,EAAE,oCAAoC;qBAC7C;iBACF,CAAC,CAAC;YACL,CAAC;YAED,4EAA4E;YAC5E,8EAA8E;YAC9E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CACxD,gBAAgB,CAAC,oBAAoB,EACrC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE,EAC9D,SAAS,EACT,cAAc,CACf,CAAC;YACF,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;YACxE,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;oBACjF,OAAO,EAAE;wBACP,UAAU,EAAE,WAAW,CAAC,MAAM;wBAC9B,MAAM,EAAE,6CAA6C;qBACtD;iBACF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,+CAA+C,CAAC;gBACpD,IAAI,EAAE,WAAW;gBACjB,eAAe,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC;gBAClF,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,cAAc;aACf,CAAC,CAAC;YAEH,IAAI,uBAAuB,GAAG,CAAC,CAAC;YAChC,KAAK,MAAM,UAAU,IAAI,kBAAkB,EAAE,CAAC;gBAC5C,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,6BAA6B,CAAC,EAAE,EAAE;oBACtE,UAAU;oBACV,IAAI,EAAE,WAAW;oBACjB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;oBACvC,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;oBACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;oBAC7C,cAAc;oBACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC,CAAC;gBACH,IAAI,mBAAmB,EAAE,CAAC;oBACxB,uBAAuB,IAAI,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YACD,IAAI,uBAAuB,KAAK,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,OAAO,EAAE;wBACP,MAAM,EAAE,kDAAkD;wBAC1D,MAAM,EAAE,IAAI,CAAC,GAAG;qBACjB;iBACF,CAAC,CAAC;YACL,CAAC;YAED,yFAAyF;YACzF,wFAAwF;YACxF,iFAAiF;YACjF,sFAAsF;YACtF,yFAAyF;YACzF,0FAA0F;YAC1F,uFAAuF;YACvF,8BAA8B;YAC9B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CACjE,gBAAgB,CAAC,KAAK,EACtB;gBACE,GAAG,EAAE,WAAW,CAAC,GAAG;gBACpB,MAAM,EAAE,UAAU,CAAC,kBAAkB;aACtC,EACD,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,EAC7B,cAAc,CACf,CAAC;YACF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;oBAChE,OAAO,EAAE;wBACP,MAAM,EAAE,6CAA6C;wBACrD,MAAM,EAAE,IAAI,CAAC,GAAG;qBACjB;iBACF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,CAAC,0BAA0B,CACnC,EAAE,EACF,IAAI,CAAC,GAAG,EACR,mBAAmB,EACnB,8BAA8B,CAAC,UAAU,EACzC,cAAc,CACf,CAAC;YACF,MAAM,IAAI,CAAC,kBAAkB,CAC3B,IAAI,CAAC,GAAG,EACR,OAAO,EACP,UAAU,EACV,cAAc,CACf,CAAC;YACF,OAAO,uBAAuB,CAAC;QACjC,CAAC,CACF,CAAC;QAEJ,IAAI,CAAC,QAAQ,CAAC,uDAAuD,EAAE;YACrE,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,KAAK,EAAE,cAAc;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,wBAAwB,CACpC,EAAyB,EACzB,MAAc,EACd,oBAA4B;QAE5B,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,KAAK;YAAE,OAAO;QAE1E,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAmB,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,EAAE;YAC1H,MAAM;YACN,cAAc,EAAE,iBAAiB,CAAC,UAAU;SAC7C,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAuB,IAAI,EAAE,CAAC;QAEhE,MAAM,eAAe,GAAG,eAAe,CAAC,IAAI,CAC1C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,KAAK,oBAAoB,CAC9E,CAAC;QAEF,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACzE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;aAC1E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,0BAA0B;IAC1B,kEAAkE;IAElE;;;OAGG;IACK,KAAK,CAAC,qBAAqB,CACjC,IAAY,EACZ,UAAoC,EACpC,YAAqB;QAErB,MAAM,UAAU,GAA2B;YACzC,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,UAAU,CAAC,WAAW;SACrC,CAAC;QAEF,IAAI,YAAY,EAAE,CAAC;YACjB,UAAU,CAAC,aAAa,GAAG,YAAY,CAAC;QAC1C,CAAC;QAED,2BAA2B;QAC3B,IAAI,UAAU,CAAC,gBAAgB,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACvE,IAAI,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;wBACjE,WAAW,EAAE,UAAU,CAAC,WAAW;wBACnC,GAAG;qBACJ,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAA2B;YACtC,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,mCAAmC;YACnE,GAAG,CAAC,UAAU,CAAC,mBAAmB,IAAI,EAAE,CAAC;SAC1C,CAAC;QAEF,wDAAwD;QACxD,QAAQ,UAAU,CAAC,uBAAuB,EAAE,CAAC;YAC3C,KAAK,oBAAoB;gBACvB,UAAU,CAAC,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC;gBAC3C,UAAU,CAAC,aAAa,GAAG,UAAU,CAAC,YAAY,CAAC;gBACnD,MAAM;YACR,KAAK,qBAAqB;gBACxB,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,GAAG,SAAS,MAAM,CAAC,IAAI,CAC3D,GAAG,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,YAAY,EAAE,CACpD,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvB,MAAM;YACR,KAAK,MAAM;gBACT,UAAU,CAAC,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC;gBAC3C,MAAM;QACV,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;SACjD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;gBAChD,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,KAAK,EAAE,SAAS;aACjB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;QACvE,IAAI,CAAC,QAAQ,CAAC,2BAA2B,EAAE;YACzC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,cAAc,EAAE,CAAC,CAAC,aAAa,CAAC,YAAY;YAC5C,UAAU,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ;SACrC,CAAC,CAAC;QAEH,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,kEAAkE;IAClE,8BAA8B;IAC9B,kEAAkE;IAElE;;;;;;;;;OASG;IACK,KAAK,CAAC,kBAAkB,CAC9B,aAAsC,EACtC,UAAoC,EACpC,YAAsC;QAEtC,IAAI,SAAS,GAA4B,EAAE,CAAC;QAE5C,0BAA0B;QAC1B,IAAI,UAAU,CAAC,cAAc,KAAK,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;YACvE,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,UAAU,CAAC,WAAW,EACtB,aAAa,CAAC,YAAsB,EACpC,UAAU,CACX,CAAC;QACJ,CAAC;aAAM,IAAI,UAAU,CAAC,cAAc,KAAK,UAAU,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC9E,4EAA4E;YAC5E,+EAA+E;YAC/E,mFAAmF;YACnF,IAAI,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;gBAC5C,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,aAAa,CAAC,QAAkB,EAChC,UAAU,CAAC,OAAO,EAClB,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,QAAQ,CACpB,CAAC;gBACJ,CAAC;gBAAC,OAAO,WAAW,EAAE,CAAC;oBACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE;wBACrD,WAAW,EAAE,UAAU,CAAC,WAAW;wBACnC,GAAG,2BAA2B,CAAC,WAAW,CAAC;qBAC5C,CAAC,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;qBACjF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE;oBAC1F,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO;oBAChC,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM;iBAC/B,CAAC,CAAC;gBACH,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,QAAkB,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,IAAI,YAAY,EAAE,IAAI,EAAE,CAAC;YACvB,IAAI,QAAiC,CAAC;YACtC,IAAI,OAAO,YAAY,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1C,IAAI,CAAC;oBACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAA4B,CAAC;gBACtE,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,QAAQ,CAAC,qEAAqE,EAAE;wBACnF,WAAW,EAAE,UAAU,CAAC,WAAW;qBACpC,CAAC,CAAC;oBACH,QAAQ,GAAG,EAAE,CAAC;gBAChB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,YAAY,CAAC,IAA+B,CAAC;YAC1D,CAAC;YAED,gEAAgE;YAChE,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAClB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAA+B,CAAC;gBACzD,IAAI,CAAC,SAAS,CAAC,kBAAkB,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;oBACvD,SAAS,CAAC,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC;gBACnD,CAAC;gBACD,IAAI,CAAC,SAAS,CAAC,iBAAiB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;oBACrD,SAAS,CAAC,iBAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;QAE/C,oDAAoD;QACpD,IAAI,UAAU,CAAC,cAAc,IAAI,aAAa,CAAC,YAAY,EAAE,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,cAAc,GAAG,IAAI,CAAC,4BAA4B,CAAC,UAAU,EAAE,UAAU,CAAC,cAAwB,CAAC,CAAC;gBAC1G,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE;oBACjD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,aAAa,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;iBAC/F,CAAC,CAAC;gBACH,IAAI,cAAc,CAAC,EAAE,EAAE,CAAC;oBACtB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAmE,CAAC;oBAC5G,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;oBACjE,IAAI,YAAY,EAAE,CAAC;wBACjB,SAAS,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC;wBAChE,SAAS,CAAC,UAAU,CAAC,cAAc,CAAC,aAAa,IAAI,gBAAgB,CAAC,GAAG,IAAI,CAAC;oBAChF,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,MAAM,OAAO,GAAG,UAAU,CAAC,cAAc,CAAC;QAE1C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACtF,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,IAAI,gBAAgB,CAAC,CAAC;QACjG,MAAM,aAAa,GAAG,gBAAgB,KAAK,IAAI,IAAI,gBAAgB,KAAK,MAAM,CAAC;QAE/E,sFAAsF;QACtF,IAAI,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEpG,+CAA+C;QAC/C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,kBAAkB;YAAE,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACjG,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,iBAAiB;YAAE,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAE7F,sCAAsC;QACtC,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1E,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAClC,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3B,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,8FAA8F;QAC9F,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;eAC9D,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;eAClE,CAAC,UAAU,CAAC,wBAAwB;gBACrC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,UAAU,CAAC,wBAAkC,CAAC,IAAI,EAAE,CAAC;gBAC3F,CAAC,CAAC,EAAE,CAAC;eACJ,KAAK,CAAC;QAEX,+DAA+D;QAC/D,MAAM,UAAU,GAAG,KAAK;eACnB,CAAC,UAAU,CAAC,kBAAkB;gBAC/B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,UAAU,CAAC,kBAA4B,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;gBACnG,CAAC,CAAC,EAAE,CAAC,CAAC;QAEV,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3G,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEnF,wDAAwD;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAuB,CAAC;QAE5E,oBAAoB;QACpB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9F,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnH,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEnH,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,cAAc;YACd,KAAK,EAAE,UAAU;YACjB,aAAa;YACb,SAAS,EAAE,SAAS,IAAI,SAAS;YACjC,QAAQ,EAAE,QAAQ,IAAI,SAAS;YAC/B,WAAW,EAAE,WAAW,IAAI,SAAS;YACrC,SAAS,EAAE,SAAS,IAAI,SAAS;YACjC,MAAM;YACN,KAAK;YACL,MAAM;YACN,UAAU,EAAE,UAAU,IAAI,SAAS;YACnC,UAAU,EAAE,UAAU,IAAI,SAAS;YACnC,SAAS;SACV,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,0BAA0B;IAC1B,kEAAkE;IAE1D,KAAK,CAAC,aAAa,CACzB,WAAmB,EACnB,WAAmB,EACnB,UAAoC;QAEpC,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,WAAW,EAAE;YACtC,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QAEF,gEAAgE;QAChE,IAAI,UAAU,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;YAC3C,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,mBAAmB,CAAC,MAAM,CAAC;QACzD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE,EAAE,OAAO,EAAE,8BAA8B,QAAQ,CAAC,MAAM,EAAE,EAAE;aACtE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;IAC1D,CAAC;IAED,kEAAkE;IAClE,kCAAkC;IAClC,kEAAkE;IAE1D,KAAK,CAAC,kBAAkB,CAC9B,MAAc,EACd,OAA8B,EAC9B,UAAqC,EACrC,cAA+B;QAE/B,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC3C,gBAAgB,CAAC,mBAAmB,EACpC;YACE,MAAM;YACN,cAAc,EAAE,iBAAiB,CAAC,MAAM;YACxC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,aAAa,EAAE,OAAO,CAAC,KAAK;YAC5B,mBAAmB,EAAE,OAAO,CAAC,WAAW;YACxC,iBAAiB,EAAE,OAAO,CAAC,SAAS;YACpC,kBAAkB,EAAE,OAAO,CAAC,SAAS;YACrC,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,EACD,cAAc,CACf,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,6BAA6B;IAC7B,kEAAkE;IAElE;;;;OAIG;IACK,KAAK,CAAC,2BAA2B;QACvC,OAAO,IAAI,CAAC,aAAa,CAAC,yBAAyB,CAAC,IAAI,CAAC,aAAa,CAAC,yBAAyB,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,kEAAkE;IAClE,wBAAwB;IACxB,kEAAkE;IAE1D,oBAAoB;QAC1B,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAEO,qBAAqB,CAAC,QAAgB;QAC5C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1E,CAAC;IAED,kEAAkE;IAClE,oCAAoC;IACpC,kEAAkE;IAE1D,4BAA4B,CAAC,UAAoC,EAAE,QAAgB;QACzF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,mFAAmF;oBACnF,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,MAAM,EAAE,yBAAyB;iBAClC;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG;YACnB,UAAU,CAAC,gBAAgB;YAC3B,UAAU,CAAC,QAAQ;YACnB,UAAU,CAAC,WAAW;SACvB;aACE,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,GAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;QAExC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,mFAAmF;oBACnF,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,MAAM,EAAE,gCAAgC;oBACxC,IAAI,EAAE,MAAM,CAAC,QAAQ;iBACtB;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,MAA+B,EAAE,IAAY;QAChE,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,OAAO,GAAY,MAAM,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC/F,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,MAA+B,EAAE,IAAY;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,OAAe;QACnC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACrE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,aAAa,CACzB,OAAe,EACf,OAAe,EACf,MAAyB,EACzB,QAA2B;QAE3B,MAAM,EAAE,SAAS,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAE/D,IAAI,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,IAAuC,EAAE;YACpF,MAAM;YACN,QAAQ;YACR,WAAW,EAAE,WAAW;SACzB,CAAC,CAAC;QAEH,OAAO,OAAkC,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACK,kBAAkB,CAAC,GAAW;QACpC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAE5B,wEAAwE;YACxE,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAChE,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,uEAAuE;YACvE,+EAA+E;YAC/E,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC7C,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvD,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACxF,IAAI,eAAe,EAAE,CAAC;gBACpB,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YAChC,CAAC;YAED,IAAI,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5C,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,wBAAwB,CAAC,QAAgB;QAC/C,oEAAoE;QACpE,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,kBAAkB,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAE9D,WAAW;QACX,IAAI,kBAAkB,KAAK,WAAW,IAAI,kBAAkB,KAAK,WAAW,IAAI,kBAAkB,KAAK,SAAS,IAAI,kBAAkB,KAAK,KAAK,EAAE,CAAC;YACjJ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,qCAAqC;QACrC,IAAI,kBAAkB,KAAK,IAAI,IAAI,kBAAkB,KAAK,iBAAiB,IAAI,kBAAkB,KAAK,iBAAiB,EAAE,CAAC;YACxH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,oEAAoE;QACpE,IAAI,kBAAkB,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,0BAA0B;QAC1B,IAAI,kBAAkB,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACtF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,4CAA4C;QAC5C,IAAI,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9D,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE;gBAAE,OAAO,IAAI,CAAC;QAChD,CAAC;QAED,8BAA8B;QAC9B,IAAI,kBAAkB,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,sEAAsE;QACtE,IAAI,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9D,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,GAAG;gBAAE,OAAO,IAAI,CAAC;QACjD,CAAC;QAED,mBAAmB;QACnB,IACE,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACrC,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC;YACxC,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC;YACzC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC;YACvC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC;YACpC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACrC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACK,mBAAmB,CAAC,QAAgB;QAC1C,wDAAwD;QACxD,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;gBAClC,OAAO,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;YAC7F,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;gBAClC,OAAO,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;YAC7F,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAClC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;gBAClC,OAAO,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;YAC7F,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAA;AAx/CY,kCAAkC;IAD9C,UAAU,EAAE;IAaR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,+BAA+B,CAAC,CAAA;IAE1D,WAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IAEnD,WAAA,MAAM,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,CAAA;IAE5D,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAO3C,YAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;qCApBJ,aAAa;QACO,uBAAuB;QACxB,0BAA0B,YAEjB,yCAAyC;QACrC,6BAA6B;QAClC,sCAAsC;QAEpC,+BAA+B;QAEjB,wCAAwC;QAE/D,uBAAuB;GAxB9F,kCAAkC,CAw/C9C","sourcesContent":["/**\n * OAuth2AuthenticationBackendService\n *\n * Generic OAuth2/OIDC engine parameterized by OAuth2ResolvedConnection.\n * Handles: authorization URL building, callback processing (code exchange +\n * profile extraction), and user provisioning/linking.\n *\n * This service is provider-agnostic — it operates solely on the resolved\n * connection config. Adding enterprise SSO (Step 15) means adding a new\n * resolver; the engine code does not change.\n *\n * Key design decisions:\n * - TRAP 12: Uses `issueTokensForUser(userId, sessionId?)` — NOT `issueTokens(session)`\n * - TRAP 13: Audit logging is generally caller-driven, EXCEPT for security policy enforcement\n *   rejections (G3 provider restrictions) which audit directly for defense-in-depth.\n * - TRAP 9: Does NOT depend on AuthenticationOrchestrator (one-way dependency arrows)\n * - Critical Note #3: Uses INTERNALLY_INITIATED_REQUEST execution context\n * - Critical Note #4: Domain-to-org lookup — bound since Step 14\n *\n * Browser-only — the framework targets web stacks exclusively\n * (`AppFrontendType` ∈ { SAAS_APP, STATIC_WEBSITE, TECH_DOC }), so the\n * authorization-URL → IdP-callback → token-exchange flow is the single\n * supported OAuth2 pathway. No native-SDK / Capacitor / Electron variants\n * exist; this service does not validate native SDK identity tokens.\n */\n\nimport 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport * as crypto from 'crypto';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { ServiceOptions } from '~wildo-backend-lib/base-classes/models/repositories.backend.schemas';\nimport type {\n  ResourcePersistenceUnitOfWorkBackendService,\n} from '~wildo-backend-lib/databases/services/resource-persistence-unit-of-work.backend.service';\nimport {\n  SOCIAL_EXISTING_USER_LINK_UNIT_OF_WORK,\n  SOCIAL_INVITATION_ACCEPTANCE_UNIT_OF_WORK,\n  SOCIAL_USER_CREATION_UNIT_OF_WORK,\n} from '~wildo-backend-lib/security/authentications/models/identity-persistence-boundaries.backend';\nimport { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport { ConsumableTokenBackendService } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport type { ConsumableToken } from '~wildo-backend-lib/security/consumable-tokens/models/consumable-tokens.shared.schemas';\nimport { OAuth2ConnectionResolverBackendService } from './oauth2-connection-resolver.backend.service';\nimport { DomainToOrgLookupBackendService } from '~wildo-backend-lib/security/authentications/services/admin-config/domain-to-org-lookup.backend.service';\nimport { EnterpriseUserProvisioningBackendService } from '~wildo-backend-lib/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport {\n  CoreConsumableTokenTypes,\n  ConsumableToken_ConsumptionMode,\n  CoreResourceType,\n  ErrorType,\n  ErrorCustomMessageReference,\n  CORE_APP_ROLES,\n  User,\n  UserStatus,\n  OrganizationMemberStatus,\n  AuthMethod,\n  AuthScopeType,\n  ExternalIdentitySource,\n  SsoConnectionType,\n  RegistrationAcquisitionChannel,\n  evaluateUserTypeAcquisition,\n  isRegistrationAcquisitionAllowed,\n  isWildoBackendError,\n  WildoHeaderKeys,\n} from '@wildo-ai/saas-models';\nimport type { UserIdentityLink, OrganizationMember } from '@wildo-ai/saas-models';\nimport {\n  applyInvitationAcceptanceCore,\n  assertInvitationBatchUserTypeAcquisitionAllowed,\n} from '~wildo-backend-lib/organizations/services/invitation-acceptance.backend.utils';\nimport { ensureUserProfileFromIdentityProfile } from '~wildo-backend-lib/security/authentications/services/utils/ensure-user-profile.backend.utils';\nimport { DurationUnit } from '@wildo-ai/zod-decorators';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type {\n  OAuth2ResolvedConnection,\n  NormalizedUserProfile,\n  OAuth2CallbackParams,\n  OAuth2StateTokenMetadata,\n  OAuth2ProvisionResult,\n\n} from '~wildo-backend-lib/security/authentications/models/oauth2-connection.backend.schemas';\nimport {\n  getApplicationIdFromEnterpriseScope,\n  getOrganizationIdFromEnterpriseScope,\n} from '~wildo-backend-lib/security/authentications/models/sso-connection.backend.schemas';\nimport type { SSOResolvedConnectionBase } from '~wildo-backend-lib/security/authentications/models/sso-connection.backend.schemas';\n\nconst RESERVED_AUTH_PARAM_KEYS = new Set([\n  'client_id',\n  'redirect_uri',\n  'scope',\n  'state',\n  'response_type',\n  'code_challenge',\n  'code_challenge_method',\n]);\n\nconst RESERVED_TOKEN_PARAM_KEYS = new Set([\n  'grant_type',\n  'code',\n  'redirect_uri',\n  'client_id',\n  'client_secret',\n  'code_verifier',\n]);\n\n/**\n * Provider-agnostic OAuth2 engine.\n *\n * Methods:\n * - buildAuthorizationUrl(connection) — generates the IdP redirect URL with state + PKCE\n * - handleCallback(callbackParams) — exchanges code, extracts profile\n * - provisionOrLinkUser(profile, connection, frontendServiceName?) — JIT provisioning or identity link (assigns the base user type)\n */\n@injectable()\nexport class OAuth2AuthenticationBackendService {\n  private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  /**\n   * Per-jwksUri cache for `createRemoteJWKSet` functions.\n   * Avoids recreating the function (and losing jose's internal key cache) on each login.\n   * The jose library's `createRemoteJWKSet` handles key rotation internally\n   * (refetch on kid miss), so caching the function instance is safe and long-lived.\n   */\n  private readonly _jwksCache = new Map<string, unknown>();\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n    @inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory) private readonly authEcFactory: AuthExecutionContextFactoryBackendService,\n    @inject(SAAS_SERVICE_TYPES.ConsumableTokenService) private readonly consumableTokenService: ConsumableTokenBackendService,\n    @inject(SAAS_SERVICE_TYPES.OAuth2ConnectionResolverService) private readonly resolver: OAuth2ConnectionResolverBackendService,\n    // Domain-to-org lookup — bound since Step 14. Provides SSO enforcement check for social logins.\n    @inject(SAAS_SERVICE_TYPES.DomainToOrgLookupService) private readonly domainToOrgLookup: DomainToOrgLookupBackendService,\n    // Enterprise user provisioning — Step 15. JIT provisioning for org users.\n    @inject(SAAS_SERVICE_TYPES.EnterpriseUserProvisioningService) private readonly enterpriseProvisioning: EnterpriseUserProvisioningBackendService,\n    // G3: Audit logging for security policy enforcement (provider restrictions)\n    @inject(SAAS_SERVICE_TYPES.AuditLogsService) private readonly auditLogsService: AuditLogsBackendService,\n    // Trusted in-process writes to system resources whose client-shaped CREATE/UPDATE\n    // DTO strips context FKs (`userId`/`organizationId`) and backend-only fields\n    // (`providerRawProfile`): USER_PROFILES + USER_IDENTITY_LINKS. Provisioning runs on a\n    // request-context-less pre-auth EC, so `createAsSystem`/`updateAsSystem` re-attach the\n    // stripped fields past the strict-DTO parse (fail-closed `systemAccessPolicy` opt-in).\n    // Reads stay on the caller EC.\n    @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourcePersistenceUnitOfWorkService)\n    private readonly resourcePersistenceUnitOfWork: ResourcePersistenceUnitOfWorkBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('OAuth2Authentication');\n    this.logger.setDebugTypeLogging('OAuth2Authentication', false);\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // 1. Build Authorization URL\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Generate the OAuth2 authorization URL for redirecting to the IdP.\n   * Creates PKCE challenge (if supported) and stores state + context in a consumable token.\n   *\n   * The state token captures all context needed by the callback handler to re-resolve\n   * the same connection configuration (including P3 credential overrides).\n   *\n   * @param options.frontendServiceName - Frontend service identity (stored in state, used to redirect back on callback)\n   * @param options.scopeType - 'organization' or 'application' — stored in the state token so\n   *   resolveFromState() can re-apply the correct scope overrides on callback.\n   *   Falls back to connection.scope.scopeType for enterprise connections.\n   * @param options.scopeId - Org/app ID — stored in the state token alongside scopeType.\n   *   Falls back to connection.scope.scopeId for enterprise connections.\n   */\n  public async buildAuthorizationUrl(\n    connection: OAuth2ResolvedConnection,\n    options?: { frontendServiceName?: string; scopeType?: AuthScopeType; scopeId?: string; returnUrl?: string },\n  ): Promise<{ authorizationUrl: string; state: string }> {\n    // Generate PKCE code verifier + challenge\n    let pkceVerifier: string | undefined;\n    let codeChallenge: string | undefined;\n    let codeChallengeMethod: string | undefined;\n\n    if (connection.pkceMethod) {\n      pkceVerifier = this.generateCodeVerifier();\n      if (connection.pkceMethod === 'S256') {\n        codeChallenge = this.generateS256Challenge(pkceVerifier);\n        codeChallengeMethod = 'S256';\n      } else {\n        codeChallenge = pkceVerifier;\n        codeChallengeMethod = 'plain';\n      }\n    }\n\n    // Store state + PKCE verifier + connection context in consumable token\n    const stateMetadata: OAuth2StateTokenMetadata = {\n      connectionType: connection.connectionType,\n      providerRef: connection.providerRef,\n      clientId: connection.clientId,\n      responseMode: connection.responseMode,\n      redirectUri: connection.redirectUri,\n      initiatedAt: new Date().toISOString(),\n      pkceVerifier,\n      frontendServiceName: options?.frontendServiceName,\n      scopeType: options?.scopeType || connection.scope?.scopeType,\n      scopeId: options?.scopeId || connection.scope?.scopeId,\n      returnUrl: options?.returnUrl,\n      connectionId: connection.scope?.connectionId,\n    };\n\n    const stateToken = await this.consumableTokenService.createToken({\n      tokenType: CoreConsumableTokenTypes.OAUTH2_STATE,\n      consumptionMode: ConsumableToken_ConsumptionMode.EPHEMERAL_STATE,\n      expiresIn: { value: 10, unit: DurationUnit.MINUTES },\n      metadata: stateMetadata as unknown as Record<string, any>,\n    });\n\n    // Build authorization URL\n    const params = new URLSearchParams({\n      client_id: connection.clientId,\n      redirect_uri: connection.redirectUri,\n      scope: connection.scopes.join(' '),\n      state: stateToken.token,\n      response_type: 'code',\n    });\n\n    if (codeChallenge && codeChallengeMethod) {\n      params.set('code_challenge', codeChallenge);\n      params.set('code_challenge_method', codeChallengeMethod);\n    }\n\n    // Merge extra auth params\n    if (connection.extraAuthParams) {\n      for (const [key, value] of Object.entries(connection.extraAuthParams)) {\n        if (RESERVED_AUTH_PARAM_KEYS.has(key)) {\n          this.logger.warn('Ignoring reserved OAuth2 authorization extra parameter', {\n            providerRef: connection.providerRef,\n            key,\n          });\n          continue;\n        }\n        params.set(key, value);\n      }\n    }\n\n    const authorizationUrl = `${connection.authorizationUrl}?${params.toString()}`;\n\n    this.logDebug('Authorization URL built', {\n      providerRef: connection.providerRef,\n      connectionType: connection.connectionType,\n      pkce: !!pkceVerifier,\n    });\n\n    return { authorizationUrl, state: stateToken.token };\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // 2. Handle Callback\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Process the OAuth2 callback: validate state, exchange code for tokens,\n   * extract user profile.\n   *\n   * The callbackParams are extracted by the route handler from query params (GET)\n   * or body (POST), based on responseMode from the state token.\n   */\n  public async handleCallback(\n    callbackParams: OAuth2CallbackParams,\n  ): Promise<{ normalizedProfile: NormalizedUserProfile; connection: OAuth2ResolvedConnection; stateMetadata: OAuth2StateTokenMetadata }> {\n    const { code, state, body } = callbackParams;\n\n    // 1. Validate and consume the state token (single-use, prevents CSRF replay)\n    let consumedToken: ConsumableToken;\n    try {\n      consumedToken = await this.consumableTokenService.consumeToken(state);\n    } catch {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n      });\n    }\n\n    // Defense-in-depth: verify the consumed token is actually an OAUTH2_STATE token\n    // (prevents a PASSWORD_RESET or other token type from being accepted as state)\n    if (consumedToken.tokenType !== CoreConsumableTokenTypes.OAUTH2_STATE) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n      });\n    }\n\n    const stateMetadata = consumedToken.metadata as unknown as OAuth2StateTokenMetadata;\n\n    // 2. Re-resolve connection (ensures fresh credentials)\n    const ec = await this.getInternalExecutionContext();\n    const connection = await this.resolver.resolveFromState(ec, stateMetadata);\n\n    // 3. Verify clientId matches (detect config drift during auth flow)\n    if (connection.clientId !== stateMetadata.clientId) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n      });\n    }\n\n    // 4. Exchange authorization code for tokens\n    const tokenResponse = await this.exchangeCodeForTokens(\n      code,\n      connection,\n      stateMetadata.pkceVerifier,\n    );\n\n    // 5. Extract user profile based on identitySource\n    const normalizedProfile = await this.extractUserProfile(\n      tokenResponse,\n      connection,\n      body,\n    );\n\n    this.logDebug('Callback handled successfully', {\n      providerRef: connection.providerRef,\n      email: normalizedProfile.email,\n      emailVerified: normalizedProfile.emailVerified,\n    });\n\n    return { normalizedProfile, connection, stateMetadata };\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // 3. Provision or Link User\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * JIT provisioning: find existing user or create new one, create identity link.\n   *\n   * 1. Enterprise SSO enforcement check (blocks social login if org requires SSO)\n   * 2. Check for existing identity link (providerRef + providerUserId + connectionType)\n   * 3. Check for existing user by verified email (auto-link)\n   * 4. Enterprise provisioning branch (delegates to EnterpriseUserProvisioningService)\n   * 5. Social provisioning: create user only when the target type permits social-OAuth JIT\n   *\n   * All DB operations use INTERNALLY_INITIATED_REQUEST execution context\n   * (the user isn't authenticated yet at callback time).\n   *\n   * Every return point funnels through {@link ensureBaseUserTypeAssigned}: a user\n   * provisioned or linked here must leave with a non-empty `userTypes[]`, because\n   * the callback gates session issuance on the active user type resolving to a\n   * frontend-service entry with `auth: true`. See that helper for the base-vs-grant\n   * source-of-truth rationale.\n   *\n   * @param frontendServiceName - Identity of the frontend that initiated the flow\n   *   (carried in the OAuth2 state token). Used to resolve the base user type to\n   *   assign, mirroring the PASSWORD-registration path. Optional: falls back to the\n   *   app default frontend when absent.\n   */\n  public async provisionOrLinkUser(\n    profile: NormalizedUserProfile,\n    connection: SSOResolvedConnectionBase,\n    frontendServiceName?: string,\n  ): Promise<OAuth2ProvisionResult> {\n    return this.provisionOrLinkUserAttempt(\n      profile,\n      connection,\n      frontendServiceName,\n      true,\n    );\n  }\n\n  /**\n   * Perform one provisioning attempt, with at most one bounded reconciliation pass.\n   *\n   * `users.email` and the identity-link business key are database-unique. Two first\n   * social callbacks can therefore both observe \"absent\" before one transaction wins.\n   * The losing transaction must re-enter the complete policy/status/linking path after\n   * the winner commits; returning an arbitrary existing user or blindly retrying the\n   * insert would either bypass acquisition policy or loop forever when email auto-link\n   * is intentionally disabled.\n   */\n  private async provisionOrLinkUserAttempt(\n    profile: NormalizedUserProfile,\n    connection: SSOResolvedConnectionBase,\n    frontendServiceName: string | undefined,\n    mayReconcileSocialCreateConflict: boolean,\n  ): Promise<OAuth2ProvisionResult> {\n    const ec = await this.getInternalExecutionContext();\n    if (connection.connectionType === SsoConnectionType.ENTERPRISE && !connection.scope) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        context: {\n          reason: 'enterprise_connection_scope_missing',\n          providerRef: connection.providerRef,\n          source: connection.source,\n        },\n      });\n    }\n\n    // ─── Step 1: Enterprise SSO Enforcement Check ───\n    const emailDomain = profile.email.split('@')[1];\n    if (emailDomain) {\n      const claimingOrg = await this.domainToOrgLookup.findOrgByDomain(ec, emailDomain);\n      if (\n        claimingOrg?.enforcement?.requireSSO\n        && connection.connectionType === SsoConnectionType.SOCIAL\n      ) {\n        throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n        });\n      }\n\n      // ─── Step 1b: Scope-Level OAuth2 Provider Restrictions (G3) ───\n      if (claimingOrg && connection.connectionType === SsoConnectionType.SOCIAL) {\n        const { allowed, reason } = await this.resolver.isProviderAllowed(\n          ec,\n          claimingOrg.scopeType,\n          claimingOrg.scopeId,\n          connection.providerRef,\n        );\n        if (!allowed) {\n          await this.auditLogsService.logOAuth2ProviderBlocked({\n            email: profile.email,\n            providerRef: connection.providerRef,\n            scopeType: claimingOrg.scopeType,\n            organizationId: claimingOrg.scopeType === AuthScopeType.ORGANIZATION\n              ? claimingOrg.scopeId\n              : undefined,\n            applicationId: claimingOrg.scopeType === AuthScopeType.APPLICATION\n              ? claimingOrg.scopeId\n              : undefined,\n            reason: reason || 'Organization policy',\n            ipAddress: 'callback',\n            userAgent: 'callback',\n          });\n          throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n            customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n            context: {\n              // diagnostic (log-only)\n              reason: reason || 'Organization policy',\n            },\n          });\n        }\n      }\n    }\n\n    // ─── Step 2: Check for existing identity link ───\n    // Enterprise connections deliberately bypass the generic identity-link fast path:\n    // every enterprise login must pass through the provisioner so scope policy,\n    // membership state, authorized type acquisition, and link ownership converge\n    // transactionally. A link is an identity binding, not proof of current tenancy.\n    const existingLink = connection.connectionType === SsoConnectionType.SOCIAL\n      ? await this.servicesRegistryHandler.read<UserIdentityLink>(\n        CoreResourceType.USER_IDENTITY_LINKS,\n        ec,\n        {\n          providerRef: connection.providerRef,\n          providerUserId: profile.providerUserId,\n          connectionType: connection.connectionType,\n        },\n      )\n      : null;\n\n    if (existingLink) {\n      const linkedUser = await this.servicesRegistryHandler.read<User>(CoreResourceType.USERS, ec, { _id: existingLink.userId });\n      if (!linkedUser) {\n        throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n          context: { reason: 'identity_link_user_missing' },\n        });\n      }\n      if (linkedUser.status !== UserStatus.ACTIVE) {\n        throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n          context: { userStatus: linkedUser.status },\n        });\n      }\n\n      await this.ensureBaseUserTypeAssigned(\n        ec,\n        existingLink.userId,\n        frontendServiceName,\n        connection.connectionType === SsoConnectionType.ENTERPRISE\n          ? RegistrationAcquisitionChannel.ENTERPRISE_SSO_JIT\n          : RegistrationAcquisitionChannel.SOCIAL_OAUTH_JIT,\n      );\n\n      // `lastUsedAt` is `.excludeFromUpdate()` (server-owned, never client-authored) and\n      // `providerRawProfile` is `.isBackendOnly()` — both are re-attached past the strict-DTO\n      // strip automatically by `updateAsSystem` (`deriveTrustedSystemWritePreservedFields`\n      // preserves authored excludeFromUpdate + backend-only fields), so the \"last used\"\n      // timestamp advances without a manual `preserveServerInjectedFields`.\n      await this.systemAccessService.updateAsSystem(CoreResourceType.USER_IDENTITY_LINKS, existingLink._id, {\n        lastUsedAt: new Date(),\n        providerEmail: profile.email,\n        providerDisplayName: profile.displayName,\n        providerAvatarUrl: profile.avatarUrl,\n        providerRawProfile: profile.rawClaims,\n      });\n\n      this.logDebug('Existing identity link found, updating lastUsedAt', {\n        userId: existingLink.userId,\n        providerRef: connection.providerRef,\n      });\n\n      // AUTH-18 (reconcile-on-every-provision): a returning social user re-authenticates through\n      // this branch on every login, so ensure their USER_PROFILES row from the verified IdP name —\n      // create-if-absent — converging any user whose profile was never seeded or whose earlier\n      // best-effort seed failed. Idempotent (no-op when present).\n      await ensureUserProfileFromIdentityProfile(ec, {\n        userId: existingLink.userId,\n        profile,\n        servicesRegistryHandler: this.servicesRegistryHandler,\n        systemAccessService: this.systemAccessService,\n        logger: this.logger,\n      });\n\n      return { userId: existingLink.userId, isNewUser: false };\n    }\n\n    // ─── Step 3: Check for existing user by verified email (auto-link) ───\n    const userTypes = this.appConfigService.config.userTypes ?? {};\n    const autoLinkByEmail = Object.values(userTypes).some(\n      (typeDef) => typeDef?.auth?.autoLinkByEmail !== false,\n    );\n\n    if (\n      connection.connectionType === SsoConnectionType.SOCIAL\n      && autoLinkByEmail\n    ) {\n      const existingUser = await this.servicesRegistryHandler.read<User>(CoreResourceType.USERS, ec, { email: profile.email.toLowerCase() });\n\n      if (existingUser) {\n        // ─── S0.7 status gate ───\n        // ACTIVE always links. A PENDING_INVITATION invitee consumes their invitation below.\n        // EVERY other status — PENDING_VERIFICATION, INACTIVE, SUSPENDED, DELETED — AND a\n        // PENDING_INVITATION on a non-social connection is a hard stop: fail closed, never\n        // silently link (mirrors the token-accept path). Widening this gate is how a\n        // deactivated/suspended account would slip back in via social OAuth.\n        const consumesInvitation = existingUser.status === UserStatus.PENDING_INVITATION;\n        if (existingUser.status !== UserStatus.ACTIVE && !consumesInvitation) {\n          throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n            customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n            context: { userStatus: existingUser.status },\n          });\n        }\n\n        // Binding a social identity to a pre-existing account — OR consuming an invitation\n        // addressed to that email — requires the IdP to have verified the email.\n        if (!profile.emailVerified) {\n          throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n            customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n          });\n        }\n\n        if (!consumesInvitation) {\n          await this.resourcePersistenceUnitOfWork.executeTransaction(\n            SOCIAL_EXISTING_USER_LINK_UNIT_OF_WORK,\n            async (serviceOptions) => {\n              await this.ensureBaseUserTypeAssigned(\n                ec,\n                existingUser._id,\n                frontendServiceName,\n                RegistrationAcquisitionChannel.SOCIAL_OAUTH_JIT,\n                serviceOptions,\n              );\n              await this.createIdentityLink(\n                existingUser._id,\n                profile,\n                connection,\n                serviceOptions,\n              );\n            },\n          );\n        }\n\n        // ─── Consume a pending invitation (junction model) ───\n        // A PENDING_INVITATION account exists solely because an org admin invited this email\n        // (the invite provisions the User + an INVITED ORGANIZATION_MEMBERS row). The social IdP\n        // has now proven the invitee controls that email, so first social login ACTIVATES the\n        // account and consumes its invite(s) — exactly like the enterprise-JIT + token-accept\n        // paths, via the SHARED `applyInvitationAcceptanceCore`.\n        if (consumesInvitation) {\n          await this.consumePendingInvitationsOnSocialLogin(\n            ec,\n            existingUser,\n            profile,\n            connection,\n            frontendServiceName,\n          );\n        }\n\n        // AUTH-18 (reconcile-on-every-provision): ensure a USER_PROFILES row from the verified IdP\n        // name on EVERY existing-user auto-link — the just-consumed invitee (nameless at invite time)\n        // AND a returning ACTIVE user whose profile was never seeded / failed to seed earlier.\n        // Create-if-absent, idempotent; runs after the orphan-invite guard (a rejected invitee throws\n        // in `consumePendingInvitationsOnSocialLogin` and never reaches here).\n        await ensureUserProfileFromIdentityProfile(ec, {\n          userId: existingUser._id,\n          profile,\n          servicesRegistryHandler: this.servicesRegistryHandler,\n          systemAccessService: this.systemAccessService,\n          logger: this.logger,\n        });\n\n        this.logDebug(consumesInvitation ? 'Invitation consumed via social OAuth' : 'Auto-linked by email', {\n          userId: existingUser._id,\n          providerRef: connection.providerRef,\n          email: profile.email,\n        });\n\n        return { userId: existingUser._id, isNewUser: false };\n      }\n    }\n\n    // ─── Step 4→15: Enterprise provisioning branch ───\n    if (connection.connectionType === SsoConnectionType.ENTERPRISE) {\n      const enterpriseScope = connection.scope;\n      // Resolver invariant: an enterprise connection ALWAYS carries its provisioningConfig. Fail\n      // loud rather than fall through to the social branch below (which would misprovision).\n      if (!connection.provisioningConfig) {\n        throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n          context: { message: 'Enterprise OAuth2 connection is missing its resolved provisioningConfig' },\n        });\n      }\n\n      // W7.2: Block cross-org SSO when disabled — check before provisioning\n      const targetOrganizationId = getOrganizationIdFromEnterpriseScope(enterpriseScope);\n      const existingUserForCrossOrg = await this.servicesRegistryHandler.read<User>(CoreResourceType.USERS, ec, { email: profile.email.toLowerCase() });\n      if (existingUserForCrossOrg && targetOrganizationId) {\n        await this.enforceCrossOrgSSOAccess(ec, existingUserForCrossOrg._id, targetOrganizationId);\n      }\n\n      // Delegate to EnterpriseUserProvisioningService (Step 15, reused by SCIM Step 20). The\n      // provisioning config was assembled once by the resolver — passed straight through.\n      const resolvedEnterpriseFrontendServiceName =\n        frontendServiceName ?? this.appConfigService.resolveDefaultFrontendServiceName() ?? undefined;\n      const fallbackUserType = resolvedEnterpriseFrontendServiceName\n        ? this.appConfigService.resolveUserTypeFromFrontendServiceName(\n          resolvedEnterpriseFrontendServiceName,\n        ) ?? undefined\n        : undefined;\n      const result = await this.enterpriseProvisioning.provisionEnterpriseUser(\n        profile,\n        connection,\n        connection.provisioningConfig,\n        { fallbackUserType },\n      );\n\n      this.logDebug('Enterprise user provisioned/linked', {\n        userId: result.user._id,\n        scopeType: enterpriseScope.scopeType,\n        scopeId: enterpriseScope.scopeId,\n        isNew: result.isNew,\n        roles: result.mappedRoles,\n      });\n\n      return { userId: result.user._id, isNewUser: result.isNew };\n    }\n\n    // ─── Step 5: Social provisioning — create new user ───\n    // The provider subject alone is not enough to claim a globally unique email.\n    // Existing-account linking already requires this proof; first creation must\n    // enforce the same boundary or an unverified IdP address could reserve and\n    // activate another person's account identity.\n    if (!profile.emailVerified) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n      });\n    }\n\n    // Resolve the SAME base user type `ensureBaseUserTypeAssigned` will write after creation.\n    // Authorizing against \"any OPEN user type\" is unsafe: an unrelated public member type could\n    // otherwise unlock JIT creation for the initiating frontend's ADMIN_ONLY or DISABLED default.\n    // Only an explicit OPEN policy on the exact target type permits social JIT creation.\n    const resolvedFrontendServiceName =\n      frontendServiceName ?? this.appConfigService.resolveDefaultFrontendServiceName() ?? undefined;\n    const registrationUserType = resolvedFrontendServiceName\n      ? this.appConfigService.resolveUserTypeFromFrontendServiceName(resolvedFrontendServiceName)\n      : null;\n    const registrationConfig = registrationUserType\n      ? userTypes[registrationUserType]?.auth?.registration\n      : undefined;\n    const frontendServiceAllowsRegistration = Boolean(\n      resolvedFrontendServiceName\n      && registrationUserType\n      && this.appConfigService.getFrontendServiceUserManagementEntry(\n        resolvedFrontendServiceName,\n        registrationUserType,\n      )?.register === true,\n    );\n    const socialJitAllowed = registrationConfig !== undefined\n      && frontendServiceAllowsRegistration\n      && Array.isArray(registrationConfig.allowedMethods)\n      && registrationConfig.allowedMethods.includes(AuthMethod.EXTERNAL_OAUTH2)\n      && isRegistrationAcquisitionAllowed(\n        registrationConfig.mode,\n        RegistrationAcquisitionChannel.SOCIAL_OAUTH_JIT,\n      );\n\n    if (!socialJitAllowed || !registrationUserType) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_FOUND,\n      });\n    }\n\n    let newUser: User;\n    try {\n      newUser = await this.resourcePersistenceUnitOfWork.executeTransaction(\n        SOCIAL_USER_CREATION_UNIT_OF_WORK,\n        async (serviceOptions) => {\n          const createdUser = await this.servicesRegistryHandler.create<User>(\n            CoreResourceType.USERS,\n            ec,\n            {\n              email: profile.email.toLowerCase(),\n              status: UserStatus.ACTIVE,\n              appRoles: [CORE_APP_ROLES.APP_USER],\n              userTypes: [registrationUserType],\n            },\n            serviceOptions,\n          );\n          await this.createIdentityLink(\n            createdUser._id,\n            profile,\n            connection,\n            serviceOptions,\n          );\n          return createdUser;\n        },\n        {\n          compositionSeedRequestInput: {\n            firstName: profile.firstName,\n            lastName: profile.lastName,\n            displayName: profile.displayName,\n          },\n        },\n      );\n    } catch (error) {\n      const persistenceError = error as { code?: number; message?: string };\n      const isCreateConflict =\n        (isWildoBackendError(error) && error.statusCode === 409)\n        || persistenceError.code === 11000\n        || persistenceError.message?.includes('duplicate key') === true\n        || persistenceError.message?.includes('E11000') === true;\n      if (isCreateConflict && mayReconcileSocialCreateConflict) {\n        this.logDebug('Concurrent social provisioning detected; reconciling through the full policy path', {\n          email: profile.email,\n          providerRef: connection.providerRef,\n        });\n        return this.provisionOrLinkUserAttempt(\n          profile,\n          connection,\n          frontendServiceName,\n          false,\n        );\n      }\n      throw error;\n    }\n\n    this.logDebug('New user provisioned via OAuth2', {\n      userId: newUser._id,\n      providerRef: connection.providerRef,\n      email: profile.email,\n    });\n\n    return { userId: newUser._id, isNewUser: true };\n  }\n\n  /**\n   * Floor that guarantees a provisioned/linked SSO user leaves with a non-empty\n   * `userTypes[]`.\n   *\n   * ### Source-of-truth model (two axes, no overlap)\n   * - **Base identity** — the frontend-service default user type\n   *   (`resolveUserTypeFromFrontendServiceName`). Every user provisioned through a\n   *   frontend service gets it; the PASSWORD-registration path assigns exactly this\n   *   (`userTypes = [activeUserType]`). SSO users authenticate through the same\n   *   frontends and are equally users of them, so they get the same base.\n   * - **Org-type grant (W5.2)** — `grantUserTypesOnOrgJoin` layers\n   *   `organizationTypes[orgType].userTypes` on top when a user joins a typed org.\n   *   Additive enrichment, not the base; no-ops when the org has no `type`.\n   *\n   * This helper is the base, applied as a FLOOR: it only writes when `userTypes` is\n   * still empty, so an org-type grant that already populated a narrower, org-authored\n   * user type WINS and is never widened by this default. A pre-existing empty-type user\n   * is not a compatibility exception: the exact base acquisition must pass the supplied\n   * channel, and social OAuth additionally requires the frontend `register` surface plus\n   * `EXTERNAL_OAUTH2` in `allowedMethods`.\n   *\n   * Resolution order: the initiating frontend service (from the state token), then the\n   * app default frontend when none was carried (SAML/SCIM-style callers do not reach\n   * this method). If neither resolves a user type — the app declares no\n   * `usersManagement` entries at all — this logs and leaves `userTypes` empty; the\n   * callback's own `usersManagement[type].auth` check then surfaces the misconfig\n   * with a precise message rather than this helper masking it.\n   */\n  private async ensureBaseUserTypeAssigned(\n    ec: ExecutionContext<any>,\n    userId: string,\n    frontendServiceName: string | undefined,\n    acquisitionChannel: RegistrationAcquisitionChannel,\n    serviceOptions?: ServiceOptions,\n  ): Promise<void> {\n    const user = await this.servicesRegistryHandler.read<User>(\n      CoreResourceType.USERS,\n      ec,\n      { _id: userId },\n      serviceOptions,\n    );\n    if (user?.userTypes?.length) return; // org-type grant (or a prior assignment) already set the base\n\n    const resolvedFrontendServiceName =\n      frontendServiceName ?? this.appConfigService.resolveDefaultFrontendServiceName() ?? undefined;\n    const baseUserType = resolvedFrontendServiceName\n      ? this.appConfigService.resolveUserTypeFromFrontendServiceName(resolvedFrontendServiceName)\n      : null;\n\n    if (!baseUserType) {\n      this.logDebug('No base user type resolvable for SSO user — leaving userTypes empty', {\n        userId,\n        frontendServiceName: resolvedFrontendServiceName,\n      });\n      return;\n    }\n\n    const userTypeDefinitions = this.appConfigService.isInitialized()\n      ? this.appConfigService.config.userTypes\n      : undefined;\n    const acquisition = evaluateUserTypeAcquisition(\n      userTypeDefinitions,\n      [baseUserType],\n      user?.userTypes ?? [],\n      acquisitionChannel,\n    );\n    const registrationConfig = userTypeDefinitions?.[baseUserType]?.auth.registration;\n    const socialSurfaceAllowed = acquisitionChannel !== RegistrationAcquisitionChannel.SOCIAL_OAUTH_JIT\n      || (\n        resolvedFrontendServiceName !== undefined\n        && this.appConfigService.getFrontendServiceUserManagementEntry(\n          resolvedFrontendServiceName,\n          baseUserType,\n        )?.register === true\n        && Array.isArray(registrationConfig?.allowedMethods)\n        && registrationConfig.allowedMethods.includes(AuthMethod.EXTERNAL_OAUTH2)\n      );\n    if (!acquisition.allowed || !socialSurfaceAllowed) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_FOUND,\n        context: {\n          channel: acquisitionChannel,\n          deniedUserTypes: acquisition.deniedUserTypes,\n          baseUserType,\n        },\n      });\n    }\n\n    await this.servicesRegistryHandler.update(\n      CoreResourceType.USERS,\n      ec,\n      userId,\n      { userTypes: [baseUserType] },\n      serviceOptions,\n    );\n    this.logDebug('Assigned base user type to SSO user', { userId, baseUserType, frontendServiceName: resolvedFrontendServiceName });\n  }\n\n  /**\n   * Consume every pending invitation addressed to a social-OAuth invitee.\n   *\n   * In the junction model an invitation IS an `ORGANIZATION_MEMBERS` row in status `INVITED`,\n   * bound to the invitee `User` (provisioned `PENDING_INVITATION` at invite time). When that\n   * invitee first authenticates through a social IdP that has verified their email, this:\n   *   1. activates the account (`PENDING_INVITATION → ACTIVE`), and\n   *   2. flips every INVITED membership → ACTIVE and grants the org-join user types,\n   * via the SHARED `applyInvitationAcceptanceCore` — the identical abstraction the token-accept\n   * (`acceptInvitation`), in-app-accept (`acceptMyInvitation`), and enterprise-JIT paths call.\n   *\n   * The invitee's `USER_PROFILES` row (nameless at invite time) is NOT seeded here — the caller's\n   * reconcile-on-every-provision step (`ensureUserProfileFromIdentityProfile` in `provisionOrLinkUser`)\n   * owns that for every existing-user path, so this method stays focused on the invitation junction.\n   *\n   * Unlike enterprise SSO/SCIM there is NO org signal on a public social connection, so every\n   * pending invite for the (now email-verified) identity is consumed, not just one org's. The\n   * common case is exactly one invite.\n   *\n   * Fails closed if the account is `PENDING_INVITATION` but has NO INVITED membership (every\n   * invite was revoked/declined — which DELETEs the row): there is nothing to accept, so the\n   * account is NOT activated.\n   *\n   * No accept-token revocation: ACTIVATING (not deleting) the membership leaves any still-valid\n   * emailed accept link harmless — `acceptInvitation` fails closed on a non-INVITED status — and\n   * it expires on its own.\n   */\n  private async consumePendingInvitationsOnSocialLogin(\n    ec: ExecutionContext<any>,\n    user: User,\n    profile: NormalizedUserProfile,\n    connection: SSOResolvedConnectionBase,\n    frontendServiceName: string | undefined,\n  ): Promise<void> {\n    const activatedCount =\n      await this.resourcePersistenceUnitOfWork.executeTransaction(\n        SOCIAL_INVITATION_ACCEPTANCE_UNIT_OF_WORK,\n        async (serviceOptions) => {\n          const currentUser = await this.servicesRegistryHandler.read<User>(\n            CoreResourceType.USERS,\n            ec,\n            { _id: user._id },\n            serviceOptions,\n          );\n          if (currentUser?.status !== UserStatus.PENDING_INVITATION) {\n            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n              customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n              context: {\n                userStatus: currentUser?.status ?? 'GONE',\n                reason: 'social_invitation_user_not_pending',\n              },\n            });\n          }\n\n          // The invite binds every pending row to this user. Resolve and consume them\n          // from the same native database snapshot used for activation and type grants.\n          const result = await this.systemAccessService.listAsSystem<OrganizationMember>(\n            CoreResourceType.ORGANIZATION_MEMBERS,\n            { userId: user._id, status: OrganizationMemberStatus.INVITED },\n            undefined,\n            serviceOptions,\n          );\n          const pendingMemberships = Array.isArray(result) ? result : result.data;\n          if (pendingMemberships.length === 0) {\n            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n              customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n              context: {\n                userStatus: currentUser.status,\n                reason: 'social_invitation_has_no_active_memberships',\n              },\n            });\n          }\n\n          await assertInvitationBatchUserTypeAcquisitionAllowed({\n            user: currentUser,\n            organizationIds: pendingMemberships.map((membership) => membership.organizationId),\n            appConfigService: this.appConfigService,\n            errorBuilder: this.errorBuilder,\n            systemAccessService: this.systemAccessService,\n            serviceOptions,\n          });\n\n          let acceptedMembershipCount = 0;\n          for (const membership of pendingMemberships) {\n            const { membershipActivated } = await applyInvitationAcceptanceCore(ec, {\n              membership,\n              user: currentUser,\n              appConfigService: this.appConfigService,\n              errorBuilder: this.errorBuilder,\n              servicesRegistryHandler: this.servicesRegistryHandler,\n              systemAccessService: this.systemAccessService,\n              serviceOptions,\n              logDebug: this.logDebug,\n            });\n            if (membershipActivated) {\n              acceptedMembershipCount += 1;\n            }\n          }\n          if (acceptedMembershipCount === 0) {\n            throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n              context: {\n                reason: 'all_social_invitations_revoked_during_acceptance',\n                userId: user._id,\n              },\n            });\n          }\n\n          // SYSTEM door: `status` is `.excludeFromUpdate()`, so a handler write is stripped by the\n          // repository's strict re-parse — the filter matches, the row comes back, and NOTHING is\n          // persisted. The account stays PENDING_INVITATION while the caller sees success.\n          // Enumerated with the sibling activations (email verification, invitation accept) per\n          // `.claude/rules/invariant-call-site-enumeration.md`: the invariant is \"a `status` write\n          // goes through the system door\", and it holds at every site or none. The compare-and-swap\n          // is preserved — the filter still pins the observed status, so a concurrent activation\n          // still loses the race below.\n          const activatedUser = await this.systemAccessService.updateAsSystem<User>(\n            CoreResourceType.USERS,\n            {\n              _id: currentUser._id,\n              status: UserStatus.PENDING_INVITATION,\n            },\n            { status: UserStatus.ACTIVE },\n            serviceOptions,\n          );\n          if (!activatedUser) {\n            throw this.errorBuilder.buildError(ErrorType.CONFLICT, undefined, {\n              context: {\n                reason: 'social_invitation_user_activation_race_lost',\n                userId: user._id,\n              },\n            });\n          }\n          await this.ensureBaseUserTypeAssigned(\n            ec,\n            user._id,\n            frontendServiceName,\n            RegistrationAcquisitionChannel.INVITATION,\n            serviceOptions,\n          );\n          await this.createIdentityLink(\n            user._id,\n            profile,\n            connection,\n            serviceOptions,\n          );\n          return acceptedMembershipCount;\n        },\n      );\n\n    this.logDebug('Pending invitation(s) consumed via social OAuth login', {\n      userId: user._id,\n      count: activatedCount,\n    });\n  }\n\n  /**\n   * W7.2: Enforce crossOrgSSOAccess policy.\n   * When `crossOrgSSOAccess === false`, a user who already has enterprise identity links\n   * from a different organization is blocked from SSO into the current org.\n   * Social/native connections are exempt (enforced by callers only passing enterprise connections).\n   */\n  private async enforceCrossOrgSSOAccess(\n    ec: ExecutionContext<any>,\n    userId: string,\n    targetOrganizationId: string,\n  ): Promise<void> {\n    if (this.appConfigService.config.auth.crossOrgSSOAccess !== false) return;\n\n    const enterpriseLinks = await this.servicesRegistryHandler.list<UserIdentityLink>(CoreResourceType.USER_IDENTITY_LINKS, ec, {\n      userId,\n      connectionType: SsoConnectionType.ENTERPRISE,\n    }, undefined, { paginated: false }) as UserIdentityLink[] ?? [];\n\n    const hasCrossOrgLink = enterpriseLinks.some(\n      (link) => link.organizationId && link.organizationId !== targetOrganizationId,\n    );\n\n    if (hasCrossOrgLink) {\n      this.logDebug('Cross-org SSO blocked', { userId, targetOrganizationId });\n      throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CROSS_ORG_SSO_BLOCKED,\n      });\n    }\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Private: Token Exchange\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Exchange the authorization code for tokens at the IdP's token endpoint.\n   * Server-to-server POST — credentials sent according to tokenEndpointAuthMethod.\n   */\n  private async exchangeCodeForTokens(\n    code: string,\n    connection: OAuth2ResolvedConnection,\n    pkceVerifier?: string,\n  ): Promise<Record<string, unknown>> {\n    const bodyParams: Record<string, string> = {\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: connection.redirectUri,\n    };\n\n    if (pkceVerifier) {\n      bodyParams.code_verifier = pkceVerifier;\n    }\n\n    // Merge extra token params\n    if (connection.extraTokenParams) {\n      for (const [key, value] of Object.entries(connection.extraTokenParams)) {\n        if (RESERVED_TOKEN_PARAM_KEYS.has(key)) {\n          this.logger.warn('Ignoring reserved OAuth2 token extra parameter', {\n            providerRef: connection.providerRef,\n            key,\n          });\n          continue;\n        }\n        bodyParams[key] = value;\n      }\n    }\n\n    const headers: Record<string, string> = {\n      [WildoHeaderKeys.CONTENT_TYPE]: 'application/x-www-form-urlencoded',\n      ...(connection.tokenRequestHeaders || {}),\n    };\n\n    // Send credentials according to tokenEndpointAuthMethod\n    switch (connection.tokenEndpointAuthMethod) {\n      case 'client_secret_post':\n        bodyParams.client_id = connection.clientId;\n        bodyParams.client_secret = connection.clientSecret;\n        break;\n      case 'client_secret_basic':\n        headers[WildoHeaderKeys.AUTHORIZATION] = `Basic ${Buffer.from(\n          `${connection.clientId}:${connection.clientSecret}`,\n        ).toString('base64')}`;\n        break;\n      case 'none':\n        bodyParams.client_id = connection.clientId;\n        break;\n    }\n\n    const response = await fetch(connection.tokenUrl, {\n      method: 'POST',\n      headers,\n      body: new URLSearchParams(bodyParams).toString(),\n    });\n\n    if (!response.ok) {\n      const errorBody = await response.text();\n      this.logger.error('OAuth2 token exchange failed', {\n        providerRef: connection.providerRef,\n        status: response.status,\n        error: errorBody,\n      });\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n      });\n    }\n\n    const tokenResponse = await response.json() as Record<string, unknown>;\n    this.logDebug('Token exchange successful', {\n      providerRef: connection.providerRef,\n      hasAccessToken: !!tokenResponse.access_token,\n      hasIdToken: !!tokenResponse.id_token,\n    });\n\n    return tokenResponse;\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Private: Profile Extraction\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Extract user identity based on connection.identitySource.\n   *\n   * - 'userinfo': fetch from userInfoUrl (Google, Microsoft, GitHub)\n   * - 'id_token': verify via JWKS then decode from ID token JWT (Apple, enterprise OIDC)\n   * - Apple uses BOTH id_token (email, sub) AND callback_body (name on first auth)\n   *\n   * C3: When jwksUri + issuer are available on the connection, ID tokens are\n   * cryptographically verified against the provider's JWKS before claims extraction.\n   */\n  private async extractUserProfile(\n    tokenResponse: Record<string, unknown>,\n    connection: OAuth2ResolvedConnection,\n    callbackBody?: Record<string, unknown>,\n  ): Promise<NormalizedUserProfile> {\n    let rawClaims: Record<string, unknown> = {};\n\n    // Primary identity source\n    if (connection.identitySource === 'userinfo' && connection.userInfoUrl) {\n      rawClaims = await this.fetchUserInfo(\n        connection.userInfoUrl,\n        tokenResponse.access_token as string,\n        connection,\n      );\n    } else if (connection.identitySource === 'id_token' && tokenResponse.id_token) {\n      // C3 fix: Verify ID token signature against provider's JWKS when available.\n      // Falls back to unsigned decode only when no JWKS URI is available (should not\n      // happen for well-configured OIDC providers — JWKS is a required discovery field).\n      if (connection.jwksUri && connection.issuer) {\n        try {\n          rawClaims = await this.verifyIdToken(\n            tokenResponse.id_token as string,\n            connection.jwksUri,\n            connection.issuer,\n            connection.clientId,\n          );\n        } catch (verifyError) {\n          this.logger.error('ID token JWKS verification failed', {\n            providerRef: connection.providerRef,\n            ...projectCaughtErrorLogFields(verifyError),\n          });\n          throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n            customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n          });\n        }\n      } else {\n        this.logger.warn('ID token decoded without signature verification — no JWKS URI available', {\n          providerRef: connection.providerRef,\n          hasJwksUri: !!connection.jwksUri,\n          hasIssuer: !!connection.issuer,\n        });\n        rawClaims = this.decodeIdToken(tokenResponse.id_token as string);\n      }\n    }\n\n    // Supplement with callback body (Apple first-auth: body.user has name)\n    if (callbackBody?.user) {\n      let userData: Record<string, unknown>;\n      if (typeof callbackBody.user === 'string') {\n        try {\n          userData = JSON.parse(callbackBody.user) as Record<string, unknown>;\n        } catch {\n          this.logDebug('Failed to parse Apple callback body.user — skipping name extraction', {\n            providerRef: connection.providerRef,\n          });\n          userData = {};\n        }\n      } else {\n        userData = callbackBody.user as Record<string, unknown>;\n      }\n\n      // Apple's user object: { name: { firstName, lastName }, email }\n      if (userData.name) {\n        const nameObj = userData.name as Record<string, unknown>;\n        if (!rawClaims._callbackFirstName && nameObj.firstName) {\n          rawClaims._callbackFirstName = nameObj.firstName;\n        }\n        if (!rawClaims._callbackLastName && nameObj.lastName) {\n          rawClaims._callbackLastName = nameObj.lastName;\n        }\n      }\n    }\n\n    // Provider-specific extension points (data-driven, not per-provider if/else)\n    const extensions = connection.extensions || {};\n\n    // Extension: emails endpoint (GitHub private email)\n    if (extensions.emailsEndpoint && tokenResponse.access_token) {\n      try {\n        const emailsEndpoint = this.validateProviderExtensionUrl(connection, extensions.emailsEndpoint as string);\n        const emailsResponse = await fetch(emailsEndpoint, {\n          headers: { Authorization: `Bearer ${tokenResponse.access_token}`, Accept: 'application/json' },\n        });\n        if (emailsResponse.ok) {\n          const emails = await emailsResponse.json() as Array<{ email: string; primary: boolean; verified: boolean }>;\n          const primaryEmail = emails.find((e) => e.primary && e.verified);\n          if (primaryEmail) {\n            rawClaims[connection.profileMapping.email] = primaryEmail.email;\n            rawClaims[connection.profileMapping.emailVerified || 'email_verified'] = true;\n          }\n        }\n      } catch {\n        this.logDebug('Failed to fetch emails endpoint', { endpoint: extensions.emailsEndpoint });\n      }\n    }\n\n    // Map raw claims to NormalizedUserProfile\n    const mapping = connection.profileMapping;\n\n    const providerUserId = String(this.extractClaim(rawClaims, mapping.id) || '');\n    const email = String(this.extractClaim(rawClaims, mapping.email) || '').toLowerCase();\n    const emailVerifiedRaw = this.extractClaim(rawClaims, mapping.emailVerified || 'email_verified');\n    const emailVerified = emailVerifiedRaw === true || emailVerifiedRaw === 'true';\n\n    // Name extraction: try firstName/lastName fields, fall back to 'name' field splitting\n    let firstName = mapping.firstName ? String(this.extractClaim(rawClaims, mapping.firstName) || '') : '';\n    let lastName = mapping.lastName ? String(this.extractClaim(rawClaims, mapping.lastName) || '') : '';\n\n    // Callback body supplements (Apple first-auth)\n    if (!firstName && rawClaims._callbackFirstName) firstName = String(rawClaims._callbackFirstName);\n    if (!lastName && rawClaims._callbackLastName) lastName = String(rawClaims._callbackLastName);\n\n    // Fall back to 'name' field and split\n    if (!firstName && !lastName && mapping.name) {\n      const fullName = String(this.extractClaim(rawClaims, mapping.name) || '');\n      if (fullName) {\n        const parts = fullName.split(' ');\n        firstName = parts[0] || '';\n        lastName = parts.slice(1).join(' ') || '';\n      }\n    }\n\n    // Display name: constructed name → full name claim → extension fallback → email (last resort)\n    const displayName = [firstName, lastName].filter(Boolean).join(' ')\n      || String(this.extractClaim(rawClaims, mapping.name || 'name') || '')\n      || (extensions.displayNameFallbackField\n        ? String(this.extractClaim(rawClaims, extensions.displayNameFallbackField as string) || '')\n        : '')\n      || email;\n\n    // Extension: email fallback (Microsoft uses userPrincipalName)\n    const finalEmail = email\n      || (extensions.emailFallbackField\n        ? String(this.extractClaim(rawClaims, extensions.emailFallbackField as string) || '').toLowerCase()\n        : '');\n\n    const rawAvatarUrl = mapping.image ? String(this.extractClaim(rawClaims, mapping.image) || '') : undefined;\n    const avatarUrl = rawAvatarUrl ? this._sanitizeAvatarUrl(rawAvatarUrl) : undefined;\n\n    // Locale (most OIDC providers include a 'locale' claim)\n    const locale = this.extractClaim(rawClaims, 'locale') as string | undefined;\n\n    // Enterprise claims\n    const roles = mapping.roles ? this.extractArrayClaim(rawClaims, mapping.roles) : undefined;\n    const groups = mapping.groups ? this.extractArrayClaim(rawClaims, mapping.groups) : undefined;\n    const department = mapping.department ? String(this.extractClaim(rawClaims, mapping.department) || '') : undefined;\n    const employeeId = mapping.employeeId ? String(this.extractClaim(rawClaims, mapping.employeeId) || '') : undefined;\n\n    if (!providerUserId || !finalEmail) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n      });\n    }\n\n    return {\n      providerUserId,\n      email: finalEmail,\n      emailVerified,\n      firstName: firstName || undefined,\n      lastName: lastName || undefined,\n      displayName: displayName || undefined,\n      avatarUrl: avatarUrl || undefined,\n      locale,\n      roles,\n      groups,\n      department: department || undefined,\n      employeeId: employeeId || undefined,\n      rawClaims,\n    };\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Private: UserInfo Fetch\n  // ═══════════════════════════════════════════════════════════════\n\n  private async fetchUserInfo(\n    userInfoUrl: string,\n    accessToken: string,\n    connection: OAuth2ResolvedConnection,\n  ): Promise<Record<string, unknown>> {\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${accessToken}`,\n      Accept: 'application/json',\n    };\n\n    // GitHub requires Accept header (TRAP: without it, returns XML)\n    if (connection.tokenRequestHeaders?.Accept) {\n      headers.Accept = connection.tokenRequestHeaders.Accept;\n    }\n\n    const response = await fetch(userInfoUrl, { headers });\n    if (!response.ok) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n        context: { message: `Failed to fetch user info: ${response.status}` },\n      });\n    }\n\n    return await response.json() as Record<string, unknown>;\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Private: Identity Link Creation\n  // ═══════════════════════════════════════════════════════════════\n\n  private async createIdentityLink(\n    userId: string,\n    profile: NormalizedUserProfile,\n    connection: SSOResolvedConnectionBase,\n    serviceOptions?: ServiceOptions,\n  ): Promise<void> {\n    await this.systemAccessService.createAsSystem(\n      CoreResourceType.USER_IDENTITY_LINKS,\n      {\n        userId,\n        connectionType: SsoConnectionType.SOCIAL,\n        providerRef: connection.providerRef,\n        providerUserId: profile.providerUserId,\n        providerEmail: profile.email,\n        providerDisplayName: profile.displayName,\n        providerAvatarUrl: profile.avatarUrl,\n        providerRawProfile: profile.rawClaims,\n        source: connection.source,\n      },\n      serviceOptions,\n    );\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Private: Execution Context\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Pre-auth EC for OAuth2 operations (SSO callbacks, user provisioning).\n   * Caller identity unknown at this point — uses PUBLIC_EXECUTION with APP_PUBLIC.\n   * Primary intent: user lookup/provisioning from IdP callback.\n   */\n  private async getInternalExecutionContext(): Promise<ExecutionContext<any>> {\n    return this.authEcFactory.createForPreAuthOperation(this.authEcFactory.getUsersReadOperationPath());\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Private: PKCE Helpers\n  // ═══════════════════════════════════════════════════════════════\n\n  private generateCodeVerifier(): string {\n    return crypto.randomBytes(32).toString('base64url');\n  }\n\n  private generateS256Challenge(verifier: string): string {\n    return crypto.createHash('sha256').update(verifier).digest('base64url');\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Private: Claim Extraction Helpers\n  // ═══════════════════════════════════════════════════════════════\n\n  private validateProviderExtensionUrl(connection: OAuth2ResolvedConnection, endpoint: string): string {\n    const parsed = new URL(endpoint);\n    if (parsed.protocol !== 'https:') {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        context: {\n          // diagnostic (log-only): server-side provider-config / SSRF guard, not user input.\n          providerRef: connection.providerRef,\n          reason: 'extension-url-not-https',\n        },\n      });\n    }\n\n    const trustedHosts = [\n      connection.authorizationUrl,\n      connection.tokenUrl,\n      connection.userInfoUrl,\n    ]\n      .filter(Boolean)\n      .map((url) => new URL(url!).hostname);\n\n    if (!trustedHosts.includes(parsed.hostname)) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        context: {\n          // diagnostic (log-only): server-side provider-config / SSRF guard, not user input.\n          providerRef: connection.providerRef,\n          reason: 'extension-url-host-not-trusted',\n          host: parsed.hostname,\n        },\n      });\n    }\n\n    return parsed.toString();\n  }\n\n  /**\n   * Extract a claim value from raw claims using dot-notation path support.\n   */\n  private extractClaim(claims: Record<string, unknown>, path: string): unknown {\n    if (!path) return undefined;\n    const parts = path.split('.');\n    let current: unknown = claims;\n    for (const part of parts) {\n      if (current === null || current === undefined || typeof current !== 'object') return undefined;\n      current = (current as Record<string, unknown>)[part];\n    }\n    return current;\n  }\n\n  /**\n   * Extract an array claim (roles, groups), handling both string and array values.\n   */\n  private extractArrayClaim(claims: Record<string, unknown>, path: string): string[] | undefined {\n    const value = this.extractClaim(claims, path);\n    if (!value) return undefined;\n    if (Array.isArray(value)) return value.map(String);\n    if (typeof value === 'string') return value.split(',').map((s) => s.trim());\n    return undefined;\n  }\n\n  /**\n   * Decode a JWT ID token without signature verification.\n   * Used as fallback for providers that don't expose a JWKS endpoint.\n   * Prefer verifyIdToken() for providers with JWKS.\n   */\n  private decodeIdToken(idToken: string): Record<string, unknown> {\n    try {\n      const parts = idToken.split('.');\n      if (parts.length !== 3) throw new Error('Invalid JWT format');\n      const payload = Buffer.from(parts[1], 'base64url').toString('utf-8');\n      return JSON.parse(payload) as Record<string, unknown>;\n    } catch {\n      this.logger.warn('Failed to decode ID token');\n      return {};\n    }\n  }\n\n  /**\n   * Verify a JWT ID token against the provider's JWKS endpoint.\n   * Uses the `jose` library for cryptographic signature verification + claims validation.\n   *\n   * C3 fix: Replaces unsigned jwt.decode() with full JWKS verification.\n   * Verifies: signature (via JWKS), issuer, audience, expiration, and issued-at claims.\n   *\n   * The JWKS function is cached per jwksUri on the service instance to avoid losing\n   * jose's internal key cache between login attempts. The library handles key rotation\n   * internally (refetch on kid miss).\n   */\n  private async verifyIdToken(\n    idToken: string,\n    jwksUri: string,\n    issuer: string | string[],\n    audience: string | string[],\n  ): Promise<Record<string, unknown>> {\n    const { jwtVerify, createRemoteJWKSet } = await import('jose');\n\n    let JWKS = this._jwksCache.get(jwksUri);\n    if (!JWKS) {\n      JWKS = createRemoteJWKSet(new URL(jwksUri));\n      this._jwksCache.set(jwksUri, JWKS);\n    }\n\n    const { payload } = await jwtVerify(idToken, JWKS as Parameters<typeof jwtVerify>[1], {\n      issuer,\n      audience,\n      maxTokenAge: '5 minutes',\n    });\n\n    return payload as Record<string, unknown>;\n  }\n\n  /**\n   * L5 fix: Sanitize avatar URL from IdP profile.\n   * Validates URL scheme (HTTPS/HTTP only) and rejects private/loopback IPs\n   * to prevent javascript: XSS, data: URI injection, and SSRF via internal network URLs.\n   *\n   * Returns undefined for invalid URLs (fail-safe — missing avatar is harmless).\n   */\n  private _sanitizeAvatarUrl(url: string): string | undefined {\n    if (!url) return undefined;\n    try {\n      const parsed = new URL(url);\n\n      // Only allow http: and https: schemes — reject javascript:, data:, etc.\n      if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {\n        return undefined;\n      }\n\n      // Normalize hostname: strip IPv6 brackets and resolve IPv4-mapped IPv6\n      // (e.g., `[::ffff:127.0.0.1]` → `127.0.0.1`, `[::ffff:10.0.0.1]` → `10.0.0.1`)\n      let hostname = parsed.hostname.toLowerCase();\n      if (hostname.startsWith('[') && hostname.endsWith(']')) {\n        hostname = hostname.slice(1, -1);\n      }\n      const ipv4MappedMatch = hostname.match(/^::ffff:(\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})$/);\n      if (ipv4MappedMatch) {\n        hostname = ipv4MappedMatch[1];\n      }\n\n      if (this._isPrivateOrReservedHost(hostname)) {\n        return undefined;\n      }\n\n      return parsed.toString();\n    } catch {\n      return undefined;\n    }\n  }\n\n  /**\n   * Check if a hostname is private, loopback, link-local, or otherwise reserved.\n   * Covers IPv4, IPv6 loopback, IPv4-mapped IPv6 (after normalization), and special TLDs.\n   */\n  private _isPrivateOrReservedHost(hostname: string): boolean {\n    // Normalize decimal/octal/hex IP representations to dotted-decimal.\n    // e.g., http://2130706433 (decimal for 127.0.0.1), http://0x7f000001 (hex),\n    // http://017700000001 (octal). These bypass naive string prefix checks.\n    const normalizedHostname = this._normalizeNumericIp(hostname);\n\n    // Loopback\n    if (normalizedHostname === 'localhost' || normalizedHostname === '127.0.0.1' || normalizedHostname === '0.0.0.0' || normalizedHostname === '::1') {\n      return true;\n    }\n\n    // IPv6 loopback/unspecified variants\n    if (normalizedHostname === '::' || normalizedHostname === '0:0:0:0:0:0:0:1' || normalizedHostname === '0:0:0:0:0:0:0:0') {\n      return true;\n    }\n\n    // IPv4-mapped IPv6 prefix (catch any remaining after normalization)\n    if (normalizedHostname.startsWith('::ffff:')) {\n      return true;\n    }\n\n    // RFC 1918 private ranges\n    if (normalizedHostname.startsWith('10.') || normalizedHostname.startsWith('192.168.')) {\n      return true;\n    }\n\n    // 172.16.0.0/12 — 172.16.x through 172.31.x\n    if (normalizedHostname.startsWith('172.')) {\n      const second = parseInt(normalizedHostname.split('.')[1], 10);\n      if (second >= 16 && second <= 31) return true;\n    }\n\n    // Link-local (169.254.0.0/16)\n    if (normalizedHostname.startsWith('169.254.')) {\n      return true;\n    }\n\n    // CGNAT (100.64.0.0/10) — shared address space, not publicly routable\n    if (normalizedHostname.startsWith('100.')) {\n      const second = parseInt(normalizedHostname.split('.')[1], 10);\n      if (second >= 64 && second <= 127) return true;\n    }\n\n    // Special-use TLDs\n    if (\n      normalizedHostname.endsWith('.local') ||\n      normalizedHostname.endsWith('.internal') ||\n      normalizedHostname.endsWith('.localhost') ||\n      normalizedHostname.endsWith('.invalid') ||\n      normalizedHostname.endsWith('.test') ||\n      normalizedHostname.endsWith('.onion')\n    ) {\n      return true;\n    }\n\n    return false;\n  }\n\n  /**\n   * Normalize numeric IP representations (decimal, hex, octal) to dotted-decimal IPv4.\n   * Prevents SSRF bypass via alternative IP notations like http://2130706433 (= 127.0.0.1).\n   * Returns the input unchanged if it's not a numeric IP.\n   */\n  private _normalizeNumericIp(hostname: string): string {\n    // Pure decimal integer (e.g., 2130706433 for 127.0.0.1)\n    if (/^\\d+$/.test(hostname)) {\n      const num = parseInt(hostname, 10);\n      if (num >= 0 && num <= 0xFFFFFFFF) {\n        return `${(num >>> 24) & 0xFF}.${(num >>> 16) & 0xFF}.${(num >>> 8) & 0xFF}.${num & 0xFF}`;\n      }\n    }\n\n    // Hex notation (e.g., 0x7f000001)\n    if (/^0x[0-9a-fA-F]+$/.test(hostname)) {\n      const num = parseInt(hostname, 16);\n      if (num >= 0 && num <= 0xFFFFFFFF) {\n        return `${(num >>> 24) & 0xFF}.${(num >>> 16) & 0xFF}.${(num >>> 8) & 0xFF}.${num & 0xFF}`;\n      }\n    }\n\n    // Octal notation (e.g., 017700000001) — leading zero\n    if (/^0[0-7]+$/.test(hostname)) {\n      const num = parseInt(hostname, 8);\n      if (num >= 0 && num <= 0xFFFFFFFF) {\n        return `${(num >>> 24) & 0xFF}.${(num >>> 16) & 0xFF}.${(num >>> 8) & 0xFF}.${num & 0xFF}`;\n      }\n    }\n\n    return hostname;\n  }\n}\n"]}
+{"version":3,"file":"oauth2-authentication.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/oauth2-authentication.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAO9G,OAAO,EACL,sCAAsC,EACtC,yCAAyC,EACzC,iCAAiC,GAClC,MAAM,4FAA4F,CAAC;AACpG,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AAExI,OAAO,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AACtG,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AACzJ,OAAO,EAAE,wCAAwC,EAAE,MAAM,gHAAgH,CAAC;AAC1K,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EACL,wBAAwB,EACxB,+BAA+B,EAC/B,gBAAgB,EAChB,SAAS,EACT,2BAA2B,EAC3B,cAAc,EAEd,UAAU,EACV,wBAAwB,EACxB,UAAU,EACV,aAAa,EAEb,iBAAiB,EACjB,8BAA8B,EAC9B,2BAA2B,EAC3B,gCAAgC,EAChC,mBAAmB,EACnB,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,6BAA6B,EAC7B,+CAA+C,GAChD,MAAM,+EAA+E,CAAC;AACvF,OAAO,EAAE,oCAAoC,EAAE,MAAM,8FAA8F,CAAC;AACpJ,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAUxD,OAAO,EAEL,oCAAoC,GACrC,MAAM,mFAAmF,CAAC;AAG3F,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,WAAW;IACX,cAAc;IACd,OAAO;IACP,OAAO;IACP,eAAe;IACf,gBAAgB;IAChB,uBAAuB;CACxB,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,YAAY;IACZ,MAAM;IACN,cAAc;IACd,WAAW;IACX,eAAe;IACf,eAAe;CAChB,CAAC,CAAC;AAEH;;;;;;;GAOG;AAEI,IAAM,kCAAkC,GAAxC,MAAM,kCAAkC;IAYS;IACU;IACG;IACW;IACH;IACL;IACS;IAEP;IAES;IAEjB;IAOG;IAEhD;IAhCF,QAAQ,CAA+D;IAExF;;;;;OAKG;IACc,UAAU,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEzD,YACsD,MAAqB,EACX,gBAAyC,EACtC,YAAwC,EAC7B,uBAA8D,EACjE,aAAwD,EAC7D,sBAAqD,EAC5C,QAAgD,EAEvD,iBAAkD,EAEzC,sBAAgE,EAEjF,gBAAyC,EAOtC,mBAA+C,EAE/F,6BAA0E;QArBvC,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QACtC,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,4BAAuB,GAAvB,uBAAuB,CAAuC;QACjE,kBAAa,GAAb,aAAa,CAA2C;QAC7D,2BAAsB,GAAtB,sBAAsB,CAA+B;QAC5C,aAAQ,GAAR,QAAQ,CAAwC;QAEvD,sBAAiB,GAAjB,iBAAiB,CAAiC;QAEzC,2BAAsB,GAAtB,sBAAsB,CAA0C;QAEjF,qBAAgB,GAAhB,gBAAgB,CAAyB;QAOtC,wBAAmB,GAAnB,mBAAmB,CAA4B;QAE/F,kCAA6B,GAA7B,6BAA6B,CAA6C;QAE3F,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;IAED,kEAAkE;IAClE,6BAA6B;IAC7B,kEAAkE;IAElE;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,qBAAqB,CAChC,UAAoC,EACpC,OAA2G;QAE3G,0CAA0C;QAC1C,IAAI,YAAgC,CAAC;QACrC,IAAI,aAAiC,CAAC;QACtC,IAAI,mBAAuC,CAAC;QAE5C,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YAC1B,YAAY,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC3C,IAAI,UAAU,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;gBACrC,aAAa,GAAG,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;gBACzD,mBAAmB,GAAG,MAAM,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACN,aAAa,GAAG,YAAY,CAAC;gBAC7B,mBAAmB,GAAG,OAAO,CAAC;YAChC,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,MAAM,aAAa,GAA6B;YAC9C,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,YAAY;YACZ,mBAAmB,EAAE,OAAO,EAAE,mBAAmB;YACjD,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,UAAU,CAAC,KAAK,EAAE,SAAS;YAC5D,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,UAAU,CAAC,KAAK,EAAE,OAAO;YACtD,SAAS,EAAE,OAAO,EAAE,SAAS;YAC7B,YAAY,EAAE,UAAU,CAAC,KAAK,EAAE,YAAY;SAC7C,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;YAC/D,SAAS,EAAE,wBAAwB,CAAC,YAAY;YAChD,eAAe,EAAE,+BAA+B,CAAC,eAAe;YAChE,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;YACpD,QAAQ,EAAE,aAA+C;SAC1D,CAAC,CAAC;QAEH,0BAA0B;QAC1B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,UAAU,CAAC,QAAQ;YAC9B,YAAY,EAAE,UAAU,CAAC,WAAW;YACpC,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAClC,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB;;;;;eAKG;YACH,aAAa,EAAE,UAAU,CAAC,YAAY;SACvC,CAAC,CAAC;QAEH,IAAI,aAAa,IAAI,mBAAmB,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;YAC5C,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,mBAAmB,CAAC,CAAC;QAC3D,CAAC;QAED;;;;;;;;;;WAUG;QACH,IAAI,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAED,0BAA0B;QAC1B,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;YAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACtE,IAAI,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wDAAwD,EAAE;wBACzE,WAAW,EAAE,UAAU,CAAC,WAAW;wBACnC,GAAG;qBACJ,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GAAG,GAAG,UAAU,CAAC,gBAAgB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QAE/E,IAAI,CAAC,QAAQ,CAAC,yBAAyB,EAAE;YACvC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,IAAI,EAAE,CAAC,CAAC,YAAY;YACpB,qFAAqF;YACrF,6DAA6D;YAC7D,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;IACvD,CAAC;IAED,kEAAkE;IAClE,qBAAqB;IACrB,kEAAkE;IAElE;;;;;;OAMG;IACI,KAAK,CAAC,cAAc,CACzB,cAAoC;QAEpC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC;QAE7C,6EAA6E;QAC7E,IAAI,aAA8B,CAAC;QACnC,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,gFAAgF;QAChF,+EAA+E;QAC/E,IAAI,aAAa,CAAC,SAAS,KAAK,wBAAwB,CAAC,YAAY,EAAE,CAAC;YACtE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAG,aAAa,CAAC,QAA+C,CAAC;QAEpF,uDAAuD;QACvD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;QAE3E,oEAAoE;QACpE,IAAI,UAAU,CAAC,QAAQ,KAAK,aAAa,CAAC,QAAQ,EAAE,CAAC;YACnD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,4CAA4C;QAC5C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,qBAAqB,CACpD,IAAI,EACJ,UAAU,EACV,aAAa,CAAC,YAAY,CAC3B,CAAC;QAEF,kDAAkD;QAClD,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,kBAAkB,CACrD,aAAa,EACb,UAAU,EACV,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,+BAA+B,EAAE;YAC7C,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,KAAK,EAAE,iBAAiB,CAAC,KAAK;YAC9B,aAAa,EAAE,iBAAiB,CAAC,aAAa;SAC/C,CAAC,CAAC;QAEH,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;IAC1D,CAAC;IAED,kEAAkE;IAClE,4BAA4B;IAC5B,kEAAkE;IAElE;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACI,KAAK,CAAC,mBAAmB,CAC9B,OAA8B,EAC9B,UAAqC,EACrC,mBAA4B;QAE5B,OAAO,IAAI,CAAC,0BAA0B,CACpC,OAAO,EACP,UAAU,EACV,mBAAmB,EACnB,IAAI,CACL,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,0BAA0B,CACtC,OAA8B,EAC9B,UAAqC,EACrC,mBAAuC,EACvC,gCAAyC;QAEzC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACpD,IAAI,UAAU,CAAC,cAAc,KAAK,iBAAiB,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACpF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,MAAM,EAAE,qCAAqC;oBAC7C,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B;aACF,CAAC,CAAC;QACL,CAAC;QAED,mDAAmD;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;YAClF,IACE,WAAW,EAAE,WAAW,EAAE,UAAU;mBACjC,UAAU,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM,EACzD,CAAC;gBACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;iBACjF,CAAC,CAAC;YACL,CAAC;YAED,iEAAiE;YACjE,IAAI,WAAW,IAAI,UAAU,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;gBAC1E,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAC/D,EAAE,EACF,WAAW,CAAC,SAAS,EACrB,WAAW,CAAC,OAAO,EACnB,UAAU,CAAC,WAAW,CACvB,CAAC;gBACF,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC;wBACnD,KAAK,EAAE,OAAO,CAAC,KAAK;wBACpB,WAAW,EAAE,UAAU,CAAC,WAAW;wBACnC,SAAS,EAAE,WAAW,CAAC,SAAS;wBAChC,cAAc,EAAE,WAAW,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;4BAClE,CAAC,CAAC,WAAW,CAAC,OAAO;4BACrB,CAAC,CAAC,SAAS;wBACb,aAAa,EAAE,WAAW,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW;4BAChE,CAAC,CAAC,WAAW,CAAC,OAAO;4BACrB,CAAC,CAAC,SAAS;wBACb,MAAM,EAAE,MAAM,IAAI,qBAAqB;wBACvC,SAAS,EAAE,UAAU;wBACrB,SAAS,EAAE,UAAU;qBACtB,CAAC,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;wBAChF,OAAO,EAAE;4BACP,wBAAwB;4BACxB,MAAM,EAAE,MAAM,IAAI,qBAAqB;yBACxC;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,mDAAmD;QACnD,kFAAkF;QAClF,4EAA4E;QAC5E,6EAA6E;QAC7E,gFAAgF;QAChF,MAAM,YAAY,GAAG,UAAU,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM;YACzE,CAAC,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACvC,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF;gBACE,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,cAAc,EAAE,UAAU,CAAC,cAAc;aAC1C,CACF;YACD,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3H,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;oBAChF,OAAO,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE;iBAClD,CAAC,CAAC;YACL,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;gBAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;oBACjF,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE;iBAC3C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,CAAC,0BAA0B,CACnC,EAAE,EACF,YAAY,CAAC,MAAM,EACnB,mBAAmB,EACnB,UAAU,CAAC,cAAc,KAAK,iBAAiB,CAAC,UAAU;gBACxD,CAAC,CAAC,8BAA8B,CAAC,kBAAkB;gBACnD,CAAC,CAAC,8BAA8B,CAAC,gBAAgB,CACpD,CAAC;YAEF,mFAAmF;YACnF,wFAAwF;YACxF,qFAAqF;YACrF,kFAAkF;YAClF,sEAAsE;YACtE,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,YAAY,CAAC,GAAG,EAAE;gBACpG,UAAU,EAAE,IAAI,IAAI,EAAE;gBACtB,aAAa,EAAE,OAAO,CAAC,KAAK;gBAC5B,mBAAmB,EAAE,OAAO,CAAC,WAAW;gBACxC,iBAAiB,EAAE,OAAO,CAAC,SAAS;gBACpC,kBAAkB,EAAE,OAAO,CAAC,SAAS;aACtC,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,mDAAmD,EAAE;gBACjE,MAAM,EAAE,YAAY,CAAC,MAAM;gBAC3B,WAAW,EAAE,UAAU,CAAC,WAAW;aACpC,CAAC,CAAC;YAEH,2FAA2F;YAC3F,6FAA6F;YAC7F,yFAAyF;YACzF,4DAA4D;YAC5D,MAAM,oCAAoC,CAAC,EAAE,EAAE;gBAC7C,MAAM,EAAE,YAAY,CAAC,MAAM;gBAC3B,OAAO;gBACP,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;gBACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;YAEH,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC3D,CAAC;QAED,wEAAwE;QACxE,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QAC/D,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CACnD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,eAAe,KAAK,KAAK,CACtD,CAAC;QAEF,IACE,UAAU,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM;eACnD,eAAe,EAClB,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAEvI,IAAI,YAAY,EAAE,CAAC;gBACjB,2BAA2B;gBAC3B,qFAAqF;gBACrF,kFAAkF;gBAClF,mFAAmF;gBACnF,6EAA6E;gBAC7E,qEAAqE;gBACrE,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,KAAK,UAAU,CAAC,kBAAkB,CAAC;gBACjF,IAAI,YAAY,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBACrE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;wBACjF,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,MAAM,EAAE;qBAC7C,CAAC,CAAC;gBACL,CAAC;gBAED,mFAAmF;gBACnF,yEAAyE;gBACzE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;oBAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;qBACjF,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBACxB,MAAM,IAAI,CAAC,6BAA6B,CAAC,kBAAkB,CACzD,sCAAsC,EACtC,KAAK,EAAE,cAAc,EAAE,EAAE;wBACvB,MAAM,IAAI,CAAC,0BAA0B,CACnC,EAAE,EACF,YAAY,CAAC,GAAG,EAChB,mBAAmB,EACnB,8BAA8B,CAAC,gBAAgB,EAC/C,cAAc,CACf,CAAC;wBACF,MAAM,IAAI,CAAC,kBAAkB,CAC3B,YAAY,CAAC,GAAG,EAChB,OAAO,EACP,UAAU,EACV,cAAc,CACf,CAAC;oBACJ,CAAC,CACF,CAAC;gBACJ,CAAC;gBAED,wDAAwD;gBACxD,qFAAqF;gBACrF,yFAAyF;gBACzF,sFAAsF;gBACtF,sFAAsF;gBACtF,yDAAyD;gBACzD,IAAI,kBAAkB,EAAE,CAAC;oBACvB,MAAM,IAAI,CAAC,sCAAsC,CAC/C,EAAE,EACF,YAAY,EACZ,OAAO,EACP,UAAU,EACV,mBAAmB,CACpB,CAAC;gBACJ,CAAC;gBAED,2FAA2F;gBAC3F,8FAA8F;gBAC9F,uFAAuF;gBACvF,8FAA8F;gBAC9F,uEAAuE;gBACvE,MAAM,oCAAoC,CAAC,EAAE,EAAE;oBAC7C,MAAM,EAAE,YAAY,CAAC,GAAG;oBACxB,OAAO;oBACP,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;oBACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;oBAC7C,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,sBAAsB,EAAE;oBAClG,MAAM,EAAE,YAAY,CAAC,GAAG;oBACxB,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,KAAK,EAAE,OAAO,CAAC,KAAK;iBACrB,CAAC,CAAC;gBAEH,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACxD,CAAC;QACH,CAAC;QAED,oDAAoD;QACpD,IAAI,UAAU,CAAC,cAAc,KAAK,iBAAiB,CAAC,UAAU,EAAE,CAAC;YAC/D,MAAM,eAAe,GAAG,UAAU,CAAC,KAAK,CAAC;YACzC,2FAA2F;YAC3F,uFAAuF;YACvF,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;gBACnC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,OAAO,EAAE,EAAE,OAAO,EAAE,yEAAyE,EAAE;iBAChG,CAAC,CAAC;YACL,CAAC;YAED,sEAAsE;YACtE,MAAM,oBAAoB,GAAG,oCAAoC,CAAC,eAAe,CAAC,CAAC;YACnF,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAClJ,IAAI,uBAAuB,IAAI,oBAAoB,EAAE,CAAC;gBACpD,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,uBAAuB,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YAC7F,CAAC;YAED,uFAAuF;YACvF,oFAAoF;YACpF,MAAM,qCAAqC,GACzC,mBAAmB,IAAI,IAAI,CAAC,gBAAgB,CAAC,iCAAiC,EAAE,IAAI,SAAS,CAAC;YAChG,MAAM,gBAAgB,GAAG,qCAAqC;gBAC5D,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,sCAAsC,CAC5D,qCAAqC,CACtC,IAAI,SAAS;gBACd,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,uBAAuB,CACtE,OAAO,EACP,UAAU,EACV,UAAU,CAAC,kBAAkB,EAC7B,EAAE,gBAAgB,EAAE,CACrB,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE;gBAClD,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;gBACvB,SAAS,EAAE,eAAe,CAAC,SAAS;gBACpC,OAAO,EAAE,eAAe,CAAC,OAAO;gBAChC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,WAAW;aAC1B,CAAC,CAAC;YAEH,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC9D,CAAC;QAED,wDAAwD;QACxD,6EAA6E;QAC7E,4EAA4E;QAC5E,2EAA2E;QAC3E,8CAA8C;QAC9C,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,0FAA0F;QAC1F,4FAA4F;QAC5F,8FAA8F;QAC9F,qFAAqF;QACrF,MAAM,2BAA2B,GAC/B,mBAAmB,IAAI,IAAI,CAAC,gBAAgB,CAAC,iCAAiC,EAAE,IAAI,SAAS,CAAC;QAChG,MAAM,oBAAoB,GAAG,2BAA2B;YACtD,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,sCAAsC,CAAC,2BAA2B,CAAC;YAC3F,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,kBAAkB,GAAG,oBAAoB;YAC7C,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,YAAY;YACrD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,iCAAiC,GAAG,OAAO,CAC/C,2BAA2B;eACxB,oBAAoB;eACpB,IAAI,CAAC,gBAAgB,CAAC,qCAAqC,CAC5D,2BAA2B,EAC3B,oBAAoB,CACrB,EAAE,QAAQ,KAAK,IAAI,CACrB,CAAC;QACF,MAAM,gBAAgB,GAAG,kBAAkB,KAAK,SAAS;eACpD,iCAAiC;eACjC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC;eAChD,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;eACtE,gCAAgC,CACjC,kBAAkB,CAAC,IAAI,EACvB,8BAA8B,CAAC,gBAAgB,CAChD,CAAC;QAEJ,IAAI,CAAC,gBAAgB,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC/C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;aAClF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAa,CAAC;QAClB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,kBAAkB,CACnE,iCAAiC,EACjC,KAAK,EAAE,cAAc,EAAE,EAAE;gBACvB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAC3D,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF;oBACE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE;oBAClC,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,QAAQ,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBACnC,SAAS,EAAE,CAAC,oBAAoB,CAAC;iBAClC,EACD,cAAc,CACf,CAAC;gBACF,MAAM,IAAI,CAAC,kBAAkB,CAC3B,WAAW,CAAC,GAAG,EACf,OAAO,EACP,UAAU,EACV,cAAc,CACf,CAAC;gBACF,OAAO,WAAW,CAAC;YACrB,CAAC,EACD;gBACE,2BAA2B,EAAE;oBAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC;aACF,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,gBAAgB,GAAG,KAA4C,CAAC;YACtE,MAAM,gBAAgB,GACpB,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,CAAC;mBACrD,gBAAgB,CAAC,IAAI,KAAK,KAAK;mBAC/B,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,eAAe,CAAC,KAAK,IAAI;mBAC5D,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;YAC3D,IAAI,gBAAgB,IAAI,gCAAgC,EAAE,CAAC;gBACzD,IAAI,CAAC,QAAQ,CAAC,mFAAmF,EAAE;oBACjG,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,WAAW,EAAE,UAAU,CAAC,WAAW;iBACpC,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,0BAA0B,CACpC,OAAO,EACP,UAAU,EACV,mBAAmB,EACnB,KAAK,CACN,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE;YAC/C,MAAM,EAAE,OAAO,CAAC,GAAG;YACnB,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QAEH,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACK,KAAK,CAAC,0BAA0B,CACtC,EAAyB,EACzB,MAAc,EACd,mBAAuC,EACvC,kBAAkD,EAClD,cAA+B;QAE/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAClD,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,GAAG,EAAE,MAAM,EAAE,EACf,cAAc,CACf,CAAC;QACF,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM;YAAE,OAAO,CAAC,8DAA8D;QAEnG,MAAM,2BAA2B,GAC/B,mBAAmB,IAAI,IAAI,CAAC,gBAAgB,CAAC,iCAAiC,EAAE,IAAI,SAAS,CAAC;QAChG,MAAM,YAAY,GAAG,2BAA2B;YAC9C,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,sCAAsC,CAAC,2BAA2B,CAAC;YAC3F,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,QAAQ,CAAC,qEAAqE,EAAE;gBACnF,MAAM;gBACN,mBAAmB,EAAE,2BAA2B;aACjD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE;YAC/D,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS;YACxC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,WAAW,GAAG,2BAA2B,CAC7C,mBAAmB,EACnB,CAAC,YAAY,CAAC,EACd,IAAI,EAAE,SAAS,IAAI,EAAE,EACrB,kBAAkB,CACnB,CAAC;QACF,MAAM,kBAAkB,GAAG,mBAAmB,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC;QAClF,MAAM,oBAAoB,GAAG,kBAAkB,KAAK,8BAA8B,CAAC,gBAAgB;eAC9F,CACD,2BAA2B,KAAK,SAAS;mBACtC,IAAI,CAAC,gBAAgB,CAAC,qCAAqC,CAC5D,2BAA2B,EAC3B,YAAY,CACb,EAAE,QAAQ,KAAK,IAAI;mBACjB,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,cAAc,CAAC;mBACjD,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,CAC1E,CAAC;QACJ,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAClD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE;oBACP,OAAO,EAAE,kBAAkB;oBAC3B,eAAe,EAAE,WAAW,CAAC,eAAe;oBAC5C,YAAY;iBACb;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CACvC,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,MAAM,EACN,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,EAC7B,cAAc,CACf,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,qCAAqC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACnI,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACK,KAAK,CAAC,sCAAsC,CAClD,EAAyB,EACzB,IAAU,EACV,OAA8B,EAC9B,UAAqC,EACrC,mBAAuC;QAEvC,MAAM,cAAc,GAClB,MAAM,IAAI,CAAC,6BAA6B,CAAC,kBAAkB,CACzD,yCAAyC,EACzC,KAAK,EAAE,cAAc,EAAE,EAAE;YACvB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACzD,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EACjB,cAAc,CACf,CAAC;YACF,IAAI,WAAW,EAAE,MAAM,KAAK,UAAU,CAAC,kBAAkB,EAAE,CAAC;gBAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;oBACjF,OAAO,EAAE;wBACP,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,MAAM;wBACzC,MAAM,EAAE,oCAAoC;qBAC7C;iBACF,CAAC,CAAC;YACL,CAAC;YAED,4EAA4E;YAC5E,8EAA8E;YAC9E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CACxD,gBAAgB,CAAC,oBAAoB,EACrC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE,EAC9D,SAAS,EACT,cAAc,CACf,CAAC;YACF,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;YACxE,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;oBACjF,OAAO,EAAE;wBACP,UAAU,EAAE,WAAW,CAAC,MAAM;wBAC9B,MAAM,EAAE,6CAA6C;qBACtD;iBACF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,+CAA+C,CAAC;gBACpD,IAAI,EAAE,WAAW;gBACjB,eAAe,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC;gBAClF,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,cAAc;aACf,CAAC,CAAC;YAEH,IAAI,uBAAuB,GAAG,CAAC,CAAC;YAChC,KAAK,MAAM,UAAU,IAAI,kBAAkB,EAAE,CAAC;gBAC5C,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,6BAA6B,CAAC,EAAE,EAAE;oBACtE,UAAU;oBACV,IAAI,EAAE,WAAW;oBACjB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;oBACvC,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;oBACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;oBAC7C,cAAc;oBACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC,CAAC;gBACH,IAAI,mBAAmB,EAAE,CAAC;oBACxB,uBAAuB,IAAI,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YACD,IAAI,uBAAuB,KAAK,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,OAAO,EAAE;wBACP,MAAM,EAAE,kDAAkD;wBAC1D,MAAM,EAAE,IAAI,CAAC,GAAG;qBACjB;iBACF,CAAC,CAAC;YACL,CAAC;YAED,yFAAyF;YACzF,wFAAwF;YACxF,iFAAiF;YACjF,sFAAsF;YACtF,yFAAyF;YACzF,0FAA0F;YAC1F,uFAAuF;YACvF,8BAA8B;YAC9B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CACjE,gBAAgB,CAAC,KAAK,EACtB;gBACE,GAAG,EAAE,WAAW,CAAC,GAAG;gBACpB,MAAM,EAAE,UAAU,CAAC,kBAAkB;aACtC,EACD,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,EAC7B,cAAc,CACf,CAAC;YACF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;oBAChE,OAAO,EAAE;wBACP,MAAM,EAAE,6CAA6C;wBACrD,MAAM,EAAE,IAAI,CAAC,GAAG;qBACjB;iBACF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,CAAC,0BAA0B,CACnC,EAAE,EACF,IAAI,CAAC,GAAG,EACR,mBAAmB,EACnB,8BAA8B,CAAC,UAAU,EACzC,cAAc,CACf,CAAC;YACF,MAAM,IAAI,CAAC,kBAAkB,CAC3B,IAAI,CAAC,GAAG,EACR,OAAO,EACP,UAAU,EACV,cAAc,CACf,CAAC;YACF,OAAO,uBAAuB,CAAC;QACjC,CAAC,CACF,CAAC;QAEJ,IAAI,CAAC,QAAQ,CAAC,uDAAuD,EAAE;YACrE,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,KAAK,EAAE,cAAc;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,wBAAwB,CACpC,EAAyB,EACzB,MAAc,EACd,oBAA4B;QAE5B,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,KAAK;YAAE,OAAO;QAE1E,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAmB,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,EAAE;YAC1H,MAAM;YACN,cAAc,EAAE,iBAAiB,CAAC,UAAU;SAC7C,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAuB,IAAI,EAAE,CAAC;QAEhE,MAAM,eAAe,GAAG,eAAe,CAAC,IAAI,CAC1C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,KAAK,oBAAoB,CAC9E,CAAC;QAEF,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACzE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;aAC1E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,0BAA0B;IAC1B,kEAAkE;IAElE;;;OAGG;IACK,KAAK,CAAC,qBAAqB,CACjC,IAAY,EACZ,UAAoC,EACpC,YAAqB;QAErB,MAAM,UAAU,GAA2B;YACzC,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,UAAU,CAAC,WAAW;SACrC,CAAC;QAEF,IAAI,YAAY,EAAE,CAAC;YACjB,UAAU,CAAC,aAAa,GAAG,YAAY,CAAC;QAC1C,CAAC;QAED,2BAA2B;QAC3B,IAAI,UAAU,CAAC,gBAAgB,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACvE,IAAI,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;wBACjE,WAAW,EAAE,UAAU,CAAC,WAAW;wBACnC,GAAG;qBACJ,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAA2B;YACtC,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,mCAAmC;YACnE,GAAG,CAAC,UAAU,CAAC,mBAAmB,IAAI,EAAE,CAAC;SAC1C,CAAC;QAEF,wDAAwD;QACxD,QAAQ,UAAU,CAAC,uBAAuB,EAAE,CAAC;YAC3C,KAAK,oBAAoB;gBACvB,UAAU,CAAC,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC;gBAC3C,UAAU,CAAC,aAAa,GAAG,UAAU,CAAC,YAAY,CAAC;gBACnD,MAAM;YACR,KAAK,qBAAqB;gBACxB,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,GAAG,SAAS,MAAM,CAAC,IAAI,CAC3D,GAAG,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,YAAY,EAAE,CACpD,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvB,MAAM;YACR,KAAK,MAAM;gBACT,UAAU,CAAC,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC;gBAC3C,MAAM;QACV,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;SACjD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;gBAChD,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,KAAK,EAAE,SAAS;aACjB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;QACvE,IAAI,CAAC,QAAQ,CAAC,2BAA2B,EAAE;YACzC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,cAAc,EAAE,CAAC,CAAC,aAAa,CAAC,YAAY;YAC5C,UAAU,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ;SACrC,CAAC,CAAC;QAEH,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,kEAAkE;IAClE,8BAA8B;IAC9B,kEAAkE;IAElE;;;;;;;;;OASG;IACK,KAAK,CAAC,kBAAkB,CAC9B,aAAsC,EACtC,UAAoC,EACpC,YAAsC;QAEtC,IAAI,SAAS,GAA4B,EAAE,CAAC;QAE5C,0BAA0B;QAC1B,IAAI,UAAU,CAAC,cAAc,KAAK,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;YACvE,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,UAAU,CAAC,WAAW,EACtB,aAAa,CAAC,YAAsB,EACpC,UAAU,CACX,CAAC;QACJ,CAAC;aAAM,IAAI,UAAU,CAAC,cAAc,KAAK,UAAU,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC9E,4EAA4E;YAC5E,+EAA+E;YAC/E,mFAAmF;YACnF,IAAI,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;gBAC5C,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,aAAa,CAAC,QAAkB,EAChC,UAAU,CAAC,OAAO,EAClB,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,QAAQ,CACpB,CAAC;gBACJ,CAAC;gBAAC,OAAO,WAAW,EAAE,CAAC;oBACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE;wBACrD,WAAW,EAAE,UAAU,CAAC,WAAW;wBACnC,GAAG,2BAA2B,CAAC,WAAW,CAAC;qBAC5C,CAAC,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;qBACjF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE;oBAC1F,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO;oBAChC,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM;iBAC/B,CAAC,CAAC;gBACH,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,QAAkB,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,IAAI,YAAY,EAAE,IAAI,EAAE,CAAC;YACvB,IAAI,QAAiC,CAAC;YACtC,IAAI,OAAO,YAAY,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1C,IAAI,CAAC;oBACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAA4B,CAAC;gBACtE,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,QAAQ,CAAC,qEAAqE,EAAE;wBACnF,WAAW,EAAE,UAAU,CAAC,WAAW;qBACpC,CAAC,CAAC;oBACH,QAAQ,GAAG,EAAE,CAAC;gBAChB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,YAAY,CAAC,IAA+B,CAAC;YAC1D,CAAC;YAED,gEAAgE;YAChE,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAClB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAA+B,CAAC;gBACzD,IAAI,CAAC,SAAS,CAAC,kBAAkB,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;oBACvD,SAAS,CAAC,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC;gBACnD,CAAC;gBACD,IAAI,CAAC,SAAS,CAAC,iBAAiB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;oBACrD,SAAS,CAAC,iBAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;QAE/C,oDAAoD;QACpD,IAAI,UAAU,CAAC,cAAc,IAAI,aAAa,CAAC,YAAY,EAAE,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,cAAc,GAAG,IAAI,CAAC,4BAA4B,CAAC,UAAU,EAAE,UAAU,CAAC,cAAwB,CAAC,CAAC;gBAC1G,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE;oBACjD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,aAAa,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;iBAC/F,CAAC,CAAC;gBACH,IAAI,cAAc,CAAC,EAAE,EAAE,CAAC;oBACtB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAmE,CAAC;oBAC5G,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;oBACjE,IAAI,YAAY,EAAE,CAAC;wBACjB,SAAS,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC;wBAChE,SAAS,CAAC,UAAU,CAAC,cAAc,CAAC,aAAa,IAAI,gBAAgB,CAAC,GAAG,IAAI,CAAC;oBAChF,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,MAAM,OAAO,GAAG,UAAU,CAAC,cAAc,CAAC;QAE1C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACtF,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,IAAI,gBAAgB,CAAC,CAAC;QACjG,MAAM,aAAa,GAAG,gBAAgB,KAAK,IAAI,IAAI,gBAAgB,KAAK,MAAM,CAAC;QAE/E,sFAAsF;QACtF,IAAI,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEpG,+CAA+C;QAC/C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,kBAAkB;YAAE,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACjG,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,iBAAiB;YAAE,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAE7F,sCAAsC;QACtC,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1E,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAClC,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3B,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,8FAA8F;QAC9F,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;eAC9D,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;eAClE,CAAC,UAAU,CAAC,wBAAwB;gBACrC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,UAAU,CAAC,wBAAkC,CAAC,IAAI,EAAE,CAAC;gBAC3F,CAAC,CAAC,EAAE,CAAC;eACJ,KAAK,CAAC;QAEX,+DAA+D;QAC/D,MAAM,UAAU,GAAG,KAAK;eACnB,CAAC,UAAU,CAAC,kBAAkB;gBAC/B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,UAAU,CAAC,kBAA4B,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;gBACnG,CAAC,CAAC,EAAE,CAAC,CAAC;QAEV,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3G,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEnF,wDAAwD;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAuB,CAAC;QAE5E,oBAAoB;QACpB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9F,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnH,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEnH,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,cAAc;YACd,KAAK,EAAE,UAAU;YACjB,aAAa;YACb,SAAS,EAAE,SAAS,IAAI,SAAS;YACjC,QAAQ,EAAE,QAAQ,IAAI,SAAS;YAC/B,WAAW,EAAE,WAAW,IAAI,SAAS;YACrC,SAAS,EAAE,SAAS,IAAI,SAAS;YACjC,MAAM;YACN,KAAK;YACL,MAAM;YACN,UAAU,EAAE,UAAU,IAAI,SAAS;YACnC,UAAU,EAAE,UAAU,IAAI,SAAS;YACnC,SAAS;SACV,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,0BAA0B;IAC1B,kEAAkE;IAE1D,KAAK,CAAC,aAAa,CACzB,WAAmB,EACnB,WAAmB,EACnB,UAAoC;QAEpC,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,WAAW,EAAE;YACtC,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QAEF,gEAAgE;QAChE,IAAI,UAAU,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;YAC3C,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,mBAAmB,CAAC,MAAM,CAAC;QACzD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE,EAAE,OAAO,EAAE,8BAA8B,QAAQ,CAAC,MAAM,EAAE,EAAE;aACtE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;IAC1D,CAAC;IAED,kEAAkE;IAClE,kCAAkC;IAClC,kEAAkE;IAE1D,KAAK,CAAC,kBAAkB,CAC9B,MAAc,EACd,OAA8B,EAC9B,UAAqC,EACrC,cAA+B;QAE/B,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC3C,gBAAgB,CAAC,mBAAmB,EACpC;YACE,MAAM;YACN,cAAc,EAAE,iBAAiB,CAAC,MAAM;YACxC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,aAAa,EAAE,OAAO,CAAC,KAAK;YAC5B,mBAAmB,EAAE,OAAO,CAAC,WAAW;YACxC,iBAAiB,EAAE,OAAO,CAAC,SAAS;YACpC,kBAAkB,EAAE,OAAO,CAAC,SAAS;YACrC,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,EACD,cAAc,CACf,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,6BAA6B;IAC7B,kEAAkE;IAElE;;;;OAIG;IACK,KAAK,CAAC,2BAA2B;QACvC,OAAO,IAAI,CAAC,aAAa,CAAC,yBAAyB,CAAC,IAAI,CAAC,aAAa,CAAC,yBAAyB,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,kEAAkE;IAClE,wBAAwB;IACxB,kEAAkE;IAE1D,oBAAoB;QAC1B,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAEO,qBAAqB,CAAC,QAAgB;QAC5C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1E,CAAC;IAED,kEAAkE;IAClE,oCAAoC;IACpC,kEAAkE;IAE1D,4BAA4B,CAAC,UAAoC,EAAE,QAAgB;QACzF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,mFAAmF;oBACnF,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,MAAM,EAAE,yBAAyB;iBAClC;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG;YACnB,UAAU,CAAC,gBAAgB;YAC3B,UAAU,CAAC,QAAQ;YACnB,UAAU,CAAC,WAAW;SACvB;aACE,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,GAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;QAExC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,mFAAmF;oBACnF,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,MAAM,EAAE,gCAAgC;oBACxC,IAAI,EAAE,MAAM,CAAC,QAAQ;iBACtB;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,MAA+B,EAAE,IAAY;QAChE,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,OAAO,GAAY,MAAM,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC/F,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,MAA+B,EAAE,IAAY;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,OAAe;QACnC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACrE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,aAAa,CACzB,OAAe,EACf,OAAe,EACf,MAAyB,EACzB,QAA2B;QAE3B,MAAM,EAAE,SAAS,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAE/D,IAAI,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QAED;;;;;;;;;WASG;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,IAAuC,EAAE;YACpF,MAAM;YACN,QAAQ;YACR,WAAW,EAAE,WAAW;SACzB,CAAC,CAAC;QAEH,OAAO,OAAkC,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACK,kBAAkB,CAAC,GAAW;QACpC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAE5B,wEAAwE;YACxE,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAChE,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,uEAAuE;YACvE,+EAA+E;YAC/E,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC7C,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvD,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACxF,IAAI,eAAe,EAAE,CAAC;gBACpB,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YAChC,CAAC;YAED,IAAI,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5C,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,wBAAwB,CAAC,QAAgB;QAC/C,oEAAoE;QACpE,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,kBAAkB,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAE9D,WAAW;QACX,IAAI,kBAAkB,KAAK,WAAW,IAAI,kBAAkB,KAAK,WAAW,IAAI,kBAAkB,KAAK,SAAS,IAAI,kBAAkB,KAAK,KAAK,EAAE,CAAC;YACjJ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,qCAAqC;QACrC,IAAI,kBAAkB,KAAK,IAAI,IAAI,kBAAkB,KAAK,iBAAiB,IAAI,kBAAkB,KAAK,iBAAiB,EAAE,CAAC;YACxH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,oEAAoE;QACpE,IAAI,kBAAkB,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,0BAA0B;QAC1B,IAAI,kBAAkB,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACtF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,4CAA4C;QAC5C,IAAI,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9D,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE;gBAAE,OAAO,IAAI,CAAC;QAChD,CAAC;QAED,8BAA8B;QAC9B,IAAI,kBAAkB,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,sEAAsE;QACtE,IAAI,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9D,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,GAAG;gBAAE,OAAO,IAAI,CAAC;QACjD,CAAC;QAED,mBAAmB;QACnB,IACE,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACrC,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC;YACxC,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC;YACzC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC;YACvC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC;YACpC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACrC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACK,mBAAmB,CAAC,QAAgB;QAC1C,wDAAwD;QACxD,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;gBAClC,OAAO,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;YAC7F,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;gBAClC,OAAO,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;YAC7F,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAClC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;gBAClC,OAAO,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;YAC7F,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAA;AAliDY,kCAAkC;IAD9C,UAAU,EAAE;IAaR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,+BAA+B,CAAC,CAAA;IAE1D,WAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IAEnD,WAAA,MAAM,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,CAAA;IAE5D,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAO3C,YAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;qCApBJ,aAAa;QACO,uBAAuB;QACxB,0BAA0B,YAEjB,yCAAyC;QACrC,6BAA6B;QAClC,sCAAsC;QAEpC,+BAA+B;QAEjB,wCAAwC;QAE/D,uBAAuB;GAxB9F,kCAAkC,CAkiD9C","sourcesContent":["/**\n * OAuth2AuthenticationBackendService\n *\n * Generic OAuth2/OIDC engine parameterized by OAuth2ResolvedConnection.\n * Handles: authorization URL building, callback processing (code exchange +\n * profile extraction), and user provisioning/linking.\n *\n * This service is provider-agnostic — it operates solely on the resolved\n * connection config. Adding enterprise SSO (Step 15) means adding a new\n * resolver; the engine code does not change.\n *\n * Key design decisions:\n * - TRAP 12: Uses `issueTokensForUser(userId, sessionId?)` — NOT `issueTokens(session)`\n * - TRAP 13: Audit logging is generally caller-driven, EXCEPT for security policy enforcement\n *   rejections (G3 provider restrictions) which audit directly for defense-in-depth.\n * - TRAP 9: Does NOT depend on AuthenticationOrchestrator (one-way dependency arrows)\n * - Critical Note #3: Uses INTERNALLY_INITIATED_REQUEST execution context\n * - Critical Note #4: Domain-to-org lookup — bound since Step 14\n *\n * Browser-only — the framework targets web stacks exclusively\n * (`AppFrontendType` ∈ { SAAS_APP, STATIC_WEBSITE, TECH_DOC }), so the\n * authorization-URL → IdP-callback → token-exchange flow is the single\n * supported OAuth2 pathway. No native-SDK / Capacitor / Electron variants\n * exist; this service does not validate native SDK identity tokens.\n */\n\nimport 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport * as crypto from 'crypto';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { ServiceOptions } from '~wildo-backend-lib/base-classes/models/repositories.backend.schemas';\nimport type {\n  ResourcePersistenceUnitOfWorkBackendService,\n} from '~wildo-backend-lib/databases/services/resource-persistence-unit-of-work.backend.service';\nimport {\n  SOCIAL_EXISTING_USER_LINK_UNIT_OF_WORK,\n  SOCIAL_INVITATION_ACCEPTANCE_UNIT_OF_WORK,\n  SOCIAL_USER_CREATION_UNIT_OF_WORK,\n} from '~wildo-backend-lib/security/authentications/models/identity-persistence-boundaries.backend';\nimport { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport { ConsumableTokenBackendService } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport type { ConsumableToken } from '~wildo-backend-lib/security/consumable-tokens/models/consumable-tokens.shared.schemas';\nimport { OAuth2ConnectionResolverBackendService } from './oauth2-connection-resolver.backend.service';\nimport { DomainToOrgLookupBackendService } from '~wildo-backend-lib/security/authentications/services/admin-config/domain-to-org-lookup.backend.service';\nimport { EnterpriseUserProvisioningBackendService } from '~wildo-backend-lib/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport {\n  CoreConsumableTokenTypes,\n  ConsumableToken_ConsumptionMode,\n  CoreResourceType,\n  ErrorType,\n  ErrorCustomMessageReference,\n  CORE_APP_ROLES,\n  User,\n  UserStatus,\n  OrganizationMemberStatus,\n  AuthMethod,\n  AuthScopeType,\n  ExternalIdentitySource,\n  SsoConnectionType,\n  RegistrationAcquisitionChannel,\n  evaluateUserTypeAcquisition,\n  isRegistrationAcquisitionAllowed,\n  isWildoBackendError,\n  WildoHeaderKeys,\n} from '@wildo-ai/saas-models';\nimport type { UserIdentityLink, OrganizationMember } from '@wildo-ai/saas-models';\nimport {\n  applyInvitationAcceptanceCore,\n  assertInvitationBatchUserTypeAcquisitionAllowed,\n} from '~wildo-backend-lib/organizations/services/invitation-acceptance.backend.utils';\nimport { ensureUserProfileFromIdentityProfile } from '~wildo-backend-lib/security/authentications/services/utils/ensure-user-profile.backend.utils';\nimport { DurationUnit } from '@wildo-ai/zod-decorators';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type {\n  OAuth2ResolvedConnection,\n  NormalizedUserProfile,\n  OAuth2CallbackParams,\n  OAuth2StateTokenMetadata,\n  OAuth2ProvisionResult,\n\n} from '~wildo-backend-lib/security/authentications/models/oauth2-connection.backend.schemas';\nimport {\n  getApplicationIdFromEnterpriseScope,\n  getOrganizationIdFromEnterpriseScope,\n} from '~wildo-backend-lib/security/authentications/models/sso-connection.backend.schemas';\nimport type { SSOResolvedConnectionBase } from '~wildo-backend-lib/security/authentications/models/sso-connection.backend.schemas';\n\nconst RESERVED_AUTH_PARAM_KEYS = new Set([\n  'client_id',\n  'redirect_uri',\n  'scope',\n  'state',\n  'response_type',\n  'code_challenge',\n  'code_challenge_method',\n]);\n\nconst RESERVED_TOKEN_PARAM_KEYS = new Set([\n  'grant_type',\n  'code',\n  'redirect_uri',\n  'client_id',\n  'client_secret',\n  'code_verifier',\n]);\n\n/**\n * Provider-agnostic OAuth2 engine.\n *\n * Methods:\n * - buildAuthorizationUrl(connection) — generates the IdP redirect URL with state + PKCE\n * - handleCallback(callbackParams) — exchanges code, extracts profile\n * - provisionOrLinkUser(profile, connection, frontendServiceName?) — JIT provisioning or identity link (assigns the base user type)\n */\n@injectable()\nexport class OAuth2AuthenticationBackendService {\n  private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  /**\n   * Per-jwksUri cache for `createRemoteJWKSet` functions.\n   * Avoids recreating the function (and losing jose's internal key cache) on each login.\n   * The jose library's `createRemoteJWKSet` handles key rotation internally\n   * (refetch on kid miss), so caching the function instance is safe and long-lived.\n   */\n  private readonly _jwksCache = new Map<string, unknown>();\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n    @inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory) private readonly authEcFactory: AuthExecutionContextFactoryBackendService,\n    @inject(SAAS_SERVICE_TYPES.ConsumableTokenService) private readonly consumableTokenService: ConsumableTokenBackendService,\n    @inject(SAAS_SERVICE_TYPES.OAuth2ConnectionResolverService) private readonly resolver: OAuth2ConnectionResolverBackendService,\n    // Domain-to-org lookup — bound since Step 14. Provides SSO enforcement check for social logins.\n    @inject(SAAS_SERVICE_TYPES.DomainToOrgLookupService) private readonly domainToOrgLookup: DomainToOrgLookupBackendService,\n    // Enterprise user provisioning — Step 15. JIT provisioning for org users.\n    @inject(SAAS_SERVICE_TYPES.EnterpriseUserProvisioningService) private readonly enterpriseProvisioning: EnterpriseUserProvisioningBackendService,\n    // G3: Audit logging for security policy enforcement (provider restrictions)\n    @inject(SAAS_SERVICE_TYPES.AuditLogsService) private readonly auditLogsService: AuditLogsBackendService,\n    // Trusted in-process writes to system resources whose client-shaped CREATE/UPDATE\n    // DTO strips context FKs (`userId`/`organizationId`) and backend-only fields\n    // (`providerRawProfile`): USER_PROFILES + USER_IDENTITY_LINKS. Provisioning runs on a\n    // request-context-less pre-auth EC, so `createAsSystem`/`updateAsSystem` re-attach the\n    // stripped fields past the strict-DTO parse (fail-closed `systemAccessPolicy` opt-in).\n    // Reads stay on the caller EC.\n    @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourcePersistenceUnitOfWorkService)\n    private readonly resourcePersistenceUnitOfWork: ResourcePersistenceUnitOfWorkBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('OAuth2Authentication');\n    this.logger.setDebugTypeLogging('OAuth2Authentication', false);\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // 1. Build Authorization URL\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Generate the OAuth2 authorization URL for redirecting to the IdP.\n   * Creates PKCE challenge (if supported) and stores state + context in a consumable token.\n   *\n   * The state token captures all context needed by the callback handler to re-resolve\n   * the same connection configuration (including P3 credential overrides).\n   *\n   * @param options.frontendServiceName - Frontend service identity (stored in state, used to redirect back on callback)\n   * @param options.scopeType - 'organization' or 'application' — stored in the state token so\n   *   resolveFromState() can re-apply the correct scope overrides on callback.\n   *   Falls back to connection.scope.scopeType for enterprise connections.\n   * @param options.scopeId - Org/app ID — stored in the state token alongside scopeType.\n   *   Falls back to connection.scope.scopeId for enterprise connections.\n   */\n  public async buildAuthorizationUrl(\n    connection: OAuth2ResolvedConnection,\n    options?: { frontendServiceName?: string; scopeType?: AuthScopeType; scopeId?: string; returnUrl?: string },\n  ): Promise<{ authorizationUrl: string; state: string }> {\n    // Generate PKCE code verifier + challenge\n    let pkceVerifier: string | undefined;\n    let codeChallenge: string | undefined;\n    let codeChallengeMethod: string | undefined;\n\n    if (connection.pkceMethod) {\n      pkceVerifier = this.generateCodeVerifier();\n      if (connection.pkceMethod === 'S256') {\n        codeChallenge = this.generateS256Challenge(pkceVerifier);\n        codeChallengeMethod = 'S256';\n      } else {\n        codeChallenge = pkceVerifier;\n        codeChallengeMethod = 'plain';\n      }\n    }\n\n    // Store state + PKCE verifier + connection context in consumable token\n    const stateMetadata: OAuth2StateTokenMetadata = {\n      connectionType: connection.connectionType,\n      providerRef: connection.providerRef,\n      clientId: connection.clientId,\n      responseMode: connection.responseMode,\n      redirectUri: connection.redirectUri,\n      initiatedAt: new Date().toISOString(),\n      pkceVerifier,\n      frontendServiceName: options?.frontendServiceName,\n      scopeType: options?.scopeType || connection.scope?.scopeType,\n      scopeId: options?.scopeId || connection.scope?.scopeId,\n      returnUrl: options?.returnUrl,\n      connectionId: connection.scope?.connectionId,\n    };\n\n    const stateToken = await this.consumableTokenService.createToken({\n      tokenType: CoreConsumableTokenTypes.OAUTH2_STATE,\n      consumptionMode: ConsumableToken_ConsumptionMode.EPHEMERAL_STATE,\n      expiresIn: { value: 10, unit: DurationUnit.MINUTES },\n      metadata: stateMetadata as unknown as Record<string, any>,\n    });\n\n    // Build authorization URL\n    const params = new URLSearchParams({\n      client_id: connection.clientId,\n      redirect_uri: connection.redirectUri,\n      scope: connection.scopes.join(' '),\n      state: stateToken.token,\n      /*\n       * The engine implements the authorization-CODE flow only. The connection carries a\n       * `responseType` and the RESOLVER refuses anything else, so this stays a constant here rather\n       * than becoming a value this method has to validate a second time — one gate, at the point\n       * where the configuration is read.\n       */\n      response_type: connection.responseType,\n    });\n\n    if (codeChallenge && codeChallengeMethod) {\n      params.set('code_challenge', codeChallenge);\n      params.set('code_challenge_method', codeChallengeMethod);\n    }\n\n    /*\n     * OIDC authorization-request shaping (#419). Declared on the enterprise connection, persisted\n     * and audit-marked since the SSO work landed, and never sent until 2026-09-08 — so an operator\n     * who set `acrValues` to demand step-up at the identity provider got no such demand AND no\n     * error, which is the worst of the three possible outcomes.\n     *\n     * Set BEFORE the extras merge below on purpose: `acr_values`, `max_age` and `prompt` are not in\n     * `RESERVED_AUTH_PARAM_KEYS`, so a provider contract's `extraAuthParams` may legitimately carry\n     * a provider-specific value for one of them, and the more specific source should win. Adding\n     * them to the reserved set instead would break social providers that already ship a `prompt`.\n     */\n    if (connection.acrValues && connection.acrValues.length > 0) {\n      params.set('acr_values', connection.acrValues.join(' '));\n    }\n    if (connection.maxAge !== undefined) {\n      params.set('max_age', String(connection.maxAge));\n    }\n    if (connection.prompt) {\n      params.set('prompt', connection.prompt);\n    }\n\n    // Merge extra auth params\n    if (connection.extraAuthParams) {\n      for (const [key, value] of Object.entries(connection.extraAuthParams)) {\n        if (RESERVED_AUTH_PARAM_KEYS.has(key)) {\n          this.logger.warn('Ignoring reserved OAuth2 authorization extra parameter', {\n            providerRef: connection.providerRef,\n            key,\n          });\n          continue;\n        }\n        params.set(key, value);\n      }\n    }\n\n    const authorizationUrl = `${connection.authorizationUrl}?${params.toString()}`;\n\n    this.logDebug('Authorization URL built', {\n      providerRef: connection.providerRef,\n      connectionType: connection.connectionType,\n      pkce: !!pkceVerifier,\n      // Logged because their absence used to be invisible: an operator debugging a step-up\n      // requirement that never took effect had nothing to look at.\n      acrValues: connection.acrValues,\n      maxAge: connection.maxAge,\n      prompt: connection.prompt,\n    });\n\n    return { authorizationUrl, state: stateToken.token };\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // 2. Handle Callback\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Process the OAuth2 callback: validate state, exchange code for tokens,\n   * extract user profile.\n   *\n   * The callbackParams are extracted by the route handler from query params (GET)\n   * or body (POST), based on responseMode from the state token.\n   */\n  public async handleCallback(\n    callbackParams: OAuth2CallbackParams,\n  ): Promise<{ normalizedProfile: NormalizedUserProfile; connection: OAuth2ResolvedConnection; stateMetadata: OAuth2StateTokenMetadata }> {\n    const { code, state, body } = callbackParams;\n\n    // 1. Validate and consume the state token (single-use, prevents CSRF replay)\n    let consumedToken: ConsumableToken;\n    try {\n      consumedToken = await this.consumableTokenService.consumeToken(state);\n    } catch {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n      });\n    }\n\n    // Defense-in-depth: verify the consumed token is actually an OAUTH2_STATE token\n    // (prevents a PASSWORD_RESET or other token type from being accepted as state)\n    if (consumedToken.tokenType !== CoreConsumableTokenTypes.OAUTH2_STATE) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n      });\n    }\n\n    const stateMetadata = consumedToken.metadata as unknown as OAuth2StateTokenMetadata;\n\n    // 2. Re-resolve connection (ensures fresh credentials)\n    const ec = await this.getInternalExecutionContext();\n    const connection = await this.resolver.resolveFromState(ec, stateMetadata);\n\n    // 3. Verify clientId matches (detect config drift during auth flow)\n    if (connection.clientId !== stateMetadata.clientId) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n      });\n    }\n\n    // 4. Exchange authorization code for tokens\n    const tokenResponse = await this.exchangeCodeForTokens(\n      code,\n      connection,\n      stateMetadata.pkceVerifier,\n    );\n\n    // 5. Extract user profile based on identitySource\n    const normalizedProfile = await this.extractUserProfile(\n      tokenResponse,\n      connection,\n      body,\n    );\n\n    this.logDebug('Callback handled successfully', {\n      providerRef: connection.providerRef,\n      email: normalizedProfile.email,\n      emailVerified: normalizedProfile.emailVerified,\n    });\n\n    return { normalizedProfile, connection, stateMetadata };\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // 3. Provision or Link User\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * JIT provisioning: find existing user or create new one, create identity link.\n   *\n   * 1. Enterprise SSO enforcement check (blocks social login if org requires SSO)\n   * 2. Check for existing identity link (providerRef + providerUserId + connectionType)\n   * 3. Check for existing user by verified email (auto-link)\n   * 4. Enterprise provisioning branch (delegates to EnterpriseUserProvisioningService)\n   * 5. Social provisioning: create user only when the target type permits social-OAuth JIT\n   *\n   * All DB operations use INTERNALLY_INITIATED_REQUEST execution context\n   * (the user isn't authenticated yet at callback time).\n   *\n   * Every return point funnels through {@link ensureBaseUserTypeAssigned}: a user\n   * provisioned or linked here must leave with a non-empty `userTypes[]`, because\n   * the callback gates session issuance on the active user type resolving to a\n   * frontend-service entry with `auth: true`. See that helper for the base-vs-grant\n   * source-of-truth rationale.\n   *\n   * @param frontendServiceName - Identity of the frontend that initiated the flow\n   *   (carried in the OAuth2 state token). Used to resolve the base user type to\n   *   assign, mirroring the PASSWORD-registration path. Optional: falls back to the\n   *   app default frontend when absent.\n   */\n  public async provisionOrLinkUser(\n    profile: NormalizedUserProfile,\n    connection: SSOResolvedConnectionBase,\n    frontendServiceName?: string,\n  ): Promise<OAuth2ProvisionResult> {\n    return this.provisionOrLinkUserAttempt(\n      profile,\n      connection,\n      frontendServiceName,\n      true,\n    );\n  }\n\n  /**\n   * Perform one provisioning attempt, with at most one bounded reconciliation pass.\n   *\n   * `users.email` and the identity-link business key are database-unique. Two first\n   * social callbacks can therefore both observe \"absent\" before one transaction wins.\n   * The losing transaction must re-enter the complete policy/status/linking path after\n   * the winner commits; returning an arbitrary existing user or blindly retrying the\n   * insert would either bypass acquisition policy or loop forever when email auto-link\n   * is intentionally disabled.\n   */\n  private async provisionOrLinkUserAttempt(\n    profile: NormalizedUserProfile,\n    connection: SSOResolvedConnectionBase,\n    frontendServiceName: string | undefined,\n    mayReconcileSocialCreateConflict: boolean,\n  ): Promise<OAuth2ProvisionResult> {\n    const ec = await this.getInternalExecutionContext();\n    if (connection.connectionType === SsoConnectionType.ENTERPRISE && !connection.scope) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        context: {\n          reason: 'enterprise_connection_scope_missing',\n          providerRef: connection.providerRef,\n          source: connection.source,\n        },\n      });\n    }\n\n    // ─── Step 1: Enterprise SSO Enforcement Check ───\n    const emailDomain = profile.email.split('@')[1];\n    if (emailDomain) {\n      const claimingOrg = await this.domainToOrgLookup.findOrgByDomain(ec, emailDomain);\n      if (\n        claimingOrg?.enforcement?.requireSSO\n        && connection.connectionType === SsoConnectionType.SOCIAL\n      ) {\n        throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n        });\n      }\n\n      // ─── Step 1b: Scope-Level OAuth2 Provider Restrictions (G3) ───\n      if (claimingOrg && connection.connectionType === SsoConnectionType.SOCIAL) {\n        const { allowed, reason } = await this.resolver.isProviderAllowed(\n          ec,\n          claimingOrg.scopeType,\n          claimingOrg.scopeId,\n          connection.providerRef,\n        );\n        if (!allowed) {\n          await this.auditLogsService.logOAuth2ProviderBlocked({\n            email: profile.email,\n            providerRef: connection.providerRef,\n            scopeType: claimingOrg.scopeType,\n            organizationId: claimingOrg.scopeType === AuthScopeType.ORGANIZATION\n              ? claimingOrg.scopeId\n              : undefined,\n            applicationId: claimingOrg.scopeType === AuthScopeType.APPLICATION\n              ? claimingOrg.scopeId\n              : undefined,\n            reason: reason || 'Organization policy',\n            ipAddress: 'callback',\n            userAgent: 'callback',\n          });\n          throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n            customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n            context: {\n              // diagnostic (log-only)\n              reason: reason || 'Organization policy',\n            },\n          });\n        }\n      }\n    }\n\n    // ─── Step 2: Check for existing identity link ───\n    // Enterprise connections deliberately bypass the generic identity-link fast path:\n    // every enterprise login must pass through the provisioner so scope policy,\n    // membership state, authorized type acquisition, and link ownership converge\n    // transactionally. A link is an identity binding, not proof of current tenancy.\n    const existingLink = connection.connectionType === SsoConnectionType.SOCIAL\n      ? await this.servicesRegistryHandler.read<UserIdentityLink>(\n        CoreResourceType.USER_IDENTITY_LINKS,\n        ec,\n        {\n          providerRef: connection.providerRef,\n          providerUserId: profile.providerUserId,\n          connectionType: connection.connectionType,\n        },\n      )\n      : null;\n\n    if (existingLink) {\n      const linkedUser = await this.servicesRegistryHandler.read<User>(CoreResourceType.USERS, ec, { _id: existingLink.userId });\n      if (!linkedUser) {\n        throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n          context: { reason: 'identity_link_user_missing' },\n        });\n      }\n      if (linkedUser.status !== UserStatus.ACTIVE) {\n        throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n          context: { userStatus: linkedUser.status },\n        });\n      }\n\n      await this.ensureBaseUserTypeAssigned(\n        ec,\n        existingLink.userId,\n        frontendServiceName,\n        connection.connectionType === SsoConnectionType.ENTERPRISE\n          ? RegistrationAcquisitionChannel.ENTERPRISE_SSO_JIT\n          : RegistrationAcquisitionChannel.SOCIAL_OAUTH_JIT,\n      );\n\n      // `lastUsedAt` is `.excludeFromUpdate()` (server-owned, never client-authored) and\n      // `providerRawProfile` is `.isBackendOnly()` — both are re-attached past the strict-DTO\n      // strip automatically by `updateAsSystem` (`deriveTrustedSystemWritePreservedFields`\n      // preserves authored excludeFromUpdate + backend-only fields), so the \"last used\"\n      // timestamp advances without a manual `preserveServerInjectedFields`.\n      await this.systemAccessService.updateAsSystem(CoreResourceType.USER_IDENTITY_LINKS, existingLink._id, {\n        lastUsedAt: new Date(),\n        providerEmail: profile.email,\n        providerDisplayName: profile.displayName,\n        providerAvatarUrl: profile.avatarUrl,\n        providerRawProfile: profile.rawClaims,\n      });\n\n      this.logDebug('Existing identity link found, updating lastUsedAt', {\n        userId: existingLink.userId,\n        providerRef: connection.providerRef,\n      });\n\n      // AUTH-18 (reconcile-on-every-provision): a returning social user re-authenticates through\n      // this branch on every login, so ensure their USER_PROFILES row from the verified IdP name —\n      // create-if-absent — converging any user whose profile was never seeded or whose earlier\n      // best-effort seed failed. Idempotent (no-op when present).\n      await ensureUserProfileFromIdentityProfile(ec, {\n        userId: existingLink.userId,\n        profile,\n        servicesRegistryHandler: this.servicesRegistryHandler,\n        systemAccessService: this.systemAccessService,\n        logger: this.logger,\n      });\n\n      return { userId: existingLink.userId, isNewUser: false };\n    }\n\n    // ─── Step 3: Check for existing user by verified email (auto-link) ───\n    const userTypes = this.appConfigService.config.userTypes ?? {};\n    const autoLinkByEmail = Object.values(userTypes).some(\n      (typeDef) => typeDef?.auth?.autoLinkByEmail !== false,\n    );\n\n    if (\n      connection.connectionType === SsoConnectionType.SOCIAL\n      && autoLinkByEmail\n    ) {\n      const existingUser = await this.servicesRegistryHandler.read<User>(CoreResourceType.USERS, ec, { email: profile.email.toLowerCase() });\n\n      if (existingUser) {\n        // ─── S0.7 status gate ───\n        // ACTIVE always links. A PENDING_INVITATION invitee consumes their invitation below.\n        // EVERY other status — PENDING_VERIFICATION, INACTIVE, SUSPENDED, DELETED — AND a\n        // PENDING_INVITATION on a non-social connection is a hard stop: fail closed, never\n        // silently link (mirrors the token-accept path). Widening this gate is how a\n        // deactivated/suspended account would slip back in via social OAuth.\n        const consumesInvitation = existingUser.status === UserStatus.PENDING_INVITATION;\n        if (existingUser.status !== UserStatus.ACTIVE && !consumesInvitation) {\n          throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n            customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n            context: { userStatus: existingUser.status },\n          });\n        }\n\n        // Binding a social identity to a pre-existing account — OR consuming an invitation\n        // addressed to that email — requires the IdP to have verified the email.\n        if (!profile.emailVerified) {\n          throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n            customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n          });\n        }\n\n        if (!consumesInvitation) {\n          await this.resourcePersistenceUnitOfWork.executeTransaction(\n            SOCIAL_EXISTING_USER_LINK_UNIT_OF_WORK,\n            async (serviceOptions) => {\n              await this.ensureBaseUserTypeAssigned(\n                ec,\n                existingUser._id,\n                frontendServiceName,\n                RegistrationAcquisitionChannel.SOCIAL_OAUTH_JIT,\n                serviceOptions,\n              );\n              await this.createIdentityLink(\n                existingUser._id,\n                profile,\n                connection,\n                serviceOptions,\n              );\n            },\n          );\n        }\n\n        // ─── Consume a pending invitation (junction model) ───\n        // A PENDING_INVITATION account exists solely because an org admin invited this email\n        // (the invite provisions the User + an INVITED ORGANIZATION_MEMBERS row). The social IdP\n        // has now proven the invitee controls that email, so first social login ACTIVATES the\n        // account and consumes its invite(s) — exactly like the enterprise-JIT + token-accept\n        // paths, via the SHARED `applyInvitationAcceptanceCore`.\n        if (consumesInvitation) {\n          await this.consumePendingInvitationsOnSocialLogin(\n            ec,\n            existingUser,\n            profile,\n            connection,\n            frontendServiceName,\n          );\n        }\n\n        // AUTH-18 (reconcile-on-every-provision): ensure a USER_PROFILES row from the verified IdP\n        // name on EVERY existing-user auto-link — the just-consumed invitee (nameless at invite time)\n        // AND a returning ACTIVE user whose profile was never seeded / failed to seed earlier.\n        // Create-if-absent, idempotent; runs after the orphan-invite guard (a rejected invitee throws\n        // in `consumePendingInvitationsOnSocialLogin` and never reaches here).\n        await ensureUserProfileFromIdentityProfile(ec, {\n          userId: existingUser._id,\n          profile,\n          servicesRegistryHandler: this.servicesRegistryHandler,\n          systemAccessService: this.systemAccessService,\n          logger: this.logger,\n        });\n\n        this.logDebug(consumesInvitation ? 'Invitation consumed via social OAuth' : 'Auto-linked by email', {\n          userId: existingUser._id,\n          providerRef: connection.providerRef,\n          email: profile.email,\n        });\n\n        return { userId: existingUser._id, isNewUser: false };\n      }\n    }\n\n    // ─── Step 4→15: Enterprise provisioning branch ───\n    if (connection.connectionType === SsoConnectionType.ENTERPRISE) {\n      const enterpriseScope = connection.scope;\n      // Resolver invariant: an enterprise connection ALWAYS carries its provisioningConfig. Fail\n      // loud rather than fall through to the social branch below (which would misprovision).\n      if (!connection.provisioningConfig) {\n        throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n          context: { message: 'Enterprise OAuth2 connection is missing its resolved provisioningConfig' },\n        });\n      }\n\n      // W7.2: Block cross-org SSO when disabled — check before provisioning\n      const targetOrganizationId = getOrganizationIdFromEnterpriseScope(enterpriseScope);\n      const existingUserForCrossOrg = await this.servicesRegistryHandler.read<User>(CoreResourceType.USERS, ec, { email: profile.email.toLowerCase() });\n      if (existingUserForCrossOrg && targetOrganizationId) {\n        await this.enforceCrossOrgSSOAccess(ec, existingUserForCrossOrg._id, targetOrganizationId);\n      }\n\n      // Delegate to EnterpriseUserProvisioningService (Step 15, reused by SCIM Step 20). The\n      // provisioning config was assembled once by the resolver — passed straight through.\n      const resolvedEnterpriseFrontendServiceName =\n        frontendServiceName ?? this.appConfigService.resolveDefaultFrontendServiceName() ?? undefined;\n      const fallbackUserType = resolvedEnterpriseFrontendServiceName\n        ? this.appConfigService.resolveUserTypeFromFrontendServiceName(\n          resolvedEnterpriseFrontendServiceName,\n        ) ?? undefined\n        : undefined;\n      const result = await this.enterpriseProvisioning.provisionEnterpriseUser(\n        profile,\n        connection,\n        connection.provisioningConfig,\n        { fallbackUserType },\n      );\n\n      this.logDebug('Enterprise user provisioned/linked', {\n        userId: result.user._id,\n        scopeType: enterpriseScope.scopeType,\n        scopeId: enterpriseScope.scopeId,\n        isNew: result.isNew,\n        roles: result.mappedRoles,\n      });\n\n      return { userId: result.user._id, isNewUser: result.isNew };\n    }\n\n    // ─── Step 5: Social provisioning — create new user ───\n    // The provider subject alone is not enough to claim a globally unique email.\n    // Existing-account linking already requires this proof; first creation must\n    // enforce the same boundary or an unverified IdP address could reserve and\n    // activate another person's account identity.\n    if (!profile.emailVerified) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n      });\n    }\n\n    // Resolve the SAME base user type `ensureBaseUserTypeAssigned` will write after creation.\n    // Authorizing against \"any OPEN user type\" is unsafe: an unrelated public member type could\n    // otherwise unlock JIT creation for the initiating frontend's ADMIN_ONLY or DISABLED default.\n    // Only an explicit OPEN policy on the exact target type permits social JIT creation.\n    const resolvedFrontendServiceName =\n      frontendServiceName ?? this.appConfigService.resolveDefaultFrontendServiceName() ?? undefined;\n    const registrationUserType = resolvedFrontendServiceName\n      ? this.appConfigService.resolveUserTypeFromFrontendServiceName(resolvedFrontendServiceName)\n      : null;\n    const registrationConfig = registrationUserType\n      ? userTypes[registrationUserType]?.auth?.registration\n      : undefined;\n    const frontendServiceAllowsRegistration = Boolean(\n      resolvedFrontendServiceName\n      && registrationUserType\n      && this.appConfigService.getFrontendServiceUserManagementEntry(\n        resolvedFrontendServiceName,\n        registrationUserType,\n      )?.register === true,\n    );\n    const socialJitAllowed = registrationConfig !== undefined\n      && frontendServiceAllowsRegistration\n      && Array.isArray(registrationConfig.allowedMethods)\n      && registrationConfig.allowedMethods.includes(AuthMethod.EXTERNAL_OAUTH2)\n      && isRegistrationAcquisitionAllowed(\n        registrationConfig.mode,\n        RegistrationAcquisitionChannel.SOCIAL_OAUTH_JIT,\n      );\n\n    if (!socialJitAllowed || !registrationUserType) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_FOUND,\n      });\n    }\n\n    let newUser: User;\n    try {\n      newUser = await this.resourcePersistenceUnitOfWork.executeTransaction(\n        SOCIAL_USER_CREATION_UNIT_OF_WORK,\n        async (serviceOptions) => {\n          const createdUser = await this.servicesRegistryHandler.create<User>(\n            CoreResourceType.USERS,\n            ec,\n            {\n              email: profile.email.toLowerCase(),\n              status: UserStatus.ACTIVE,\n              appRoles: [CORE_APP_ROLES.APP_USER],\n              userTypes: [registrationUserType],\n            },\n            serviceOptions,\n          );\n          await this.createIdentityLink(\n            createdUser._id,\n            profile,\n            connection,\n            serviceOptions,\n          );\n          return createdUser;\n        },\n        {\n          compositionSeedRequestInput: {\n            firstName: profile.firstName,\n            lastName: profile.lastName,\n            displayName: profile.displayName,\n          },\n        },\n      );\n    } catch (error) {\n      const persistenceError = error as { code?: number; message?: string };\n      const isCreateConflict =\n        (isWildoBackendError(error) && error.statusCode === 409)\n        || persistenceError.code === 11000\n        || persistenceError.message?.includes('duplicate key') === true\n        || persistenceError.message?.includes('E11000') === true;\n      if (isCreateConflict && mayReconcileSocialCreateConflict) {\n        this.logDebug('Concurrent social provisioning detected; reconciling through the full policy path', {\n          email: profile.email,\n          providerRef: connection.providerRef,\n        });\n        return this.provisionOrLinkUserAttempt(\n          profile,\n          connection,\n          frontendServiceName,\n          false,\n        );\n      }\n      throw error;\n    }\n\n    this.logDebug('New user provisioned via OAuth2', {\n      userId: newUser._id,\n      providerRef: connection.providerRef,\n      email: profile.email,\n    });\n\n    return { userId: newUser._id, isNewUser: true };\n  }\n\n  /**\n   * Floor that guarantees a provisioned/linked SSO user leaves with a non-empty\n   * `userTypes[]`.\n   *\n   * ### Source-of-truth model (two axes, no overlap)\n   * - **Base identity** — the frontend-service default user type\n   *   (`resolveUserTypeFromFrontendServiceName`). Every user provisioned through a\n   *   frontend service gets it; the PASSWORD-registration path assigns exactly this\n   *   (`userTypes = [activeUserType]`). SSO users authenticate through the same\n   *   frontends and are equally users of them, so they get the same base.\n   * - **Org-type grant (W5.2)** — `grantUserTypesOnOrgJoin` layers\n   *   `organizationTypes[orgType].userTypes` on top when a user joins a typed org.\n   *   Additive enrichment, not the base; no-ops when the org has no `type`.\n   *\n   * This helper is the base, applied as a FLOOR: it only writes when `userTypes` is\n   * still empty, so an org-type grant that already populated a narrower, org-authored\n   * user type WINS and is never widened by this default. A pre-existing empty-type user\n   * is not a compatibility exception: the exact base acquisition must pass the supplied\n   * channel, and social OAuth additionally requires the frontend `register` surface plus\n   * `EXTERNAL_OAUTH2` in `allowedMethods`.\n   *\n   * Resolution order: the initiating frontend service (from the state token), then the\n   * app default frontend when none was carried (SAML/SCIM-style callers do not reach\n   * this method). If neither resolves a user type — the app declares no\n   * `usersManagement` entries at all — this logs and leaves `userTypes` empty; the\n   * callback's own `usersManagement[type].auth` check then surfaces the misconfig\n   * with a precise message rather than this helper masking it.\n   */\n  private async ensureBaseUserTypeAssigned(\n    ec: ExecutionContext<any>,\n    userId: string,\n    frontendServiceName: string | undefined,\n    acquisitionChannel: RegistrationAcquisitionChannel,\n    serviceOptions?: ServiceOptions,\n  ): Promise<void> {\n    const user = await this.servicesRegistryHandler.read<User>(\n      CoreResourceType.USERS,\n      ec,\n      { _id: userId },\n      serviceOptions,\n    );\n    if (user?.userTypes?.length) return; // org-type grant (or a prior assignment) already set the base\n\n    const resolvedFrontendServiceName =\n      frontendServiceName ?? this.appConfigService.resolveDefaultFrontendServiceName() ?? undefined;\n    const baseUserType = resolvedFrontendServiceName\n      ? this.appConfigService.resolveUserTypeFromFrontendServiceName(resolvedFrontendServiceName)\n      : null;\n\n    if (!baseUserType) {\n      this.logDebug('No base user type resolvable for SSO user — leaving userTypes empty', {\n        userId,\n        frontendServiceName: resolvedFrontendServiceName,\n      });\n      return;\n    }\n\n    const userTypeDefinitions = this.appConfigService.isInitialized()\n      ? this.appConfigService.config.userTypes\n      : undefined;\n    const acquisition = evaluateUserTypeAcquisition(\n      userTypeDefinitions,\n      [baseUserType],\n      user?.userTypes ?? [],\n      acquisitionChannel,\n    );\n    const registrationConfig = userTypeDefinitions?.[baseUserType]?.auth.registration;\n    const socialSurfaceAllowed = acquisitionChannel !== RegistrationAcquisitionChannel.SOCIAL_OAUTH_JIT\n      || (\n        resolvedFrontendServiceName !== undefined\n        && this.appConfigService.getFrontendServiceUserManagementEntry(\n          resolvedFrontendServiceName,\n          baseUserType,\n        )?.register === true\n        && Array.isArray(registrationConfig?.allowedMethods)\n        && registrationConfig.allowedMethods.includes(AuthMethod.EXTERNAL_OAUTH2)\n      );\n    if (!acquisition.allowed || !socialSurfaceAllowed) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_FOUND,\n        context: {\n          channel: acquisitionChannel,\n          deniedUserTypes: acquisition.deniedUserTypes,\n          baseUserType,\n        },\n      });\n    }\n\n    await this.servicesRegistryHandler.update(\n      CoreResourceType.USERS,\n      ec,\n      userId,\n      { userTypes: [baseUserType] },\n      serviceOptions,\n    );\n    this.logDebug('Assigned base user type to SSO user', { userId, baseUserType, frontendServiceName: resolvedFrontendServiceName });\n  }\n\n  /**\n   * Consume every pending invitation addressed to a social-OAuth invitee.\n   *\n   * In the junction model an invitation IS an `ORGANIZATION_MEMBERS` row in status `INVITED`,\n   * bound to the invitee `User` (provisioned `PENDING_INVITATION` at invite time). When that\n   * invitee first authenticates through a social IdP that has verified their email, this:\n   *   1. activates the account (`PENDING_INVITATION → ACTIVE`), and\n   *   2. flips every INVITED membership → ACTIVE and grants the org-join user types,\n   * via the SHARED `applyInvitationAcceptanceCore` — the identical abstraction the token-accept\n   * (`acceptInvitation`), in-app-accept (`acceptMyInvitation`), and enterprise-JIT paths call.\n   *\n   * The invitee's `USER_PROFILES` row (nameless at invite time) is NOT seeded here — the caller's\n   * reconcile-on-every-provision step (`ensureUserProfileFromIdentityProfile` in `provisionOrLinkUser`)\n   * owns that for every existing-user path, so this method stays focused on the invitation junction.\n   *\n   * Unlike enterprise SSO/SCIM there is NO org signal on a public social connection, so every\n   * pending invite for the (now email-verified) identity is consumed, not just one org's. The\n   * common case is exactly one invite.\n   *\n   * Fails closed if the account is `PENDING_INVITATION` but has NO INVITED membership (every\n   * invite was revoked/declined — which DELETEs the row): there is nothing to accept, so the\n   * account is NOT activated.\n   *\n   * No accept-token revocation: ACTIVATING (not deleting) the membership leaves any still-valid\n   * emailed accept link harmless — `acceptInvitation` fails closed on a non-INVITED status — and\n   * it expires on its own.\n   */\n  private async consumePendingInvitationsOnSocialLogin(\n    ec: ExecutionContext<any>,\n    user: User,\n    profile: NormalizedUserProfile,\n    connection: SSOResolvedConnectionBase,\n    frontendServiceName: string | undefined,\n  ): Promise<void> {\n    const activatedCount =\n      await this.resourcePersistenceUnitOfWork.executeTransaction(\n        SOCIAL_INVITATION_ACCEPTANCE_UNIT_OF_WORK,\n        async (serviceOptions) => {\n          const currentUser = await this.servicesRegistryHandler.read<User>(\n            CoreResourceType.USERS,\n            ec,\n            { _id: user._id },\n            serviceOptions,\n          );\n          if (currentUser?.status !== UserStatus.PENDING_INVITATION) {\n            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n              customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n              context: {\n                userStatus: currentUser?.status ?? 'GONE',\n                reason: 'social_invitation_user_not_pending',\n              },\n            });\n          }\n\n          // The invite binds every pending row to this user. Resolve and consume them\n          // from the same native database snapshot used for activation and type grants.\n          const result = await this.systemAccessService.listAsSystem<OrganizationMember>(\n            CoreResourceType.ORGANIZATION_MEMBERS,\n            { userId: user._id, status: OrganizationMemberStatus.INVITED },\n            undefined,\n            serviceOptions,\n          );\n          const pendingMemberships = Array.isArray(result) ? result : result.data;\n          if (pendingMemberships.length === 0) {\n            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n              customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n              context: {\n                userStatus: currentUser.status,\n                reason: 'social_invitation_has_no_active_memberships',\n              },\n            });\n          }\n\n          await assertInvitationBatchUserTypeAcquisitionAllowed({\n            user: currentUser,\n            organizationIds: pendingMemberships.map((membership) => membership.organizationId),\n            appConfigService: this.appConfigService,\n            errorBuilder: this.errorBuilder,\n            systemAccessService: this.systemAccessService,\n            serviceOptions,\n          });\n\n          let acceptedMembershipCount = 0;\n          for (const membership of pendingMemberships) {\n            const { membershipActivated } = await applyInvitationAcceptanceCore(ec, {\n              membership,\n              user: currentUser,\n              appConfigService: this.appConfigService,\n              errorBuilder: this.errorBuilder,\n              servicesRegistryHandler: this.servicesRegistryHandler,\n              systemAccessService: this.systemAccessService,\n              serviceOptions,\n              logDebug: this.logDebug,\n            });\n            if (membershipActivated) {\n              acceptedMembershipCount += 1;\n            }\n          }\n          if (acceptedMembershipCount === 0) {\n            throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n              context: {\n                reason: 'all_social_invitations_revoked_during_acceptance',\n                userId: user._id,\n              },\n            });\n          }\n\n          // SYSTEM door: `status` is `.excludeFromUpdate()`, so a handler write is stripped by the\n          // repository's strict re-parse — the filter matches, the row comes back, and NOTHING is\n          // persisted. The account stays PENDING_INVITATION while the caller sees success.\n          // Enumerated with the sibling activations (email verification, invitation accept) per\n          // `.claude/rules/invariant-call-site-enumeration.md`: the invariant is \"a `status` write\n          // goes through the system door\", and it holds at every site or none. The compare-and-swap\n          // is preserved — the filter still pins the observed status, so a concurrent activation\n          // still loses the race below.\n          const activatedUser = await this.systemAccessService.updateAsSystem<User>(\n            CoreResourceType.USERS,\n            {\n              _id: currentUser._id,\n              status: UserStatus.PENDING_INVITATION,\n            },\n            { status: UserStatus.ACTIVE },\n            serviceOptions,\n          );\n          if (!activatedUser) {\n            throw this.errorBuilder.buildError(ErrorType.CONFLICT, undefined, {\n              context: {\n                reason: 'social_invitation_user_activation_race_lost',\n                userId: user._id,\n              },\n            });\n          }\n          await this.ensureBaseUserTypeAssigned(\n            ec,\n            user._id,\n            frontendServiceName,\n            RegistrationAcquisitionChannel.INVITATION,\n            serviceOptions,\n          );\n          await this.createIdentityLink(\n            user._id,\n            profile,\n            connection,\n            serviceOptions,\n          );\n          return acceptedMembershipCount;\n        },\n      );\n\n    this.logDebug('Pending invitation(s) consumed via social OAuth login', {\n      userId: user._id,\n      count: activatedCount,\n    });\n  }\n\n  /**\n   * W7.2: Enforce crossOrgSSOAccess policy.\n   * When `crossOrgSSOAccess === false`, a user who already has enterprise identity links\n   * from a different organization is blocked from SSO into the current org.\n   * Social/native connections are exempt (enforced by callers only passing enterprise connections).\n   */\n  private async enforceCrossOrgSSOAccess(\n    ec: ExecutionContext<any>,\n    userId: string,\n    targetOrganizationId: string,\n  ): Promise<void> {\n    if (this.appConfigService.config.auth.crossOrgSSOAccess !== false) return;\n\n    const enterpriseLinks = await this.servicesRegistryHandler.list<UserIdentityLink>(CoreResourceType.USER_IDENTITY_LINKS, ec, {\n      userId,\n      connectionType: SsoConnectionType.ENTERPRISE,\n    }, undefined, { paginated: false }) as UserIdentityLink[] ?? [];\n\n    const hasCrossOrgLink = enterpriseLinks.some(\n      (link) => link.organizationId && link.organizationId !== targetOrganizationId,\n    );\n\n    if (hasCrossOrgLink) {\n      this.logDebug('Cross-org SSO blocked', { userId, targetOrganizationId });\n      throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CROSS_ORG_SSO_BLOCKED,\n      });\n    }\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Private: Token Exchange\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Exchange the authorization code for tokens at the IdP's token endpoint.\n   * Server-to-server POST — credentials sent according to tokenEndpointAuthMethod.\n   */\n  private async exchangeCodeForTokens(\n    code: string,\n    connection: OAuth2ResolvedConnection,\n    pkceVerifier?: string,\n  ): Promise<Record<string, unknown>> {\n    const bodyParams: Record<string, string> = {\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: connection.redirectUri,\n    };\n\n    if (pkceVerifier) {\n      bodyParams.code_verifier = pkceVerifier;\n    }\n\n    // Merge extra token params\n    if (connection.extraTokenParams) {\n      for (const [key, value] of Object.entries(connection.extraTokenParams)) {\n        if (RESERVED_TOKEN_PARAM_KEYS.has(key)) {\n          this.logger.warn('Ignoring reserved OAuth2 token extra parameter', {\n            providerRef: connection.providerRef,\n            key,\n          });\n          continue;\n        }\n        bodyParams[key] = value;\n      }\n    }\n\n    const headers: Record<string, string> = {\n      [WildoHeaderKeys.CONTENT_TYPE]: 'application/x-www-form-urlencoded',\n      ...(connection.tokenRequestHeaders || {}),\n    };\n\n    // Send credentials according to tokenEndpointAuthMethod\n    switch (connection.tokenEndpointAuthMethod) {\n      case 'client_secret_post':\n        bodyParams.client_id = connection.clientId;\n        bodyParams.client_secret = connection.clientSecret;\n        break;\n      case 'client_secret_basic':\n        headers[WildoHeaderKeys.AUTHORIZATION] = `Basic ${Buffer.from(\n          `${connection.clientId}:${connection.clientSecret}`,\n        ).toString('base64')}`;\n        break;\n      case 'none':\n        bodyParams.client_id = connection.clientId;\n        break;\n    }\n\n    const response = await fetch(connection.tokenUrl, {\n      method: 'POST',\n      headers,\n      body: new URLSearchParams(bodyParams).toString(),\n    });\n\n    if (!response.ok) {\n      const errorBody = await response.text();\n      this.logger.error('OAuth2 token exchange failed', {\n        providerRef: connection.providerRef,\n        status: response.status,\n        error: errorBody,\n      });\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n      });\n    }\n\n    const tokenResponse = await response.json() as Record<string, unknown>;\n    this.logDebug('Token exchange successful', {\n      providerRef: connection.providerRef,\n      hasAccessToken: !!tokenResponse.access_token,\n      hasIdToken: !!tokenResponse.id_token,\n    });\n\n    return tokenResponse;\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Private: Profile Extraction\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Extract user identity based on connection.identitySource.\n   *\n   * - 'userinfo': fetch from userInfoUrl (Google, Microsoft, GitHub)\n   * - 'id_token': verify via JWKS then decode from ID token JWT (Apple, enterprise OIDC)\n   * - Apple uses BOTH id_token (email, sub) AND callback_body (name on first auth)\n   *\n   * C3: When jwksUri + issuer are available on the connection, ID tokens are\n   * cryptographically verified against the provider's JWKS before claims extraction.\n   */\n  private async extractUserProfile(\n    tokenResponse: Record<string, unknown>,\n    connection: OAuth2ResolvedConnection,\n    callbackBody?: Record<string, unknown>,\n  ): Promise<NormalizedUserProfile> {\n    let rawClaims: Record<string, unknown> = {};\n\n    // Primary identity source\n    if (connection.identitySource === 'userinfo' && connection.userInfoUrl) {\n      rawClaims = await this.fetchUserInfo(\n        connection.userInfoUrl,\n        tokenResponse.access_token as string,\n        connection,\n      );\n    } else if (connection.identitySource === 'id_token' && tokenResponse.id_token) {\n      // C3 fix: Verify ID token signature against provider's JWKS when available.\n      // Falls back to unsigned decode only when no JWKS URI is available (should not\n      // happen for well-configured OIDC providers — JWKS is a required discovery field).\n      if (connection.jwksUri && connection.issuer) {\n        try {\n          rawClaims = await this.verifyIdToken(\n            tokenResponse.id_token as string,\n            connection.jwksUri,\n            connection.issuer,\n            connection.clientId,\n          );\n        } catch (verifyError) {\n          this.logger.error('ID token JWKS verification failed', {\n            providerRef: connection.providerRef,\n            ...projectCaughtErrorLogFields(verifyError),\n          });\n          throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n            customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n          });\n        }\n      } else {\n        this.logger.warn('ID token decoded without signature verification — no JWKS URI available', {\n          providerRef: connection.providerRef,\n          hasJwksUri: !!connection.jwksUri,\n          hasIssuer: !!connection.issuer,\n        });\n        rawClaims = this.decodeIdToken(tokenResponse.id_token as string);\n      }\n    }\n\n    // Supplement with callback body (Apple first-auth: body.user has name)\n    if (callbackBody?.user) {\n      let userData: Record<string, unknown>;\n      if (typeof callbackBody.user === 'string') {\n        try {\n          userData = JSON.parse(callbackBody.user) as Record<string, unknown>;\n        } catch {\n          this.logDebug('Failed to parse Apple callback body.user — skipping name extraction', {\n            providerRef: connection.providerRef,\n          });\n          userData = {};\n        }\n      } else {\n        userData = callbackBody.user as Record<string, unknown>;\n      }\n\n      // Apple's user object: { name: { firstName, lastName }, email }\n      if (userData.name) {\n        const nameObj = userData.name as Record<string, unknown>;\n        if (!rawClaims._callbackFirstName && nameObj.firstName) {\n          rawClaims._callbackFirstName = nameObj.firstName;\n        }\n        if (!rawClaims._callbackLastName && nameObj.lastName) {\n          rawClaims._callbackLastName = nameObj.lastName;\n        }\n      }\n    }\n\n    // Provider-specific extension points (data-driven, not per-provider if/else)\n    const extensions = connection.extensions || {};\n\n    // Extension: emails endpoint (GitHub private email)\n    if (extensions.emailsEndpoint && tokenResponse.access_token) {\n      try {\n        const emailsEndpoint = this.validateProviderExtensionUrl(connection, extensions.emailsEndpoint as string);\n        const emailsResponse = await fetch(emailsEndpoint, {\n          headers: { Authorization: `Bearer ${tokenResponse.access_token}`, Accept: 'application/json' },\n        });\n        if (emailsResponse.ok) {\n          const emails = await emailsResponse.json() as Array<{ email: string; primary: boolean; verified: boolean }>;\n          const primaryEmail = emails.find((e) => e.primary && e.verified);\n          if (primaryEmail) {\n            rawClaims[connection.profileMapping.email] = primaryEmail.email;\n            rawClaims[connection.profileMapping.emailVerified || 'email_verified'] = true;\n          }\n        }\n      } catch {\n        this.logDebug('Failed to fetch emails endpoint', { endpoint: extensions.emailsEndpoint });\n      }\n    }\n\n    // Map raw claims to NormalizedUserProfile\n    const mapping = connection.profileMapping;\n\n    const providerUserId = String(this.extractClaim(rawClaims, mapping.id) || '');\n    const email = String(this.extractClaim(rawClaims, mapping.email) || '').toLowerCase();\n    const emailVerifiedRaw = this.extractClaim(rawClaims, mapping.emailVerified || 'email_verified');\n    const emailVerified = emailVerifiedRaw === true || emailVerifiedRaw === 'true';\n\n    // Name extraction: try firstName/lastName fields, fall back to 'name' field splitting\n    let firstName = mapping.firstName ? String(this.extractClaim(rawClaims, mapping.firstName) || '') : '';\n    let lastName = mapping.lastName ? String(this.extractClaim(rawClaims, mapping.lastName) || '') : '';\n\n    // Callback body supplements (Apple first-auth)\n    if (!firstName && rawClaims._callbackFirstName) firstName = String(rawClaims._callbackFirstName);\n    if (!lastName && rawClaims._callbackLastName) lastName = String(rawClaims._callbackLastName);\n\n    // Fall back to 'name' field and split\n    if (!firstName && !lastName && mapping.name) {\n      const fullName = String(this.extractClaim(rawClaims, mapping.name) || '');\n      if (fullName) {\n        const parts = fullName.split(' ');\n        firstName = parts[0] || '';\n        lastName = parts.slice(1).join(' ') || '';\n      }\n    }\n\n    // Display name: constructed name → full name claim → extension fallback → email (last resort)\n    const displayName = [firstName, lastName].filter(Boolean).join(' ')\n      || String(this.extractClaim(rawClaims, mapping.name || 'name') || '')\n      || (extensions.displayNameFallbackField\n        ? String(this.extractClaim(rawClaims, extensions.displayNameFallbackField as string) || '')\n        : '')\n      || email;\n\n    // Extension: email fallback (Microsoft uses userPrincipalName)\n    const finalEmail = email\n      || (extensions.emailFallbackField\n        ? String(this.extractClaim(rawClaims, extensions.emailFallbackField as string) || '').toLowerCase()\n        : '');\n\n    const rawAvatarUrl = mapping.image ? String(this.extractClaim(rawClaims, mapping.image) || '') : undefined;\n    const avatarUrl = rawAvatarUrl ? this._sanitizeAvatarUrl(rawAvatarUrl) : undefined;\n\n    // Locale (most OIDC providers include a 'locale' claim)\n    const locale = this.extractClaim(rawClaims, 'locale') as string | undefined;\n\n    // Enterprise claims\n    const roles = mapping.roles ? this.extractArrayClaim(rawClaims, mapping.roles) : undefined;\n    const groups = mapping.groups ? this.extractArrayClaim(rawClaims, mapping.groups) : undefined;\n    const department = mapping.department ? String(this.extractClaim(rawClaims, mapping.department) || '') : undefined;\n    const employeeId = mapping.employeeId ? String(this.extractClaim(rawClaims, mapping.employeeId) || '') : undefined;\n\n    if (!providerUserId || !finalEmail) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n      });\n    }\n\n    return {\n      providerUserId,\n      email: finalEmail,\n      emailVerified,\n      firstName: firstName || undefined,\n      lastName: lastName || undefined,\n      displayName: displayName || undefined,\n      avatarUrl: avatarUrl || undefined,\n      locale,\n      roles,\n      groups,\n      department: department || undefined,\n      employeeId: employeeId || undefined,\n      rawClaims,\n    };\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Private: UserInfo Fetch\n  // ═══════════════════════════════════════════════════════════════\n\n  private async fetchUserInfo(\n    userInfoUrl: string,\n    accessToken: string,\n    connection: OAuth2ResolvedConnection,\n  ): Promise<Record<string, unknown>> {\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${accessToken}`,\n      Accept: 'application/json',\n    };\n\n    // GitHub requires Accept header (TRAP: without it, returns XML)\n    if (connection.tokenRequestHeaders?.Accept) {\n      headers.Accept = connection.tokenRequestHeaders.Accept;\n    }\n\n    const response = await fetch(userInfoUrl, { headers });\n    if (!response.ok) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n        context: { message: `Failed to fetch user info: ${response.status}` },\n      });\n    }\n\n    return await response.json() as Record<string, unknown>;\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Private: Identity Link Creation\n  // ═══════════════════════════════════════════════════════════════\n\n  private async createIdentityLink(\n    userId: string,\n    profile: NormalizedUserProfile,\n    connection: SSOResolvedConnectionBase,\n    serviceOptions?: ServiceOptions,\n  ): Promise<void> {\n    await this.systemAccessService.createAsSystem(\n      CoreResourceType.USER_IDENTITY_LINKS,\n      {\n        userId,\n        connectionType: SsoConnectionType.SOCIAL,\n        providerRef: connection.providerRef,\n        providerUserId: profile.providerUserId,\n        providerEmail: profile.email,\n        providerDisplayName: profile.displayName,\n        providerAvatarUrl: profile.avatarUrl,\n        providerRawProfile: profile.rawClaims,\n        source: connection.source,\n      },\n      serviceOptions,\n    );\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Private: Execution Context\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Pre-auth EC for OAuth2 operations (SSO callbacks, user provisioning).\n   * Caller identity unknown at this point — uses PUBLIC_EXECUTION with APP_PUBLIC.\n   * Primary intent: user lookup/provisioning from IdP callback.\n   */\n  private async getInternalExecutionContext(): Promise<ExecutionContext<any>> {\n    return this.authEcFactory.createForPreAuthOperation(this.authEcFactory.getUsersReadOperationPath());\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Private: PKCE Helpers\n  // ═══════════════════════════════════════════════════════════════\n\n  private generateCodeVerifier(): string {\n    return crypto.randomBytes(32).toString('base64url');\n  }\n\n  private generateS256Challenge(verifier: string): string {\n    return crypto.createHash('sha256').update(verifier).digest('base64url');\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Private: Claim Extraction Helpers\n  // ═══════════════════════════════════════════════════════════════\n\n  private validateProviderExtensionUrl(connection: OAuth2ResolvedConnection, endpoint: string): string {\n    const parsed = new URL(endpoint);\n    if (parsed.protocol !== 'https:') {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        context: {\n          // diagnostic (log-only): server-side provider-config / SSRF guard, not user input.\n          providerRef: connection.providerRef,\n          reason: 'extension-url-not-https',\n        },\n      });\n    }\n\n    const trustedHosts = [\n      connection.authorizationUrl,\n      connection.tokenUrl,\n      connection.userInfoUrl,\n    ]\n      .filter(Boolean)\n      .map((url) => new URL(url!).hostname);\n\n    if (!trustedHosts.includes(parsed.hostname)) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        context: {\n          // diagnostic (log-only): server-side provider-config / SSRF guard, not user input.\n          providerRef: connection.providerRef,\n          reason: 'extension-url-host-not-trusted',\n          host: parsed.hostname,\n        },\n      });\n    }\n\n    return parsed.toString();\n  }\n\n  /**\n   * Extract a claim value from raw claims using dot-notation path support.\n   */\n  private extractClaim(claims: Record<string, unknown>, path: string): unknown {\n    if (!path) return undefined;\n    const parts = path.split('.');\n    let current: unknown = claims;\n    for (const part of parts) {\n      if (current === null || current === undefined || typeof current !== 'object') return undefined;\n      current = (current as Record<string, unknown>)[part];\n    }\n    return current;\n  }\n\n  /**\n   * Extract an array claim (roles, groups), handling both string and array values.\n   */\n  private extractArrayClaim(claims: Record<string, unknown>, path: string): string[] | undefined {\n    const value = this.extractClaim(claims, path);\n    if (!value) return undefined;\n    if (Array.isArray(value)) return value.map(String);\n    if (typeof value === 'string') return value.split(',').map((s) => s.trim());\n    return undefined;\n  }\n\n  /**\n   * Decode a JWT ID token without signature verification.\n   * Used as fallback for providers that don't expose a JWKS endpoint.\n   * Prefer verifyIdToken() for providers with JWKS.\n   */\n  private decodeIdToken(idToken: string): Record<string, unknown> {\n    try {\n      const parts = idToken.split('.');\n      if (parts.length !== 3) throw new Error('Invalid JWT format');\n      const payload = Buffer.from(parts[1], 'base64url').toString('utf-8');\n      return JSON.parse(payload) as Record<string, unknown>;\n    } catch {\n      this.logger.warn('Failed to decode ID token');\n      return {};\n    }\n  }\n\n  /**\n   * Verify a JWT ID token against the provider's JWKS endpoint.\n   * Uses the `jose` library for cryptographic signature verification + claims validation.\n   *\n   * C3 fix: Replaces unsigned jwt.decode() with full JWKS verification.\n   * Verifies: signature (via JWKS), issuer, audience, expiration, and issued-at claims.\n   *\n   * The JWKS function is cached per jwksUri on the service instance to avoid losing\n   * jose's internal key cache between login attempts. The library handles key rotation\n   * internally (refetch on kid miss).\n   */\n  private async verifyIdToken(\n    idToken: string,\n    jwksUri: string,\n    issuer: string | string[],\n    audience: string | string[],\n  ): Promise<Record<string, unknown>> {\n    const { jwtVerify, createRemoteJWKSet } = await import('jose');\n\n    let JWKS = this._jwksCache.get(jwksUri);\n    if (!JWKS) {\n      JWKS = createRemoteJWKSet(new URL(jwksUri));\n      this._jwksCache.set(jwksUri, JWKS);\n    }\n\n    /*\n     * Issuer and audience are verified UNCONDITIONALLY, and `maxTokenAge` is a constant, BY DECISION\n     * (#419, 2026-09-08) — not as a TODO awaiting configurability.\n     *\n     * The SSO connection carried `validateIssuer`, `validateAudience` and `clockTolerance` for as\n     * long as this method existed, and nothing here ever read them. Rather than wire them up, they\n     * were REMOVED from the schema: the guard here is already the strict end of their range, so the\n     * only effect honouring them could have had was to let an operator weaken it. Do not re-add a\n     * configuration path into this call without a reason that is not \"the fields exist\".\n     */\n    const { payload } = await jwtVerify(idToken, JWKS as Parameters<typeof jwtVerify>[1], {\n      issuer,\n      audience,\n      maxTokenAge: '5 minutes',\n    });\n\n    return payload as Record<string, unknown>;\n  }\n\n  /**\n   * L5 fix: Sanitize avatar URL from IdP profile.\n   * Validates URL scheme (HTTPS/HTTP only) and rejects private/loopback IPs\n   * to prevent javascript: XSS, data: URI injection, and SSRF via internal network URLs.\n   *\n   * Returns undefined for invalid URLs (fail-safe — missing avatar is harmless).\n   */\n  private _sanitizeAvatarUrl(url: string): string | undefined {\n    if (!url) return undefined;\n    try {\n      const parsed = new URL(url);\n\n      // Only allow http: and https: schemes — reject javascript:, data:, etc.\n      if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {\n        return undefined;\n      }\n\n      // Normalize hostname: strip IPv6 brackets and resolve IPv4-mapped IPv6\n      // (e.g., `[::ffff:127.0.0.1]` → `127.0.0.1`, `[::ffff:10.0.0.1]` → `10.0.0.1`)\n      let hostname = parsed.hostname.toLowerCase();\n      if (hostname.startsWith('[') && hostname.endsWith(']')) {\n        hostname = hostname.slice(1, -1);\n      }\n      const ipv4MappedMatch = hostname.match(/^::ffff:(\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})$/);\n      if (ipv4MappedMatch) {\n        hostname = ipv4MappedMatch[1];\n      }\n\n      if (this._isPrivateOrReservedHost(hostname)) {\n        return undefined;\n      }\n\n      return parsed.toString();\n    } catch {\n      return undefined;\n    }\n  }\n\n  /**\n   * Check if a hostname is private, loopback, link-local, or otherwise reserved.\n   * Covers IPv4, IPv6 loopback, IPv4-mapped IPv6 (after normalization), and special TLDs.\n   */\n  private _isPrivateOrReservedHost(hostname: string): boolean {\n    // Normalize decimal/octal/hex IP representations to dotted-decimal.\n    // e.g., http://2130706433 (decimal for 127.0.0.1), http://0x7f000001 (hex),\n    // http://017700000001 (octal). These bypass naive string prefix checks.\n    const normalizedHostname = this._normalizeNumericIp(hostname);\n\n    // Loopback\n    if (normalizedHostname === 'localhost' || normalizedHostname === '127.0.0.1' || normalizedHostname === '0.0.0.0' || normalizedHostname === '::1') {\n      return true;\n    }\n\n    // IPv6 loopback/unspecified variants\n    if (normalizedHostname === '::' || normalizedHostname === '0:0:0:0:0:0:0:1' || normalizedHostname === '0:0:0:0:0:0:0:0') {\n      return true;\n    }\n\n    // IPv4-mapped IPv6 prefix (catch any remaining after normalization)\n    if (normalizedHostname.startsWith('::ffff:')) {\n      return true;\n    }\n\n    // RFC 1918 private ranges\n    if (normalizedHostname.startsWith('10.') || normalizedHostname.startsWith('192.168.')) {\n      return true;\n    }\n\n    // 172.16.0.0/12 — 172.16.x through 172.31.x\n    if (normalizedHostname.startsWith('172.')) {\n      const second = parseInt(normalizedHostname.split('.')[1], 10);\n      if (second >= 16 && second <= 31) return true;\n    }\n\n    // Link-local (169.254.0.0/16)\n    if (normalizedHostname.startsWith('169.254.')) {\n      return true;\n    }\n\n    // CGNAT (100.64.0.0/10) — shared address space, not publicly routable\n    if (normalizedHostname.startsWith('100.')) {\n      const second = parseInt(normalizedHostname.split('.')[1], 10);\n      if (second >= 64 && second <= 127) return true;\n    }\n\n    // Special-use TLDs\n    if (\n      normalizedHostname.endsWith('.local') ||\n      normalizedHostname.endsWith('.internal') ||\n      normalizedHostname.endsWith('.localhost') ||\n      normalizedHostname.endsWith('.invalid') ||\n      normalizedHostname.endsWith('.test') ||\n      normalizedHostname.endsWith('.onion')\n    ) {\n      return true;\n    }\n\n    return false;\n  }\n\n  /**\n   * Normalize numeric IP representations (decimal, hex, octal) to dotted-decimal IPv4.\n   * Prevents SSRF bypass via alternative IP notations like http://2130706433 (= 127.0.0.1).\n   * Returns the input unchanged if it's not a numeric IP.\n   */\n  private _normalizeNumericIp(hostname: string): string {\n    // Pure decimal integer (e.g., 2130706433 for 127.0.0.1)\n    if (/^\\d+$/.test(hostname)) {\n      const num = parseInt(hostname, 10);\n      if (num >= 0 && num <= 0xFFFFFFFF) {\n        return `${(num >>> 24) & 0xFF}.${(num >>> 16) & 0xFF}.${(num >>> 8) & 0xFF}.${num & 0xFF}`;\n      }\n    }\n\n    // Hex notation (e.g., 0x7f000001)\n    if (/^0x[0-9a-fA-F]+$/.test(hostname)) {\n      const num = parseInt(hostname, 16);\n      if (num >= 0 && num <= 0xFFFFFFFF) {\n        return `${(num >>> 24) & 0xFF}.${(num >>> 16) & 0xFF}.${(num >>> 8) & 0xFF}.${num & 0xFF}`;\n      }\n    }\n\n    // Octal notation (e.g., 017700000001) — leading zero\n    if (/^0[0-7]+$/.test(hostname)) {\n      const num = parseInt(hostname, 8);\n      if (num >= 0 && num <= 0xFFFFFFFF) {\n        return `${(num >>> 24) & 0xFF}.${(num >>> 16) & 0xFF}.${(num >>> 8) & 0xFF}.${num & 0xFF}`;\n      }\n    }\n\n    return hostname;\n  }\n}\n"]}

package/dist/esm/security/authentications/services/auth-methods/oauth2-connection-resolver.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2-connection-resolver.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/oauth2-connection-resolver.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AACrJ,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,2BAA2B,EAAE,MAAM,kGAAkG,CAAC;AAC/I,OAAO,EAGL,aAAa,EAOd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,wBAAwB,EAExB,wBAAwB,EACzB,MAAM,sFAAsF,CAAC;AAE9F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAoG5G;;;;GAIG;AACH,qBACa,sCAAsC;IAIZ,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAChB,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IACtC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjD,OAAO,CAAC,QAAQ,CAAC,aAAa;IARjF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACtC,YAAY,EAAE,0BAA0B,EAC3B,yBAAyB,EAAE,uCAAuC,EAC9D,gBAAgB,EAAE,oCAAoC,EACtE,aAAa,EAAE,2BAA2B;IAU9G;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACU,uBAAuB,CAClC,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAAC,SAAS,CAAC,EAAE,aAAa,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GACpF,OAAO,CAAC,wBAAwB,CAAC;IAoPpC;;;;;;;;;;;;;OAaG;IACU,2BAA2B,CACtC,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,wBAAwB,CAAC;IAsJpC;;;OAGG;YACW,mBAAmB;IA+DjC;;;OAGG;YACW,oBAAoB;IA+BlC,OAAO,CAAC,wBAAwB;IAWhC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA4BzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACH,OAAO,CAAC,6BAA6B;IAqBrC;;;;;;;;;OASG;IACU,iBAAiB,CAC5B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAuBjD;;;OAGG;IACU,eAAe,CAC1B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,EAAE,CAAC;IAcpB;;;;;;;;;;;;;;OAcG;IACU,gBAAgB,CAC3B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,aAAa,EAAE,wBAAwB,GACtC,OAAO,CAAC,wBAAwB,CAAC;IAiCpC,OAAO,CAAC,8BAA8B;IAatC,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,qBAAqB;IAU7B,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,mBAAmB;CAiB5B"}
+{"version":3,"file":"oauth2-connection-resolver.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/oauth2-connection-resolver.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AACrJ,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,2BAA2B,EAAE,MAAM,kGAAkG,CAAC;AAC/I,OAAO,EAGL,aAAa,EAQd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,wBAAwB,EAExB,wBAAwB,EACzB,MAAM,sFAAsF,CAAC;AAE9F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAoG5G;;;;GAIG;AACH,qBACa,sCAAsC;IAIZ,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAChB,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IACtC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjD,OAAO,CAAC,QAAQ,CAAC,aAAa;IARjF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACtC,YAAY,EAAE,0BAA0B,EAC3B,yBAAyB,EAAE,uCAAuC,EAC9D,gBAAgB,EAAE,oCAAoC,EACtE,aAAa,EAAE,2BAA2B;IAU9G;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACU,uBAAuB,CAClC,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAAC,SAAS,CAAC,EAAE,aAAa,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GACpF,OAAO,CAAC,wBAAwB,CAAC;IAuPpC;;;;;;;;;;;;;OAaG;IACU,2BAA2B,CACtC,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,wBAAwB,CAAC;IAkLpC;;;OAGG;YACW,mBAAmB;IA+DjC;;;OAGG;YACW,oBAAoB;IA+BlC,OAAO,CAAC,wBAAwB;IAWhC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA4BzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACH,OAAO,CAAC,6BAA6B;IAqBrC;;;;;;;;;OASG;IACU,iBAAiB,CAC5B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAuBjD;;;OAGG;IACU,eAAe,CAC1B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,EAAE,CAAC;IAcpB;;;;;;;;;;;;;;OAcG;IACU,gBAAgB,CAC3B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,aAAa,EAAE,wBAAwB,GACtC,OAAO,CAAC,wBAAwB,CAAC;IAiCpC,OAAO,CAAC,8BAA8B;IAatC,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,qBAAqB;IAU7B,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,mBAAmB;CAiB5B"}