npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.2 → 1.1.3 - Mend

@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (853) hide show

package/dist/esm/security/scim/controllers/scim.backend.controller.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"scim.backend.controller.js","sourceRoot":"","sources":["../../../../../../src/security/scim/controllers/scim.backend.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAGvG,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,wCAAwC,EAAE,MAAM,gHAAgH,CAAC;AAC1K,OAAO,EAAE,8BAA8B,EAAE,MAAM,mFAAmF,CAAC;AAGnI,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAC5I,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAC7H,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,iBAAiB,EACjB,4BAA4B,EAC5B,2BAA2B,EAC3B,mBAAmB,EACnB,6BAA6B,GAI9B,MAAM,uEAAuE,CAAC;AAC/E,OAAO,EACL,uCAAuC,EACvC,6BAA6B,EAC7B,yCAAyC,GAC1C,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EAAE,eAAe,EAAE,MAAM,2DAA2D,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,gEAAgE,CAAC;AACrI,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AAExG,OAAO,EAAE,+BAA+B,EAAE,MAAM,gFAAgF,CAAC;AAI1H,IAAM,4BAA4B,GAAlC,MAAM,4BAA6B,SAAQ,gCAAgC;IAWF;IACH;IACM;IACjB;IACoB;IACb;IACP;IAIG;IApBnE,yEAAyE;IACzE,sEAAsE;IACtE,wEAAwE;IACxE,mEAAmE;IACnE,4DAA4D;IAE5D,YACqC,MAAqB,EACR,YAAwC,EACxC,YAAiC,EACL,uBAA8D,EACjE,aAAwD,EAClD,mBAA6D,EAC9E,gBAAyC,EACrB,gBAAsD,EACnE,gBAAyC,EAChD,gBAAyC,EAItC,mBAA+C;QAEhH,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;QAZgB,4BAAuB,GAAvB,uBAAuB,CAAuC;QACjE,kBAAa,GAAb,aAAa,CAA2C;QAClD,wBAAmB,GAAnB,mBAAmB,CAA0C;QAC9E,qBAAgB,GAAhB,gBAAgB,CAAyB;QACrB,qBAAgB,GAAhB,gBAAgB,CAAsC;QACnE,qBAAgB,GAAhB,gBAAgB,CAAyB;QAChD,qBAAgB,GAAhB,gBAAgB,CAAyB;QAItC,wBAAmB,GAAnB,mBAAmB,CAA4B;IAGlH,CAAC;IAED,kEAAkE;IAClE,cAAc;IACd,kEAAkE;IAExD,WAAW;QACnB,wFAAwF;QACxF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gCAAgC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnH,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,gCAAgC,EAAE,4BAA4B,CAAC,CAAC;QAEjG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC;QAErE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,wBAAwB,EAAE,oBAAoB,CAAC,CAAC;QAEjF,iDAAiD;QACjD,MAAM,cAAc,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEjE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAExE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QAEtE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,EAAE,eAAe,CAAC,CAAC;QAExE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7G,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;QAE5E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7G,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;QAE5E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/G,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;QAE9E,4BAA4B;QAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClG,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,eAAe,EAAE,sBAAsB,CAAC,CAAC;IAC7E,CAAC;IAED,kEAAkE;IAClE,+BAA+B;IAC/B,kEAAkE;IAE1D,KAAK,CAAC,yBAAyB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACrF,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,uBAAuB,EAAE,cAAc,CAAC,CAC9D,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,uBAAuB,EAAE,cAAc,CAAC,CAC9D,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAE9C,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,4BAA4B,EAAE,CAAC;YACrD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAA6C,gBAAgB,CAAC,wBAAwB,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAEhK,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAC7C,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACpB,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;gBACxF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAC/C,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC9D,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;gBACvF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAC1C,CAAC;gBACF,OAAO;YACT,CAAC;YAED,sEAAsE;YACtE,qEAAqE;YACrE,kEAAkE;YAClE,mEAAmE;YACnE,iEAAiE;YACjE,gEAAgE;YAChE,iEAAiE;YACjE,yDAAyD;YACzD,iEAAiE;YACjE,yDAAyD;YACzD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,GAAG,EAAE,EAC1B,YAAY,EACZ,SAAS,EACT,KAAK,CAAC,GAAG,CACV,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,mBAAmB,CAAC,CAAC,CAAC,IAAK,CAAuB,CAAC,IAAI,KAAK,SAAS,CAAC,UAAU,EAAE,CAAC;oBACrF,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;oBACrG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,uCAAuC,EAAE,SAAS,CAAC,CACzE,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,CAAC;YACV,CAAC;YAED,uEAAuE;YACtE,GAAgC,CAAC,WAAW,GAAG;gBAC9C,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,SAAS,EAAE,aAAa,CAAC,YAAY;gBACrC,OAAO,EAAE,KAAK,CAAC,cAAc;gBAC7B,OAAO,EAAE,KAAK,CAAC,GAAG;gBAClB,gBAAgB,EAAE,KAAK,CAAC,WAAW;aACpC,CAAC;YACD,GAAgC,CAAC,MAAM,GAAG,EAAE,CAAC;YAE9C,mEAAmE;YACnE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gCAAgC,CAAC,EAAE,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;YAC1F,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,IAAI,CAAC,iBAAiB,CAAC,4BAA4B,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;gBAC/F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,6DAA6D,EAAE,cAAc,CAAC,CACpG,CAAC;gBACF,OAAO;YACT,CAAC;YAED,qDAAqD;YACrD,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,wBAAwB,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBACnI,gEAAgE;YAClE,CAAC,CAAC,CAAC;YAEH,MAAM,OAAO,GAAI,GAAgC,CAAC,WAAW,CAAC;YAC9D,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE;gBACrC,OAAO,EAAE,KAAK,CAAC,GAAG;gBAClB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAC;YAEH,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,+BAA+B,CAAC,CACtD,CAAC;gBACF,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAC9C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,sBAAsB;IACtB,kEAAkE;IAE1D,KAAK,CAAC,4BAA4B,CAAC,IAAa,EAAE,GAAa;QACrE,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC9F,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAAa,EAAE,GAAa;QACvD,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC;YAC5D,OAAO,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC;YACrC,YAAY,EAAE,CAAC;YACf,UAAU,EAAE,CAAC;YACb,YAAY,EAAE,CAAC;YACf,SAAS,EAAE,CAAC,2BAA2B,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,IAAa,EAAE,GAAa;QAC7D,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC;YAC5D,OAAO,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC;YACrC,YAAY,EAAE,mBAAmB,CAAC,MAAM;YACxC,UAAU,EAAE,CAAC;YACb,YAAY,EAAE,mBAAmB,CAAC,MAAM;YACxC,SAAS,EAAE,mBAAmB;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAClE,oCAAoC;IACpC,kEAAkE;IAE1D,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAEtB,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAEpJ,0FAA0F;QAC1F,wFAAwF;QACxF,MAAM,EAAE,GAAI,GAAgC,CAAC,MAAM,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,8BAA8B,EAAE,cAAc,CAAC,CACrE,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAElD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;YAEtG,+FAA+F;YAC/F,8FAA8F;YAC9F,MAAM,IAAI,CAAC,gCAAgC,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YAEtG,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpE,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAEtF,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE;gBACrC,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;gBACvB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,GAAG,CAAC,OAAO;aACrB,CAAC,CAAC;YAEH,kCAAkC;YAClC,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;gBAC3C,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;gBACvB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,MAAM,CAAC,KAAK;gBACvB,cAAc,EAAE,QAAQ,GAAG,CAAC,gBAAgB,EAAE;gBAC9C,UAAU,EAAE,MAAM;aACnB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAEvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5I,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,oCAAoC;IACpC,kEAAkE;IAE1D,KAAK,CAAC,cAAc,CAAC,GAAY,EAAE,GAAa;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QAEvC,IAAI,CAAC;YACH,MAAM,EAAE,GAAI,GAAgC,CAAC,MAAM,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YAEvE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,QAAQ,MAAM,YAAY,CAAC,CACjD,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACvD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YACrF,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;YAExF,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,6DAA6D;IAC7D,kEAAkE;IAE1D,KAAK,CAAC,gBAAgB,CAAC,GAAY,EAAE,GAAa;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAA4B,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QAErF,IAAI,CAAC;YACH,MAAM,EAAE,GAAI,GAAgC,CAAC,MAAM,CAAC;YACpD,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YAE5C,8CAA8C;YAC9C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACxD,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,EACjF,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CACR,CAAC;YAC1B,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAEtD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACtC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC5G,OAAO;YACT,CAAC;YAED,qCAAqC;YACrC,MAAM,cAAc,GAAG;gBACrB,GAAG,WAAW;gBACd,GAAG,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE;aAC5B,CAAC;YAEF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YACnE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACzD,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,cAAc,EAC1C,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EACtB,EAAE,SAAS,EAAE,IAAI,EAAE,CACe,CAAC;YAErC,MAAM,KAAK,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,EAAE,CAAW,CAAC;YACjD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,EAAE,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YAEjE,mBAAmB;YACnB,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,GAAG,CACzC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;gBACzD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;gBACvF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;YACrE,CAAC,CAAC,CACH,CAAC;YAEF,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YAEtF,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,sDAAsD;IACtD,kEAAkE;IAE1D,KAAK,CAAC,kBAAkB,CAAC,GAAY,EAAE,GAAa;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAEtB,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAE7J,IAAI,CAAC;YACH,MAAM,EAAE,GAAI,GAAgC,CAAC,MAAM,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YAEvE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,QAAQ,MAAM,YAAY,CAAC,CACjD,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAE7E,4BAA4B;YAC5B,MAAM,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,MAAM,EAAE;gBACnD,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,EAAE,SAAS,CAAC,CAAC;YAEd,8BAA8B;YAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACjE,MAAM,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;YAC1F,CAAC;iBAAM,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;gBACrE,uFAAuF;gBACvF,wFAAwF;gBACxF,wFAAwF;gBACxF,iEAAiE;gBACjE,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/G,CAAC;YAED,+FAA+F;YAC/F,+EAA+E;YAC/E,MAAM,IAAI,CAAC,gCAAgC,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YAE7F,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YAC9E,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9D,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YACrF,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,IAAI,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;YAE9G,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAE9J,wCAAwC;YACxC,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBACvC,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,MAAM;gBACN,SAAS,EAAE,SAAS;gBACpB,iBAAiB,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa;aAC7G,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAEvB,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,8DAA8D;IAC9D,kEAAkE;IAE1D,KAAK,CAAC,gBAAgB,CAAC,GAAY,EAAE,GAAa;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAEtB,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAE3J,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,iCAAiC,EAAE,eAAe,CAAC,CACzE,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,GAAI,GAAgC,CAAC,MAAM,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YAEvE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,QAAQ,MAAM,YAAY,CAAC,CACjD,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YAC5E,MAAM,cAAc,GAA2B,EAAE,CAAC;YAClD,IAAI,YAAY,GAAqC,IAAI,CAAC;YAE1D,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAkC,EAAE,CAAC;gBACzD,MAAM,YAAY,GAAG,EAAE,CAAC,EAAE,EAAE,WAAW,EAAkC,CAAC;gBAE1E,IAAI,YAAY,KAAK,KAAK,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;oBACzD,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;wBACZ,0BAA0B;wBAC1B,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC7F,CAAC;yBAAM,IAAI,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;wBACpD,qEAAqE;wBACrE,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAgC,CAAC;wBACrD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;4BAClD,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;wBACpF,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,YAAY,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;oBAChD,MAAM,QAAQ,GAAG,EAAE,CAAC,IAAI,CAAC;oBACzB,MAAM,OAAO,GAAI,uBAAkD,CAAC,QAAQ,CAAC,CAAC;oBAC9E,IAAI,OAAO,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;wBAC5D,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;oBAC/B,CAAC;gBACH,CAAC;YACH,CAAC;YAED,wBAAwB;YACxB,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,MAAM,EAAE,cAAwC,EAAE,SAAS,CAAC,CAAC;YAC5G,CAAC;YAED,sBAAsB;YACtB,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;YAC1F,CAAC;iBAAM,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;gBACvC,2EAA2E;gBAC3E,0EAA0E;gBAC1E,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/G,CAAC;YAED,sBAAsB;YACtB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YAC9E,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9D,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YACrF,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,IAAI,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;YAE9G,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE;gBACrC,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM;gBACN,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM;gBAClC,OAAO,EAAE,GAAG,CAAC,OAAO;aACrB,CAAC,CAAC;YAEH,sCAAsC;YACtC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjD,IAAI,YAAY;gBAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBACvC,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,MAAM;gBACN,SAAS,EAAE,OAAO;gBAClB,iBAAiB,EAAE,YAAY;aAChC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAEvB,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,8CAA8C;IAC9C,kEAAkE;IAE1D,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QAEvC,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAE5J,IAAI,CAAC;YACH,MAAM,EAAE,GAAI,GAAgC,CAAC,MAAM,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YAEvE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,QAAQ,MAAM,YAAY,CAAC,CACjD,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YAC5E,MAAM,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;YAExF,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAEjK,kCAAkC;YAClC,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;gBAC3C,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,MAAM;gBACN,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAEvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,iDAAiD;IACjD,kEAAkE;IAE1D,KAAK,CAAC,WAAW,CAAC,GAAY,EAAE,GAAa;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAuB,CAAC;QAEzC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,wCAAwC,EAAE,eAAe,CAAC,CAChF,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACjC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,gDAAgD,EAAE,SAAS,CAAC,CAClF,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE;YACnC,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM;YACtC,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,CAAC,CAAC;QAEH,MAAM,OAAO,GAAgC,EAAE,CAAC;QAChD,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;QAE5C,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACjC,IAAI,YAAY,GAAG,CAAC,IAAI,UAAU,IAAI,YAAY,EAAE,CAAC;gBACnD,OAAO,CAAC,IAAI,CAAC;oBACX,MAAM,EAAE,EAAE,CAAC,MAAM;oBACjB,MAAM,EAAE,EAAE,CAAC,MAAM;oBACjB,MAAM,EAAE,KAAK;oBACb,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,kDAAkD,CAAC;iBACnF,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;oBACnC,UAAU,EAAE,CAAC;gBACf,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC;oBACX,MAAM,EAAE,EAAE,CAAC,MAAM;oBACjB,MAAM,EAAE,EAAE,CAAC,MAAM;oBACjB,MAAM,EAAE,KAAK;oBACb,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,0CAA0C,CAAC;iBAC3E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE;YACtC,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,eAAe,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM;YACvC,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC;YAC5D,OAAO,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC;YACrC,UAAU,EAAE,OAAO;SACpB,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,EAAoC,EACpC,GAAuB,EACvB,GAAY;QAEZ,MAAM,SAAS,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC;QACjH,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,EAAE,GAAI,GAAgC,CAAC,MAAM,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAEtC,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC;YAClB,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;oBACb,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,uBAAuB,CAAC,EAAE,CAAC;gBACvH,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;gBAChF,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;oBACnB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,mBAAmB,CAAC,EAAE,CAAC;gBACnH,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;gBAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;gBAEtG,uCAAuC;gBACvC,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;oBAC3C,cAAc,EAAE,GAAG,CAAC,cAAc;oBAClC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;oBACvB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,SAAS,EAAE,MAAM,CAAC,KAAK;oBACvB,cAAc,EAAE,aAAa,GAAG,CAAC,gBAAgB,EAAE;oBACnD,UAAU,EAAE,MAAM;iBACnB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAEvB,OAAO;oBACL,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,EAAE,CAAC,MAAM;oBACjB,QAAQ,EAAE,GAAG,OAAO,UAAU,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;oBAC/C,MAAM,EAAE,KAAK;iBACd,CAAC;YACJ,CAAC;YAED,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;oBACxB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,2BAA2B,CAAC,EAAE,CAAC;gBAC1H,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;gBACvE,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,QAAQ,MAAM,YAAY,CAAC,EAAE,CAAC;gBACzH,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;gBACnF,MAAM,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,MAAM,EAAE;oBACnD,SAAS,EAAE,UAAU,CAAC,SAAS;oBAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;oBAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;iBACpC,EAAE,SAAS,CAAC,CAAC;gBAEd,6CAA6C;gBAC7C,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;oBACvC,cAAc,EAAE,GAAG,CAAC,cAAc;oBAClC,MAAM;oBACN,SAAS,EAAE,SAAS;oBACpB,iBAAiB,EAAE,CAAC,SAAS,CAAC;iBAC/B,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAEvB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,UAAU,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACrG,CAAC;YAED,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;oBACxB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,2BAA2B,CAAC,EAAE,CAAC;gBAC5H,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;gBAC5E,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,QAAQ,MAAM,YAAY,CAAC,EAAE,CAAC;gBAC3H,CAAC;gBACD,yCAAyC;gBACzC,MAAM,UAAU,GAAI,EAAE,CAAC,IAAgC,CAAC,UAA8C,CAAC;gBACvG,MAAM,gBAAgB,GAAa,EAAE,CAAC;gBACtC,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,mBAAmB,GAA2B,EAAE,CAAC;oBACvD,IAAI,iBAAiB,GAAqC,IAAI,CAAC;oBAC/D,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;wBACjC,MAAM,YAAY,GAAG,OAAO,CAAC,EAAE,EAAE,WAAW,EAAkC,CAAC;wBAC/E,IAAI,YAAY,KAAK,KAAK,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;4BACzD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gCACjB,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,iBAAiB,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;4BACjH,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,IAAI,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAChD,MAAM,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,MAAM,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAC;oBACvF,CAAC;oBACD,IAAI,iBAAiB,KAAK,YAAY,EAAE,CAAC;wBACvC,MAAM,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;oBAC1F,CAAC;oBACD,gBAAgB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;oBAC3D,IAAI,iBAAiB;wBAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzD,CAAC;gBAED,2CAA2C;gBAC3C,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;oBACvC,cAAc,EAAE,GAAG,CAAC,cAAc;oBAClC,MAAM;oBACN,SAAS,EAAE,OAAO;oBAClB,iBAAiB,EAAE,gBAAgB;iBACpC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAEvB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,UAAU,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACvG,CAAC;YAED,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,kBAAkB,CAAC,EAAE,CAAC;gBACpH,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;gBAC7E,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,QAAQ,MAAM,YAAY,CAAC,EAAE,CAAC;gBAC5H,CAAC;gBACD,MAAM,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;gBAExF,uCAAuC;gBACvC,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;oBAC3C,cAAc,EAAE,GAAG,CAAC,cAAc;oBAClC,MAAM;oBACN,KAAK,EAAE,UAAU,CAAC,KAAK;iBACxB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAEvB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAChE,CAAC;YAED;gBACE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,uBAAuB,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;QACvI,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,gBAAgB;IAChB,kEAAkE;IAE1D,oBAAoB,CAC1B,IAAY,EACZ,KAAc,EACd,cAAsC,EACtC,cAA2D;QAE3D,MAAM,OAAO,GAAG,uBAAiD,CAAC;QAClE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9B,IAAI,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,MAAM,CAAC;YACpD,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,IAAI,OAAO,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACnC,cAAc,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,oCAAoC;IACpC,kEAAkE;IAE1D,qBAAqB,CAAC,IAA6B,EAAE,OAA8B;QACzF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAA8B,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,IAA0C,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAiE,CAAC;QAEtF,8FAA8F;QAC9F,2FAA2F;QAC3F,yEAAyE;QACzE,4FAA4F;QAC5F,4FAA4F;QAC5F,qDAAqD;QACrD,IAAI,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,QAAQ,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBAC5C,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;YACnD,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC;QAC3G,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;QACzG,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW;YACtC,CAAC,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC;YACrD,CAAC,CAAE,IAAI,CAAC,WAAkC,CAAC;QAE7C,OAAO;YACL,+FAA+F;YAC/F,kGAAkG;YAClG,kGAAkG;YAClG,6FAA6F;YAC7F,gGAAgG;YAChG,+FAA+F;YAC/F,6FAA6F;YAC7F,uFAAuF;YACvF,cAAc,EAAG,IAAI,CAAC,UAAqB,IAAI,KAAK,CAAC,WAAW,EAAE;YAClE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;YAC1B,0FAA0F;YAC1F,6FAA6F;YAC7F,6FAA6F;YAC7F,gGAAgG;YAChG,aAAa,EAAE,IAAI;YACnB,SAAS;YACT,QAAQ;YACR,WAAW,EAAE,WAAW,IAAI,SAAS;YACrC,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IAEO,oBAAoB,CAAC,GAAuB;QAClD,4FAA4F;QAC5F,+FAA+F;QAC/F,wGAAwG;QACxG,mFAAmF;QACnF,OAAO;YACL,MAAM,EAAE,sBAAsB,CAAC,IAAI;YACnC,WAAW,EAAE,MAAM;YACnB,WAAW,EAAE,6BAA6B;YAC1C,KAAK,EAAE,8BAA8B,CACnC,aAAa,CAAC,YAAY,EAC1B,GAAG,CAAC,cAAc,EAClB,QAAQ,GAAG,CAAC,OAAO,EAAE,CACtB;SACF,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,sBAAsB;IACtB,kEAAkE;IAE1D,KAAK,CAAC,cAAc,CAAC,EAAyB,EAAE,MAAc,EAAE,cAAsB;QAC5F,IAAI,CAAC;YACH,qBAAqB;YACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YACxG,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAClI,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;YAE7B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,EAAyB,EAAE,MAAc;QACrE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACxG,OAAO,OAAqG,CAAC;QAC/G,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,EAAyB,EAAE,MAAc,EAAE,cAAsB;QAClG,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,EAAE;gBAC7F,MAAM;gBACN,cAAc,EAAE,iBAAiB,CAAC,UAAU;gBAC5C,cAAc;aACf,CAAC,CAAC;YACH,OAAO,IAA0C,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH;;;;;;;OAOG;IACK,KAAK,CAAC,sBAAsB,CAClC,EAAyB,EACzB,cAAsB;QAEtB,IAAI,cAAc,GAAa,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;YAC5G,IAAI,SAAS,EAAE,CAAC;gBACd,8DAA8D;gBAC9D,cAAc,GAAG,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CACvD,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC,KAAK,UAAU,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,iEAAiE,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,IAAI,UAAU,GAAsC,IAAI,CAAC;QACzD,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,EAAE,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QACtH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,sEAAsE,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5G,CAAC;QAED,OAAO;YACL,eAAe,EAAE,UAAU,EAAE,eAAe,IAAI,IAAI;YACpD,eAAe,EAAE,UAAU,EAAE,eAAe,IAAI,IAAI;YACpD,mBAAmB,EAAE,UAAU,EAAE,mBAAmB,IAAI,IAAI;YAC5D,WAAW,EAAE,UAAU,EAAE,WAAW;YACpC,gBAAgB,EAAE,UAAU,EAAE,gBAAgB;YAC9C,cAAc;YACd,6FAA6F;YAC7F,+FAA+F;YAC/F,4FAA4F;YAC5F,4EAA4E;YAC5E,uBAAuB,EAAE,UAAU,EAAE,uBAAuB;YAC5D,eAAe,EAAE,UAAU,EAAE,eAAe;SAC7C,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,KAAK,CAAC,gCAAgC,CAC5C,EAAyB,EACzB,MAAc,EACd,cAAsB,EACtB,IAAa,EACb,MAA2E;QAE3E,IAAI,CAAC,uCAAuC,CAAC,MAAM,CAAC;YAAE,OAAO;QAE7D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACxD,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CACtE,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,GAAG;YAAE,OAAO;QAE7B,MAAM,cAAc,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,6BAA6B,CAAC,cAAc,EAAE,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAEpG,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAChE,gBAAgB,CAAC,yBAAyB,EAAE,EAAE,EAAE,EAAE,oBAAoB,EAAE,UAAU,CAAC,GAAG,EAAE,EACxF,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CACI,CAAC;QAEtC,MAAM,EAAE,eAAe,EAAE,qBAAqB,EAAE,GAAG,yCAAyC,CAC1F,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,EACpC,kBAAkB,IAAI,EAAE,CACzB,CAAC;QAEF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,qBAAqB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE/E,KAAK,MAAM,YAAY,IAAI,qBAAqB,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,yBAAyB,EAAE,EAAE,EAAE,YAAY,CAAC,CAAC;QAC1G,CAAC;QACD,KAAK,MAAM,kBAAkB,IAAI,eAAe,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,yBAAyB,EAAE,EAAE,EAAE;gBACxF,cAAc;gBACd,kBAAkB;gBAClB,oBAAoB,EAAE,UAAU,CAAC,GAAG;gBACpC,IAAI,EAAE,MAAM,CAAC,eAAe;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,2BAA2B,EAAE;YAClD,cAAc;YACd,MAAM;YACN,cAAc;YACd,wFAAwF;YACxF,8FAA8F;YAC9F,mDAAmD;YACnD,cAAc,EAAE,aAAa,IAAI,IAAI;YACrC,aAAa,EAAE,eAAe,CAAC,MAAM;YACrC,kBAAkB,EAAE,qBAAqB,CAAC,MAAM;SACjD,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAClE,+BAA+B;IAC/B,kEAAkE;IAE1D,iBAAiB,CAAC,SAAiB,EAAE,OAAgC;QAC3E,IAAI,CAAC,QAAQ,CAAC,SAAS,SAAS,EAAE,EAAE;YAClC,aAAa,EAAE,SAAS;YACxB,GAAG,OAAO;SACX,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAClE,iBAAiB;IACjB,kEAAkE;IAE1D,gBAAgB,CAAC,GAAa,EAAE,KAAc,EAAE,SAAiB;QACvE,IAAI,CAAC,iBAAiB,CAAC,GAAG,SAAS,QAAQ,EAAE,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAEpF,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,UAAU,GAAG,KAAiE,CAAC;YACrF,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,IAAI,GAAG,CAAC;YAE5C,+CAA+C;YAC/C,IAAI,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACvD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,qBAAqB,EAAE,YAAY,CAAC,CAC1D,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,IAAI,oBAAoB,CAAC,CACjE,CAAC;gBACF,OAAO;YACT,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAC1E,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,IAAI,cAAc,CAAC,CAC9D,CAAC;YACF,OAAO;QACT,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAC9C,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,YAAY;IACZ,kEAAkE;IAE1D,UAAU,CAAC,UAAkB;QACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IAEO,KAAK,CAAC,gCAAgC,CAAC,EAAyB,EAAE,cAAsB;QAC9F,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE;YAAE,OAAO,IAAI,CAAC;QAGxD,MAAM,iBAAiB,GAAI,IAAI,CAAC,gBAAgB,CAAC,MAAkE,EAAE,iBAAiB,CAAC;QAEvI,IAAI,CAAC;YACH,OAAO,MAAM,+BAA+B,CAAC,EAAE,EAAE;gBAC/C,cAAc;gBACd,iBAAiB;gBACjB,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;aACtD,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,GAAY;QAClC,OAAQ,GAAgC,CAAC,WAAW,CAAC;IACvD,CAAC;IAEO,WAAW,CAAC,GAAY;QAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC;QACtF,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1E,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC;QAC1D,OAAO,GAAG,QAAQ,MAAM,IAAI,iBAAiB,CAAC;IAChD,CAAC;IAEO,KAAK,CAAC,4BAA4B;QACxC,OAAO,IAAI,CAAC,aAAa,CAAC,4BAA4B,CAAC,IAAI,CAAC,aAAa,CAAC,2BAA2B,EAAE,CAAC,CAAC;IAC3G,CAAC;CACF,CAAA;AA3oCY,4BAA4B;IADxC,UAAU,EAAE;IASR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,CAAA;IAC5D,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAC/D,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAClD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAI3C,YAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCAbJ,aAAa;QACM,0BAA0B;QAC1B,mBAAmB,YAEO,yCAAyC;QAC7B,wCAAwC;QAC5D,uBAAuB;QACH,oCAAoC;QACjD,uBAAuB;GAhBrG,4BAA4B,CA2oCxC","sourcesContent":["/*\n SCIM 2.0 User Provisioning Controller — Step 20\n \n Receives user lifecycle events from identity providers (Okta, Azure AD, OneLogin)\n * via SCIM 2.0 protocol (RFC 7643 Core Schema, RFC 7644 Protocol).\n \n Decision 13: Lean SCIM — Users only in v1, no Groups, no generic adapter.\n * Critical Note #8: One controller, Users only, future extensions documented in code comments.\n * Critical Note #9: Follows billing's ManualControllersOptions pattern for conditional mounting.\n \n Bearer token auth: extracts token from Authorization header, hashes it,\n * looks up ScimTokenBase, validates isActive/expiresAt,\n * creates ExecutionContext with executionType: ORG_API_KEY.\n \n Reuses EnterpriseUserProvisioningService from Step 15 for:\n * - provisionEnterpriseUser() — user + profile + org member + identity link creation\n * - updateOrgUser() — profile attribute updates\n * - deactivateOrgUser() — set user status to INACTIVE\n /\n\nimport 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { createHash } from 'crypto';\nimport type { Request, Response, NextFunction } from 'express';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ErrorHandlerService } from '~wildo-backend-lib/errors/services/error-handler.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport type { Resources_PaginatedResult } from '@wildo-ai/saas-models';\nimport { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport { EnterpriseUserProvisioningBackendService } from '~wildo-backend-lib/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service';\nimport { buildEnterpriseConnectionScope } from '~wildo-backend-lib/security/authentications/models/sso-connection.backend.schemas';\nimport type { EnterpriseProvisioningConfig } from '~wildo-backend-lib/security/authentications/models/sso-connection.backend.schemas';\nimport type { NormalizedUserProfile, ProvisioningConnectionContext } from '~wildo-backend-lib/security/authentications/models/sso-connection.backend.schemas';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { AbstractControllerBackendService } from '~wildo-backend-lib/base-classes/services/controllers/abstract-controller.backend.service';\nimport {\n CoreResourceType,\n UserStatus,\n ErrorType,\n isWildoBackendError,\n AuthScopeType,\n ExternalIdentitySource,\n SsoConnectionType,\n WildoHeaderKeys,\n} from '@wildo-ai/saas-models';\nimport type { User, ScimProvisioningConfigBase, ScimAttributeMapping } from '@wildo-ai/saas-models';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { ScimTokenBase } from '@wildo-ai/saas-models';\nimport { resolveScimAttributePath } from '~wildo-backend-lib/security/scim/utils/scim-attribute-path-resolver.backend.utils';\nimport {\n SCIM_USER_ATTRIBUTE_MAP,\n SCIM_SCHEMAS,\n SCIM_CONTENT_TYPE,\n SCIM_SERVICE_PROVIDER_CONFIG,\n SCIM_USER_SCHEMA_DEFINITION,\n SCIM_RESOURCE_TYPES,\n extractScimDirectoryUnitValue,\n type SCIMPatchOperation,\n type SCIMBulkRequest,\n type SCIMBulkOperationResponse,\n} from '~wildo-backend-lib/security/scim/models/scim-protocol.backend.schemas';\nimport {\n isScimOrganizationUnitManagementEnabled,\n resolveScimOrganizationUnitId,\n resolveScimOrganizationUnitReconciliation,\n} from '@wildo-ai/saas-models';\nimport type {\n ScimOrganizationUnitAssignment,\n ScimOrganizationUnitManagementSignal,\n} from '@wildo-ai/saas-models';\nimport { parseSCIMFilter } from '~wildo-backend-lib/security/scim/utils/scim-filter-parser';\nimport { formatUserAsSCIM, formatListAsSCIM, formatSCIMError } from '~wildo-backend-lib/security/scim/utils/scim-response-formatter';\nimport { AuthOrganizationConfigurationService } from '~wildo-backend-lib/security/authentications/services/admin-config/auth-organization-configuration.service';\nimport { RateLimitBackendService } from '~wildo-backend-lib/errors/services/rate-limit.backend.service';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { isScimProvisioningEnabledForOrg } from '~wildo-backend-lib/organizations/services/scim-provisioning-gate.backend.utils';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\n\n@injectable()\nexport class SCIMControllerBackendService extends AbstractControllerBackendService {\n // (Per-token rate-limit constants — 300/min/token — were removed in PR 5\n // of the rate-limit unification: the policy is now declared inline in\n // `_scimBearerAuthMiddleware` via `RateLimitBackendService.checkPolicy`\n // with `clientIdOverride: token._id` for per-token bucketing. Same\n // semantic — no IP, no organizationId — different surface.)\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ErrorHandlerService) errorHandler: ErrorHandlerService,\n @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory) private readonly authEcFactory: AuthExecutionContextFactoryBackendService,\n @inject(SAAS_SERVICE_TYPES.EnterpriseUserProvisioningService) private readonly provisioningService: EnterpriseUserProvisioningBackendService,\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) private readonly auditLogsService: AuditLogsBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService) private readonly orgConfigService: AuthOrganizationConfigurationService,\n @inject(SAAS_SERVICE_TYPES.RateLimitBackendService) private readonly rateLimitService: RateLimitBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n // Directory-driven re-activation writes `User.status`, which is `.excludeFromUpdate()` — the\n // client-facing contract cannot carry it, so the write goes through the trusted system door.\n // Appended LAST to keep positional construction in existing tests stable.\n @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n ) {\n super(logger, errorBuilder, errorHandler, 'SCIMController');\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Route Setup\n // ═══════════════════════════════════════════════════════════════\n\n protected setupRoutes(): void {\n // SCIM Discovery endpoints (no auth required for ServiceProviderConfig per RFC 7644 §4)\n this.router.get('/scim/v2/ServiceProviderConfig', this.asyncHandler(this._handleServiceProviderConfig.bind(this)));\n this.logRouteRegistration('GET', '/scim/v2/ServiceProviderConfig', 'SCIM ServiceProviderConfig');\n\n this.router.get('/scim/v2/Schemas', this.asyncHandler(this._handleSchemas.bind(this)));\n this.logRouteRegistration('GET', '/scim/v2/Schemas', 'SCIM Schemas');\n\n this.router.get('/scim/v2/ResourceTypes', this.asyncHandler(this._handleResourceTypes.bind(this)));\n this.logRouteRegistration('GET', '/scim/v2/ResourceTypes', 'SCIM ResourceTypes');\n\n // All /Users endpoints require bearer token auth\n const authMiddleware = this._scimBearerAuthMiddleware.bind(this);\n\n this.router.post('/scim/v2/Users', authMiddleware, this.asyncHandler(this._handleCreateUser.bind(this)));\n this.logRouteRegistration('POST', '/scim/v2/Users', 'SCIM Create User');\n\n this.router.get('/scim/v2/Users', authMiddleware, this.asyncHandler(this._handleListUsers.bind(this)));\n this.logRouteRegistration('GET', '/scim/v2/Users', 'SCIM List Users');\n\n this.router.get('/scim/v2/Users/:id', authMiddleware, this.asyncHandler(this._handleGetUser.bind(this)));\n this.logRouteRegistration('GET', '/scim/v2/Users/:id', 'SCIM Get User');\n\n this.router.put('/scim/v2/Users/:id', authMiddleware, this.asyncHandler(this._handleReplaceUser.bind(this)));\n this.logRouteRegistration('PUT', '/scim/v2/Users/:id', 'SCIM Replace User');\n\n this.router.patch('/scim/v2/Users/:id', authMiddleware, this.asyncHandler(this._handlePatchUser.bind(this)));\n this.logRouteRegistration('PATCH', '/scim/v2/Users/:id', 'SCIM Patch User');\n\n this.router.delete('/scim/v2/Users/:id', authMiddleware, this.asyncHandler(this._handleDeleteUser.bind(this)));\n this.logRouteRegistration('DELETE', '/scim/v2/Users/:id', 'SCIM Delete User');\n\n // Bulk operations (Step 21)\n this.router.post('/scim/v2/Bulk', authMiddleware, this.asyncHandler(this._handleBulk.bind(this)));\n this.logRouteRegistration('POST', '/scim/v2/Bulk', 'SCIM Bulk Operations');\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Bearer Token Auth Middleware\n // ═══════════════════════════════════════════════════════════════\n\n private async _scimBearerAuthMiddleware(req: Request, res: Response, next: NextFunction): Promise<void> {\n const authHeader = req.headers[WildoHeaderKeys.AUTHORIZATION];\n if (!authHeader \|\| !authHeader.startsWith('Bearer ')) {\n res.status(401).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(401, 'Bearer token required', 'invalidValue')\n );\n return;\n }\n\n const plainToken = authHeader.substring(7);\n if (!plainToken) {\n res.status(401).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(401, 'Bearer token is empty', 'invalidValue')\n );\n return;\n }\n\n const tokenHash = this._hashToken(plainToken);\n\n try {\n const ec = await this._getInternalExecutionContext();\n const token = await this.servicesRegistryHandler.read<ScimTokenBase & { organizationId: string }>(CoreResourceType.ORGANIZATION_SCIM_TOKENS, ec, { tokenHash });\n\n if (!token) {\n this._logSCIMOperation('auth_failed', { reason: 'token_not_found' });\n res.status(401).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(401, 'Invalid bearer token')\n );\n return;\n }\n\n if (!token.isActive) {\n this._logSCIMOperation('auth_failed', { reason: 'token_inactive', tokenId: token._id });\n res.status(401).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(401, 'Token has been revoked')\n );\n return;\n }\n\n if (token.expiresAt && new Date(token.expiresAt) < new Date()) {\n this._logSCIMOperation('auth_failed', { reason: 'token_expired', tokenId: token._id });\n res.status(401).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(401, 'Token has expired')\n );\n return;\n }\n\n // Per-token rate limiting (PR 5 of the rate-limit unification, Step 5\n // — second imperative-to-declarative migration wave). 300/min/token,\n // keyed on the token id (NOT the IP — IP rotation must not let an\n // attacker sidestep a per-token quota; the token IS the subject of\n // the quota). Standard `X-RateLimit-` and `Retry-After` headers\n // are now written by `checkPolicy` BEFORE the throw, so they're\n // preserved on the SCIM 429 response below (previously absent at\n // this seam — IdP retry logic had to guess backoff). The\n // try/catch stays because SCIM has its own RFC 7644 error format\n // (the underlying `RATE_LIMIT` error type is unchanged).\n try {\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 300 },\n 'scim:token',\n undefined,\n token._id,\n );\n } catch (e) {\n if (isWildoBackendError(e) && (e as { type?: string }).type === ErrorType.RATE_LIMIT) {\n this._logSCIMOperation('rate_limited', { tokenId: token._id, organizationId: token.organizationId });\n res.status(429).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(429, 'Rate limit exceeded. Try again later.', 'tooMany')\n );\n return;\n }\n throw e;\n }\n\n // Attach org + scope context and EC to request for downstream handlers\n (req as SCIMAuthenticatedRequest).scimContext = {\n organizationId: token.organizationId,\n scopeType: AuthScopeType.ORGANIZATION,\n scopeId: token.organizationId,\n tokenId: token._id,\n tokenDisplayName: token.displayName,\n };\n (req as SCIMAuthenticatedRequest).scimEc = ec;\n\n // W5.10: Check if SCIM provisioning is enabled for this org's type\n const scimEnabled = await this._isScimProvisioningEnabledForOrg(ec, token.organizationId);\n if (!scimEnabled) {\n this._logSCIMOperation('scim_disabled_for_org_type', { organizationId: token.organizationId });\n res.status(403).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(403, 'SCIM provisioning is not enabled for this organization type', 'invalidValue')\n );\n return;\n }\n\n // Update lastUsedAt asynchronously (fire-and-forget)\n this.servicesRegistryHandler.update(CoreResourceType.ORGANIZATION_SCIM_TOKENS, ec, token._id, { lastUsedAt: new Date() }).catch(() => {\n // Non-fatal — don't fail the request if lastUsedAt update fails\n });\n\n const scimCtx = (req as SCIMAuthenticatedRequest).scimContext;\n this._logSCIMOperation('auth_success', {\n tokenId: token._id,\n organizationId: token.organizationId,\n scopeType: scimCtx.scopeType,\n scopeId: scimCtx.scopeId,\n method: req.method,\n path: req.path,\n });\n\n next();\n } catch (error) {\n if (isWildoBackendError(error)) {\n res.status(500).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(500, 'Internal authentication error')\n );\n return;\n }\n res.status(500).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(500, 'Internal server error')\n );\n }\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Discovery Endpoints\n // ═══════════════════════════════════════════════════════════════\n\n private async _handleServiceProviderConfig(_req: Request, res: Response): Promise<void> {\n res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(SCIM_SERVICE_PROVIDER_CONFIG);\n }\n\n private async _handleSchemas(_req: Request, res: Response): Promise<void> {\n res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json({\n schemas: [SCIM_SCHEMAS.LIST_RESPONSE],\n totalResults: 1,\n startIndex: 1,\n itemsPerPage: 1,\n Resources: [SCIM_USER_SCHEMA_DEFINITION],\n });\n }\n\n private async _handleResourceTypes(_req: Request, res: Response): Promise<void> {\n res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json({\n schemas: [SCIM_SCHEMAS.LIST_RESPONSE],\n totalResults: SCIM_RESOURCE_TYPES.length,\n startIndex: 1,\n itemsPerPage: SCIM_RESOURCE_TYPES.length,\n Resources: SCIM_RESOURCE_TYPES,\n });\n }\n\n // ═══════════════════════════════════════════════════════════════\n // POST /scim/v2/Users — Create User\n // ═══════════════════════════════════════════════════════════════\n\n private async _handleCreateUser(req: Request, res: Response): Promise<void> {\n const ctx = this._getSCIMContext(req);\n const body = req.body;\n\n this._logSCIMOperation('create_user', { organizationId: ctx.organizationId, scopeType: ctx.scopeType, scopeId: ctx.scopeId, tokenId: ctx.tokenId });\n\n // Config first — its `attributeMapping` drives how the body is normalised into a profile.\n // `_getProvisioningConfig` is resilient (never throws), so this is safe before the try.\n const ec = (req as SCIMAuthenticatedRequest).scimEc;\n const orgConfig = await this._getProvisioningConfig(ec, ctx.organizationId);\n const profile = this._mapSCIMBodyToProfile(body, orgConfig.attributeMapping);\n if (!profile.email) {\n res.status(400).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(400, 'userName (email) is required', 'invalidValue')\n );\n return;\n }\n\n try {\n const connection = this._buildSCIMConnection(ctx);\n\n const result = await this.provisioningService.provisionEnterpriseUser(profile, connection, orgConfig);\n\n // WS-C: bind the directory's department to an organization unit. Runs BEFORE the response so a\n // failure surfaces as a SCIM error the IdP retries, rather than a 201 hiding diverged grants.\n await this._syncOrganizationUnitAssignments(ec, result.user._id, ctx.organizationId, body, orgConfig);\n\n const userProfile = await this._getUserProfile(ec, result.user._id);\n const baseUrl = this._getBaseUrl(req);\n const scimUser = formatUserAsSCIM(result.user, userProfile, baseUrl, body.externalId);\n\n this._logSCIMOperation('user_created', {\n organizationId: ctx.organizationId,\n scopeType: ctx.scopeType,\n scopeId: ctx.scopeId,\n userId: result.user._id,\n isNew: result.isNew,\n tokenId: ctx.tokenId,\n });\n\n // H8: Audit SCIM user provisioned\n this.auditLogsService.logSCIMUserProvisioned({\n organizationId: ctx.organizationId,\n userId: result.user._id,\n email: profile.email,\n isNewUser: result.isNew,\n provisionedVia: `scim:${ctx.tokenDisplayName}`,\n authSource: 'scim',\n }, ec).catch(() => {});\n\n res.status(201).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).set(WildoHeaderKeys.LOCATION, scimUser.meta.location).json(scimUser);\n } catch (error) {\n this._handleSCIMError(res, error, 'create_user');\n }\n }\n\n // ═══════════════════════════════════════════════════════════════\n // GET /scim/v2/Users/:id — Get User\n // ═══════════════════════════════════════════════════════════════\n\n private async _handleGetUser(req: Request, res: Response): Promise<void> {\n const ctx = this._getSCIMContext(req);\n const userId = req.params.id as string;\n\n try {\n const ec = (req as SCIMAuthenticatedRequest).scimEc;\n const user = await this._findUserInOrg(ec, userId, ctx.organizationId);\n\n if (!user) {\n res.status(404).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(404, `User ${userId} not found`)\n );\n return;\n }\n\n const profile = await this._getUserProfile(ec, userId);\n const identityLink = await this._getUserIdentityLink(ec, userId, ctx.organizationId);\n const baseUrl = this._getBaseUrl(req);\n const scimUser = formatUserAsSCIM(user, profile, baseUrl, identityLink?.providerUserId);\n\n res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(scimUser);\n } catch (error) {\n this._handleSCIMError(res, error, 'get_user');\n }\n }\n\n // ═══════════════════════════════════════════════════════════════\n // GET /scim/v2/Users — List Users (with filter + pagination)\n // ═══════════════════════════════════════════════════════════════\n\n private async _handleListUsers(req: Request, res: Response): Promise<void> {\n const ctx = this._getSCIMContext(req);\n const filter = req.query.filter as string \| undefined;\n const startIndex = Math.max(1, parseInt(req.query.startIndex as string) \|\| 1);\n const count = Math.min(200, Math.max(1, parseInt(req.query.count as string) \|\| 100));\n\n try {\n const ec = (req as SCIMAuthenticatedRequest).scimEc;\n const mongoFilter = parseSCIMFilter(filter);\n\n // Scope to organization via org member lookup\n const orgMembers = await this.servicesRegistryHandler.list<{ userId: string }>(\n CoreResourceType.ORGANIZATION_MEMBERS, ec, { organizationId: ctx.organizationId },\n undefined, { paginated: false },\n ) as { userId: string }[];\n const memberUserIds = orgMembers.map((m) => m.userId);\n\n if (memberUserIds.length === 0) {\n const baseUrl = this._getBaseUrl(req);\n res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatListAsSCIM([], 0, startIndex, baseUrl));\n return;\n }\n\n // Combine SCIM filter with org scope\n const combinedFilter = {\n ...mongoFilter,\n _id: { $in: memberUserIds },\n };\n\n const page = Math.max(1, Math.floor((startIndex - 1) / count) + 1);\n const usersResult = await this.servicesRegistryHandler.list<User>(\n CoreResourceType.USERS, ec, combinedFilter,\n { page, limit: count },\n { paginated: true },\n ) as Resources_PaginatedResult<User>;\n\n const users = (usersResult.data \|\| []) as User[];\n const totalCount = usersResult.pagination?.total ?? users.length;\n\n // Hydrate profiles\n const usersWithProfiles = await Promise.all(\n users.map(async (user) => {\n const profile = await this._getUserProfile(ec, user._id);\n const identityLink = await this._getUserIdentityLink(ec, user._id, ctx.organizationId);\n return { user, profile, externalId: identityLink?.providerUserId };\n })\n );\n\n const baseUrl = this._getBaseUrl(req);\n const response = formatListAsSCIM(usersWithProfiles, totalCount, startIndex, baseUrl);\n\n res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(response);\n } catch (error) {\n this._handleSCIMError(res, error, 'list_users');\n }\n }\n\n // ═══════════════════════════════════════════════════════════════\n // PUT /scim/v2/Users/:id — Replace User (full update)\n // ═══════════════════════════════════════════════════════════════\n\n private async _handleReplaceUser(req: Request, res: Response): Promise<void> {\n const ctx = this._getSCIMContext(req);\n const userId = req.params.id as string;\n const body = req.body;\n\n this._logSCIMOperation('replace_user', { organizationId: ctx.organizationId, scopeType: ctx.scopeType, scopeId: ctx.scopeId, userId, tokenId: ctx.tokenId });\n\n try {\n const ec = (req as SCIMAuthenticatedRequest).scimEc;\n const user = await this._findUserInOrg(ec, userId, ctx.organizationId);\n\n if (!user) {\n res.status(404).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(404, `User ${userId} not found`)\n );\n return;\n }\n\n const orgConfig = await this._getProvisioningConfig(ec, ctx.organizationId);\n const profile = this._mapSCIMBodyToProfile(body, orgConfig.attributeMapping);\n\n // Update profile attributes\n await this.provisioningService.updateOrgUser(userId, {\n firstName: profile.firstName,\n lastName: profile.lastName,\n displayName: profile.displayName,\n }, orgConfig);\n\n // Handle active status change\n if (body.active === false && user.status !== UserStatus.INACTIVE) {\n await this.provisioningService.deactivateOrgUser(userId, ctx.organizationId, orgConfig);\n } else if (body.active === true && user.status !== UserStatus.ACTIVE) {\n // `status` is `.excludeFromUpdate()`, so the ordinary handler write is stripped by the\n // repository's strict re-parse and the user would silently stay deactivated. The system\n // door re-attaches it. Not a lifecycle VERB: re-activation here is a consequence of the\n // directory's state, not an operator decision carrying a reason.\n await this.systemAccessService.updateAsSystem(CoreResourceType.USERS, userId, { status: UserStatus.ACTIVE });\n }\n\n // WS-C: a PUT carries the directory's full current state, so this is where a department CHANGE\n // (and therefore the revocation of the previous unit's access) actually lands.\n await this._syncOrganizationUnitAssignments(ec, userId, ctx.organizationId, body, orgConfig);\n\n const updatedUser = await this._findUserInOrg(ec, userId, ctx.organizationId);\n const updatedProfile = await this._getUserProfile(ec, userId);\n const identityLink = await this._getUserIdentityLink(ec, userId, ctx.organizationId);\n const baseUrl = this._getBaseUrl(req);\n const scimUser = formatUserAsSCIM(updatedUser \|\| user, updatedProfile, baseUrl, identityLink?.providerUserId);\n\n this._logSCIMOperation('user_replaced', { organizationId: ctx.organizationId, scopeType: ctx.scopeType, scopeId: ctx.scopeId, userId, tokenId: ctx.tokenId });\n\n // H8: Audit SCIM user updated (replace)\n this.auditLogsService.logSCIMUserUpdated({\n organizationId: ctx.organizationId,\n userId,\n operation: 'replace',\n updatedAttributes: ['profile', body.active !== undefined ? 'active' : undefined].filter(Boolean) as string[],\n }, ec).catch(() => {});\n\n res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(scimUser);\n } catch (error) {\n this._handleSCIMError(res, error, 'replace_user');\n }\n }\n\n // ═══════════════════════════════════════════════════════════════\n // PATCH /scim/v2/Users/:id — Partial Update (RFC 7644 §3.5.2)\n // ═══════════════════════════════════════════════════════════════\n\n private async _handlePatchUser(req: Request, res: Response): Promise<void> {\n const ctx = this._getSCIMContext(req);\n const userId = req.params.id as string;\n const body = req.body;\n\n this._logSCIMOperation('patch_user', { organizationId: ctx.organizationId, scopeType: ctx.scopeType, scopeId: ctx.scopeId, userId, tokenId: ctx.tokenId });\n\n if (!body.Operations \|\| !Array.isArray(body.Operations)) {\n res.status(400).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(400, 'PATCH requires Operations array', 'invalidSyntax')\n );\n return;\n }\n\n try {\n const ec = (req as SCIMAuthenticatedRequest).scimEc;\n const user = await this._findUserInOrg(ec, userId, ctx.organizationId);\n\n if (!user) {\n res.status(404).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(404, `User ${userId} not found`)\n );\n return;\n }\n\n const orgConfig = await this._getProvisioningConfig(ec, ctx.organizationId);\n const profileUpdates: Record<string, string> = {};\n let statusChange: 'activate' \| 'deactivate' \| null = null;\n\n for (const op of body.Operations as SCIMPatchOperation[]) {\n const normalizedOp = op.op?.toLowerCase() as 'add' \| 'remove' \| 'replace';\n\n if (normalizedOp === 'add' \|\| normalizedOp === 'replace') {\n if (op.path) {\n // Single attribute update\n this._applyPatchAttribute(op.path, op.value, profileUpdates, (s) => { statusChange = s; });\n } else if (op.value && typeof op.value === 'object') {\n // Bulk attribute update (no path — value is an object of attributes)\n const valueObj = op.value as Record<string, unknown>;\n for (const [key, val] of Object.entries(valueObj)) {\n this._applyPatchAttribute(key, val, profileUpdates, (s) => { statusChange = s; });\n }\n }\n } else if (normalizedOp === 'remove' && op.path) {\n const scimAttr = op.path;\n const dbField = (SCIM_USER_ATTRIBUTE_MAP as Record<string, string>)[scimAttr];\n if (dbField && dbField !== '_active' && dbField !== 'email') {\n profileUpdates[dbField] = '';\n }\n }\n }\n\n // Apply profile updates\n if (Object.keys(profileUpdates).length > 0) {\n await this.provisioningService.updateOrgUser(userId, profileUpdates as Record<string, string>, orgConfig);\n }\n\n // Apply status change\n if (statusChange === 'deactivate') {\n await this.provisioningService.deactivateOrgUser(userId, ctx.organizationId, orgConfig);\n } else if (statusChange === 'activate') {\n // Same system door as the PUT path above, for the same reason: `status` is\n // `.excludeFromUpdate()` and a handler write would be silently discarded.\n await this.systemAccessService.updateAsSystem(CoreResourceType.USERS, userId, { status: UserStatus.ACTIVE });\n }\n\n // Return updated user\n const updatedUser = await this._findUserInOrg(ec, userId, ctx.organizationId);\n const updatedProfile = await this._getUserProfile(ec, userId);\n const identityLink = await this._getUserIdentityLink(ec, userId, ctx.organizationId);\n const baseUrl = this._getBaseUrl(req);\n const scimUser = formatUserAsSCIM(updatedUser \|\| user, updatedProfile, baseUrl, identityLink?.providerUserId);\n\n this._logSCIMOperation('user_patched', {\n organizationId: ctx.organizationId,\n scopeType: ctx.scopeType,\n scopeId: ctx.scopeId,\n userId,\n operations: body.Operations.length,\n tokenId: ctx.tokenId,\n });\n\n // H8: Audit SCIM user updated (patch)\n const patchedAttrs = Object.keys(profileUpdates);\n if (statusChange) patchedAttrs.push('active');\n this.auditLogsService.logSCIMUserUpdated({\n organizationId: ctx.organizationId,\n userId,\n operation: 'patch',\n updatedAttributes: patchedAttrs,\n }, ec).catch(() => {});\n\n res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(scimUser);\n } catch (error) {\n this._handleSCIMError(res, error, 'patch_user');\n }\n }\n\n // ═══════════════════════════════════════════════════════════════\n // DELETE /scim/v2/Users/:id — Deactivate User\n // ═══════════════════════════════════════════════════════════════\n\n private async _handleDeleteUser(req: Request, res: Response): Promise<void> {\n const ctx = this._getSCIMContext(req);\n const userId = req.params.id as string;\n\n this._logSCIMOperation('delete_user', { organizationId: ctx.organizationId, scopeType: ctx.scopeType, scopeId: ctx.scopeId, userId, tokenId: ctx.tokenId });\n\n try {\n const ec = (req as SCIMAuthenticatedRequest).scimEc;\n const user = await this._findUserInOrg(ec, userId, ctx.organizationId);\n\n if (!user) {\n res.status(404).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(404, `User ${userId} not found`)\n );\n return;\n }\n\n const orgConfig = await this._getProvisioningConfig(ec, ctx.organizationId);\n await this.provisioningService.deactivateOrgUser(userId, ctx.organizationId, orgConfig);\n\n this._logSCIMOperation('user_deactivated', { organizationId: ctx.organizationId, scopeType: ctx.scopeType, scopeId: ctx.scopeId, userId, tokenId: ctx.tokenId });\n\n // H8: Audit SCIM user deactivated\n this.auditLogsService.logSCIMUserDeactivated({\n organizationId: ctx.organizationId,\n userId,\n email: user.email,\n }, ec).catch(() => {});\n\n res.status(204).end();\n } catch (error) {\n this._handleSCIMError(res, error, 'delete_user');\n }\n }\n\n // ═══════════════════════════════════════════════════════════════\n // POST /scim/v2/Bulk — Bulk Operations (Step 21)\n // ═══════════════════════════════════════════════════════════════\n\n private async _handleBulk(req: Request, res: Response): Promise<void> {\n const ctx = this._getSCIMContext(req);\n const body = req.body as SCIMBulkRequest;\n\n if (!body.Operations \|\| !Array.isArray(body.Operations)) {\n res.status(400).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(400, 'Bulk request requires Operations array', 'invalidSyntax')\n );\n return;\n }\n\n if (body.Operations.length > 100) {\n res.status(413).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(413, 'Bulk request exceeds maximum of 100 operations', 'tooMany')\n );\n return;\n }\n\n this._logSCIMOperation('bulk_start', {\n organizationId: ctx.organizationId,\n scopeType: ctx.scopeType,\n scopeId: ctx.scopeId,\n operationCount: body.Operations.length,\n tokenId: ctx.tokenId,\n });\n\n const results: SCIMBulkOperationResponse[] = [];\n let errorCount = 0;\n const failOnErrors = body.failOnErrors \|\| 0;\n\n for (const op of body.Operations) {\n if (failOnErrors > 0 && errorCount >= failOnErrors) {\n results.push({\n method: op.method,\n bulkId: op.bulkId,\n status: '412',\n response: formatSCIMError(412, 'Processing stopped due to failOnErrors threshold'),\n });\n continue;\n }\n\n try {\n const result = await this._executeBulkOperation(op, ctx, req);\n results.push(result);\n if (parseInt(result.status) >= 400) {\n errorCount++;\n }\n } catch {\n errorCount++;\n results.push({\n method: op.method,\n bulkId: op.bulkId,\n status: '500',\n response: formatSCIMError(500, 'Internal error processing bulk operation'),\n });\n }\n }\n\n this._logSCIMOperation('bulk_complete', {\n organizationId: ctx.organizationId,\n scopeType: ctx.scopeType,\n scopeId: ctx.scopeId,\n totalOperations: body.Operations.length,\n errors: errorCount,\n tokenId: ctx.tokenId,\n });\n\n res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json({\n schemas: [SCIM_SCHEMAS.BULK_RESPONSE],\n Operations: results,\n });\n }\n\n private async _executeBulkOperation(\n op: SCIMBulkRequest['Operations'][0],\n ctx: SCIMRequestContext,\n req: Request,\n ): Promise<SCIMBulkOperationResponse> {\n const pathMatch = op.path?.match(/\\/Users(?:\\/(.+))?$/);\n if (!pathMatch) {\n return { method: op.method, bulkId: op.bulkId, status: '400', response: formatSCIMError(400, 'Invalid path') };\n }\n const userId = pathMatch[1];\n const ec = (req as SCIMAuthenticatedRequest).scimEc;\n const orgConfig = await this._getProvisioningConfig(ec, ctx.organizationId);\n const baseUrl = this._getBaseUrl(req);\n\n switch (op.method) {\n case 'POST': {\n if (!op.data) {\n return { method: 'POST', bulkId: op.bulkId, status: '400', response: formatSCIMError(400, 'Missing data for POST') };\n }\n const profile = this._mapSCIMBodyToProfile(op.data, orgConfig.attributeMapping);\n if (!profile.email) {\n return { method: 'POST', bulkId: op.bulkId, status: '400', response: formatSCIMError(400, 'userName required') };\n }\n const connection = this._buildSCIMConnection(ctx);\n const result = await this.provisioningService.provisionEnterpriseUser(profile, connection, orgConfig);\n\n // H8: Audit bulk SCIM user provisioned\n this.auditLogsService.logSCIMUserProvisioned({\n organizationId: ctx.organizationId,\n userId: result.user._id,\n email: profile.email,\n isNewUser: result.isNew,\n provisionedVia: `scim:bulk:${ctx.tokenDisplayName}`,\n authSource: 'scim',\n }, ec).catch(() => {});\n\n return {\n method: 'POST',\n bulkId: op.bulkId,\n location: `${baseUrl}/Users/${result.user._id}`,\n status: '201',\n };\n }\n\n case 'PUT': {\n if (!userId \|\| !op.data) {\n return { method: 'PUT', bulkId: op.bulkId, status: '400', response: formatSCIMError(400, 'User ID and data required') };\n }\n const user = await this._findUserInOrg(ec, userId, ctx.organizationId);\n if (!user) {\n return { method: 'PUT', bulkId: op.bulkId, status: '404', response: formatSCIMError(404, `User ${userId} not found`) };\n }\n const putProfile = this._mapSCIMBodyToProfile(op.data, orgConfig.attributeMapping);\n await this.provisioningService.updateOrgUser(userId, {\n firstName: putProfile.firstName,\n lastName: putProfile.lastName,\n displayName: putProfile.displayName,\n }, orgConfig);\n\n // H8: Audit bulk SCIM user updated (replace)\n this.auditLogsService.logSCIMUserUpdated({\n organizationId: ctx.organizationId,\n userId,\n operation: 'replace',\n updatedAttributes: ['profile'],\n }, ec).catch(() => {});\n\n return { method: 'PUT', bulkId: op.bulkId, location: `${baseUrl}/Users/${userId}`, status: '200' };\n }\n\n case 'PATCH': {\n if (!userId \|\| !op.data) {\n return { method: 'PATCH', bulkId: op.bulkId, status: '400', response: formatSCIMError(400, 'User ID and data required') };\n }\n const patchUser = await this._findUserInOrg(ec, userId, ctx.organizationId);\n if (!patchUser) {\n return { method: 'PATCH', bulkId: op.bulkId, status: '404', response: formatSCIMError(404, `User ${userId} not found`) };\n }\n // Simplified: apply operations from data\n const operations = (op.data as Record<string, unknown>).Operations as SCIMPatchOperation[] \| undefined;\n const bulkPatchedAttrs: string[] = [];\n if (operations) {\n const patchProfileUpdates: Record<string, string> = {};\n let patchStatusChange: 'activate' \| 'deactivate' \| null = null;\n for (const patchOp of operations) {\n const normalizedOp = patchOp.op?.toLowerCase() as 'add' \| 'remove' \| 'replace';\n if (normalizedOp === 'add' \|\| normalizedOp === 'replace') {\n if (patchOp.path) {\n this._applyPatchAttribute(patchOp.path, patchOp.value, patchProfileUpdates, (s) => { patchStatusChange = s; });\n }\n }\n }\n if (Object.keys(patchProfileUpdates).length > 0) {\n await this.provisioningService.updateOrgUser(userId, patchProfileUpdates, orgConfig);\n }\n if (patchStatusChange === 'deactivate') {\n await this.provisioningService.deactivateOrgUser(userId, ctx.organizationId, orgConfig);\n }\n bulkPatchedAttrs.push(...Object.keys(patchProfileUpdates));\n if (patchStatusChange) bulkPatchedAttrs.push('active');\n }\n\n // H8: Audit bulk SCIM user updated (patch)\n this.auditLogsService.logSCIMUserUpdated({\n organizationId: ctx.organizationId,\n userId,\n operation: 'patch',\n updatedAttributes: bulkPatchedAttrs,\n }, ec).catch(() => {});\n\n return { method: 'PATCH', bulkId: op.bulkId, location: `${baseUrl}/Users/${userId}`, status: '200' };\n }\n\n case 'DELETE': {\n if (!userId) {\n return { method: 'DELETE', bulkId: op.bulkId, status: '400', response: formatSCIMError(400, 'User ID required') };\n }\n const deleteUser = await this._findUserInOrg(ec, userId, ctx.organizationId);\n if (!deleteUser) {\n return { method: 'DELETE', bulkId: op.bulkId, status: '404', response: formatSCIMError(404, `User ${userId} not found`) };\n }\n await this.provisioningService.deactivateOrgUser(userId, ctx.organizationId, orgConfig);\n\n // H8: Audit bulk SCIM user deactivated\n this.auditLogsService.logSCIMUserDeactivated({\n organizationId: ctx.organizationId,\n userId,\n email: deleteUser.email,\n }, ec).catch(() => {});\n\n return { method: 'DELETE', bulkId: op.bulkId, status: '204' };\n }\n\n default:\n return { method: op.method, bulkId: op.bulkId, status: '400', response: formatSCIMError(400, `Unsupported method: ${op.method}`) };\n }\n }\n\n // ═══════════════════════════════════════════════════════════════\n // PATCH Helpers\n // ═══════════════════════════════════════════════════════════════\n\n private _applyPatchAttribute(\n path: string,\n value: unknown,\n profileUpdates: Record<string, string>,\n onStatusChange: (change: 'activate' \| 'deactivate') => void,\n ): void {\n const attrMap = SCIM_USER_ATTRIBUTE_MAP as Record<string, string>;\n const dbField = attrMap[path];\n\n if (path === 'active' \|\| dbField === '_active') {\n const isActive = value === true \|\| value === 'true';\n onStatusChange(isActive ? 'activate' : 'deactivate');\n return;\n }\n\n if (dbField && dbField !== 'email') {\n profileUpdates[dbField] = String(value ?? '');\n }\n }\n\n // ═══════════════════════════════════════════════════════════════\n // SCIM Body → NormalizedUserProfile\n // ═══════════════════════════════════════════════════════════════\n\n private _mapSCIMBodyToProfile(body: Record<string, unknown>, mapping?: ScimAttributeMapping): NormalizedUserProfile {\n const userName = body.userName as string \| undefined;\n const name = body.name as Record<string, string> \| undefined;\n const emails = body.emails as Array<{ value: string; primary?: boolean }> \| undefined;\n\n // An authored `attributeMapping` (set only via `saveScimProvisioningConfig`, which no surface\n // calls yet — so every current row leaves `mapping` undefined and the legacy normalisation\n // below runs verbatim) routes each field through its configured path via\n // `resolveScimAttributePath`. Email additionally falls back to the legacy chain (userName →\n // primary email → first email) whenever the mapped path yields nothing, so a directory that\n // omits the mapped email attribute still provisions.\n let email = mapping?.email ? (resolveScimAttributePath(body, mapping.email) ?? '') : '';\n if (!email) {\n email = userName \|\| '';\n if (!email && emails?.length) {\n const primary = emails.find(e => e.primary);\n email = primary?.value \|\| emails[0]?.value \|\| '';\n }\n }\n\n const firstName = mapping?.firstName ? resolveScimAttributePath(body, mapping.firstName) : name?.givenName;\n const lastName = mapping?.lastName ? resolveScimAttributePath(body, mapping.lastName) : name?.familyName;\n const displayName = mapping?.displayName\n ? resolveScimAttributePath(body, mapping.displayName)\n : (body.displayName as string \| undefined);\n\n return {\n // SCIM robustness: `externalId` is OPTIONAL per RFC 7643 §4.1.1, but the identity link keys on\n // `providerUserId` (`USER_IDENTITY_LINKS.providerUserId` is `.min(1)`), so a directory that omits\n // `externalId` used to fail `createIdentityLink`'s validation and 400 the WHOLE provision (opaque\n // \"Server error\"). Fall back to the (already-resolved, D8-unique) email — the identifier the\n // directory DID send as `userName` — so an externalId-less SCIM client still provisions cleanly\n // and the link keeps a stable, idempotent key. If neither `externalId` nor an email is present\n // this stays empty, but the caller (`_handleCreateUser`) rejects that earlier with a precise\n // \"userName (email) is required\" 400, so `createIdentityLink` never sees an empty key.\n providerUserId: (body.externalId as string) \|\| email.toLowerCase(),\n email: email.toLowerCase(),\n // SCIM-provisioned users are IdP-trusted, so their email is treated as verified. Honoring\n // `autoVerifyEmail=false` (create PENDING_VERIFICATION + drive email verification) needs the\n // verification-completion flow wired for IdP-pushed users — tracked as AUTH-21, deliberately\n // not half-shipped here (a PENDING_VERIFICATION SCIM user with no verification email is stuck).\n emailVerified: true,\n firstName,\n lastName,\n displayName: displayName \|\| undefined,\n rawClaims: body,\n };\n }\n\n private _buildSCIMConnection(ctx: SCIMRequestContext): ProvisioningConnectionContext {\n // Identity only. Provisioning settings are deliberately omitted: SCIM's config is assembled\n // independently by `_getProvisioningConfig` (SCIM config row + SSO-derived domains) and passed\n // to `provisionEnterpriseUser` as a separate argument. Hardcoding hints here would be inert, misleading\n // duplication (a stub `allowedDomains: []` in particular reads as \"unrestricted\").\n return {\n source: ExternalIdentitySource.SCIM,\n providerRef: 'scim',\n displayName: 'SCIM Directory Provisioning',\n scope: buildEnterpriseConnectionScope(\n AuthScopeType.ORGANIZATION,\n ctx.organizationId,\n `scim:${ctx.tokenId}`,\n ),\n };\n }\n\n // ═══════════════════════════════════════════════════════════════\n // User Lookup Helpers\n // ═══════════════════════════════════════════════════════════════\n\n private async _findUserInOrg(ec: ExecutionContext<any>, userId: string, organizationId: string): Promise<User \| null> {\n try {\n // Verify user exists\n const user = await this.servicesRegistryHandler.read<User>(CoreResourceType.USERS, ec, { _id: userId });\n if (!user) return null;\n\n const membership = await this.servicesRegistryHandler.read(CoreResourceType.ORGANIZATION_MEMBERS, ec, { userId, organizationId });\n if (!membership) return null;\n\n return user;\n } catch {\n return null;\n }\n }\n\n private async _getUserProfile(ec: ExecutionContext<any>, userId: string): Promise<{ firstName?: string; lastName?: string; displayName?: string; avatarUrl?: string } \| null> {\n try {\n const profile = await this.servicesRegistryHandler.read(CoreResourceType.USER_PROFILES, ec, { userId });\n return profile as { firstName?: string; lastName?: string; displayName?: string; avatarUrl?: string } \| null;\n } catch {\n return null;\n }\n }\n\n private async _getUserIdentityLink(ec: ExecutionContext<any>, userId: string, organizationId: string): Promise<{ providerUserId?: string } \| null> {\n try {\n const link = await this.servicesRegistryHandler.read(CoreResourceType.USER_IDENTITY_LINKS, ec, {\n userId,\n connectionType: SsoConnectionType.ENTERPRISE,\n organizationId,\n });\n return link as { providerUserId?: string } \| null;\n } catch {\n return null;\n }\n }\n\n /*\n Assemble the per-org provisioning config the SCIM push path runs against, reading each field\n * from the resource that OWNS it — no duplication, no hardcoded assumptions:\n * - `allowedDomains` from the scope's SSO config (`SsoConfig.domains`, which owns DNS\n * verification) — the DNS-verified subset only (H4). Read live, never copied.\n * - the SCIM channel behaviour (`autoCreateUsers`, `autoVerifyEmail`, `autoDeactivateUsers`,\n * `defaultRole`, `attributeMapping`) from the `ScimProvisioningConfig` row.\n \n Both loads are resilient: a read failure falls back to the historical hardcoded defaults\n * (`autoCreateUsers`/`autoVerifyEmail`/`autoDeactivateUsers` = true, no domain restriction) so a\n * transient config-store blip degrades to \"provision with safe defaults\", never a failed push.\n * Every default here equals the value this method previously hardcoded, so an org that has not\n * customised its SCIM config behaves exactly as before.\n /\n /\n Load the organization's provisioning settings.\n \n Returns the shared `EnterpriseProvisioningConfig` (which SSO JIT also consumes) INTERSECTED with\n * the SCIM-only organization-unit fields, rather than widening the shared type: unit provisioning is\n * a SCIM channel concern, and adding it to the type SSO JIT reads would advertise a capability that\n * path does not implement.\n /\n private async _getProvisioningConfig(\n ec: ExecutionContext<any>,\n organizationId: string,\n ): Promise<EnterpriseProvisioningConfig & ScimOrganizationUnitManagementSignal> {\n let allowedDomains: string[] = [];\n try {\n const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, AuthScopeType.ORGANIZATION, organizationId);\n if (ssoConfig) {\n // Only include domains that have passed DNS verification (H4)\n allowedDomains = ssoConfig.domains.verifiedDomains.filter(\n d => ssoConfig.domains.domainVerificationStatus[d] === 'verified',\n );\n }\n } catch {\n this.logDebug('Failed to load org SSO config for SCIM provisioning (non-fatal)', { organizationId });\n }\n\n let scimConfig: ScimProvisioningConfigBase \| null = null;\n try {\n scimConfig = await this.orgConfigService.loadScimProvisioningConfig(ec, AuthScopeType.ORGANIZATION, organizationId);\n } catch {\n this.logDebug('Failed to load SCIM provisioning config (non-fatal — using defaults)', { organizationId });\n }\n\n return {\n autoCreateUsers: scimConfig?.autoCreateUsers ?? true,\n autoVerifyEmail: scimConfig?.autoVerifyEmail ?? true,\n autoDeactivateUsers: scimConfig?.autoDeactivateUsers ?? true,\n defaultRole: scimConfig?.defaultRole,\n attributeMapping: scimConfig?.attributeMapping,\n allowedDomains,\n // Organization-unit provisioning (WS-C). Carried on the SAME config read rather than fetched\n // separately, so a push that manages units costs no extra round-trip. Undefined on both fields\n // means the organization never opted in, which `_syncOrganizationUnitAssignments` treats as\n // \"SCIM does not manage units here\" — and therefore never deletes anything.\n organizationUnitMapping: scimConfig?.organizationUnitMapping,\n defaultUnitRole: scimConfig?.defaultUnitRole,\n };\n }\n\n /\n Make the member's organization-unit assignments match what the directory just pushed.\n \n assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — the directory is the authority for unit\n * membership, and unit membership is an authorization grant.\n \n ## Opt-in, and what \"authoritative\" costs\n \n Runs ONLY when the organization declared both a `organizationUnitMapping` and a `defaultUnitRole`.\n * That gate is load-bearing: reconciliation REPLACES the member's assignments with exactly what the\n * directory says, so without it a push from an organization that never configured units would delete\n * every assignment an admin had made by hand.\n \n Within an opted-in organization that replacement is the point — a user who moves from Sales to\n * Legal LOSES Sales. Access that only ever accumulates is how an offboarded department is never\n * actually left.\n \n ## Failure PROPAGATES\n \n A sync failure fails the SCIM request rather than being swallowed. The alternative leaves the\n * directory and the live grants diverged with no signal — and since assignments are authorization,\n * that divergence is silent over- or under-privilege. Failing loudly makes the IdP retry, and the\n * reconciliation is idempotent so a retry converges.\n */\n private async _syncOrganizationUnitAssignments(\n ec: ExecutionContext<any>,\n userId: string,\n organizationId: string,\n body: unknown,\n config: EnterpriseProvisioningConfig & ScimOrganizationUnitManagementSignal,\n ): Promise<void> {\n if (!isScimOrganizationUnitManagementEnabled(config)) return;\n\n const membership = await this.servicesRegistryHandler.read<{ _id: string }>(\n CoreResourceType.ORGANIZATION_MEMBERS, ec, { userId, organizationId },\n );\n if (!membership?._id) return;\n\n const directoryValue = extractScimDirectoryUnitValue(body);\n const desiredUnitId = resolveScimOrganizationUnitId(directoryValue, config.organizationUnitMapping);\n\n const currentAssignments = await this.servicesRegistryHandler.list<ScimOrganizationUnitAssignment>(\n CoreResourceType.ORGANIZATION_UNIT_MEMBERS, ec, { organizationMemberId: membership._id },\n undefined, { paginated: false },\n ) as ScimOrganizationUnitAssignment[];\n\n const { unitIdsToCreate, assignmentIdsToRemove } = resolveScimOrganizationUnitReconciliation(\n desiredUnitId ? [desiredUnitId] : [],\n currentAssignments ?? [],\n );\n\n if (unitIdsToCreate.length === 0 && assignmentIdsToRemove.length === 0) return;\n\n for (const assignmentId of assignmentIdsToRemove) {\n await this.servicesRegistryHandler.delete(CoreResourceType.ORGANIZATION_UNIT_MEMBERS, ec, assignmentId);\n }\n for (const organizationUnitId of unitIdsToCreate) {\n await this.servicesRegistryHandler.create(CoreResourceType.ORGANIZATION_UNIT_MEMBERS, ec, {\n organizationId,\n organizationUnitId,\n organizationMemberId: membership._id,\n role: config.defaultUnitRole,\n });\n }\n\n this._logSCIMOperation('organization_units_synced', {\n organizationId,\n userId,\n directoryValue,\n // An unmapped directory value is reported explicitly: it is the difference between \"the\n // directory said nothing\" and \"the directory said something nobody bound to a unit\", and only\n // the second is a configuration gap worth chasing.\n resolvedToUnit: desiredUnitId ?? null,\n unitsAssigned: unitIdsToCreate.length,\n assignmentsRemoved: assignmentIdsToRemove.length,\n });\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Structured Logging (Step 21)\n // ═══════════════════════════════════════════════════════════════\n\n private _logSCIMOperation(operation: string, context: Record<string, unknown>): void {\n this.logDebug(`SCIM: ${operation}`, {\n scimOperation: operation,\n ...context,\n });\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Error Handling\n // ═══════════════════════════════════════════════════════════════\n\n private _handleSCIMError(res: Response, error: unknown, operation: string): void {\n this._logSCIMOperation(`${operation}_error`, { error: describeCaughtError(error) });\n\n if (isWildoBackendError(error)) {\n const wildoError = error as { statusCode?: number; type?: string; message?: string };\n const status = wildoError.statusCode \|\| 500;\n\n // Map common errors to SCIM-specific responses\n if (status === 409 \|\| wildoError.type === 'uniqueness') {\n res.status(409).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(409, 'User already exists', 'uniqueness')\n );\n return;\n }\n if (status === 404) {\n res.status(404).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(404, wildoError.message \|\| 'Resource not found')\n );\n return;\n }\n\n res.status(status).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(status, wildoError.message \|\| 'Server error')\n );\n return;\n }\n\n res.status(500).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(500, 'Internal server error')\n );\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Utilities\n // ═══════════════════════════════════════════════════════════════\n\n private _hashToken(plainToken: string): string {\n return createHash('sha256').update(plainToken).digest('hex');\n }\n\n private async _isScimProvisioningEnabledForOrg(ec: ExecutionContext<any>, organizationId: string): Promise<boolean> {\n if (!this.appConfigService.isInitialized()) return true;\n\n type OrgTypeWithScim = { scimProvisioning?: { enabled: boolean; syncFrequencyHours?: number } };\n const organizationTypes = (this.appConfigService.config as { organizationTypes?: Record<string, OrgTypeWithScim> })?.organizationTypes;\n\n try {\n return await isScimProvisioningEnabledForOrg(ec, {\n organizationId,\n organizationTypes,\n servicesRegistryHandler: this.servicesRegistryHandler,\n });\n } catch {\n return true;\n }\n }\n\n private _getSCIMContext(req: Request): SCIMRequestContext {\n return (req as SCIMAuthenticatedRequest).scimContext;\n }\n\n private _getBaseUrl(req: Request): string {\n const proto = req.headers[WildoHeaderKeys.FORWARDED_PROTO];\n const protocol = (Array.isArray(proto) ? proto[0] : proto) \|\| req.protocol \|\| 'https';\n const h = req.headers[WildoHeaderKeys.FORWARDED_HOST] \|\| req.headers.host;\n const host = (Array.isArray(h) ? h[0] : h) \|\| 'localhost';\n return `${protocol}://${host}/api/v1/scim/v2`;\n }\n\n private async _getInternalExecutionContext(): Promise<ExecutionContext<any>> {\n return this.authEcFactory.createForSystemAuthOperation(this.authEcFactory.getUsersCreateOperationPath());\n }\n}\n\n// ═══════════════════════════════════════════════════════════════\n// Request Context Types\n// ═══════════════════════════════════════════════════════════════\n\ninterface SCIMRequestContext {\n organizationId: string;\n scopeType: AuthScopeType;\n scopeId: string;\n tokenId: string;\n tokenDisplayName: string;\n}\n\ninterface SCIMAuthenticatedRequest extends Request {\n scimContext: SCIMRequestContext;\n scimEc: ExecutionContext<any>;\n}\n"]}
1	+ {"version":3,"file":"scim.backend.controller.js","sourceRoot":"","sources":["../../../../../../src/security/scim/controllers/scim.backend.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAGvG,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,wCAAwC,EAAE,MAAM,gHAAgH,CAAC;AAC1K,OAAO,EAAE,8BAA8B,EAAE,MAAM,mFAAmF,CAAC;AAGnI,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAC5I,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,UAAU,EACV,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAC7H,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,iBAAiB,EACjB,8BAA8B,EAC9B,2BAA2B,EAC3B,mBAAmB,EACnB,6BAA6B,GAI9B,MAAM,uEAAuE,CAAC;AAC/E,OAAO,EACL,uCAAuC,EACvC,6BAA6B,EAC7B,yCAAyC,GAC1C,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EAAE,eAAe,EAAE,MAAM,2DAA2D,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,gEAAgE,CAAC;AACrI,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AAExG,OAAO,EAAE,+BAA+B,EAAE,MAAM,gFAAgF,CAAC;AAI1H,IAAM,4BAA4B,GAAlC,MAAM,4BAA6B,SAAQ,gCAAgC;IAWF;IACH;IACM;IACjB;IACoB;IACb;IACP;IAIG;IApBnE,yEAAyE;IACzE,sEAAsE;IACtE,wEAAwE;IACxE,mEAAmE;IACnE,4DAA4D;IAE5D,YACqC,MAAqB,EACR,YAAwC,EACxC,YAAiC,EACL,uBAA8D,EACjE,aAAwD,EAClD,mBAA6D,EAC9E,gBAAyC,EACrB,gBAAsD,EACnE,gBAAyC,EAChD,gBAAyC,EAItC,mBAA+C;QAEhH,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;QAZgB,4BAAuB,GAAvB,uBAAuB,CAAuC;QACjE,kBAAa,GAAb,aAAa,CAA2C;QAClD,wBAAmB,GAAnB,mBAAmB,CAA0C;QAC9E,qBAAgB,GAAhB,gBAAgB,CAAyB;QACrB,qBAAgB,GAAhB,gBAAgB,CAAsC;QACnE,qBAAgB,GAAhB,gBAAgB,CAAyB;QAChD,qBAAgB,GAAhB,gBAAgB,CAAyB;QAItC,wBAAmB,GAAnB,mBAAmB,CAA4B;IAGlH,CAAC;IAED,kEAAkE;IAClE,cAAc;IACd,kEAAkE;IAExD,WAAW;QACnB,wFAAwF;QACxF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gCAAgC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnH,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,gCAAgC,EAAE,4BAA4B,CAAC,CAAC;QAEjG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC;QAErE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,wBAAwB,EAAE,oBAAoB,CAAC,CAAC;QAEjF,iDAAiD;QACjD,MAAM,cAAc,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEjE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAExE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QAEtE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,EAAE,eAAe,CAAC,CAAC;QAExE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7G,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;QAE5E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7G,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;QAE5E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/G,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;QAE9E,4BAA4B;QAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClG,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,eAAe,EAAE,sBAAsB,CAAC,CAAC;IAC7E,CAAC;IAED,kEAAkE;IAClE,+BAA+B;IAC/B,kEAAkE;IAE1D,KAAK,CAAC,yBAAyB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACrF,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,uBAAuB,EAAE,cAAc,CAAC,CAC9D,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,uBAAuB,EAAE,cAAc,CAAC,CAC9D,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAE9C,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,4BAA4B,EAAE,CAAC;YACrD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAA6C,gBAAgB,CAAC,wBAAwB,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAEhK,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAC7C,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACpB,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;gBACxF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAC/C,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC9D,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;gBACvF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAC1C,CAAC;gBACF,OAAO;YACT,CAAC;YAED,sEAAsE;YACtE,qEAAqE;YACrE,kEAAkE;YAClE,mEAAmE;YACnE,iEAAiE;YACjE,gEAAgE;YAChE,iEAAiE;YACjE,yDAAyD;YACzD,iEAAiE;YACjE,yDAAyD;YACzD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACrC,GAAG,EACH,GAAG,EACH,EAAE,iBAAiB,EAAE,GAAG,EAAE,EAC1B,YAAY,EACZ,SAAS,EACT,KAAK,CAAC,GAAG,CACV,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,mBAAmB,CAAC,CAAC,CAAC,IAAK,CAAuB,CAAC,IAAI,KAAK,SAAS,CAAC,UAAU,EAAE,CAAC;oBACrF,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;oBACrG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,uCAAuC,EAAE,SAAS,CAAC,CACzE,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,CAAC;YACV,CAAC;YAED,uEAAuE;YACtE,GAAgC,CAAC,WAAW,GAAG;gBAC9C,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,SAAS,EAAE,aAAa,CAAC,YAAY;gBACrC,OAAO,EAAE,KAAK,CAAC,cAAc;gBAC7B,OAAO,EAAE,KAAK,CAAC,GAAG;gBAClB,gBAAgB,EAAE,KAAK,CAAC,WAAW;aACpC,CAAC;YACD,GAAgC,CAAC,MAAM,GAAG,EAAE,CAAC;YAE9C,mEAAmE;YACnE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gCAAgC,CAAC,EAAE,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;YAC1F,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,IAAI,CAAC,iBAAiB,CAAC,4BAA4B,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;gBAC/F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,6DAA6D,EAAE,cAAc,CAAC,CACpG,CAAC;gBACF,OAAO;YACT,CAAC;YAED,qDAAqD;YACrD,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,wBAAwB,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBACnI,gEAAgE;YAClE,CAAC,CAAC,CAAC;YAEH,MAAM,OAAO,GAAI,GAAgC,CAAC,WAAW,CAAC;YAC9D,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE;gBACrC,OAAO,EAAE,KAAK,CAAC,GAAG;gBAClB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAC;YAEH,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,+BAA+B,CAAC,CACtD,CAAC;gBACF,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAC9C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,sBAAsB;IACtB,kEAAkE;IAE1D,KAAK,CAAC,4BAA4B,CAAC,IAAa,EAAE,GAAa;QACrE;;;;;;WAMG;QACH,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE;YAC7D,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,iBAAiB;YACtD,CAAC,CAAC,SAAS,CAAC;QAEd,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC;aACrD,IAAI,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAAa,EAAE,GAAa;QACvD,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC;YAC5D,OAAO,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC;YACrC,YAAY,EAAE,CAAC;YACf,UAAU,EAAE,CAAC;YACb,YAAY,EAAE,CAAC;YACf,SAAS,EAAE,CAAC,2BAA2B,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,IAAa,EAAE,GAAa;QAC7D,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC;YAC5D,OAAO,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC;YACrC,YAAY,EAAE,mBAAmB,CAAC,MAAM;YACxC,UAAU,EAAE,CAAC;YACb,YAAY,EAAE,mBAAmB,CAAC,MAAM;YACxC,SAAS,EAAE,mBAAmB;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAClE,oCAAoC;IACpC,kEAAkE;IAE1D,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAEtB,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAEpJ,0FAA0F;QAC1F,wFAAwF;QACxF,MAAM,EAAE,GAAI,GAAgC,CAAC,MAAM,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,8BAA8B,EAAE,cAAc,CAAC,CACrE,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAElD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;YAEtG,+FAA+F;YAC/F,8FAA8F;YAC9F,MAAM,IAAI,CAAC,gCAAgC,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YAEtG,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpE,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAEtF,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE;gBACrC,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;gBACvB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,GAAG,CAAC,OAAO;aACrB,CAAC,CAAC;YAEH,kCAAkC;YAClC,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;gBAC3C,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;gBACvB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,MAAM,CAAC,KAAK;gBACvB,cAAc,EAAE,QAAQ,GAAG,CAAC,gBAAgB,EAAE;gBAC9C,UAAU,EAAE,MAAM;aACnB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAEvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5I,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,oCAAoC;IACpC,kEAAkE;IAE1D,KAAK,CAAC,cAAc,CAAC,GAAY,EAAE,GAAa;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QAEvC,IAAI,CAAC;YACH,MAAM,EAAE,GAAI,GAAgC,CAAC,MAAM,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YAEvE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,QAAQ,MAAM,YAAY,CAAC,CACjD,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACvD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YACrF,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;YAExF,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,6DAA6D;IAC7D,kEAAkE;IAE1D,KAAK,CAAC,gBAAgB,CAAC,GAAY,EAAE,GAAa;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAA4B,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QAErF,IAAI,CAAC;YACH,MAAM,EAAE,GAAI,GAAgC,CAAC,MAAM,CAAC;YACpD,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YAE5C,8CAA8C;YAC9C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACxD,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,EACjF,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CACR,CAAC;YAC1B,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAEtD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACtC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC5G,OAAO;YACT,CAAC;YAED,qCAAqC;YACrC,MAAM,cAAc,GAAG;gBACrB,GAAG,WAAW;gBACd,GAAG,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE;aAC5B,CAAC;YAEF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YACnE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACzD,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,cAAc,EAC1C,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EACtB,EAAE,SAAS,EAAE,IAAI,EAAE,CACe,CAAC;YAErC,MAAM,KAAK,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,EAAE,CAAW,CAAC;YACjD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,EAAE,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YAEjE,mBAAmB;YACnB,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,GAAG,CACzC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;gBACzD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;gBACvF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;YACrE,CAAC,CAAC,CACH,CAAC;YAEF,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YAEtF,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,sDAAsD;IACtD,kEAAkE;IAE1D,KAAK,CAAC,kBAAkB,CAAC,GAAY,EAAE,GAAa;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAEtB,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAE7J,IAAI,CAAC;YACH,MAAM,EAAE,GAAI,GAAgC,CAAC,MAAM,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YAEvE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,QAAQ,MAAM,YAAY,CAAC,CACjD,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAE7E,4BAA4B;YAC5B,MAAM,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,MAAM,EAAE;gBACnD,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,EAAE,SAAS,CAAC,CAAC;YAEd,8BAA8B;YAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACjE,MAAM,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;YAC1F,CAAC;iBAAM,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;gBACrE,uFAAuF;gBACvF,wFAAwF;gBACxF,wFAAwF;gBACxF,iEAAiE;gBACjE,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/G,CAAC;YAED,+FAA+F;YAC/F,+EAA+E;YAC/E,MAAM,IAAI,CAAC,gCAAgC,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YAE7F,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YAC9E,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9D,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YACrF,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,IAAI,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;YAE9G,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAE9J,wCAAwC;YACxC,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBACvC,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,MAAM;gBACN,SAAS,EAAE,SAAS;gBACpB,iBAAiB,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa;aAC7G,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAEvB,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,8DAA8D;IAC9D,kEAAkE;IAE1D,KAAK,CAAC,gBAAgB,CAAC,GAAY,EAAE,GAAa;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAEtB,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAE3J,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,iCAAiC,EAAE,eAAe,CAAC,CACzE,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,GAAI,GAAgC,CAAC,MAAM,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YAEvE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,QAAQ,MAAM,YAAY,CAAC,CACjD,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YAC5E,MAAM,cAAc,GAA2B,EAAE,CAAC;YAClD,IAAI,YAAY,GAAqC,IAAI,CAAC;YAE1D,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAkC,EAAE,CAAC;gBACzD,MAAM,YAAY,GAAG,EAAE,CAAC,EAAE,EAAE,WAAW,EAAkC,CAAC;gBAE1E,IAAI,YAAY,KAAK,KAAK,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;oBACzD,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;wBACZ,0BAA0B;wBAC1B,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC7F,CAAC;yBAAM,IAAI,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;wBACpD,qEAAqE;wBACrE,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAgC,CAAC;wBACrD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;4BAClD,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;wBACpF,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,YAAY,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;oBAChD,MAAM,QAAQ,GAAG,EAAE,CAAC,IAAI,CAAC;oBACzB,MAAM,OAAO,GAAI,uBAAkD,CAAC,QAAQ,CAAC,CAAC;oBAC9E,IAAI,OAAO,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;wBAC5D,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;oBAC/B,CAAC;gBACH,CAAC;YACH,CAAC;YAED,wBAAwB;YACxB,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,MAAM,EAAE,cAAwC,EAAE,SAAS,CAAC,CAAC;YAC5G,CAAC;YAED,sBAAsB;YACtB,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;YAC1F,CAAC;iBAAM,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;gBACvC,2EAA2E;gBAC3E,0EAA0E;gBAC1E,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/G,CAAC;YAED,sBAAsB;YACtB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YAC9E,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9D,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YACrF,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,IAAI,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;YAE9G,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE;gBACrC,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM;gBACN,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM;gBAClC,OAAO,EAAE,GAAG,CAAC,OAAO;aACrB,CAAC,CAAC;YAEH,sCAAsC;YACtC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjD,IAAI,YAAY;gBAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBACvC,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,MAAM;gBACN,SAAS,EAAE,OAAO;gBAClB,iBAAiB,EAAE,YAAY;aAChC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAEvB,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,8CAA8C;IAC9C,kEAAkE;IAE1D,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QAEvC,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAE5J,IAAI,CAAC;YACH,MAAM,EAAE,GAAI,GAAgC,CAAC,MAAM,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YAEvE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,QAAQ,MAAM,YAAY,CAAC,CACjD,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YAC5E,MAAM,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;YAExF,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAEjK,kCAAkC;YAClC,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;gBAC3C,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,MAAM;gBACN,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAEvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,iDAAiD;IACjD,kEAAkE;IAE1D,KAAK,CAAC,WAAW,CAAC,GAAY,EAAE,GAAa;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAuB,CAAC;QAEzC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,wCAAwC,EAAE,eAAe,CAAC,CAChF,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACjC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,gDAAgD,EAAE,SAAS,CAAC,CAClF,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE;YACnC,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM;YACtC,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,CAAC,CAAC;QAEH,MAAM,OAAO,GAAgC,EAAE,CAAC;QAChD,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;QAE5C,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACjC,IAAI,YAAY,GAAG,CAAC,IAAI,UAAU,IAAI,YAAY,EAAE,CAAC;gBACnD,OAAO,CAAC,IAAI,CAAC;oBACX,MAAM,EAAE,EAAE,CAAC,MAAM;oBACjB,MAAM,EAAE,EAAE,CAAC,MAAM;oBACjB,MAAM,EAAE,KAAK;oBACb,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,kDAAkD,CAAC;iBACnF,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;oBACnC,UAAU,EAAE,CAAC;gBACf,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC;oBACX,MAAM,EAAE,EAAE,CAAC,MAAM;oBACjB,MAAM,EAAE,EAAE,CAAC,MAAM;oBACjB,MAAM,EAAE,KAAK;oBACb,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,0CAA0C,CAAC;iBAC3E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE;YACtC,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,eAAe,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM;YACvC,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC;YAC5D,OAAO,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC;YACrC,UAAU,EAAE,OAAO;SACpB,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,EAAoC,EACpC,GAAuB,EACvB,GAAY;QAEZ,MAAM,SAAS,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC;QACjH,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,EAAE,GAAI,GAAgC,CAAC,MAAM,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAEtC,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC;YAClB,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;oBACb,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,uBAAuB,CAAC,EAAE,CAAC;gBACvH,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;gBAChF,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;oBACnB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,mBAAmB,CAAC,EAAE,CAAC;gBACnH,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;gBAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;gBAEtG,uCAAuC;gBACvC,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;oBAC3C,cAAc,EAAE,GAAG,CAAC,cAAc;oBAClC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;oBACvB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,SAAS,EAAE,MAAM,CAAC,KAAK;oBACvB,cAAc,EAAE,aAAa,GAAG,CAAC,gBAAgB,EAAE;oBACnD,UAAU,EAAE,MAAM;iBACnB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAEvB,OAAO;oBACL,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,EAAE,CAAC,MAAM;oBACjB,QAAQ,EAAE,GAAG,OAAO,UAAU,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;oBAC/C,MAAM,EAAE,KAAK;iBACd,CAAC;YACJ,CAAC;YAED,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;oBACxB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,2BAA2B,CAAC,EAAE,CAAC;gBAC1H,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;gBACvE,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,QAAQ,MAAM,YAAY,CAAC,EAAE,CAAC;gBACzH,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;gBACnF,MAAM,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,MAAM,EAAE;oBACnD,SAAS,EAAE,UAAU,CAAC,SAAS;oBAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;oBAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;iBACpC,EAAE,SAAS,CAAC,CAAC;gBAEd,6CAA6C;gBAC7C,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;oBACvC,cAAc,EAAE,GAAG,CAAC,cAAc;oBAClC,MAAM;oBACN,SAAS,EAAE,SAAS;oBACpB,iBAAiB,EAAE,CAAC,SAAS,CAAC;iBAC/B,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAEvB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,UAAU,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACrG,CAAC;YAED,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;oBACxB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,2BAA2B,CAAC,EAAE,CAAC;gBAC5H,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;gBAC5E,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,QAAQ,MAAM,YAAY,CAAC,EAAE,CAAC;gBAC3H,CAAC;gBACD,yCAAyC;gBACzC,MAAM,UAAU,GAAI,EAAE,CAAC,IAAgC,CAAC,UAA8C,CAAC;gBACvG,MAAM,gBAAgB,GAAa,EAAE,CAAC;gBACtC,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,mBAAmB,GAA2B,EAAE,CAAC;oBACvD,IAAI,iBAAiB,GAAqC,IAAI,CAAC;oBAC/D,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;wBACjC,MAAM,YAAY,GAAG,OAAO,CAAC,EAAE,EAAE,WAAW,EAAkC,CAAC;wBAC/E,IAAI,YAAY,KAAK,KAAK,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;4BACzD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gCACjB,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,iBAAiB,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;4BACjH,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,IAAI,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAChD,MAAM,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,MAAM,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAC;oBACvF,CAAC;oBACD,IAAI,iBAAiB,KAAK,YAAY,EAAE,CAAC;wBACvC,MAAM,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;oBAC1F,CAAC;oBACD,gBAAgB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;oBAC3D,IAAI,iBAAiB;wBAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzD,CAAC;gBAED,2CAA2C;gBAC3C,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;oBACvC,cAAc,EAAE,GAAG,CAAC,cAAc;oBAClC,MAAM;oBACN,SAAS,EAAE,OAAO;oBAClB,iBAAiB,EAAE,gBAAgB;iBACpC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAEvB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,UAAU,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACvG,CAAC;YAED,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,kBAAkB,CAAC,EAAE,CAAC;gBACpH,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;gBAC7E,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,QAAQ,MAAM,YAAY,CAAC,EAAE,CAAC;gBAC5H,CAAC;gBACD,MAAM,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;gBAExF,uCAAuC;gBACvC,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;oBAC3C,cAAc,EAAE,GAAG,CAAC,cAAc;oBAClC,MAAM;oBACN,KAAK,EAAE,UAAU,CAAC,KAAK;iBACxB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAEvB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAChE,CAAC;YAED;gBACE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,uBAAuB,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;QACvI,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,gBAAgB;IAChB,kEAAkE;IAE1D,oBAAoB,CAC1B,IAAY,EACZ,KAAc,EACd,cAAsC,EACtC,cAA2D;QAE3D,MAAM,OAAO,GAAG,uBAAiD,CAAC;QAClE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9B,IAAI,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,MAAM,CAAC;YACpD,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,IAAI,OAAO,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACnC,cAAc,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,oCAAoC;IACpC,kEAAkE;IAE1D,qBAAqB,CAAC,IAA6B,EAAE,OAA8B;QACzF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAA8B,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,IAA0C,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAiE,CAAC;QAEtF,8FAA8F;QAC9F,2FAA2F;QAC3F,yEAAyE;QACzE,4FAA4F;QAC5F,4FAA4F;QAC5F,qDAAqD;QACrD,IAAI,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,QAAQ,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBAC5C,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;YACnD,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC;QAC3G,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;QACzG,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW;YACtC,CAAC,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC;YACrD,CAAC,CAAE,IAAI,CAAC,WAAkC,CAAC;QAE7C,OAAO;YACL,+FAA+F;YAC/F,kGAAkG;YAClG,kGAAkG;YAClG,6FAA6F;YAC7F,gGAAgG;YAChG,+FAA+F;YAC/F,6FAA6F;YAC7F,uFAAuF;YACvF,cAAc,EAAG,IAAI,CAAC,UAAqB,IAAI,KAAK,CAAC,WAAW,EAAE;YAClE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;YAC1B,0FAA0F;YAC1F,6FAA6F;YAC7F,6FAA6F;YAC7F,gGAAgG;YAChG,aAAa,EAAE,IAAI;YACnB,SAAS;YACT,QAAQ;YACR,WAAW,EAAE,WAAW,IAAI,SAAS;YACrC,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IAEO,oBAAoB,CAAC,GAAuB;QAClD,4FAA4F;QAC5F,+FAA+F;QAC/F,wGAAwG;QACxG,mFAAmF;QACnF,OAAO;YACL,MAAM,EAAE,sBAAsB,CAAC,IAAI;YACnC,WAAW,EAAE,MAAM;YACnB,WAAW,EAAE,6BAA6B;YAC1C,KAAK,EAAE,8BAA8B,CACnC,aAAa,CAAC,YAAY,EAC1B,GAAG,CAAC,cAAc,EAClB,QAAQ,GAAG,CAAC,OAAO,EAAE,CACtB;SACF,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,sBAAsB;IACtB,kEAAkE;IAE1D,KAAK,CAAC,cAAc,CAAC,EAAyB,EAAE,MAAc,EAAE,cAAsB;QAC5F,IAAI,CAAC;YACH,qBAAqB;YACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YACxG,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAClI,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;YAE7B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,EAAyB,EAAE,MAAc;QACrE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACxG,OAAO,OAAqG,CAAC;QAC/G,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,EAAyB,EAAE,MAAc,EAAE,cAAsB;QAClG,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,EAAE;gBAC7F,MAAM;gBACN,cAAc,EAAE,iBAAiB,CAAC,UAAU;gBAC5C,cAAc;aACf,CAAC,CAAC;YACH,OAAO,IAA0C,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH;;;;;;;OAOG;IACK,KAAK,CAAC,sBAAsB,CAClC,EAAyB,EACzB,cAAsB;QAEtB,IAAI,cAAc,GAAa,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;YAC5G,IAAI,SAAS,EAAE,CAAC;gBACd,0FAA0F;gBAC1F,wFAAwF;gBACxF,cAAc,GAAG,sBAAsB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,iEAAiE,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,IAAI,UAAU,GAAsC,IAAI,CAAC;QACzD,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,EAAE,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QACtH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,sEAAsE,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5G,CAAC;QAED,OAAO;YACL,eAAe,EAAE,UAAU,EAAE,eAAe,IAAI,IAAI;YACpD,eAAe,EAAE,UAAU,EAAE,eAAe,IAAI,IAAI;YACpD,mBAAmB,EAAE,UAAU,EAAE,mBAAmB,IAAI,IAAI;YAC5D,WAAW,EAAE,UAAU,EAAE,WAAW;YACpC,gBAAgB,EAAE,UAAU,EAAE,gBAAgB;YAC9C,cAAc;YACd,6FAA6F;YAC7F,+FAA+F;YAC/F,4FAA4F;YAC5F,4EAA4E;YAC5E,uBAAuB,EAAE,UAAU,EAAE,uBAAuB;YAC5D,eAAe,EAAE,UAAU,EAAE,eAAe;SAC7C,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,KAAK,CAAC,gCAAgC,CAC5C,EAAyB,EACzB,MAAc,EACd,cAAsB,EACtB,IAAa,EACb,MAA2E;QAE3E,IAAI,CAAC,uCAAuC,CAAC,MAAM,CAAC;YAAE,OAAO;QAE7D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACxD,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CACtE,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,GAAG;YAAE,OAAO;QAE7B,MAAM,cAAc,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,6BAA6B,CAAC,cAAc,EAAE,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAEpG,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAChE,gBAAgB,CAAC,yBAAyB,EAAE,EAAE,EAAE,EAAE,oBAAoB,EAAE,UAAU,CAAC,GAAG,EAAE,EACxF,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CACI,CAAC;QAEtC,MAAM,EAAE,eAAe,EAAE,qBAAqB,EAAE,GAAG,yCAAyC,CAC1F,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,EACpC,kBAAkB,IAAI,EAAE,CACzB,CAAC;QAEF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,qBAAqB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE/E,KAAK,MAAM,YAAY,IAAI,qBAAqB,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,yBAAyB,EAAE,EAAE,EAAE,YAAY,CAAC,CAAC;QAC1G,CAAC;QACD,KAAK,MAAM,kBAAkB,IAAI,eAAe,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,yBAAyB,EAAE,EAAE,EAAE;gBACxF,cAAc;gBACd,kBAAkB;gBAClB,oBAAoB,EAAE,UAAU,CAAC,GAAG;gBACpC,IAAI,EAAE,MAAM,CAAC,eAAe;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,2BAA2B,EAAE;YAClD,cAAc;YACd,MAAM;YACN,cAAc;YACd,wFAAwF;YACxF,8FAA8F;YAC9F,mDAAmD;YACnD,cAAc,EAAE,aAAa,IAAI,IAAI;YACrC,aAAa,EAAE,eAAe,CAAC,MAAM;YACrC,kBAAkB,EAAE,qBAAqB,CAAC,MAAM;SACjD,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAClE,+BAA+B;IAC/B,kEAAkE;IAE1D,iBAAiB,CAAC,SAAiB,EAAE,OAAgC;QAC3E,IAAI,CAAC,QAAQ,CAAC,SAAS,SAAS,EAAE,EAAE;YAClC,aAAa,EAAE,SAAS;YACxB,GAAG,OAAO;SACX,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAClE,iBAAiB;IACjB,kEAAkE;IAE1D,gBAAgB,CAAC,GAAa,EAAE,KAAc,EAAE,SAAiB;QACvE,IAAI,CAAC,iBAAiB,CAAC,GAAG,SAAS,QAAQ,EAAE,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAEpF,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,UAAU,GAAG,KAAiE,CAAC;YACrF,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,IAAI,GAAG,CAAC;YAE5C,+CAA+C;YAC/C,IAAI,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACvD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,qBAAqB,EAAE,YAAY,CAAC,CAC1D,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,IAAI,oBAAoB,CAAC,CACjE,CAAC;gBACF,OAAO;YACT,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAC1E,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,IAAI,cAAc,CAAC,CAC9D,CAAC;YACF,OAAO;QACT,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,eAAe,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAC9C,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,YAAY;IACZ,kEAAkE;IAE1D,UAAU,CAAC,UAAkB;QACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IAEO,KAAK,CAAC,gCAAgC,CAAC,EAAyB,EAAE,cAAsB;QAC9F,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE;YAAE,OAAO,IAAI,CAAC;QAGxD,MAAM,iBAAiB,GAAI,IAAI,CAAC,gBAAgB,CAAC,MAAkE,EAAE,iBAAiB,CAAC;QAEvI,IAAI,CAAC;YACH,OAAO,MAAM,+BAA+B,CAAC,EAAE,EAAE;gBAC/C,cAAc;gBACd,iBAAiB;gBACjB,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;aACtD,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,GAAY;QAClC,OAAQ,GAAgC,CAAC,WAAW,CAAC;IACvD,CAAC;IAEO,WAAW,CAAC,GAAY;QAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC;QACtF,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1E,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC;QAC1D,OAAO,GAAG,QAAQ,MAAM,IAAI,iBAAiB,CAAC;IAChD,CAAC;IAEO,KAAK,CAAC,4BAA4B;QACxC,OAAO,IAAI,CAAC,aAAa,CAAC,4BAA4B,CAAC,IAAI,CAAC,aAAa,CAAC,2BAA2B,EAAE,CAAC,CAAC;IAC3G,CAAC;CACF,CAAA;AAtpCY,4BAA4B;IADxC,UAAU,EAAE;IASR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,CAAA;IAC5D,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAC/D,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAClD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAI3C,YAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCAbJ,aAAa;QACM,0BAA0B;QAC1B,mBAAmB,YAEO,yCAAyC;QAC7B,wCAAwC;QAC5D,uBAAuB;QACH,oCAAoC;QACjD,uBAAuB;GAhBrG,4BAA4B,CAspCxC","sourcesContent":["/*\n SCIM 2.0 User Provisioning Controller — Step 20\n \n Receives user lifecycle events from identity providers (Okta, Azure AD, OneLogin)\n * via SCIM 2.0 protocol (RFC 7643 Core Schema, RFC 7644 Protocol).\n \n Decision 13: Lean SCIM — Users only in v1, no Groups, no generic adapter.\n * Critical Note #8: One controller, Users only, future extensions documented in code comments.\n * Critical Note #9: Follows billing's ManualControllersOptions pattern for conditional mounting.\n \n Bearer token auth: extracts token from Authorization header, hashes it,\n * looks up ScimTokenBase, validates isActive/expiresAt,\n * creates ExecutionContext with executionType: ORG_API_KEY.\n \n Reuses EnterpriseUserProvisioningService from Step 15 for:\n * - provisionEnterpriseUser() — user + profile + org member + identity link creation\n * - updateOrgUser() — profile attribute updates\n * - deactivateOrgUser() — set user status to INACTIVE\n /\n\nimport 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { createHash } from 'crypto';\nimport type { Request, Response, NextFunction } from 'express';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ErrorHandlerService } from '~wildo-backend-lib/errors/services/error-handler.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport type { Resources_PaginatedResult } from '@wildo-ai/saas-models';\nimport { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport { EnterpriseUserProvisioningBackendService } from '~wildo-backend-lib/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service';\nimport { buildEnterpriseConnectionScope } from '~wildo-backend-lib/security/authentications/models/sso-connection.backend.schemas';\nimport type { EnterpriseProvisioningConfig } from '~wildo-backend-lib/security/authentications/models/sso-connection.backend.schemas';\nimport type { NormalizedUserProfile, ProvisioningConnectionContext } from '~wildo-backend-lib/security/authentications/models/sso-connection.backend.schemas';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { AbstractControllerBackendService } from '~wildo-backend-lib/base-classes/services/controllers/abstract-controller.backend.service';\nimport {\n resolveVerifiedDomains,\n CoreResourceType,\n UserStatus,\n ErrorType,\n isWildoBackendError,\n AuthScopeType,\n ExternalIdentitySource,\n SsoConnectionType,\n WildoHeaderKeys,\n} from '@wildo-ai/saas-models';\nimport type { User, ScimProvisioningConfigBase, ScimAttributeMapping } from '@wildo-ai/saas-models';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { ScimTokenBase } from '@wildo-ai/saas-models';\nimport { resolveScimAttributePath } from '~wildo-backend-lib/security/scim/utils/scim-attribute-path-resolver.backend.utils';\nimport {\n SCIM_USER_ATTRIBUTE_MAP,\n SCIM_SCHEMAS,\n SCIM_CONTENT_TYPE,\n buildScimServiceProviderConfig,\n SCIM_USER_SCHEMA_DEFINITION,\n SCIM_RESOURCE_TYPES,\n extractScimDirectoryUnitValue,\n type SCIMPatchOperation,\n type SCIMBulkRequest,\n type SCIMBulkOperationResponse,\n} from '~wildo-backend-lib/security/scim/models/scim-protocol.backend.schemas';\nimport {\n isScimOrganizationUnitManagementEnabled,\n resolveScimOrganizationUnitId,\n resolveScimOrganizationUnitReconciliation,\n} from '@wildo-ai/saas-models';\nimport type {\n ScimOrganizationUnitAssignment,\n ScimOrganizationUnitManagementSignal,\n} from '@wildo-ai/saas-models';\nimport { parseSCIMFilter } from '~wildo-backend-lib/security/scim/utils/scim-filter-parser';\nimport { formatUserAsSCIM, formatListAsSCIM, formatSCIMError } from '~wildo-backend-lib/security/scim/utils/scim-response-formatter';\nimport { AuthOrganizationConfigurationService } from '~wildo-backend-lib/security/authentications/services/admin-config/auth-organization-configuration.service';\nimport { RateLimitBackendService } from '~wildo-backend-lib/errors/services/rate-limit.backend.service';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { isScimProvisioningEnabledForOrg } from '~wildo-backend-lib/organizations/services/scim-provisioning-gate.backend.utils';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\n\n@injectable()\nexport class SCIMControllerBackendService extends AbstractControllerBackendService {\n // (Per-token rate-limit constants — 300/min/token — were removed in PR 5\n // of the rate-limit unification: the policy is now declared inline in\n // `_scimBearerAuthMiddleware` via `RateLimitBackendService.checkPolicy`\n // with `clientIdOverride: token._id` for per-token bucketing. Same\n // semantic — no IP, no organizationId — different surface.)\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ErrorHandlerService) errorHandler: ErrorHandlerService,\n @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory) private readonly authEcFactory: AuthExecutionContextFactoryBackendService,\n @inject(SAAS_SERVICE_TYPES.EnterpriseUserProvisioningService) private readonly provisioningService: EnterpriseUserProvisioningBackendService,\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) private readonly auditLogsService: AuditLogsBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService) private readonly orgConfigService: AuthOrganizationConfigurationService,\n @inject(SAAS_SERVICE_TYPES.RateLimitBackendService) private readonly rateLimitService: RateLimitBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n // Directory-driven re-activation writes `User.status`, which is `.excludeFromUpdate()` — the\n // client-facing contract cannot carry it, so the write goes through the trusted system door.\n // Appended LAST to keep positional construction in existing tests stable.\n @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n ) {\n super(logger, errorBuilder, errorHandler, 'SCIMController');\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Route Setup\n // ═══════════════════════════════════════════════════════════════\n\n protected setupRoutes(): void {\n // SCIM Discovery endpoints (no auth required for ServiceProviderConfig per RFC 7644 §4)\n this.router.get('/scim/v2/ServiceProviderConfig', this.asyncHandler(this._handleServiceProviderConfig.bind(this)));\n this.logRouteRegistration('GET', '/scim/v2/ServiceProviderConfig', 'SCIM ServiceProviderConfig');\n\n this.router.get('/scim/v2/Schemas', this.asyncHandler(this._handleSchemas.bind(this)));\n this.logRouteRegistration('GET', '/scim/v2/Schemas', 'SCIM Schemas');\n\n this.router.get('/scim/v2/ResourceTypes', this.asyncHandler(this._handleResourceTypes.bind(this)));\n this.logRouteRegistration('GET', '/scim/v2/ResourceTypes', 'SCIM ResourceTypes');\n\n // All /Users endpoints require bearer token auth\n const authMiddleware = this._scimBearerAuthMiddleware.bind(this);\n\n this.router.post('/scim/v2/Users', authMiddleware, this.asyncHandler(this._handleCreateUser.bind(this)));\n this.logRouteRegistration('POST', '/scim/v2/Users', 'SCIM Create User');\n\n this.router.get('/scim/v2/Users', authMiddleware, this.asyncHandler(this._handleListUsers.bind(this)));\n this.logRouteRegistration('GET', '/scim/v2/Users', 'SCIM List Users');\n\n this.router.get('/scim/v2/Users/:id', authMiddleware, this.asyncHandler(this._handleGetUser.bind(this)));\n this.logRouteRegistration('GET', '/scim/v2/Users/:id', 'SCIM Get User');\n\n this.router.put('/scim/v2/Users/:id', authMiddleware, this.asyncHandler(this._handleReplaceUser.bind(this)));\n this.logRouteRegistration('PUT', '/scim/v2/Users/:id', 'SCIM Replace User');\n\n this.router.patch('/scim/v2/Users/:id', authMiddleware, this.asyncHandler(this._handlePatchUser.bind(this)));\n this.logRouteRegistration('PATCH', '/scim/v2/Users/:id', 'SCIM Patch User');\n\n this.router.delete('/scim/v2/Users/:id', authMiddleware, this.asyncHandler(this._handleDeleteUser.bind(this)));\n this.logRouteRegistration('DELETE', '/scim/v2/Users/:id', 'SCIM Delete User');\n\n // Bulk operations (Step 21)\n this.router.post('/scim/v2/Bulk', authMiddleware, this.asyncHandler(this._handleBulk.bind(this)));\n this.logRouteRegistration('POST', '/scim/v2/Bulk', 'SCIM Bulk Operations');\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Bearer Token Auth Middleware\n // ═══════════════════════════════════════════════════════════════\n\n private async _scimBearerAuthMiddleware(req: Request, res: Response, next: NextFunction): Promise<void> {\n const authHeader = req.headers[WildoHeaderKeys.AUTHORIZATION];\n if (!authHeader \|\| !authHeader.startsWith('Bearer ')) {\n res.status(401).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(401, 'Bearer token required', 'invalidValue')\n );\n return;\n }\n\n const plainToken = authHeader.substring(7);\n if (!plainToken) {\n res.status(401).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(401, 'Bearer token is empty', 'invalidValue')\n );\n return;\n }\n\n const tokenHash = this._hashToken(plainToken);\n\n try {\n const ec = await this._getInternalExecutionContext();\n const token = await this.servicesRegistryHandler.read<ScimTokenBase & { organizationId: string }>(CoreResourceType.ORGANIZATION_SCIM_TOKENS, ec, { tokenHash });\n\n if (!token) {\n this._logSCIMOperation('auth_failed', { reason: 'token_not_found' });\n res.status(401).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(401, 'Invalid bearer token')\n );\n return;\n }\n\n if (!token.isActive) {\n this._logSCIMOperation('auth_failed', { reason: 'token_inactive', tokenId: token._id });\n res.status(401).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(401, 'Token has been revoked')\n );\n return;\n }\n\n if (token.expiresAt && new Date(token.expiresAt) < new Date()) {\n this._logSCIMOperation('auth_failed', { reason: 'token_expired', tokenId: token._id });\n res.status(401).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(401, 'Token has expired')\n );\n return;\n }\n\n // Per-token rate limiting (PR 5 of the rate-limit unification, Step 5\n // — second imperative-to-declarative migration wave). 300/min/token,\n // keyed on the token id (NOT the IP — IP rotation must not let an\n // attacker sidestep a per-token quota; the token IS the subject of\n // the quota). Standard `X-RateLimit-` and `Retry-After` headers\n // are now written by `checkPolicy` BEFORE the throw, so they're\n // preserved on the SCIM 429 response below (previously absent at\n // this seam — IdP retry logic had to guess backoff). The\n // try/catch stays because SCIM has its own RFC 7644 error format\n // (the underlying `RATE_LIMIT` error type is unchanged).\n try {\n await this.rateLimitService.checkPolicy(\n req,\n res,\n { requestsPerMinute: 300 },\n 'scim:token',\n undefined,\n token._id,\n );\n } catch (e) {\n if (isWildoBackendError(e) && (e as { type?: string }).type === ErrorType.RATE_LIMIT) {\n this._logSCIMOperation('rate_limited', { tokenId: token._id, organizationId: token.organizationId });\n res.status(429).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(429, 'Rate limit exceeded. Try again later.', 'tooMany')\n );\n return;\n }\n throw e;\n }\n\n // Attach org + scope context and EC to request for downstream handlers\n (req as SCIMAuthenticatedRequest).scimContext = {\n organizationId: token.organizationId,\n scopeType: AuthScopeType.ORGANIZATION,\n scopeId: token.organizationId,\n tokenId: token._id,\n tokenDisplayName: token.displayName,\n };\n (req as SCIMAuthenticatedRequest).scimEc = ec;\n\n // W5.10: Check if SCIM provisioning is enabled for this org's type\n const scimEnabled = await this._isScimProvisioningEnabledForOrg(ec, token.organizationId);\n if (!scimEnabled) {\n this._logSCIMOperation('scim_disabled_for_org_type', { organizationId: token.organizationId });\n res.status(403).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(403, 'SCIM provisioning is not enabled for this organization type', 'invalidValue')\n );\n return;\n }\n\n // Update lastUsedAt asynchronously (fire-and-forget)\n this.servicesRegistryHandler.update(CoreResourceType.ORGANIZATION_SCIM_TOKENS, ec, token._id, { lastUsedAt: new Date() }).catch(() => {\n // Non-fatal — don't fail the request if lastUsedAt update fails\n });\n\n const scimCtx = (req as SCIMAuthenticatedRequest).scimContext;\n this._logSCIMOperation('auth_success', {\n tokenId: token._id,\n organizationId: token.organizationId,\n scopeType: scimCtx.scopeType,\n scopeId: scimCtx.scopeId,\n method: req.method,\n path: req.path,\n });\n\n next();\n } catch (error) {\n if (isWildoBackendError(error)) {\n res.status(500).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(500, 'Internal authentication error')\n );\n return;\n }\n res.status(500).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(500, 'Internal server error')\n );\n }\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Discovery Endpoints\n // ═══════════════════════════════════════════════════════════════\n\n private async _handleServiceProviderConfig(_req: Request, res: Response): Promise<void> {\n /\n The two documentation URLs come from the application (`auth.scimDocumentation`) and are\n * OMITTED when it declares none — see `buildScimServiceProviderConfig`. Read through\n * `isInitialized()` because this is a public discovery endpoint: it must answer with the\n * implementation's own facts even on a runtime whose configuration has not landed, rather than\n * throw and leave a directory administrator with a 500 where the RFC promises a document.\n /\n const scimDocumentation = this.appConfigService.isInitialized()\n ? this.appConfigService.config.auth?.scimDocumentation\n : undefined;\n\n res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE)\n .json(buildScimServiceProviderConfig(scimDocumentation));\n }\n\n private async _handleSchemas(_req: Request, res: Response): Promise<void> {\n res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json({\n schemas: [SCIM_SCHEMAS.LIST_RESPONSE],\n totalResults: 1,\n startIndex: 1,\n itemsPerPage: 1,\n Resources: [SCIM_USER_SCHEMA_DEFINITION],\n });\n }\n\n private async _handleResourceTypes(_req: Request, res: Response): Promise<void> {\n res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json({\n schemas: [SCIM_SCHEMAS.LIST_RESPONSE],\n totalResults: SCIM_RESOURCE_TYPES.length,\n startIndex: 1,\n itemsPerPage: SCIM_RESOURCE_TYPES.length,\n Resources: SCIM_RESOURCE_TYPES,\n });\n }\n\n // ═══════════════════════════════════════════════════════════════\n // POST /scim/v2/Users — Create User\n // ═══════════════════════════════════════════════════════════════\n\n private async _handleCreateUser(req: Request, res: Response): Promise<void> {\n const ctx = this._getSCIMContext(req);\n const body = req.body;\n\n this._logSCIMOperation('create_user', { organizationId: ctx.organizationId, scopeType: ctx.scopeType, scopeId: ctx.scopeId, tokenId: ctx.tokenId });\n\n // Config first — its `attributeMapping` drives how the body is normalised into a profile.\n // `_getProvisioningConfig` is resilient (never throws), so this is safe before the try.\n const ec = (req as SCIMAuthenticatedRequest).scimEc;\n const orgConfig = await this._getProvisioningConfig(ec, ctx.organizationId);\n const profile = this._mapSCIMBodyToProfile(body, orgConfig.attributeMapping);\n if (!profile.email) {\n res.status(400).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(400, 'userName (email) is required', 'invalidValue')\n );\n return;\n }\n\n try {\n const connection = this._buildSCIMConnection(ctx);\n\n const result = await this.provisioningService.provisionEnterpriseUser(profile, connection, orgConfig);\n\n // WS-C: bind the directory's department to an organization unit. Runs BEFORE the response so a\n // failure surfaces as a SCIM error the IdP retries, rather than a 201 hiding diverged grants.\n await this._syncOrganizationUnitAssignments(ec, result.user._id, ctx.organizationId, body, orgConfig);\n\n const userProfile = await this._getUserProfile(ec, result.user._id);\n const baseUrl = this._getBaseUrl(req);\n const scimUser = formatUserAsSCIM(result.user, userProfile, baseUrl, body.externalId);\n\n this._logSCIMOperation('user_created', {\n organizationId: ctx.organizationId,\n scopeType: ctx.scopeType,\n scopeId: ctx.scopeId,\n userId: result.user._id,\n isNew: result.isNew,\n tokenId: ctx.tokenId,\n });\n\n // H8: Audit SCIM user provisioned\n this.auditLogsService.logSCIMUserProvisioned({\n organizationId: ctx.organizationId,\n userId: result.user._id,\n email: profile.email,\n isNewUser: result.isNew,\n provisionedVia: `scim:${ctx.tokenDisplayName}`,\n authSource: 'scim',\n }, ec).catch(() => {});\n\n res.status(201).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).set(WildoHeaderKeys.LOCATION, scimUser.meta.location).json(scimUser);\n } catch (error) {\n this._handleSCIMError(res, error, 'create_user');\n }\n }\n\n // ═══════════════════════════════════════════════════════════════\n // GET /scim/v2/Users/:id — Get User\n // ═══════════════════════════════════════════════════════════════\n\n private async _handleGetUser(req: Request, res: Response): Promise<void> {\n const ctx = this._getSCIMContext(req);\n const userId = req.params.id as string;\n\n try {\n const ec = (req as SCIMAuthenticatedRequest).scimEc;\n const user = await this._findUserInOrg(ec, userId, ctx.organizationId);\n\n if (!user) {\n res.status(404).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(404, `User ${userId} not found`)\n );\n return;\n }\n\n const profile = await this._getUserProfile(ec, userId);\n const identityLink = await this._getUserIdentityLink(ec, userId, ctx.organizationId);\n const baseUrl = this._getBaseUrl(req);\n const scimUser = formatUserAsSCIM(user, profile, baseUrl, identityLink?.providerUserId);\n\n res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(scimUser);\n } catch (error) {\n this._handleSCIMError(res, error, 'get_user');\n }\n }\n\n // ═══════════════════════════════════════════════════════════════\n // GET /scim/v2/Users — List Users (with filter + pagination)\n // ═══════════════════════════════════════════════════════════════\n\n private async _handleListUsers(req: Request, res: Response): Promise<void> {\n const ctx = this._getSCIMContext(req);\n const filter = req.query.filter as string \| undefined;\n const startIndex = Math.max(1, parseInt(req.query.startIndex as string) \|\| 1);\n const count = Math.min(200, Math.max(1, parseInt(req.query.count as string) \|\| 100));\n\n try {\n const ec = (req as SCIMAuthenticatedRequest).scimEc;\n const mongoFilter = parseSCIMFilter(filter);\n\n // Scope to organization via org member lookup\n const orgMembers = await this.servicesRegistryHandler.list<{ userId: string }>(\n CoreResourceType.ORGANIZATION_MEMBERS, ec, { organizationId: ctx.organizationId },\n undefined, { paginated: false },\n ) as { userId: string }[];\n const memberUserIds = orgMembers.map((m) => m.userId);\n\n if (memberUserIds.length === 0) {\n const baseUrl = this._getBaseUrl(req);\n res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(formatListAsSCIM([], 0, startIndex, baseUrl));\n return;\n }\n\n // Combine SCIM filter with org scope\n const combinedFilter = {\n ...mongoFilter,\n _id: { $in: memberUserIds },\n };\n\n const page = Math.max(1, Math.floor((startIndex - 1) / count) + 1);\n const usersResult = await this.servicesRegistryHandler.list<User>(\n CoreResourceType.USERS, ec, combinedFilter,\n { page, limit: count },\n { paginated: true },\n ) as Resources_PaginatedResult<User>;\n\n const users = (usersResult.data \|\| []) as User[];\n const totalCount = usersResult.pagination?.total ?? users.length;\n\n // Hydrate profiles\n const usersWithProfiles = await Promise.all(\n users.map(async (user) => {\n const profile = await this._getUserProfile(ec, user._id);\n const identityLink = await this._getUserIdentityLink(ec, user._id, ctx.organizationId);\n return { user, profile, externalId: identityLink?.providerUserId };\n })\n );\n\n const baseUrl = this._getBaseUrl(req);\n const response = formatListAsSCIM(usersWithProfiles, totalCount, startIndex, baseUrl);\n\n res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(response);\n } catch (error) {\n this._handleSCIMError(res, error, 'list_users');\n }\n }\n\n // ═══════════════════════════════════════════════════════════════\n // PUT /scim/v2/Users/:id — Replace User (full update)\n // ═══════════════════════════════════════════════════════════════\n\n private async _handleReplaceUser(req: Request, res: Response): Promise<void> {\n const ctx = this._getSCIMContext(req);\n const userId = req.params.id as string;\n const body = req.body;\n\n this._logSCIMOperation('replace_user', { organizationId: ctx.organizationId, scopeType: ctx.scopeType, scopeId: ctx.scopeId, userId, tokenId: ctx.tokenId });\n\n try {\n const ec = (req as SCIMAuthenticatedRequest).scimEc;\n const user = await this._findUserInOrg(ec, userId, ctx.organizationId);\n\n if (!user) {\n res.status(404).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(404, `User ${userId} not found`)\n );\n return;\n }\n\n const orgConfig = await this._getProvisioningConfig(ec, ctx.organizationId);\n const profile = this._mapSCIMBodyToProfile(body, orgConfig.attributeMapping);\n\n // Update profile attributes\n await this.provisioningService.updateOrgUser(userId, {\n firstName: profile.firstName,\n lastName: profile.lastName,\n displayName: profile.displayName,\n }, orgConfig);\n\n // Handle active status change\n if (body.active === false && user.status !== UserStatus.INACTIVE) {\n await this.provisioningService.deactivateOrgUser(userId, ctx.organizationId, orgConfig);\n } else if (body.active === true && user.status !== UserStatus.ACTIVE) {\n // `status` is `.excludeFromUpdate()`, so the ordinary handler write is stripped by the\n // repository's strict re-parse and the user would silently stay deactivated. The system\n // door re-attaches it. Not a lifecycle VERB: re-activation here is a consequence of the\n // directory's state, not an operator decision carrying a reason.\n await this.systemAccessService.updateAsSystem(CoreResourceType.USERS, userId, { status: UserStatus.ACTIVE });\n }\n\n // WS-C: a PUT carries the directory's full current state, so this is where a department CHANGE\n // (and therefore the revocation of the previous unit's access) actually lands.\n await this._syncOrganizationUnitAssignments(ec, userId, ctx.organizationId, body, orgConfig);\n\n const updatedUser = await this._findUserInOrg(ec, userId, ctx.organizationId);\n const updatedProfile = await this._getUserProfile(ec, userId);\n const identityLink = await this._getUserIdentityLink(ec, userId, ctx.organizationId);\n const baseUrl = this._getBaseUrl(req);\n const scimUser = formatUserAsSCIM(updatedUser \|\| user, updatedProfile, baseUrl, identityLink?.providerUserId);\n\n this._logSCIMOperation('user_replaced', { organizationId: ctx.organizationId, scopeType: ctx.scopeType, scopeId: ctx.scopeId, userId, tokenId: ctx.tokenId });\n\n // H8: Audit SCIM user updated (replace)\n this.auditLogsService.logSCIMUserUpdated({\n organizationId: ctx.organizationId,\n userId,\n operation: 'replace',\n updatedAttributes: ['profile', body.active !== undefined ? 'active' : undefined].filter(Boolean) as string[],\n }, ec).catch(() => {});\n\n res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(scimUser);\n } catch (error) {\n this._handleSCIMError(res, error, 'replace_user');\n }\n }\n\n // ═══════════════════════════════════════════════════════════════\n // PATCH /scim/v2/Users/:id — Partial Update (RFC 7644 §3.5.2)\n // ═══════════════════════════════════════════════════════════════\n\n private async _handlePatchUser(req: Request, res: Response): Promise<void> {\n const ctx = this._getSCIMContext(req);\n const userId = req.params.id as string;\n const body = req.body;\n\n this._logSCIMOperation('patch_user', { organizationId: ctx.organizationId, scopeType: ctx.scopeType, scopeId: ctx.scopeId, userId, tokenId: ctx.tokenId });\n\n if (!body.Operations \|\| !Array.isArray(body.Operations)) {\n res.status(400).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(400, 'PATCH requires Operations array', 'invalidSyntax')\n );\n return;\n }\n\n try {\n const ec = (req as SCIMAuthenticatedRequest).scimEc;\n const user = await this._findUserInOrg(ec, userId, ctx.organizationId);\n\n if (!user) {\n res.status(404).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(404, `User ${userId} not found`)\n );\n return;\n }\n\n const orgConfig = await this._getProvisioningConfig(ec, ctx.organizationId);\n const profileUpdates: Record<string, string> = {};\n let statusChange: 'activate' \| 'deactivate' \| null = null;\n\n for (const op of body.Operations as SCIMPatchOperation[]) {\n const normalizedOp = op.op?.toLowerCase() as 'add' \| 'remove' \| 'replace';\n\n if (normalizedOp === 'add' \|\| normalizedOp === 'replace') {\n if (op.path) {\n // Single attribute update\n this._applyPatchAttribute(op.path, op.value, profileUpdates, (s) => { statusChange = s; });\n } else if (op.value && typeof op.value === 'object') {\n // Bulk attribute update (no path — value is an object of attributes)\n const valueObj = op.value as Record<string, unknown>;\n for (const [key, val] of Object.entries(valueObj)) {\n this._applyPatchAttribute(key, val, profileUpdates, (s) => { statusChange = s; });\n }\n }\n } else if (normalizedOp === 'remove' && op.path) {\n const scimAttr = op.path;\n const dbField = (SCIM_USER_ATTRIBUTE_MAP as Record<string, string>)[scimAttr];\n if (dbField && dbField !== '_active' && dbField !== 'email') {\n profileUpdates[dbField] = '';\n }\n }\n }\n\n // Apply profile updates\n if (Object.keys(profileUpdates).length > 0) {\n await this.provisioningService.updateOrgUser(userId, profileUpdates as Record<string, string>, orgConfig);\n }\n\n // Apply status change\n if (statusChange === 'deactivate') {\n await this.provisioningService.deactivateOrgUser(userId, ctx.organizationId, orgConfig);\n } else if (statusChange === 'activate') {\n // Same system door as the PUT path above, for the same reason: `status` is\n // `.excludeFromUpdate()` and a handler write would be silently discarded.\n await this.systemAccessService.updateAsSystem(CoreResourceType.USERS, userId, { status: UserStatus.ACTIVE });\n }\n\n // Return updated user\n const updatedUser = await this._findUserInOrg(ec, userId, ctx.organizationId);\n const updatedProfile = await this._getUserProfile(ec, userId);\n const identityLink = await this._getUserIdentityLink(ec, userId, ctx.organizationId);\n const baseUrl = this._getBaseUrl(req);\n const scimUser = formatUserAsSCIM(updatedUser \|\| user, updatedProfile, baseUrl, identityLink?.providerUserId);\n\n this._logSCIMOperation('user_patched', {\n organizationId: ctx.organizationId,\n scopeType: ctx.scopeType,\n scopeId: ctx.scopeId,\n userId,\n operations: body.Operations.length,\n tokenId: ctx.tokenId,\n });\n\n // H8: Audit SCIM user updated (patch)\n const patchedAttrs = Object.keys(profileUpdates);\n if (statusChange) patchedAttrs.push('active');\n this.auditLogsService.logSCIMUserUpdated({\n organizationId: ctx.organizationId,\n userId,\n operation: 'patch',\n updatedAttributes: patchedAttrs,\n }, ec).catch(() => {});\n\n res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(scimUser);\n } catch (error) {\n this._handleSCIMError(res, error, 'patch_user');\n }\n }\n\n // ═══════════════════════════════════════════════════════════════\n // DELETE /scim/v2/Users/:id — Deactivate User\n // ═══════════════════════════════════════════════════════════════\n\n private async _handleDeleteUser(req: Request, res: Response): Promise<void> {\n const ctx = this._getSCIMContext(req);\n const userId = req.params.id as string;\n\n this._logSCIMOperation('delete_user', { organizationId: ctx.organizationId, scopeType: ctx.scopeType, scopeId: ctx.scopeId, userId, tokenId: ctx.tokenId });\n\n try {\n const ec = (req as SCIMAuthenticatedRequest).scimEc;\n const user = await this._findUserInOrg(ec, userId, ctx.organizationId);\n\n if (!user) {\n res.status(404).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(404, `User ${userId} not found`)\n );\n return;\n }\n\n const orgConfig = await this._getProvisioningConfig(ec, ctx.organizationId);\n await this.provisioningService.deactivateOrgUser(userId, ctx.organizationId, orgConfig);\n\n this._logSCIMOperation('user_deactivated', { organizationId: ctx.organizationId, scopeType: ctx.scopeType, scopeId: ctx.scopeId, userId, tokenId: ctx.tokenId });\n\n // H8: Audit SCIM user deactivated\n this.auditLogsService.logSCIMUserDeactivated({\n organizationId: ctx.organizationId,\n userId,\n email: user.email,\n }, ec).catch(() => {});\n\n res.status(204).end();\n } catch (error) {\n this._handleSCIMError(res, error, 'delete_user');\n }\n }\n\n // ═══════════════════════════════════════════════════════════════\n // POST /scim/v2/Bulk — Bulk Operations (Step 21)\n // ═══════════════════════════════════════════════════════════════\n\n private async _handleBulk(req: Request, res: Response): Promise<void> {\n const ctx = this._getSCIMContext(req);\n const body = req.body as SCIMBulkRequest;\n\n if (!body.Operations \|\| !Array.isArray(body.Operations)) {\n res.status(400).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(400, 'Bulk request requires Operations array', 'invalidSyntax')\n );\n return;\n }\n\n if (body.Operations.length > 100) {\n res.status(413).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(413, 'Bulk request exceeds maximum of 100 operations', 'tooMany')\n );\n return;\n }\n\n this._logSCIMOperation('bulk_start', {\n organizationId: ctx.organizationId,\n scopeType: ctx.scopeType,\n scopeId: ctx.scopeId,\n operationCount: body.Operations.length,\n tokenId: ctx.tokenId,\n });\n\n const results: SCIMBulkOperationResponse[] = [];\n let errorCount = 0;\n const failOnErrors = body.failOnErrors \|\| 0;\n\n for (const op of body.Operations) {\n if (failOnErrors > 0 && errorCount >= failOnErrors) {\n results.push({\n method: op.method,\n bulkId: op.bulkId,\n status: '412',\n response: formatSCIMError(412, 'Processing stopped due to failOnErrors threshold'),\n });\n continue;\n }\n\n try {\n const result = await this._executeBulkOperation(op, ctx, req);\n results.push(result);\n if (parseInt(result.status) >= 400) {\n errorCount++;\n }\n } catch {\n errorCount++;\n results.push({\n method: op.method,\n bulkId: op.bulkId,\n status: '500',\n response: formatSCIMError(500, 'Internal error processing bulk operation'),\n });\n }\n }\n\n this._logSCIMOperation('bulk_complete', {\n organizationId: ctx.organizationId,\n scopeType: ctx.scopeType,\n scopeId: ctx.scopeId,\n totalOperations: body.Operations.length,\n errors: errorCount,\n tokenId: ctx.tokenId,\n });\n\n res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json({\n schemas: [SCIM_SCHEMAS.BULK_RESPONSE],\n Operations: results,\n });\n }\n\n private async _executeBulkOperation(\n op: SCIMBulkRequest['Operations'][0],\n ctx: SCIMRequestContext,\n req: Request,\n ): Promise<SCIMBulkOperationResponse> {\n const pathMatch = op.path?.match(/\\/Users(?:\\/(.+))?$/);\n if (!pathMatch) {\n return { method: op.method, bulkId: op.bulkId, status: '400', response: formatSCIMError(400, 'Invalid path') };\n }\n const userId = pathMatch[1];\n const ec = (req as SCIMAuthenticatedRequest).scimEc;\n const orgConfig = await this._getProvisioningConfig(ec, ctx.organizationId);\n const baseUrl = this._getBaseUrl(req);\n\n switch (op.method) {\n case 'POST': {\n if (!op.data) {\n return { method: 'POST', bulkId: op.bulkId, status: '400', response: formatSCIMError(400, 'Missing data for POST') };\n }\n const profile = this._mapSCIMBodyToProfile(op.data, orgConfig.attributeMapping);\n if (!profile.email) {\n return { method: 'POST', bulkId: op.bulkId, status: '400', response: formatSCIMError(400, 'userName required') };\n }\n const connection = this._buildSCIMConnection(ctx);\n const result = await this.provisioningService.provisionEnterpriseUser(profile, connection, orgConfig);\n\n // H8: Audit bulk SCIM user provisioned\n this.auditLogsService.logSCIMUserProvisioned({\n organizationId: ctx.organizationId,\n userId: result.user._id,\n email: profile.email,\n isNewUser: result.isNew,\n provisionedVia: `scim:bulk:${ctx.tokenDisplayName}`,\n authSource: 'scim',\n }, ec).catch(() => {});\n\n return {\n method: 'POST',\n bulkId: op.bulkId,\n location: `${baseUrl}/Users/${result.user._id}`,\n status: '201',\n };\n }\n\n case 'PUT': {\n if (!userId \|\| !op.data) {\n return { method: 'PUT', bulkId: op.bulkId, status: '400', response: formatSCIMError(400, 'User ID and data required') };\n }\n const user = await this._findUserInOrg(ec, userId, ctx.organizationId);\n if (!user) {\n return { method: 'PUT', bulkId: op.bulkId, status: '404', response: formatSCIMError(404, `User ${userId} not found`) };\n }\n const putProfile = this._mapSCIMBodyToProfile(op.data, orgConfig.attributeMapping);\n await this.provisioningService.updateOrgUser(userId, {\n firstName: putProfile.firstName,\n lastName: putProfile.lastName,\n displayName: putProfile.displayName,\n }, orgConfig);\n\n // H8: Audit bulk SCIM user updated (replace)\n this.auditLogsService.logSCIMUserUpdated({\n organizationId: ctx.organizationId,\n userId,\n operation: 'replace',\n updatedAttributes: ['profile'],\n }, ec).catch(() => {});\n\n return { method: 'PUT', bulkId: op.bulkId, location: `${baseUrl}/Users/${userId}`, status: '200' };\n }\n\n case 'PATCH': {\n if (!userId \|\| !op.data) {\n return { method: 'PATCH', bulkId: op.bulkId, status: '400', response: formatSCIMError(400, 'User ID and data required') };\n }\n const patchUser = await this._findUserInOrg(ec, userId, ctx.organizationId);\n if (!patchUser) {\n return { method: 'PATCH', bulkId: op.bulkId, status: '404', response: formatSCIMError(404, `User ${userId} not found`) };\n }\n // Simplified: apply operations from data\n const operations = (op.data as Record<string, unknown>).Operations as SCIMPatchOperation[] \| undefined;\n const bulkPatchedAttrs: string[] = [];\n if (operations) {\n const patchProfileUpdates: Record<string, string> = {};\n let patchStatusChange: 'activate' \| 'deactivate' \| null = null;\n for (const patchOp of operations) {\n const normalizedOp = patchOp.op?.toLowerCase() as 'add' \| 'remove' \| 'replace';\n if (normalizedOp === 'add' \|\| normalizedOp === 'replace') {\n if (patchOp.path) {\n this._applyPatchAttribute(patchOp.path, patchOp.value, patchProfileUpdates, (s) => { patchStatusChange = s; });\n }\n }\n }\n if (Object.keys(patchProfileUpdates).length > 0) {\n await this.provisioningService.updateOrgUser(userId, patchProfileUpdates, orgConfig);\n }\n if (patchStatusChange === 'deactivate') {\n await this.provisioningService.deactivateOrgUser(userId, ctx.organizationId, orgConfig);\n }\n bulkPatchedAttrs.push(...Object.keys(patchProfileUpdates));\n if (patchStatusChange) bulkPatchedAttrs.push('active');\n }\n\n // H8: Audit bulk SCIM user updated (patch)\n this.auditLogsService.logSCIMUserUpdated({\n organizationId: ctx.organizationId,\n userId,\n operation: 'patch',\n updatedAttributes: bulkPatchedAttrs,\n }, ec).catch(() => {});\n\n return { method: 'PATCH', bulkId: op.bulkId, location: `${baseUrl}/Users/${userId}`, status: '200' };\n }\n\n case 'DELETE': {\n if (!userId) {\n return { method: 'DELETE', bulkId: op.bulkId, status: '400', response: formatSCIMError(400, 'User ID required') };\n }\n const deleteUser = await this._findUserInOrg(ec, userId, ctx.organizationId);\n if (!deleteUser) {\n return { method: 'DELETE', bulkId: op.bulkId, status: '404', response: formatSCIMError(404, `User ${userId} not found`) };\n }\n await this.provisioningService.deactivateOrgUser(userId, ctx.organizationId, orgConfig);\n\n // H8: Audit bulk SCIM user deactivated\n this.auditLogsService.logSCIMUserDeactivated({\n organizationId: ctx.organizationId,\n userId,\n email: deleteUser.email,\n }, ec).catch(() => {});\n\n return { method: 'DELETE', bulkId: op.bulkId, status: '204' };\n }\n\n default:\n return { method: op.method, bulkId: op.bulkId, status: '400', response: formatSCIMError(400, `Unsupported method: ${op.method}`) };\n }\n }\n\n // ═══════════════════════════════════════════════════════════════\n // PATCH Helpers\n // ═══════════════════════════════════════════════════════════════\n\n private _applyPatchAttribute(\n path: string,\n value: unknown,\n profileUpdates: Record<string, string>,\n onStatusChange: (change: 'activate' \| 'deactivate') => void,\n ): void {\n const attrMap = SCIM_USER_ATTRIBUTE_MAP as Record<string, string>;\n const dbField = attrMap[path];\n\n if (path === 'active' \|\| dbField === '_active') {\n const isActive = value === true \|\| value === 'true';\n onStatusChange(isActive ? 'activate' : 'deactivate');\n return;\n }\n\n if (dbField && dbField !== 'email') {\n profileUpdates[dbField] = String(value ?? '');\n }\n }\n\n // ═══════════════════════════════════════════════════════════════\n // SCIM Body → NormalizedUserProfile\n // ═══════════════════════════════════════════════════════════════\n\n private _mapSCIMBodyToProfile(body: Record<string, unknown>, mapping?: ScimAttributeMapping): NormalizedUserProfile {\n const userName = body.userName as string \| undefined;\n const name = body.name as Record<string, string> \| undefined;\n const emails = body.emails as Array<{ value: string; primary?: boolean }> \| undefined;\n\n // An authored `attributeMapping` (set only via `saveScimProvisioningConfig`, which no surface\n // calls yet — so every current row leaves `mapping` undefined and the legacy normalisation\n // below runs verbatim) routes each field through its configured path via\n // `resolveScimAttributePath`. Email additionally falls back to the legacy chain (userName →\n // primary email → first email) whenever the mapped path yields nothing, so a directory that\n // omits the mapped email attribute still provisions.\n let email = mapping?.email ? (resolveScimAttributePath(body, mapping.email) ?? '') : '';\n if (!email) {\n email = userName \|\| '';\n if (!email && emails?.length) {\n const primary = emails.find(e => e.primary);\n email = primary?.value \|\| emails[0]?.value \|\| '';\n }\n }\n\n const firstName = mapping?.firstName ? resolveScimAttributePath(body, mapping.firstName) : name?.givenName;\n const lastName = mapping?.lastName ? resolveScimAttributePath(body, mapping.lastName) : name?.familyName;\n const displayName = mapping?.displayName\n ? resolveScimAttributePath(body, mapping.displayName)\n : (body.displayName as string \| undefined);\n\n return {\n // SCIM robustness: `externalId` is OPTIONAL per RFC 7643 §4.1.1, but the identity link keys on\n // `providerUserId` (`USER_IDENTITY_LINKS.providerUserId` is `.min(1)`), so a directory that omits\n // `externalId` used to fail `createIdentityLink`'s validation and 400 the WHOLE provision (opaque\n // \"Server error\"). Fall back to the (already-resolved, D8-unique) email — the identifier the\n // directory DID send as `userName` — so an externalId-less SCIM client still provisions cleanly\n // and the link keeps a stable, idempotent key. If neither `externalId` nor an email is present\n // this stays empty, but the caller (`_handleCreateUser`) rejects that earlier with a precise\n // \"userName (email) is required\" 400, so `createIdentityLink` never sees an empty key.\n providerUserId: (body.externalId as string) \|\| email.toLowerCase(),\n email: email.toLowerCase(),\n // SCIM-provisioned users are IdP-trusted, so their email is treated as verified. Honoring\n // `autoVerifyEmail=false` (create PENDING_VERIFICATION + drive email verification) needs the\n // verification-completion flow wired for IdP-pushed users — tracked as AUTH-21, deliberately\n // not half-shipped here (a PENDING_VERIFICATION SCIM user with no verification email is stuck).\n emailVerified: true,\n firstName,\n lastName,\n displayName: displayName \|\| undefined,\n rawClaims: body,\n };\n }\n\n private _buildSCIMConnection(ctx: SCIMRequestContext): ProvisioningConnectionContext {\n // Identity only. Provisioning settings are deliberately omitted: SCIM's config is assembled\n // independently by `_getProvisioningConfig` (SCIM config row + SSO-derived domains) and passed\n // to `provisionEnterpriseUser` as a separate argument. Hardcoding hints here would be inert, misleading\n // duplication (a stub `allowedDomains: []` in particular reads as \"unrestricted\").\n return {\n source: ExternalIdentitySource.SCIM,\n providerRef: 'scim',\n displayName: 'SCIM Directory Provisioning',\n scope: buildEnterpriseConnectionScope(\n AuthScopeType.ORGANIZATION,\n ctx.organizationId,\n `scim:${ctx.tokenId}`,\n ),\n };\n }\n\n // ═══════════════════════════════════════════════════════════════\n // User Lookup Helpers\n // ═══════════════════════════════════════════════════════════════\n\n private async _findUserInOrg(ec: ExecutionContext<any>, userId: string, organizationId: string): Promise<User \| null> {\n try {\n // Verify user exists\n const user = await this.servicesRegistryHandler.read<User>(CoreResourceType.USERS, ec, { _id: userId });\n if (!user) return null;\n\n const membership = await this.servicesRegistryHandler.read(CoreResourceType.ORGANIZATION_MEMBERS, ec, { userId, organizationId });\n if (!membership) return null;\n\n return user;\n } catch {\n return null;\n }\n }\n\n private async _getUserProfile(ec: ExecutionContext<any>, userId: string): Promise<{ firstName?: string; lastName?: string; displayName?: string; avatarUrl?: string } \| null> {\n try {\n const profile = await this.servicesRegistryHandler.read(CoreResourceType.USER_PROFILES, ec, { userId });\n return profile as { firstName?: string; lastName?: string; displayName?: string; avatarUrl?: string } \| null;\n } catch {\n return null;\n }\n }\n\n private async _getUserIdentityLink(ec: ExecutionContext<any>, userId: string, organizationId: string): Promise<{ providerUserId?: string } \| null> {\n try {\n const link = await this.servicesRegistryHandler.read(CoreResourceType.USER_IDENTITY_LINKS, ec, {\n userId,\n connectionType: SsoConnectionType.ENTERPRISE,\n organizationId,\n });\n return link as { providerUserId?: string } \| null;\n } catch {\n return null;\n }\n }\n\n /\n Assemble the per-org provisioning config the SCIM push path runs against, reading each field\n * from the resource that OWNS it — no duplication, no hardcoded assumptions:\n * - `allowedDomains` from the scope's SSO config (`SsoConfig.domains`, which owns DNS\n * verification) — the DNS-verified subset only (H4). Read live, never copied.\n * - the SCIM channel behaviour (`autoCreateUsers`, `autoVerifyEmail`, `autoDeactivateUsers`,\n * `defaultRole`, `attributeMapping`) from the `ScimProvisioningConfig` row.\n \n Both loads are resilient: a read failure falls back to the historical hardcoded defaults\n * (`autoCreateUsers`/`autoVerifyEmail`/`autoDeactivateUsers` = true, no domain restriction) so a\n * transient config-store blip degrades to \"provision with safe defaults\", never a failed push.\n * Every default here equals the value this method previously hardcoded, so an org that has not\n * customised its SCIM config behaves exactly as before.\n /\n /\n Load the organization's provisioning settings.\n \n Returns the shared `EnterpriseProvisioningConfig` (which SSO JIT also consumes) INTERSECTED with\n * the SCIM-only organization-unit fields, rather than widening the shared type: unit provisioning is\n * a SCIM channel concern, and adding it to the type SSO JIT reads would advertise a capability that\n * path does not implement.\n /\n private async _getProvisioningConfig(\n ec: ExecutionContext<any>,\n organizationId: string,\n ): Promise<EnterpriseProvisioningConfig & ScimOrganizationUnitManagementSignal> {\n let allowedDomains: string[] = [];\n try {\n const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, AuthScopeType.ORGANIZATION, organizationId);\n if (ssoConfig) {\n // Only include domains that have passed DNS verification (H4). Through the one derivation\n // (#457) rather than a fifth hand-written join — the stored list holds CLAIMED domains.\n allowedDomains = resolveVerifiedDomains(ssoConfig.domains);\n }\n } catch {\n this.logDebug('Failed to load org SSO config for SCIM provisioning (non-fatal)', { organizationId });\n }\n\n let scimConfig: ScimProvisioningConfigBase \| null = null;\n try {\n scimConfig = await this.orgConfigService.loadScimProvisioningConfig(ec, AuthScopeType.ORGANIZATION, organizationId);\n } catch {\n this.logDebug('Failed to load SCIM provisioning config (non-fatal — using defaults)', { organizationId });\n }\n\n return {\n autoCreateUsers: scimConfig?.autoCreateUsers ?? true,\n autoVerifyEmail: scimConfig?.autoVerifyEmail ?? true,\n autoDeactivateUsers: scimConfig?.autoDeactivateUsers ?? true,\n defaultRole: scimConfig?.defaultRole,\n attributeMapping: scimConfig?.attributeMapping,\n allowedDomains,\n // Organization-unit provisioning (WS-C). Carried on the SAME config read rather than fetched\n // separately, so a push that manages units costs no extra round-trip. Undefined on both fields\n // means the organization never opted in, which `_syncOrganizationUnitAssignments` treats as\n // \"SCIM does not manage units here\" — and therefore never deletes anything.\n organizationUnitMapping: scimConfig?.organizationUnitMapping,\n defaultUnitRole: scimConfig?.defaultUnitRole,\n };\n }\n\n /\n Make the member's organization-unit assignments match what the directory just pushed.\n \n assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — the directory is the authority for unit\n * membership, and unit membership is an authorization grant.\n \n ## Opt-in, and what \"authoritative\" costs\n \n Runs ONLY when the organization declared both a `organizationUnitMapping` and a `defaultUnitRole`.\n * That gate is load-bearing: reconciliation REPLACES the member's assignments with exactly what the\n * directory says, so without it a push from an organization that never configured units would delete\n * every assignment an admin had made by hand.\n \n Within an opted-in organization that replacement is the point — a user who moves from Sales to\n * Legal LOSES Sales. Access that only ever accumulates is how an offboarded department is never\n * actually left.\n \n ## Failure PROPAGATES\n \n A sync failure fails the SCIM request rather than being swallowed. The alternative leaves the\n * directory and the live grants diverged with no signal — and since assignments are authorization,\n * that divergence is silent over- or under-privilege. Failing loudly makes the IdP retry, and the\n * reconciliation is idempotent so a retry converges.\n */\n private async _syncOrganizationUnitAssignments(\n ec: ExecutionContext<any>,\n userId: string,\n organizationId: string,\n body: unknown,\n config: EnterpriseProvisioningConfig & ScimOrganizationUnitManagementSignal,\n ): Promise<void> {\n if (!isScimOrganizationUnitManagementEnabled(config)) return;\n\n const membership = await this.servicesRegistryHandler.read<{ _id: string }>(\n CoreResourceType.ORGANIZATION_MEMBERS, ec, { userId, organizationId },\n );\n if (!membership?._id) return;\n\n const directoryValue = extractScimDirectoryUnitValue(body);\n const desiredUnitId = resolveScimOrganizationUnitId(directoryValue, config.organizationUnitMapping);\n\n const currentAssignments = await this.servicesRegistryHandler.list<ScimOrganizationUnitAssignment>(\n CoreResourceType.ORGANIZATION_UNIT_MEMBERS, ec, { organizationMemberId: membership._id },\n undefined, { paginated: false },\n ) as ScimOrganizationUnitAssignment[];\n\n const { unitIdsToCreate, assignmentIdsToRemove } = resolveScimOrganizationUnitReconciliation(\n desiredUnitId ? [desiredUnitId] : [],\n currentAssignments ?? [],\n );\n\n if (unitIdsToCreate.length === 0 && assignmentIdsToRemove.length === 0) return;\n\n for (const assignmentId of assignmentIdsToRemove) {\n await this.servicesRegistryHandler.delete(CoreResourceType.ORGANIZATION_UNIT_MEMBERS, ec, assignmentId);\n }\n for (const organizationUnitId of unitIdsToCreate) {\n await this.servicesRegistryHandler.create(CoreResourceType.ORGANIZATION_UNIT_MEMBERS, ec, {\n organizationId,\n organizationUnitId,\n organizationMemberId: membership._id,\n role: config.defaultUnitRole,\n });\n }\n\n this._logSCIMOperation('organization_units_synced', {\n organizationId,\n userId,\n directoryValue,\n // An unmapped directory value is reported explicitly: it is the difference between \"the\n // directory said nothing\" and \"the directory said something nobody bound to a unit\", and only\n // the second is a configuration gap worth chasing.\n resolvedToUnit: desiredUnitId ?? null,\n unitsAssigned: unitIdsToCreate.length,\n assignmentsRemoved: assignmentIdsToRemove.length,\n });\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Structured Logging (Step 21)\n // ═══════════════════════════════════════════════════════════════\n\n private _logSCIMOperation(operation: string, context: Record<string, unknown>): void {\n this.logDebug(`SCIM: ${operation}`, {\n scimOperation: operation,\n ...context,\n });\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Error Handling\n // ═══════════════════════════════════════════════════════════════\n\n private _handleSCIMError(res: Response, error: unknown, operation: string): void {\n this._logSCIMOperation(`${operation}_error`, { error: describeCaughtError(error) });\n\n if (isWildoBackendError(error)) {\n const wildoError = error as { statusCode?: number; type?: string; message?: string };\n const status = wildoError.statusCode \|\| 500;\n\n // Map common errors to SCIM-specific responses\n if (status === 409 \|\| wildoError.type === 'uniqueness') {\n res.status(409).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(409, 'User already exists', 'uniqueness')\n );\n return;\n }\n if (status === 404) {\n res.status(404).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(404, wildoError.message \|\| 'Resource not found')\n );\n return;\n }\n\n res.status(status).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(status, wildoError.message \|\| 'Server error')\n );\n return;\n }\n\n res.status(500).set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(\n formatSCIMError(500, 'Internal server error')\n );\n }\n\n // ═══════════════════════════════════════════════════════════════\n // Utilities\n // ═══════════════════════════════════════════════════════════════\n\n private _hashToken(plainToken: string): string {\n return createHash('sha256').update(plainToken).digest('hex');\n }\n\n private async _isScimProvisioningEnabledForOrg(ec: ExecutionContext<any>, organizationId: string): Promise<boolean> {\n if (!this.appConfigService.isInitialized()) return true;\n\n type OrgTypeWithScim = { scimProvisioning?: { enabled: boolean; syncFrequencyHours?: number } };\n const organizationTypes = (this.appConfigService.config as { organizationTypes?: Record<string, OrgTypeWithScim> })?.organizationTypes;\n\n try {\n return await isScimProvisioningEnabledForOrg(ec, {\n organizationId,\n organizationTypes,\n servicesRegistryHandler: this.servicesRegistryHandler,\n });\n } catch {\n return true;\n }\n }\n\n private _getSCIMContext(req: Request): SCIMRequestContext {\n return (req as SCIMAuthenticatedRequest).scimContext;\n }\n\n private _getBaseUrl(req: Request): string {\n const proto = req.headers[WildoHeaderKeys.FORWARDED_PROTO];\n const protocol = (Array.isArray(proto) ? proto[0] : proto) \|\| req.protocol \|\| 'https';\n const h = req.headers[WildoHeaderKeys.FORWARDED_HOST] \|\| req.headers.host;\n const host = (Array.isArray(h) ? h[0] : h) \|\| 'localhost';\n return `${protocol}://${host}/api/v1/scim/v2`;\n }\n\n private async _getInternalExecutionContext(): Promise<ExecutionContext<any>> {\n return this.authEcFactory.createForSystemAuthOperation(this.authEcFactory.getUsersCreateOperationPath());\n }\n}\n\n// ═══════════════════════════════════════════════════════════════\n// Request Context Types\n// ═══════════════════════════════════════════════════════════════\n\ninterface SCIMRequestContext {\n organizationId: string;\n scopeType: AuthScopeType;\n scopeId: string;\n tokenId: string;\n tokenDisplayName: string;\n}\n\ninterface SCIMAuthenticatedRequest extends Request {\n scimContext: SCIMRequestContext;\n scimEc: ExecutionContext<any>;\n}\n"]}