npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.2 → 1.1.3 - Mend

@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (853) hide show

package/dist/esm/config/models/app-config.backend.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"app-config.backend.schemas.js","sourceRoot":"","sources":["../../../../../src/config/models/app-config.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,0CAA0C,EAC1C,qDAAqD,EACrD,kCAAkC,EAClC,wCAAwC,EACxC,uBAAuB,EACvB,4BAA4B,EAC5B,0BAA0B,EAC1B,gBAAgB,EAChB,qBAAqB,EACrB,0BAA0B,EAC1B,2BAA2B,EAC3B,6BAA6B,EAC7B,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtF,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,yBAAyB,EAAE,MAAM,qEAAqE,CAAC;AACrI,OAAO,EAAiB,uBAAuB,EAAE,MAAM,wEAAwE,CAAC;AAChI,OAAO,EAAE,2BAA2B,EAAE,qCAAqC,EAAE,MAAM,yEAAyE,CAAC;AAE7J,MAAM,iCAAiC,GAAG,CAAC,CAAC,aAAa,CACvD,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACxB,CAAC,CAAC,YAAY,CAAC;IACb,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CACH,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAEd,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAC3C,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAC7C,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEjC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IAClD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5D,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAClD,CAAC,CAAC;AAEH,MAAM,6BAA6B,GAAG,CAAC,CAAC,YAAY,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAClD,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,CAAC,CAAC,YAAY,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,aAAa,CACxB,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACxB,6BAA6B,CAC9B,CAAC,QAAQ,EAAE;CACb,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAC9C,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,QAAQ,EAAE;IACpF,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,QAAQ,EAAE;IAC3E,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,QAAQ,EAAE;CAC5E,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,MAAM,EAAE,oBAAoB;CAC7B,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAEnC;;;;;;;GAOG;AACH,MAAM,0BAA0B,GAAG,CAAC,CAAC,YAAY,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9C,CAAC,CAAC;AAqDH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,0FAA0F;IAC1F,SAAS,EAAE,WAAW;IACtB,sEAAsE;IACtE,IAAI,EAAE,MAAM;CACJ,CAAC;AAIX,MAAM,kCAAkC,GAA4C,CAAC,CAAC,YAAY,CAAC;IACjG,cAAc,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IACrD,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5F,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE;IACvD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAC7C,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,kCAAkC,CACnC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAEd,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAC7C,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,CAAC,CAAC,YAAY,CAAC;IACb,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC5B,CAAC;IACF,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC;QACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;KAC1D,CAAC;IACF,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,YAAY,CAAC;QACxB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACrC,CAAC,CAAC,QAAQ,EAAE;IACb,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC7B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;KACnE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CACH,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAEd;;oEAEoE;AAEpE,MAAM,CAAN,IAAY,UAIX;AAJD,WAAY,UAAU;IACpB,iCAAmB,CAAA;IACnB,iCAAmB,CAAA;IACnB,mCAAqB,CAAA;AACvB,CAAC,EAJW,UAAU,KAAV,UAAU,QAIrB;AAED,MAAM,CAAN,IAAY,uBAIX;AAJD,WAAY,uBAAuB;IACjC,gDAAqB,CAAA;IACrB,4DAAiC,CAAA;IACjC,sCAAW,CAAA;AACb,CAAC,EAJW,uBAAuB,KAAvB,uBAAuB,QAIlC;AAED,MAAM,CAAN,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,yCAAqB,CAAA;IACrB,2CAAuB,CAAA;IACvB,+CAA2B,CAAA;AAC7B,CAAC,EAJW,gBAAgB,KAAhB,gBAAgB,QAI3B;AAED,0EAA0E;AAC1E,MAAM,CAAN,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,gCAAa,CAAA;IACb,wCAAqB,CAAA;IACrB,oCAAiB,CAAA;IACjB,4CAAyB,CAAA;AAC3B,CAAC,EALW,eAAe,KAAf,eAAe,QAK1B;AAED,MAAM,CAAN,IAAY,aAIX;AAJD,WAAY,aAAa;IACvB,8BAAa,CAAA;IACb,kCAAiB,CAAA;IACjB,kCAAiB,CAAA;AACnB,CAAC,EAJW,aAAa,KAAb,aAAa,QAIxB;AAED;;oEAEoE;AAEpE,MAAM,CAAN,IAAY,eAGX;AAHD,WAAY,eAAe;IACzB,sCAAmB,CAAA;IACnB,8CAA2B,CAAA;AAC7B,CAAC,EAHW,eAAe,KAAf,eAAe,QAG1B;AAED,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IACxD,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC/B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC1C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,4DAA4D;IAC5D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,sDAAsD;IACtD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAC3C,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7C,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,uBAAuB;IAC/B,QAAQ,EAAE,yBAAyB;CACpC,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAC5C,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACxC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE;CAClC,CAAC,CAAC;AAEH;;;;;oEAKoE;AAEpE,MAAM,CAAC,MAAM,2BAA2B,GAAG,kCAAkC,CAAC,MAAM,CAAC;IACnF,wEAAwE;IACxE,qBAAqB,EAAE,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;IAE9D;;;;;;;OAOG;IACH,IAAI,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IAE5C;;;;;;OAMG;IACH,yBAAyB,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IAE3E,wFAAwF;IACxF,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,MAAM,EAAE,2BAA2B,CAAC,QAAQ,EAAE;KAC/C,CAAC;IAEF,0EAA0E;IAC1E,+FAA+F;IAE/F,gHAAgH;IAChH,kBAAkB,EAAE,wBAAwB;IAE5C,2FAA2F;IAC3F,cAAc,EAAE,oBAAoB;IAEpC,kDAAkD;IAClD,oBAAoB,EAAE,0BAA0B;IAEhD,4CAA4C;IAC5C,eAAe,EAAE,qBAAqB;IAEtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,wCAAwC,CAAA;AAGzF,MAAM,CAAC,MAAM,mCAAmC,GAAI,0CAA0C,CAAA;AAC9F,MAAM,CAAC,MAAM,8CAA8C,GAAG,qDAAqD,CAAA;AAEnH;;;;;oEAKoE;AAEpE,0GAA0G;AAC1G,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAgC,aAA2B,EAAE,EAAE;IAC1H,OAAO,CAAC,CAAC,MAAM,CAAC;QACd;;;;WAIG;QACH,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;YACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACnC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACvB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC;;;;;;;;;;;;;;;;;;;;;;WAsBG;QACH,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC;YAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;YAChD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACtC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACtC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YAClC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YAC5B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YACnC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;YAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;YAClD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;SACjD,CAAC,CAAC,QAAQ,EAAE;KACd,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAG,6CAA6C,CAAsB,yBAAyB,CAAC,CAAC;AAE5I;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAI,CAAC,CAAC,MAAM,CAAC;IACrD,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IAC7B,2BAA2B,EAAE,CAAC,CAAC,OAAO,EAAE;IACxC,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE;IACpC,WAAW,EAAE,6BAA6B,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACjD,CAAC;CACH,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,gDAAgD;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACvC,gDAAgD;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,kFAAkF;IAClF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACrD;;;;;;;OAOG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,kDAAkD;IAClD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC;;;;;;;;;OASG;IACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IACnD,mDAAmD;IACnD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,uCAAuC;IACvC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC;IACrE,oCAAoC;IACpC,IAAI,EAAE,4BAA4B,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,+CAA+C;IAC/C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,2CAA2C;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;IAC9D,4BAA4B;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;IAC3E,0BAA0B;IAC1B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACjC,yBAAyB;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;QACxB,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACzC,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC;IAE9E;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAEzC,+DAA+D;IAC/D,UAAU,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAE/C,mEAAmE;IACnE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;QACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACtD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC;;;;;;;;;;;;;;;;;;WAkBG;QACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;IAEb,sEAAsE;IACtE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;QACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACtD;;;;;;;;;;;;;;;;;WAiBG;QACH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH,wFAAwF;AACxF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,6FAA6F;IAC7F,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,kCAAkC;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;;;;OAOG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CACpE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QACpC,IAAI,CAAC;YACH,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,EACF,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAClC;IACD;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7G,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;IACtC,mCAAmC;IACnC,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;CAC1D,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,uCAAuC;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,gEAAgE;IAChE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,gEAAgE;AAChE,MAAM,CAAC,MAAM,uDAAuD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,OAAO,EAAE,gDAAgD,CAAC,QAAQ,EAAE;IACpE,cAAc,EAAE,uDAAuD,CAAC,QAAQ,EAAE;CACnF,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACjC,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,iGAAiG;AACjG,6FAA6F;AAC7F,iGAAiG;AACjG,+FAA+F;AAC/F,gGAAgG;AAEhG,0EAA0E;AAC1E,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,SAAS,EAAE,qDAAqD,CAAC,QAAQ,EAAE;IAC3E,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,UAAU,EAAE,qDAAqD,CAAC,QAAQ,EAAE;KAC7E,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAyCH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,mCAAmC,CACjD,GAAqC;IAErC,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,gBAAgB;YACtB,CAAC,CAAC;gBACA,OAAO,EAAE;oBACP,QAAQ,EAAE,GAAG,CAAC,gBAAgB;oBAC9B,IAAI,EAAE,GAAG,CAAC,YAAY,IAAI,mBAAmB,CAAC,KAAK;oBACnD,MAAM,EAAE,GAAG,CAAC,eAAe,IAAI,KAAK;oBACpC,MAAM,EAAE,GAAG,CAAC,cAAc,IAAI,gBAAgB,CAAC,MAAM;oBACrD,gEAAgE;oBAChE,qEAAqE;oBACrE,mBAAmB;oBACnB,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClF;aACF;YACD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnG,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wCAAwC,CACtD,GAA0C;IAE1C,OAAO;QACL,YAAY,EAAE;YACZ,GAAG,CAAC,GAAG,CAAC,WAAW;gBACjB,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,IAAI,mBAAmB,EAAE,EAAE;gBACxF,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS;gBACjD,CAAC,CAAC;oBACA,IAAI,EAAE;wBACJ,OAAO,EAAE,GAAG,CAAC,YAAY,KAAK,IAAI;wBAClC,GAAG,CAAC,GAAG,CAAC,SAAS;4BACf,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,IAAI,iBAAiB,EAAE,EAAE;4BACnF,CAAC,CAAC,EAAE,CAAC;qBACR;iBACF;gBACD,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,GAAuC;IAEvC,MAAM,OAAO,GAAG,GAAG,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,GAAG,CAAC,6BAA6B,CAAC,eAAe,CAAC,CAAC;IACrE,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,gBAAgB,CAAC;YACrD,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,6BAA6B,CAAC,gBAAgB,CAAC,EAAE;YAC3E,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,cAAc,CAAC;YACnD,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,6BAA6B,CAAC,cAAc,CAAC,EAAE;YACvE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,qBAAqB,CAAC;YAC1D,CAAC,CAAC,EAAE,qBAAqB,EAAE,GAAG,CAAC,6BAA6B,CAAC,qBAAqB,CAAC,EAAE;YACrF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,sBAAsB,CAAC;YAC3D,CAAC,CAAC,EAAE,sBAAsB,EAAE,GAAG,CAAC,6BAA6B,CAAC,sBAAsB,CAAC,EAAE;YACvF,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,SAAS,qBAAqB,CAAC,GAAuC,EAAE,GAAW;IACjF,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yCAAyC,CACvD,GAAuC;IAEvC,MAAM,WAAW,GAAG,GAAG,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,EAAE,6BAA6B,CAAC,WAAW,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,EAAE,6BAA6B,CAAC,SAAS,CAAC,CAAC;IACrF,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,WAAW,CAAC;YAChD,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,6BAA6B,CAAC,WAAW,CAAC,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC;YAC9C,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2CAA2C,CACzD,GAAuC;IAEvC,OAAO;QACL,OAAO,EAAE,mCAAmC,CAAC,oCAAoC,CAAC,GAAG,CAAC,CAAC;QACvF,GAAG,wCAAwC,CAAC,yCAAyC,CAAC,GAAG,CAAC,CAAC;KAC5F,CAAC;AACJ,CAAC;AAED,MAAM,uCAAuC,GAAG,kCAAkC,CAAC,MAAM,CAAC;IACxF,qBAAqB,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IAC7D,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,MAAM,EAAE,2BAA2B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACzD,CAAC,CAAC,QAAQ,EAAE;IACb,kBAAkB,EAAE,wBAAwB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,MAAM,EAAE,uBAAuB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACpD,QAAQ,EAAE,yBAAyB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACzD,CAAC,CAAC,QAAQ,EAAE;IACb,oBAAoB,EAAE,0BAA0B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrE,eAAe,EAAE,qBAAqB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC5D,CAAC,CAAC;AAEH,MAAM,yCAAyC,GAAG,6BAA6B,CAAC,OAAO,CAAC;IACtF,2BAA2B,EAAE,IAAI;IACjC,uBAAuB,EAAE,IAAI;CAC9B,CAAC,CAAC;AAEH,MAAM,0CAA0C,GAAG,8BAA8B,CAAC,OAAO,EAAE,CAAC;AAE5F,MAAM,8CAA8C,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/B,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC9C,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,uCAAuC,GAAG,2BAA2B,CAAC,OAAO,CAAC;IAClF,0BAA0B,EAAE,IAAI;IAChC,4BAA4B,EAAE,IAAI;CACnC,CAAC,CAAC;AAEH;;;;;;oEAMoE;AAEpE,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IAEvE,WAAW,EAAE,mCAAmC;IAEhD;;;;;;;;;OASG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IAExD,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,SAAS,EAAE,8CAA8C;KAC1D,CAAC;IAEF,IAAI,EAAE,2BAA2B;IACjC,SAAS,EAAE,qBAAqB;IAChC,gBAAgB,EAAE,4BAA4B;IAC9C,iBAAiB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAC3D,UAAU,EAAE,iCAAiC;IAC7C,KAAK,EAAE,6BAA6B;IACpC,OAAO,EAAE,8BAA8B;IACvC,+EAA+E;IAC/E,+EAA+E;IAC/E,sEAAsE;IACtE,kEAAkE;IAClE,YAAY,EAAE,mCAAmC,CAAC,QAAQ,EAAE;IAC5D,UAAU,EAAE,kCAAkC;IAE9C,OAAO,EAAE,8BAA8B;IACvC,OAAO,EAAE,8BAA8B;IACvC,kBAAkB,EAAE,iCAAiC;IACrD,SAAS,EAAE,oBAAoB;IAC/B,sBAAsB,EAAE,4BAA4B;IACpD,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAC9C,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC3C,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,qCAAqC;IACrC,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAC/C,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC7C,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,6EAA6E;IAC7E,cAAc,EAAE,0BAA0B,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;oEAsBoE;AAEpE,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E;;;;OAIG;IACH,OAAO,EAAE,8BAA8B;IACvC;;;OAGG;IACH,QAAQ,EAAE,gCAAgC;IAC1C;;;;OAIG;IACH,GAAG,EAAE,2BAA2B;CACjC,CAAC,CAAC;AAEH;;;;;;;;;oEASoE;AAEpE;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,GAAG,gDAAgD,CAAC,KAAK;IACzD,GAAG,qDAAqD,CAAC,KAAK;IAC9D,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IACpD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACrD,CAAC;AAsCF,MAAM,CAAC,MAAM,uBAAuB,GAAwC,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAE9G,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,WAAW,EAAE,mCAAmC;IAChD,qFAAqF;IACrF,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IACxD,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,SAAS,EAAE,8CAA8C;KAC1D,CAAC;IACF,IAAI,EAAE,uCAAuC;IAC7C,SAAS,EAAE,qBAAqB;IAChC,gBAAgB,EAAE,4BAA4B;IAC9C,iBAAiB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAC3D,UAAU,EAAE,iCAAiC;IAC7C,KAAK,EAAE,yCAAyC;IAChD,OAAO,EAAE,0CAA0C;IACnD,YAAY,EAAE,mCAAmC,CAAC,QAAQ,EAAE;IAC5D,UAAU,EAAE,8CAA8C;IAC1D,OAAO,EAAE,8BAA8B;IACvC,OAAO,EAAE,8BAA8B;IACvC,kBAAkB,EAAE,iCAAiC;IACrD,SAAS,EAAE,oBAAoB;IAC/B,sBAAsB,EAAE,4BAA4B;IACpD,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAC9C,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAC/C,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC7C,cAAc,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IACrD,OAAO,EAAE,8BAA8B;IACvC,QAAQ,EAAE,gCAAgC;IAC1C,GAAG,EAAE,uCAAuC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IACpD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACrD,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG;IACzD,OAAO,EAAE,iCAAiC;IAC1C,OAAO,EAAE,oBAAoB;IAC7B,aAAa,EAAE,wCAAwC;IACvD,WAAW,EAAE,sBAAsB;IACnC,SAAS,EAAE,gCAAgC;CACnC,CAAC;AAoBX;;;;;;GAMG;AACH,MAAM,UAAU,uCAAuC,CACrD,KAAmD;IAEnD,OAAO,uCAAuC,CAAC,KAAK,CAAC;QACnD,WAAW,EAAE;YACX,OAAO,EAAE,2CAA2C,CAAC,OAAO;YAC5D,OAAO,EAAE,2CAA2C,CAAC,OAAO;SAC7D;QACD,cAAc,EAAE;YACd,SAAS,EAAE,EAAE;SACd;QACD,IAAI,EAAE;YACJ,aAAa,EAAE;gBACb,MAAM,EAAE,2CAA2C,CAAC,aAAa;gBACjE,IAAI,EAAE,2CAA2C,CAAC,WAAW;aAC9D;SACF;QACD,UAAU,EAAE,EAAE;QACd,KAAK,EAAE;YACL,IAAI,EAAE,2CAA2C,CAAC,SAAS;SAC5D;QACD,SAAS,EAAE,EAAE;QACb,gBAAgB,EAAE,EAAE;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;QAC5B,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,UAAU,EAAE;YACV,OAAO,EAAE,EAAE;SACZ;QACD,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,EAAE;QACX,OAAO,EAAE;YACP,SAAS,EAAE,KAAK,CAAC,gBAAgB;SAClC;QACD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,EAAE;KACrB,CAAC,CAAC;AACL,CAAC","sourcesContent":["/*\n Backend Application Configuration Schemas\n \n Complete backend configuration schemas with all necessary fields.\n * Frontend configuration is handled separately in saas-frontend-lib.\n /\n\nimport {\n AnalyticsConfigSchema,\n AuditTrailConfigSchema,\n AppConfiguration_Shared_AppIdentity_Schema,\n AppConfiguration_Shared_AppPreferencesLanguage_Schema,\n AppConfiguration_Shared_AuthSchema,\n AppConfiguration_Shared_ComplianceSchema,\n DataSeedingConfigSchema,\n FrontendServicesConfigSchema,\n BillingConfigurationSchema,\n EngineCapability,\n LifecycleConfigSchema,\n TenantTeardownConfigSchema,\n OAuth2ProvidersConfigSchema,\n OrganizationTypesConfigSchema,\n PersistenceAdapter,\n ResourceIdFormat,\n PostgreSQLSSLMode,\n RuntimeBrandAssetSchema,\n UserTypesConfigSchema,\n} from '@wildo-ai/saas-models';\nimport { INFRA_DEFAULT_PORTS, STORAGE_DEFAULTS } from '@wildo-ai/platform-config-lib';\nimport { ApplicationBackendDataEnvKeys } from '@wildo-ai/platform-core-shared';\nimport { z } from 'zod';\n\nimport { AllApplicationTypes, AllApplicationTypesSchema } from '~wildo-backend-lib/applications/models/applications.backend.schemas';\nimport { JwtPublicKeys, VerifiableJwtKeysSchema } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport { CimdApplicationConfigSchema, DynamicClientRegistrationConfigSchema } from '~wildo-backend-lib/security/authentications/models/cimd.backend.schemas';\n\nconst EngineCapabilityActivationsSchema = z.partialRecord(\n z.enum(EngineCapability),\n z.strictObject({\n enabled: z.boolean(),\n required: z.boolean().optional(),\n }),\n).default({});\n\nconst ProviderConfigurationsSchema = z.record(\n z.string(),\n z.record(z.string(), z.unknown()).optional(),\n).optional().default(() => ({}));\n\nconst ProviderScopeSelectionSchema = z.strictObject({\n engineCapabilities: z.array(z.enum(EngineCapability)).default([]),\n providerCapabilities: z.array(z.string().min(1)).default([]),\n protocols: z.array(z.string().min(1)).default([]),\n});\n\nconst ProviderSelectionPolicySchema = z.strictObject({\n primary: z.string().min(1),\n fallbacks: z.array(z.string().min(1)).default([]),\n});\n\nconst RuntimeProviderScopeSchema = z.strictObject({\n providers: z.record(z.string().min(1), ProviderScopeSelectionSchema).default({}),\n selection: z.partialRecord(\n z.enum(EngineCapability),\n ProviderSelectionPolicySchema,\n ).optional(),\n});\n\nconst ProviderScopesSchema = z.strictObject({\n backend: RuntimeProviderScopeSchema.optional(),\n companion: RuntimeProviderScopeSchema.optional(),\n frontendServices: z.record(z.string().min(1), RuntimeProviderScopeSchema).optional(),\n minions: z.record(z.string().min(1), RuntimeProviderScopeSchema).optional(),\n workers: z.record(z.string().min(1), RuntimeProviderScopeSchema).optional(),\n});\n\nconst ProvidersBlockSchema = z.strictObject({\n scopes: ProviderScopesSchema,\n}).default(() => ({ scopes: {} }));\n\n/\n Minion runtime inventory materialized from the SaaS declaration.\n \n This branch intentionally carries only the runtime-facing minion metadata the\n * application process may need at boot. Today that is the per-minion\n * `resourceAccess` authority whitelist used by the minion kernel; execution\n * topology (`path`, cron mode, Docker wiring, ...) stays on the SaaS/deploy side.\n /\nconst MinionResourceAccessSchema = z.strictObject({\n read: z.array(z.string().min(1)).default([]),\n write: z.array(z.string().min(1)).default([]),\n});\n\n/\n One minion's runtime-facing entry, EXPLICITLY typed.\n \n The annotation is not decoration. `Wildo_Application_ResolvedConfig_Schema` in\n * apps-manager extends `AppConfiguration_Schema`, and that inferred type sits AT\n * the compiler's serialization ceiling: adding ANY field to this object — an\n * enum-backed one, a structural one, even an inline `z.string()` array — tipped\n * it over, and apps-manager stopped compiling with\n \n TS7056 The inferred type of this node exceeds the maximum length the compiler will serialize\n * TS2742 … cannot be named without a reference to '…/@wildo-ai/saas-models/src'\n \n Measured by removal: taking the field out cleared both, putting it back\n * restored them, three variants running. Naming the entry type here stops the\n * expansion at this node instead, which is the remedy TS7056 asks for.\n \n ## CORRECTION 2026-08-18 — this was per-node relief, and its closing claim was wrong\n \n The original ended \"…and the only one available — an explicit annotation on the giant schema\n * itself is not writable by hand.\" It is writable: hoist the composed shape into a value and\n * annotate against `typeof` it. That is what `AppConfiguration_Shape` /\n * `AppConfiguration_Schema` below now do, and what the two apps-manager schemas that extend them\n * now do in turn.\n \n The distinction matters because the two remedies differ in kind. Naming THIS node buys headroom\n * until the next field is added anywhere in the surface — the ceiling stays, and the next author\n * meets it with no idea why. Naming the TOP-LEVEL shape removes the consumer-side expansion\n * altogether. The prediction here (\"adding ANY field tipped it over\") was correct and came true\n * again on 2026-08-18, from growth in `saas-models` rather than a field added here — which is\n * exactly why the per-node form could not hold.\n \n Keep this annotation: it is still correct, and a `z.ZodType<T>` interface boundary on a nested\n * entry is good practice independent of the ceiling.\n /\nexport interface AppConfiguration_MinionEntry {\n resourceAccess?: { read: string[]; write: string[] };\n /* R4/R5 — see the platform-access axis. Structural on purpose; the closed\n * vocabulary is enforced at authoring and at the apps-manager door. /\n platformAccess?: { scopes?: string[] };\n /\n KD-12 — when `mode === 'cron'` and `schedule` is provided, the\n * backend-api's `cron-job-sync.backend.service.ts` registers a\n * `MINION_TICK` CronJob record on `platform-crontabs-batches-manager`\n * so the per-minion queue actually fires on schedule. Carried\n * through from `wildo.minion.config.ts` per the CLI merge in\n * `app-runtime-targets.service.ts`.\n /\n mode?: AppConfigurationMinionMode;\n schedule?: string;\n}\n\n/\n The named runtime source for the minion execution-mode vocabulary (KD-3).\n \n A const object rather than a nominal enum, deliberately: the AUTHORING surface for these values\n * is `defineMinionConfig` in `platform-config-lib` (which this engine package must not depend on,\n * and which declares the same wire values structurally), and the CLI merge in\n * `app-runtime-targets.service.ts` carries them across that seam as plain strings. A nominal enum\n * here would break that seam's assignability while unifying nothing. When the vocabulary ever\n * gains a member, add it here AND in `define-minion-config.ts` in the same change — the two\n * declarations share wire values by contract, not by import.\n /\nexport const APP_CONFIGURATION_MINION_MODES = {\n /* A long-running daemon; self-ticks from its own loop, never registered as a CronJob. /\n ALWAYS_UP: 'always-up',\n /* Fired on `schedule` via a `MINION_TICK` CronJob record (KD-12). /\n CRON: 'cron',\n} as const;\n\nexport type AppConfigurationMinionMode = (typeof APP_CONFIGURATION_MINION_MODES)[keyof typeof APP_CONFIGURATION_MINION_MODES];\n\nconst AppConfiguration_MinionEntrySchema: z.ZodType<AppConfiguration_MinionEntry> = z.strictObject({\n resourceAccess: MinionResourceAccessSchema.optional(),\n platformAccess: z.strictObject({ scopes: z.array(z.string().min(1)).optional() }).optional(),\n mode: z.enum(APP_CONFIGURATION_MINION_MODES).optional(),\n schedule: z.string().min(1).optional(),\n});\n\nconst AppConfiguration_MinionsSchema = z.record(\n z.string().min(1),\n AppConfiguration_MinionEntrySchema,\n).default({});\n\nconst AppConfiguration_WorkersSchema = z.record(\n z.string().min(1),\n z.strictObject({\n name: z.string().min(1),\n displayName: z.string().min(1),\n description: z.string().optional(),\n runtime: z.strictObject({\n type: z.string().min(1),\n language: z.string().min(1),\n }),\n http: z.strictObject({\n port: z.number().int().positive(),\n healthPath: z.string().min(1).startsWith('/'),\n readyPath: z.string().min(1).startsWith('/'),\n metricsPath: z.string().min(1).startsWith('/').optional(),\n }),\n auth: z.literal('wildo-jwt'),\n replicas: z.number().int().positive(),\n resources: z.strictObject({\n cpu: z.string().min(1).optional(),\n memory: z.string().min(1).optional(),\n }).optional(),\n dataAccess: z.strictObject({\n database: z.enum(['read-only', 'read-write', 'none']).optional(),\n cache: z.boolean().optional(),\n queue: z.enum(['consumer', 'producer', 'both', 'none']).optional(),\n }).optional(),\n }),\n).default({});\n\n/* ──────────────────────────────────────────────────────────────\n * Auth Backend-Only Enums\n * ────────────────────────────────────────────────────────────── /\n\nexport enum Argon2Type {\n ARGON2D = 'argon2d',\n ARGON2I = 'argon2i',\n ARGON2ID = 'argon2id',\n}\n\nexport enum AuthenticatorAttachment {\n PLATFORM = 'platform',\n CROSS_PLATFORM = 'cross-platform',\n ANY = 'any',\n}\n\nexport enum UserVerification {\n REQUIRED = 'required',\n PREFERRED = 'preferred',\n DISCOURAGED = 'discouraged',\n}\n\n/* W3C AttestationConveyancePreference — all four values per the spec. /\nexport enum AttestationType {\n NONE = 'none',\n INDIRECT = 'indirect',\n DIRECT = 'direct',\n ENTERPRISE = 'enterprise',\n}\n\nexport enum TotpAlgorithm {\n SHA1 = 'SHA1',\n SHA256 = 'SHA256',\n SHA512 = 'SHA512',\n}\n\n/* ──────────────────────────────────────────────────────────────\n * Database & Infrastructure Enums\n * ────────────────────────────────────────────────────────────── /\n\nexport enum MongoDBProtocol {\n MONGODB = 'mongodb',\n MONGODB_SRV = 'mongodb+srv'\n}\n\nexport { PostgreSQLSSLMode } from '@wildo-ai/saas-models';\n\nconst Argon2PasswordHashingSchema = z.object({\n type: z.enum(Argon2Type),\n memoryCost: z.number(),\n timeCost: z.number(),\n parallelism: z.number(),\n});\n\nconst PasskeyOperationalSchema = z.object({\n authenticatorAttachment: z.enum(AuthenticatorAttachment),\n requireResidentKey: z.boolean(),\n userVerification: z.enum(UserVerification),\n timeoutSeconds: z.number().min(30).max(600),\n attestation: z.enum(AttestationType),\n});\n\nconst SmsOtpOperationalSchema = z.object({\n otpLength: z.number().min(4).max(8),\n expiryMinutes: z.number().min(1).max(30),\n /* Max SMS sends per phone per minute (burst protection) /\n rateLimitBurst: z.number().min(1).max(5),\n /* Max SMS sends per phone per hour (cost control) /\n rateLimitHourly: z.number().min(1).max(20),\n});\n\nconst EmailOtpOperationalSchema = z.object({\n otpLength: z.number().min(4).max(8),\n expiryMinutes: z.number().min(1).max(30),\n rateLimitPerMinute: z.number().min(1).max(5),\n});\n\nconst OtpOperationalSchema = z.object({\n smsOtp: SmsOtpOperationalSchema,\n emailOtp: EmailOtpOperationalSchema,\n});\n\nconst MagicLinkOperationalSchema = z.object({\n tokenExpiryMinutes: z.number().min(1).max(60),\n rateLimitPerMinute: z.number().min(1).max(5),\n rateLimitPerHour: z.number().min(1).max(20),\n});\n\nconst TotpOperationalSchema = z.object({\n issuer: z.string().optional(),\n algorithm: z.enum(TotpAlgorithm),\n digits: z.number().min(6).max(8),\n period: z.number().min(15).max(300),\n window: z.number().min(0).max(10),\n qrCodeSize: z.number().min(100).max(400),\n includeIssuerInLabel: z.boolean(),\n});\n\n/* ──────────────────────────────────────────────────────────────\n * Backend Auth Schema — extends shared auth with backend-only operational config.\n * The shared auth schema is the frontend-safe subset; this adds hashing,\n * lockout, OTP operational, passkey ceremony, TOTP, and magic link tuning.\n * toAppConfiguration_Shared() strips backend-only fields before sending to frontend.\n * ────────────────────────────────────────────────────────────── /\n\nexport const AppConfiguration_AuthSchema = AppConfiguration_Shared_AuthSchema.extend({\n /* Backend-only: full social OAuth2 provider authoring/config branch /\n socialOAuth2Providers: OAuth2ProvidersConfigSchema.default({}),\n\n /\n Backend-only: OAuth Client ID Metadata Documents posture (how much of the open internet this\n * deployment accepts as a client identity at `/oauth/authorize`).\n \n OPTIONAL, and absence means `DISABLED` — the fail-closed default. An application that never\n * mentions CIMD must never find itself fetching a stranger's URL, which is an SSRF surface it\n * did not ask for.\n /\n cimd: CimdApplicationConfigSchema.optional(),\n\n /\n Backend-only: RFC 7591 dynamic client registration (`POST /oauth/register`).\n \n OPTIONAL and off by default. Absent means the endpoint 404s and `registration_endpoint` is not\n * advertised — an anonymous row-creation primitive is not something an application should acquire\n * by upgrading the framework.\n /\n dynamicClientRegistration: DynamicClientRegistrationConfigSchema.optional(),\n\n /* Backend-only: password hashing configuration (rules are in shared passwordPolicy) /\n passwordHashing: z.object({\n argon2: Argon2PasswordHashingSchema.optional(),\n }),\n\n // W6.8: passwordExpiryDays, maxConcurrentSessions, lockoutPolicy REMOVED.\n // These are now per-user-type in userTypes[t].auth (entity-identity-config.shared.schemas.ts).\n\n /* Backend-only: passkey WebAuthn ceremony tuning (identity fields rpName/rpId stay in shared passkeyConfig) /\n passkeyOperational: PasskeyOperationalSchema,\n\n /* Backend-only: OTP operational config (enabled flags stay in shared smsOtp/magicLink) /\n otpOperational: OtpOperationalSchema,\n\n /* Backend-only: magic link operational config /\n magicLinkOperational: MagicLinkOperationalSchema,\n\n /* Backend-only: TOTP operational config /\n totpOperational: TotpOperationalSchema,\n\n /\n Backend-only: the `Domain` attribute for the anonymous-session\n * continuity cookie (`__wildo_anon_session`, set by\n * `AnonymousSessionBackendService.setSessionCookie`).\n \n The cookie carries the anonymous session across the marketing-site\n * apex → app subdomain → API cross-origin boundary so a lead / draft\n * captured on the public website transposes to the user's account on\n * signup / login with NO frontend handoff (the app's login reads the\n * session from this cookie as a fallback to the `x-anonymous-session`\n * header).\n \n - UNSET (default) ⇒ host-only cookie. Correct for local dev, where\n * the website / app / API all share the `localhost` host (cookies\n * ignore the port, so a host-only `localhost` cookie is already\n * shared across the dev ports).\n * - SET to the REGISTRABLE PARENT domain in production (e.g.\n * `wonder-todos.com`) so the cookie set by `api.<brand>` is\n * also sent to the apex marketing site AND the `app.<brand>`\n * subdomain. Author the value per-environment (it is derived from\n * the deployment's public domain), NOT as a single app-wide\n * constant — an env-specific parent domain set on a `localhost`\n * response would be rejected by the browser.\n \n Intentionally NOT public-suffix-derived: guessing the registrable\n * domain from the host is fragile (the PSL changes, multi-label\n * eTLDs exist). An explicit operator-authored value is the safe\n * contract. Frontend-invisible (backend-only) because only the\n * backend sets / reads the cookie — the browser carries it\n * transparently.\n /\n anonymousSessionCookieDomain: z.string().optional(),\n});\n\nexport const AppConfiguration_ComplianceSchema = AppConfiguration_Shared_ComplianceSchema\n\n\nexport const AppConfiguration_AppIdentity_Schema = AppConfiguration_Shared_AppIdentity_Schema\nexport const AppConfiguration_AppPreferencesLanguage_Schema = AppConfiguration_Shared_AppPreferencesLanguage_Schema\n\n/* ──────────────────────────────────────────────────────────────\n * Internal Schemas with z.ZodObject type annotation\n \n ✅ Preserves all ZodObject methods (.extend, .partial, .omit, .pick, .shape)\n * ✅ Compatible with isolatedDeclarations: true (OXC)\n * ────────────────────────────────────────────────────────────── /\n\n// Backend runtime schema builder: allows ALL application types (including platform) and exposes both URLs\nexport const appConfiguration_Backend_RuntimeSchemaBuilder = <T extends AllApplicationTypes>(appTypeSchema: z.ZodType<T>) => {\n return z.object({\n /\n URL map per application type. Platform service URLs and app endpoint URLs.\n * After T5, these are built from env vars + developer overrides (not fetched from apps-manager).\n * Empty default — the loading chain and developer overrides populate this.\n /\n endPoints: z.record(z.string(), z.object({\n publicUrl: z.string().optional(),\n internalUrl: z.string().optional(),\n })).default(() => ({})),\n appCustomRoot: z.string().optional(),\n /\n Optional partial override of the HTTP-server runtime configuration\n * baked into `RuntimeConfigurationSchema` (see\n * `engine/saas-backend-lib/src/runtime/models/runtime.backend.schemas.ts`).\n \n The Zod `.partial()` lets apps author only the fields they need to\n * change — everything else falls back to the schema's defaults during\n * the merge that happens inside\n * `HttpServerBackendService.extractRuntimeConfig`.\n \n Canonical use: the dev companion overrides the framework default\n * `requestTimeout: 300_000` (5 min) to ~30 min so long-running LLM\n * batch endpoints (`/api/companion/labelling/labellize`,\n * `/api/companion/labelling/translate`, email generation, market\n * generation) don't get killed mid-stream by Node's HTTP server\n * `requestTimeout`. The 5-min default is correct for app traffic;\n * the companion's LLM-bound endpoints legitimately exceed it.\n \n App authors generally do NOT touch this — the defaults are right\n * for production app traffic. Setting it loosely on a public-internet\n * app is a footgun (a slow client can hold a server thread for the\n * full timeout window).\n /\n httpServerConfiguration: z.object({\n requestTimeout: z.number().positive().optional(),\n bodyParserLimit: z.string().optional(),\n urlEncodedLimit: z.string().optional(),\n trustProxy: z.boolean().optional(),\n etag: z.boolean().optional(),\n compression: z.boolean().optional(),\n maxConnections: z.number().positive().optional(),\n keepAliveTimeout: z.number().positive().optional(),\n headersTimeout: z.number().positive().optional(),\n }).optional(),\n })\n}\n\nexport const AppConfiguration_RuntimeSchema = appConfiguration_Backend_RuntimeSchemaBuilder<AllApplicationTypes>(AllApplicationTypesSchema);\n\n/\n Simplified brand tokens for email templates.\n * App developers set high-level brand values; the email service\n * derives the full `EmailBrandTokens` palette (with fallback defaults).\n /\nexport const EmailBrandTokens_ConfigSchema = z.object({\n primaryColor: z.string().optional(),\n secondaryColor: z.string().optional(),\n fontFamily: z.string().optional(),\n logoUrl: z.string().optional(),\n});\n\nexport type EmailBrandTokens_Config = z.infer<typeof EmailBrandTokens_ConfigSchema>;\n\nexport const AppConfiguration_Email_Schema = z.object({\n from: z.email({ error: 'Valid from email required' }),\n replyTo: z.email().optional(),\n isTransactionalWildoManaged: z.boolean(),\n isMarketingWildoManaged: z.boolean(),\n brandTokens: EmailBrandTokens_ConfigSchema.optional(),\n});\n\n\nexport const AppConfigBackend_Monitoring_Schema = z.object({\n metrics: z.object({\n enabled: z.boolean().default(false),\n collectDefaultMetrics: z.boolean().default(true),\n }),\n});\n\n/\n PostgreSQL connection pool configuration\n /\nconst PostgreSQL_PoolConfig_Schema = z.object({\n /* Minimum number of connections in the pool /\n min: z.number().int().min(0).default(2),\n /* Maximum number of connections in the pool /\n max: z.number().int().min(1).default(10),\n /* Idle timeout in milliseconds (connections idle longer than this are closed) /\n idleTimeoutMs: z.number().int().min(0).default(30000),\n /\n How long to wait for a connection from the pool before failing.\n \n Read by `PostgreSQLDatabaseBackendService` (`connectionTimeoutMillis`) but never DECLARED here\n * — another field the `as any` on `pgConfig` concealed. Left OPTIONAL with no default on purpose:\n * `pg` treats absent as \"wait indefinitely\", and inventing a timeout would change the failure\n * behaviour of every existing deployment as a side effect of typing the field.\n /\n connectionTimeoutMs: z.number().int().min(0).optional(),\n});\n\n/\n PostgreSQL configuration schema\n /\nconst PostgreSQL_Config_Schema = z.object({\n /* Is PostgreSQL enabled for this application? /\n enabled: z.boolean().default(false),\n /\n Where the database lives. TOPOLOGY, mirroring MongoDB's `host` — credentials stay in\n * `secrets.database.postgresql`.\n \n These were MISSING from this schema while `PostgreSQLDatabaseBackendService` already read them\n * as `(pgConfig as any)?.host` / `?.port`. So the service consumed two fields the contract did not\n * declare, and the `as any` is what stopped the compiler from saying so — the exact shape this\n * workstream keeps finding. Adding them makes the read type-checked and lets the config loader\n * populate the branch from the environment at all.\n /\n host: z.string().min(1).optional(),\n port: z.number().int().min(1).max(65535).optional(),\n /* Database name (can be overridden in secrets) /\n databaseName: z.string().optional(),\n /* SSL mode for connection security /\n sslMode: z.enum(PostgreSQLSSLMode).default(PostgreSQLSSLMode.REQUIRE),\n /* Connection pool configuration /\n pool: PostgreSQL_PoolConfig_Schema.optional(),\n});\n\n/\n MongoDB configuration schema with enabled flag\n /\nconst MongoDB_Config_Schema = z.object({\n /* Is MongoDB enabled for this application? /\n enabled: z.boolean(),\n /* MongoDB host (cluster or standalone) /\n host: z.string().min(1, { error: 'MongoDB host is required' }),\n /* MongoDB database name /\n database: z.string().min(1, { error: 'MongoDB database name is required' }),\n /* Connection protocol /\n protocol: z.enum(MongoDBProtocol),\n /* Connection options /\n options: z.object({\n retryWrites: z.boolean(),\n w: z.union([z.string(), z.number()]),\n appName: z.string().optional(),\n authSource: z.string(),\n directConnection: z.boolean().optional(),\n })\n});\n\nexport const AppConfigBackend_Database_Schema = z.object({\n /\n Default persistence adapter for resources that don't specify one.\n * - 'mongodb': MongoDB with Mongoose ORM (default)\n * - 'postgresql': PostgreSQL (Kysely-based SQL adapter)\n \n In practice this is THE adapter, not merely the default. An application is wholly one\n * adapter unless a resource explicitly opts out, because two adapters cannot share a native\n * transaction — so a resource declaring `ResourceConfiguration.persistenceAdapter` with a\n * DIFFERENT value is refused at registration by `ResourcesRegistryBackendService`.\n \n A resource may override this only by declaring `ResourceConfiguration.persistenceAdapter`\n * together with `ResourceConfiguration.persistenceAdapterIsolation` — a named claim (see\n * `ResourcePersistenceAdapterIsolation`) that the resource takes part in no cross-adapter\n * atomic write. The admitted set is logged at startup, and the persistence unit of work still\n * refuses any real cross-adapter atomic boundary at runtime.\n \n This paragraph used to read \"Individual resources can override this via\n * ResourceConfiguration.persistenceAdapter\", which the registry had refused outright since the\n * one-adapter-per-application rule landed. Contract and behaviour now agree.\n /\n defaultAdapter: z.enum(PersistenceAdapter),\n\n /\n The format NEW resource identifiers are minted in.\n \n Declared, never derived from the adapter. It used to be a function of the persistence\n * adapter — MongoDB implied `OBJECT_ID`, PostgreSQL implied `UUID` — which made an application's\n * identity format a side effect of where its rows happen to live. Moving one resource to another\n * adapter then silently changed the shape of every id it minted, and made every id it had ALREADY\n * minted fail `validateForResource`, because that check compared a stored, historical value\n * against the currently-configured format.\n \n Identity format is an application-level decision (it reaches URLs, external references, exports\n * and integrations), so it is declared here and applies uniformly. Storage is free to change\n * underneath it; `formatForQuery` still adapts the value to each dialect, which is the part that\n * genuinely IS adapter-specific.\n \n Defaults to `OBJECT_ID`, which is what every existing application already mints.\n \n Deployment constraint, and it bites in exactly one place. On PostgreSQL the `_id` COLUMN\n * TYPE must be able to hold the declared format. The SQL planner already types it from the schema\n * (`z.string()` → `text`), so a migration built from the plan is correct for either format — but a\n * hand-written `_id uuid` column silently restricts the application to `UUID`, and rejects an\n * `OBJECT_ID` with `invalid input syntax for type uuid`. Two integration fixtures had exactly that\n * DDL and only passed while format was still derived from the adapter.\n \n For the same reason, do NOT give `_id` a database default (`gen_random_uuid()`): identity is\n * minted by `ResourceIdBackendService` so that one rule governs it, and a column default would\n * produce a second format for any row that reached the table another way.\n /\n resourceIdFormat: z.enum(ResourceIdFormat).default(ResourceIdFormat.OBJECT_ID),\n\n /\n MongoDB configuration — OPTIONAL, and absent when the environment supplies no MongoDB address.\n \n Host/database/protocol come from env (`MONGODB_HOST`, `MONGODB_DATABASE`, `MONGODB_PROTOCOL`).\n \n REQUIRED until 2026-08-28, while `postgresql` beside it was already optional — and the asymmetry\n * was a defect, for the precise reason that field's own JSDoc gives: a branch with `enabled: true`\n * and no host passes the registry's boot check (\"is the declared adapter enabled?\") and then fails\n * at the first connection, which is the wrong place to learn about it.\n \n Because the loader built this branch unconditionally, `database.mongodb.enabled` was `true` on\n * every runtime that has ever existed — including one with no mongod within reach — so nothing\n * could ask \"does this runtime have a MongoDB?\" and get a true answer. `wonder-crm` (PostgreSQL on\n * both planes, no mongod declared) is where that was met: its readiness gate probed a MongoDB it\n * does not have and would have reported 503 with no way to become ready.\n \n ABSENT now means exactly what it means for PostgreSQL: this runtime has no MongoDB.\n /\n mongodb: MongoDB_Config_Schema.optional(),\n\n /* PostgreSQL configuration (optional, disabled by default) /\n postgresql: PostgreSQL_Config_Schema.optional(),\n\n /* Redis configuration — after T5, host/port come from env vars /\n redis: z.object({\n host: z.string().default('localhost'),\n port: z.number().int().min(1).max(65535).default(6379),\n db: z.number().int().min(0).default(0),\n /\n Slice 3.6 (F-43) — canonical app-level Redis key namespace.\n \n Sourced from `wildo.saas.config.dataServices.redis.keyPrefix` and\n * threaded into the backend via the `REDIS_KEY_PREFIX` env. When\n * present here, `RedisService.connect()` adopts it as `appPrefix`\n * (replacing the legacy `secrets.database.redis.username`-derived\n * prefix). When unauthored, `RedisService.connect()` falls back to\n * the slug-derived `<appSlug>:` default (2026-05-26 ACL-alignment\n * fix — the previous literal `'saas:'` schema default was global\n * across every un-authored app and `NOPERM`-collided with the\n * per-app ACL grant `~<appSlug>:` provisioned by apps-manager).\n \n * NOTE: Without this field on the AppConfiguration redis schema, the\n * loader-injected `keyPrefix` would be silently stripped at schema\n * parse time (`z.object` strips unknown keys), defeating the entire\n * Slice 3.6 wiring. This is the boundary where the two schemas\n * (connection-tuning vs app config) intentionally overlap.\n /\n keyPrefix: z.string().optional(),\n }).optional(),\n\n /* RabbitMQ configuration — after T5, host/port come from env vars /\n rabbitmq: z.object({\n host: z.string().default('localhost'),\n port: z.number().int().min(1).max(65535).default(5672),\n /\n Optional virtual host. Slice 2.5c-3 of `infra-provider-planner.md`:\n * activates per-app vhost isolation when authored at\n * `wildo.infra.<envName>.config.ts > backingServices.rabbitmq.vhost`.\n * Apps-manager reads `RABBITMQ_VHOST` from process.env (written by\n * `env-vars-builder.service.ts`) and threads it here. The engine\n * `RabbitMQAdapterBackendService` reads it via\n * `appConfig.database.rabbitmq.vhost` and passes it to the broker\n * connection URL (`adapter.configure({...vhost})`); when omitted\n * the adapter falls back to the default vhost `/`.\n \n `RabbitmqSelfInfraProviderModule.mintAppCredentials` is\n * orchestrator-driven: when the lifecycle service supplies the\n * vhost via `applicationConfigInputs.vhost`, the module calls\n * `ensureVhost(...)` and sets permissions ON that vhost; otherwise\n * the per-app user lands on `/` with regex-based isolation\n * (legacy Slice 2 behavior).\n /\n vhost: z.string().optional(),\n }).optional()\n});\n\n\n\n/* L6: Schema for a rotated public key entry, including its kid for header matching. /\nexport const RotatedPublicKeyEntry_Schema = z.object({\n /* The key ID that was used when signing tokens with this key (matches JWT header `kid`). /\n kid: z.string(),\n /* The PEM-encoded public key. /\n publicKey: z.string(),\n /\n OPTIONAL self-retirement instant. When set, this rotated key STOPS being advertised in the JWKS and STOPS\n * verifying tokens once the instant has passed — so an operator can schedule a compromised or aged prior key\n * to expire WITHOUT a redeploy or a manual config removal. Absent = the key stays valid until it is removed\n * from config (the prior behavior; a rotated key was otherwise time-unbounded in code, fenced only by the\n * token's own `exp`). Coerced from an ISO-8601 string when authored as text.\n * assurance-control: WILDO.IDENTITY.SIGNING_KEY_LIFECYCLE — bounds a retired signing key's lifetime.\n /\n notAfter: z.coerce.date().optional(),\n});\n\nexport const AppConfiguration_JWT_Schema = z.object({\n /\n JWT public keys per verifiable key type.\n * After T5, these are the ONLY config fetched from apps-manager (dynamic, rotatable).\n * Defaults to empty — populated by fetchAndMergeFromAppsManager() at startup.\n /\n publicKey: z.record(z.string(), z.string()).default(() => ({})).refine(\n (val) => Object.keys(val).every(key => {\n try {\n VerifiableJwtKeysSchema.parse(key);\n return true;\n } catch {\n return false;\n }\n }),\n { error: 'Invalid JWT key type' }\n ),\n /\n L6: Previous public keys for key rotation. Maps key type to an array of { kid, publicKey } entries.\n * Verification decodes the JWT header `kid` and matches against these entries.\n * Sign always uses the current key. Remove rotated keys after their max token TTL has elapsed.\n /\n rotatedPublicKeys: z.record(z.string(), z.array(RotatedPublicKeyEntry_Schema)).optional().default(() => ({})),\n refreshTokenExpirationDays: z.number(),\n /* Access token TTL in minutes. /\n accessTokenExpirationMinutes: z.number().min(1).max(1440),\n});\n\n/\n Where the managed object store lives. Platform-injected topology, NOT a\n * credential — the credential is a short-lived, prefix-confined STS session\n * fetched from apps-manager and never appears in configuration.\n * See `.claude/plans/object-storage-root-credential-distribution.md`.\n /\nexport const AppConfiguration_Storage_ManagedConnectionSchema = z.object({\n /* Host or URL of the object store. /\n endpoint: z.string().min(1),\n port: z.number().int().positive(),\n useSsl: z.boolean(),\n /* Infra-controlled bucket. N applications share one bucket. /\n bucket: z.string().min(1),\n /\n Object-key namespace prefix, authored by the application. Cosmetic only:\n * isolation is enforced by the session policy, which keys on the\n * platform-minted `applicationId` and never on this value — an application\n * cannot be trusted to author its own boundary.\n /\n bucketPrefix: z.string().optional(),\n});\n\n/* Filesystem root for the local-directory storage provider. /\nexport const AppConfiguration_Storage_LocalDirectoryConnectionSchema = z.object({\n baseDir: z.string().min(1),\n});\n\n/\n Storage configuration — deliberately holding BOTH application policy and\n * platform-injected topology, mirroring `AppConfigBackend_Database_Schema`,\n * which carries `defaultAdapter` (an app decision) beside `mongodb.host` (a\n * platform-injected connection detail).\n \n The two halves have different owners and it is worth keeping that legible:\n * `maxFileSize` is authored by the application; `managed` / `localDirectory` are\n * injected by the configuration loader. Both connection blocks are OPTIONAL —\n * an application configures at most one storage provider, and an application\n * with no file feature configures neither.\n /\nexport const AppConfiguration_StorageSchema = z.object({\n maxFileSize: z.number(),\n managed: AppConfiguration_Storage_ManagedConnectionSchema.optional(),\n localDirectory: AppConfiguration_Storage_LocalDirectoryConnectionSchema.optional(),\n});\n\n/\n Default ports for the file-pipeline sidecars.\n \n They live HERE, with the derivation, rather than in each consuming service —\n * the consumer now receives a fully-resolved connection, so a default owned by\n * the consumer would be a second source that can disagree with the one the\n * configuration was built from. Values match the upstream images' own defaults\n * (ClamAV clamd 3310, the YARA sidecar 8080).\n /\nconst CLAMAV_DEFAULT_PORT = 3310;\nconst YARA_DEFAULT_PORT = 8080;\n\n// NOTE: `AppConfiguration_ConnectionScheme` (the inbound-dial http/https vocabulary) was deleted\n// on 2026-08-26 with the Weaviate RAG lane — its only consumers were the Weaviate connection\n// surfaces. The rule its JSDoc carried still holds and is restated here so it survives the enum:\n// an inbound dial scheme and a published edge scheme share wire values and nothing else, so if\n// either concept returns it gets its OWN named vocabulary rather than an inlined literal union.\n\n/* A scanning sidecar reachable over HTTP. Platform-injected topology. /\nexport const AppConfiguration_FileScanning_ServiceConnectionSchema = z.object({\n host: z.string().min(1),\n port: z.number().int().positive(),\n});\n\n/\n File-scanning configuration.\n \n `yara.enabled` and `yara.connection` are two INDEPENDENT axes and must stay\n * that way: the startup validator reports \"explicitly enabled but not\n * configured\" as its own issue, so collapsing them into one optional block\n * would silently turn a misconfiguration into \"scanning is simply off\".\n * ClamAV has no such opt-in — presence of a host IS the opt-in.\n /\nexport const AppConfiguration_FileScanningSchema = z.object({\n antivirus: AppConfiguration_FileScanning_ServiceConnectionSchema.optional(),\n yara: z.object({\n enabled: z.boolean(),\n connection: AppConfiguration_FileScanning_ServiceConnectionSchema.optional(),\n }).optional(),\n});\n\n/\n The environment slice that DEFINES object-storage topology, already coerced\n * (`STORAGE_PORT` a number, `STORAGE_USE_SSL` a boolean) — the shape\n * `ApplicationEnvConfigurationSchema` produces for these keys.\n /\nexport interface StorageTopologyEnvironmentSource {\n STORAGE_ENDPOINT?: string \| undefined;\n STORAGE_PORT?: number \| undefined;\n STORAGE_USE_SSL?: boolean \| undefined;\n STORAGE_BUCKET?: string \| undefined;\n STORAGE_BUCKET_PREFIX?: string \| undefined;\n STORAGE_LOCAL_BASE_DIR?: string \| undefined;\n}\n\n/\n The environment slice that DEFINES the file-pipeline service topology\n * (antivirus and YARA sidecars), already coerced — the shape\n * `ApplicationEnvConfigurationSchema` produces for these keys.\n /\nexport interface FileServicesTopologyEnvironmentSource {\n CLAMAV_HOST?: string \| undefined;\n CLAMAV_PORT?: number \| undefined;\n YARA_ENABLED?: boolean \| undefined;\n YARA_HOST?: string \| undefined;\n YARA_PORT?: number \| undefined;\n}\n\n/* Every platform-injected topology section, so a construction path seeds them together. /\nexport interface PlatformInjectedTopologySections {\n storage: AppConfiguration_StorageTopology;\n fileScanning: z.infer<typeof AppConfiguration_FileScanningSchema>;\n}\n\n/* The platform-injected half of {@link AppConfiguration_StorageSchema}. /\nexport type AppConfiguration_StorageTopology = Pick<\n z.infer<typeof AppConfiguration_StorageSchema>,\n 'managed' \| 'localDirectory'\n>;\n\n/\n Derive the platform-injected storage topology from environment material.\n \n ## Why this is a shared function rather than an inline mapping\n \n Storage consumers read `appConfigService.config.storage`, so the invariant is\n * \"EVERY path that constructs an `AppConfiguration` carries this topology\". That\n * is not one call site — it is the application loader plus every platform\n * service, each of which builds its configuration a different way:\n * `buildConfigFromEnv` (applications), `initializeWithMinimalConfig`\n * (crontabs-batches-manager and the shared platform startup base),\n * and two hand-authored `hydrateResolvedConfiguration` inputs (apps-manager,\n * module-registry). All four run the app-tier `WildoManagedStorageProvider` in\n * their own process, and the module registry publishes its artifacts through it.\n \n A path that omits the topology does not fail — the provider reports itself\n * UNCONFIGURED and the router SKIPS it, which disables the file feature in\n * silence. One shared derivation is what keeps a fifth construction path from\n * re-deriving this slightly differently, or forgetting it entirely.\n * See `.claude/rules/invariant-call-site-enumeration.md`.\n \n Each block is emitted ONLY when its defining value is present, for the same\n * reason: seeding a plausible default would make an unconfigured runtime look\n * configured, and it would fail later at an object operation rather than here.\n /\nexport function buildStorageTopologyFromEnvironment(\n env: StorageTopologyEnvironmentSource,\n): AppConfiguration_StorageTopology {\n return {\n ...(env.STORAGE_ENDPOINT\n ? {\n managed: {\n endpoint: env.STORAGE_ENDPOINT,\n port: env.STORAGE_PORT ?? INFRA_DEFAULT_PORTS.MINIO,\n useSsl: env.STORAGE_USE_SSL ?? false,\n bucket: env.STORAGE_BUCKET ?? STORAGE_DEFAULTS.BUCKET,\n // Absent rather than empty-string when unauthored: the provider\n // distinguishes \"no prefix\" from \"a prefix that is the empty string\"\n // only by absence.\n ...(env.STORAGE_BUCKET_PREFIX ? { bucketPrefix: env.STORAGE_BUCKET_PREFIX } : {}),\n },\n }\n : {}),\n ...(env.STORAGE_LOCAL_BASE_DIR ? { localDirectory: { baseDir: env.STORAGE_LOCAL_BASE_DIR } } : {}),\n };\n}\n\n/\n Coerce raw environment strings into {@link StorageTopologyEnvironmentSource}.\n \n For callers that never parse `ApplicationEnvConfigurationSchema` — the platform\n * services, which assemble their configuration by hand. The coercions MUST match\n * that schema's (`z.coerce.number()` for the port, the literal `'true'` test for\n * SSL); `storage-topology.backend.schemas.test.ts` pins the two against each\n * other so a change to one that is not made to the other fails rather than\n * quietly giving platform services a different topology than applications.\n /\n/\n Derive the file-pipeline service topology (antivirus, YARA) from environment\n * material. Same contract and same reasoning as\n * {@link buildStorageTopologyFromEnvironment}: a section is emitted only when its\n * defining value is present, because a plausible default reads as \"configured\"\n * to a subsystem whose whole configuration test is \"is a host set?\".\n \n The YARA block is emitted when EITHER key is present, precisely so\n * \"enabled but no host\" survives as a distinguishable state for the startup\n * validator to report.\n /\nexport function buildFileServicesTopologyFromEnvironment(\n env: FileServicesTopologyEnvironmentSource,\n): Pick<PlatformInjectedTopologySections, 'fileScanning'> {\n return {\n fileScanning: {\n ...(env.CLAMAV_HOST\n ? { antivirus: { host: env.CLAMAV_HOST, port: env.CLAMAV_PORT ?? CLAMAV_DEFAULT_PORT } }\n : {}),\n ...(env.YARA_ENABLED !== undefined \|\| env.YARA_HOST\n ? {\n yara: {\n enabled: env.YARA_ENABLED === true,\n ...(env.YARA_HOST\n ? { connection: { host: env.YARA_HOST, port: env.YARA_PORT ?? YARA_DEFAULT_PORT } }\n : {}),\n },\n }\n : {}),\n },\n };\n}\n\nexport function readStorageTopologyEnvironmentSource(\n raw: Record<string, string \| undefined>,\n): StorageTopologyEnvironmentSource {\n const rawPort = raw[ApplicationBackendDataEnvKeys.STORAGE_PORT];\n const rawUseSsl = raw[ApplicationBackendDataEnvKeys.STORAGE_USE_SSL];\n return {\n ...(raw[ApplicationBackendDataEnvKeys.STORAGE_ENDPOINT]\n ? { STORAGE_ENDPOINT: raw[ApplicationBackendDataEnvKeys.STORAGE_ENDPOINT] }\n : {}),\n ...(rawPort !== undefined && rawPort !== '' ? { STORAGE_PORT: Number(rawPort) } : {}),\n ...(rawUseSsl !== undefined ? { STORAGE_USE_SSL: rawUseSsl === 'true' } : {}),\n ...(raw[ApplicationBackendDataEnvKeys.STORAGE_BUCKET]\n ? { STORAGE_BUCKET: raw[ApplicationBackendDataEnvKeys.STORAGE_BUCKET] }\n : {}),\n ...(raw[ApplicationBackendDataEnvKeys.STORAGE_BUCKET_PREFIX]\n ? { STORAGE_BUCKET_PREFIX: raw[ApplicationBackendDataEnvKeys.STORAGE_BUCKET_PREFIX] }\n : {}),\n ...(raw[ApplicationBackendDataEnvKeys.STORAGE_LOCAL_BASE_DIR]\n ? { STORAGE_LOCAL_BASE_DIR: raw[ApplicationBackendDataEnvKeys.STORAGE_LOCAL_BASE_DIR] }\n : {}),\n };\n}\n\n/* Numeric coercion matching `z.coerce.number().optional()`: absent stays absent. /\nfunction readOptionalNumberEnv(raw: Record<string, string \| undefined>, key: string): number \| undefined {\n const value = raw[key];\n return value === undefined \|\| value === '' ? undefined : Number(value);\n}\n\n/\n Coerce raw environment strings into {@link FileServicesTopologyEnvironmentSource}.\n * The platform counterpart of {@link readStorageTopologyEnvironmentSource}; the same\n * parity pin covers it.\n /\nexport function readFileServicesTopologyEnvironmentSource(\n raw: Record<string, string \| undefined>,\n): FileServicesTopologyEnvironmentSource {\n const yaraEnabled = raw[ApplicationBackendDataEnvKeys.YARA_ENABLED];\n const clamavPort = readOptionalNumberEnv(raw, ApplicationBackendDataEnvKeys.CLAMAV_PORT);\n const yaraPort = readOptionalNumberEnv(raw, ApplicationBackendDataEnvKeys.YARA_PORT);\n return {\n ...(raw[ApplicationBackendDataEnvKeys.CLAMAV_HOST]\n ? { CLAMAV_HOST: raw[ApplicationBackendDataEnvKeys.CLAMAV_HOST] }\n : {}),\n ...(clamavPort !== undefined ? { CLAMAV_PORT: clamavPort } : {}),\n ...(yaraEnabled !== undefined ? { YARA_ENABLED: yaraEnabled === 'true' } : {}),\n ...(raw[ApplicationBackendDataEnvKeys.YARA_HOST]\n ? { YARA_HOST: raw[ApplicationBackendDataEnvKeys.YARA_HOST] }\n : {}),\n ...(yaraPort !== undefined ? { YARA_PORT: yaraPort } : {}),\n };\n}\n\n/\n Every platform-injected topology section, derived from raw environment in one\n * call.\n \n This exists so a config-construction path seeds them TOGETHER. Three of the\n * four paths hand-author an `AppConfiguration` (the platform services), which\n * means no type can force them to include a new section — the compiler never\n * sees the object as an `AppConfiguration`. One entry point is what keeps\n * \"remember to add the new section in four places\" from being the mechanism.\n * See `.claude/rules/invariant-call-site-enumeration.md`.\n /\nexport function buildPlatformInjectedTopologyFromProcessEnv(\n raw: Record<string, string \| undefined>,\n): PlatformInjectedTopologySections {\n return {\n storage: buildStorageTopologyFromEnvironment(readStorageTopologyEnvironmentSource(raw)),\n ...buildFileServicesTopologyFromEnvironment(readFileServicesTopologyEnvironmentSource(raw)),\n };\n}\n\nconst AppConfiguration_PreOverride_AuthSchema = AppConfiguration_Shared_AuthSchema.extend({\n socialOAuth2Providers: OAuth2ProvidersConfigSchema.optional(),\n passwordHashing: z.object({\n argon2: Argon2PasswordHashingSchema.partial().optional(),\n }).optional(),\n passkeyOperational: PasskeyOperationalSchema.partial().optional(),\n otpOperational: z.object({\n smsOtp: SmsOtpOperationalSchema.partial().optional(),\n emailOtp: EmailOtpOperationalSchema.partial().optional(),\n }).optional(),\n magicLinkOperational: MagicLinkOperationalSchema.partial().optional(),\n totpOperational: TotpOperationalSchema.partial().optional(),\n});\n\nconst AppConfiguration_PreOverride_Email_Schema = AppConfiguration_Email_Schema.partial({\n isTransactionalWildoManaged: true,\n isMarketingWildoManaged: true,\n});\n\nconst AppConfiguration_PreOverride_StorageSchema = AppConfiguration_StorageSchema.partial();\n\nconst AppConfiguration_PreOverride_Monitoring_Schema = z.object({\n metrics: z.object({\n enabled: z.boolean().optional(),\n collectDefaultMetrics: z.boolean().optional(),\n }).optional(),\n});\n\nconst AppConfiguration_PreOverride_JWT_Schema = AppConfiguration_JWT_Schema.partial({\n refreshTokenExpirationDays: true,\n accessTokenExpirationMinutes: true,\n});\n\n/* ──────────────────────────────────────────────────────────────\n * App-Managed Configuration\n \n Fields that application developers control via backend config files\n * (the config files in backend-api/src/config/). These define\n * the application's identity, behavior, and integrations.\n * ────────────────────────────────────────────────────────────── /\n\nexport const _AppConfiguration_AppManagedConfiguration_Schema = z.object({\n\n appIdentity: AppConfiguration_AppIdentity_Schema,\n\n /\n Generated brand assets — the runtime projection every logo/favicon/brand\n * consumer resolves against via `resolveBrandAsset` (composition × theme ×\n * purpose). This is a BACKEND-AUTHORABLE slot: it lives on the app-managed\n * config (NOT on the boundary-blocked `appIdentity`) and is NOT in the\n * backend-authored Omit set, so an app's `saas-config.backend.ts` composes it\n * from the CLI-generated `backend-api/src/brand-assets.generated.ts`\n * (`generatedBrandAssets`). Empty/absent until a brand is generated; backend\n * consumers fall back to undefined.\n /\n brandAssets: z.array(RuntimeBrandAssetSchema).optional(),\n\n appPreferences: z.object({\n languages: AppConfiguration_AppPreferencesLanguage_Schema,\n }),\n\n auth: AppConfiguration_AuthSchema,\n userTypes: UserTypesConfigSchema,\n frontendServices: FrontendServicesConfigSchema,\n organizationTypes: OrganizationTypesConfigSchema.optional(),\n compliance: AppConfiguration_ComplianceSchema,\n email: AppConfiguration_Email_Schema,\n storage: AppConfiguration_StorageSchema,\n // Platform-injected file-pipeline topology, seeded by the configuration loader\n // from environment material. Optional as a SECTION because an application with\n // no scanning sidecar configures none; the subsystems read absence as\n // \"not configured\" and skip, which is the pre-existing behaviour.\n fileScanning: AppConfiguration_FileScanningSchema.optional(),\n monitoring: AppConfigBackend_Monitoring_Schema,\n\n minions: AppConfiguration_MinionsSchema,\n workers: AppConfiguration_WorkersSchema,\n engineCapabilities: EngineCapabilityActivationsSchema,\n providers: ProvidersBlockSchema,\n providerConfigurations: ProviderConfigurationsSchema,\n billing: BillingConfigurationSchema.optional(),\n analytics: AnalyticsConfigSchema.optional(),\n lifecycle: LifecycleConfigSchema.optional(),\n // Phase 7 / Item 47 (Slice 5) — operator-tunable cron cadence for the\n // engine-owned `data-seeding:scheduled-rerun` batch. Optional: when\n // omitted, the batch factory falls back to the manifest's declared\n // default (currently `' * * * '`).\n dataSeeding: DataSeedingConfigSchema.optional(),\n // Audit Phase 5 / F1 — operator-tunable audit-log archival horizon consumed\n // by the engine-owned `compliance:audit-logs-archive` batch. Optional: when\n // omitted, no archival runs (records retained in AUDIT_LOGS indefinitely).\n auditTrail: AuditTrailConfigSchema.optional(),\n // WS-A tenant teardown — operator-tunable retention window, purge cron and\n // per-run bound consumed by the engine-owned `organization-purge` batch.\n // Optional: every field defaults, so omitting the block yields a working\n // 30-day window purged nightly rather than tenants that are never destroyed.\n tenantTeardown: TenantTeardownConfigSchema.optional(),\n});\n\n/* ──────────────────────────────────────────────────────────────\n * Platform-Managed Configuration\n \n Fields injected by the Wildo platform that developers do NOT\n * override (or only override infra-level details). These are\n * populated by the apps-manager / CLI / .env pipeline.\n \n Note: some sub-fields within these sections are conceptually\n * operator-tunable but NOT developer-tunable. The canonical example is\n * `jwt.{accessTokenExpirationMinutes, refreshTokenExpirationDays}`,\n * which Slice 3.3 moved out of `saas-config.backend.ts` and onto the\n * infra-environment policy (`wildo.infra.<env>.config.ts.serviceAuth`).\n * The application backend READS those values here at sign time, but\n * cannot author them — the apps-manager seeds the persisted\n * `Wildo_Application_Config.jwt.` from the operator-authored\n `serviceAuth` (with `WildoAuthConfigSchema` defaults of 15 min / 30\n * days when omitted \\u2014 access-token default tightened from 60 \\u2192\n * 15 in Auth-hardening Slice A Step 5 on 2026-04-13). The section as a\n * whole is classified by its\n * PRIMARY owner (the platform). Narrow app-authored seams inside\n * platform-managed sections must be modeled explicitly rather than\n * opened up as generic section patching.\n * ────────────────────────────────────────────────────────────── /\n\nexport const _AppConfiguration_PlatformManagedConfiguration_Schema = z.object({\n /\n `runtime.endPoints` is assembled from the env/bootstrap loading chain.\n * App backend authors declare service identities and policy, while runtime\n * topology stays outside the backendConfig contract.\n /\n runtime: AppConfiguration_RuntimeSchema,\n /\n After T5, database addresses come from env vars (MONGODB_, REDIS_, RABBITMQ_).\n The loading chain populates these explicit runtime values from env/bootstrap material.\n /\n database: AppConfigBackend_Database_Schema,\n /\n JWT public keys are fetched from apps-manager (dynamic, rotatable).\n * TTL values are app-authored policy and must be supplied by backendConfig\n * or another explicit config writer before final runtime parse.\n /\n jwt: AppConfiguration_JWT_Schema,\n});\n\n/* ──────────────────────────────────────────────────────────────\n * Full Application Configuration\n \n Composed from:\n * AppManagedConfiguration ∪ PlatformManagedConfiguration ∪ metadata\n \n The ApplicationEnvConfigurationSchema (from .env) contributes\n * values that get mapped into the runtime config via the loader\n * but is not merged here — it's parsed separately from process.env.\n * ────────────────────────────────────────────────────────────── /\n\n/\n The composed shape of {@link AppConfiguration_Schema}, hoisted into a value so the type below\n * has a NAME. Not a stylistic split — see the alias for why it is load-bearing.\n /\nexport const _AppConfiguration_Shape = {\n ..._AppConfiguration_AppManagedConfiguration_Schema.shape,\n ..._AppConfiguration_PlatformManagedConfiguration_Schema.shape,\n createdAt: z.coerce.date().default(() => new Date()),\n updatedAt: z.coerce.date().default(() => new Date()),\n};\n\n/\n ## Why this alias exists — it is load-bearing, not decoration\n \n Without an annotation, `AppConfiguration_Schema` infers a single ANONYMOUS `z.ZodObject<{…}>`\n * whose emitted declaration is ~570 lines of inline structural literal. A consumer that merely\n * `.parse()`s it is unaffected, but one that RE-INFERS from it (`.extend(...)`) must serialise that\n * literal again into its own `.d.ts`, plus whatever it adds. That crossed TypeScript's limit on\n * 2026-08-18 and broke the one such consumer with a pair of errors naming neither this file nor the\n * real cause:\n \n TS7056 The inferred type of this node exceeds the maximum length the compiler will serialize.\n * TS2742 The inferred type of 'X' cannot be named without a reference to\n * '../../node_modules/@wildo-ai/saas-models/src'.\n \n Nothing had changed here — this file was untouched for three days. Growth in the `saas-models`\n * types it composes pushed the INLINE form over the threshold, which is why the failure surfaced at\n * a consumer, during a rebuild, with no edit anywhere near it. That is the shape of this defect:\n * it is a function of SIZE, so it arrives without a culprit and it will arrive again for anything\n * that stays anonymous.\n \n Naming the shape fixes it for every consumer at once. The annotation emits\n * `z.ZodObject<AppConfiguration_Shape>`, so a consumer writes a NAME plus the two or three fields\n * it adds instead of re-expanding the whole configuration surface.\n \n Deliberately `z.ZodObject<…>` rather than `z.ZodType<AppConfiguration>`: consumers genuinely need\n * the object surface — `.extend()`, `.shape` and `.partial()` are all used against this schema and\n * the schemas derived from it — and `z.ZodType` erases every one of them.\n \n Built with `z.object(shape)` rather than `.extend()` because the spread produces a FLATTENED\n * object type that the annotation can restate exactly; `.extend()` returns Zod's internal `Extend<>`\n * mapped type, which an intersection alias is not assignable to (measured, not assumed). Both\n * component schemas are plain `z.object` with no catchall or modifiers, so the two forms are\n * equivalent at runtime — pinned by the `AppConfiguration_Schema` parse tests.\n /\nexport type AppConfiguration_Shape = typeof _AppConfiguration_Shape;\n\nexport const AppConfiguration_Schema: z.ZodObject<AppConfiguration_Shape> = z.object(_AppConfiguration_Shape);\n\nexport const AppConfiguration_PreOverrideSeed_Schema = z.object({\n appIdentity: AppConfiguration_AppIdentity_Schema,\n /* Optional pre-override — populated by the app's backendConfig brandAssets slot. /\n brandAssets: z.array(RuntimeBrandAssetSchema).optional(),\n appPreferences: z.object({\n languages: AppConfiguration_AppPreferencesLanguage_Schema,\n }),\n auth: AppConfiguration_PreOverride_AuthSchema,\n userTypes: UserTypesConfigSchema,\n frontendServices: FrontendServicesConfigSchema,\n organizationTypes: OrganizationTypesConfigSchema.optional(),\n compliance: AppConfiguration_ComplianceSchema,\n email: AppConfiguration_PreOverride_Email_Schema,\n storage: AppConfiguration_PreOverride_StorageSchema,\n fileScanning: AppConfiguration_FileScanningSchema.optional(),\n monitoring: AppConfiguration_PreOverride_Monitoring_Schema,\n minions: AppConfiguration_MinionsSchema,\n workers: AppConfiguration_WorkersSchema,\n engineCapabilities: EngineCapabilityActivationsSchema,\n providers: ProvidersBlockSchema,\n providerConfigurations: ProviderConfigurationsSchema,\n billing: BillingConfigurationSchema.optional(),\n analytics: AnalyticsConfigSchema.optional(),\n lifecycle: LifecycleConfigSchema.optional(),\n dataSeeding: DataSeedingConfigSchema.optional(),\n auditTrail: AuditTrailConfigSchema.optional(),\n tenantTeardown: TenantTeardownConfigSchema.optional(),\n runtime: AppConfiguration_RuntimeSchema,\n database: AppConfigBackend_Database_Schema,\n jwt: AppConfiguration_PreOverride_JWT_Schema,\n createdAt: z.coerce.date().default(() => new Date()),\n updatedAt: z.coerce.date().default(() => new Date()),\n});\n\n/\n Explicit synthetic placeholders used only for the pre-override startup seed.\n \n These are intentionally conspicuous so runtime validation can fail clearly if\n * a non-platform application reaches startup without replacing them via its\n * backendConfig.\n /\nexport const APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS = {\n appName: '__WILDO_PRE_OVERRIDE_APP_NAME__',\n version: '0.0.0-pre-override',\n passkeyRpName: '__WILDO_PRE_OVERRIDE_PASSKEY_RP_NAME__',\n passkeyRpId: 'pre-override.invalid',\n emailFrom: 'pre-override@invalid.localhost',\n} as const;\n\nexport interface BuildMinimalPreOverrideAppConfigurationInput {\n runtimeEndpoints: Record<string, { publicUrl?: string; internalUrl?: string }>;\n database: z.input<typeof AppConfigBackend_Database_Schema>;\n jwt?: Partial<z.input<typeof AppConfiguration_JWT_Schema>> \| undefined;\n /\n Object-storage topology, injected by the loader exactly as `database` is.\n \n Optional because an application may configure no storage provider at all —\n * and because it must stay absent rather than become a placeholder: the\n * storage provider treats a missing connection as UNCONFIGURED, and a\n * plausible-looking default would disable the file feature silently instead of\n * failing loudly. See `.claude/plans/application-runtime-topology-delivery.md`.\n /\n storage?: z.input<typeof AppConfiguration_PreOverride_StorageSchema> \| undefined;\n /* Same contract as `storage`: seeded from env by the loader, absent when unconfigured. /\n fileScanning?: z.input<typeof AppConfiguration_FileScanningSchema> \| undefined;\n}\n\n/\n Build the minimal config seed required before app-local overrides run.\n \n The backend loader is allowed to author runtime/env material plus the narrow\n * structural placeholders required to satisfy the full schema. It must not\n * invent believable app semantics inline.\n /\nexport function buildMinimalPreOverrideAppConfiguration(\n input: BuildMinimalPreOverrideAppConfigurationInput,\n): AppConfiguration_PreOverrideSeed {\n return AppConfiguration_PreOverrideSeed_Schema.parse({\n appIdentity: {\n appName: APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.appName,\n version: APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.version,\n },\n appPreferences: {\n languages: {},\n },\n auth: {\n passkeyConfig: {\n rpName: APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.passkeyRpName,\n rpId: APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.passkeyRpId,\n },\n },\n compliance: {},\n email: {\n from: APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.emailFrom,\n },\n userTypes: {},\n frontendServices: {},\n storage: input.storage ?? {},\n ...(input.fileScanning ? { fileScanning: input.fileScanning } : {}),\n monitoring: {\n metrics: {},\n },\n minions: {},\n workers: {},\n runtime: {\n endPoints: input.runtimeEndpoints,\n },\n database: input.database,\n jwt: input.jwt ?? {},\n });\n}\n\n/* ──────────────────────────────────────────────────────────────\n * Inferred Types (from schemas - no interface duplication)\n * ────────────────────────────────────────────────────────────── */\n\n\n\nexport type AppConfiguration_Auth = z.infer<typeof AppConfiguration_AuthSchema>;\nexport type PasswordHashing = AppConfiguration_Auth['passwordHashing'];\nexport type OtpOperational = AppConfiguration_Auth['otpOperational'];\nexport type MagicLinkOperational = AppConfiguration_Auth['magicLinkOperational'];\nexport type TotpOperational = AppConfiguration_Auth['totpOperational'];\nexport type PasskeyOperational = AppConfiguration_Auth['passkeyOperational'];\n\nexport type AppConfiguration_Compliance = z.infer<typeof AppConfiguration_ComplianceSchema>;\n\nexport type PostgreSQL_PoolConfig = z.infer<typeof PostgreSQL_PoolConfig_Schema>;\nexport type PostgreSQL_Config = z.infer<typeof PostgreSQL_Config_Schema>;\nexport type MongoDB_Config = z.infer<typeof MongoDB_Config_Schema>;\n\nexport type RotatedPublicKeyEntry = z.infer<typeof RotatedPublicKeyEntry_Schema>;\n\nexport type AppConfiguration_Runtime = z.infer<typeof AppConfiguration_RuntimeSchema>;\nexport type AppConfiguration_Email = z.infer<typeof AppConfiguration_Email_Schema>;\nexport type AppConfiguration_Monitoring = z.infer<typeof AppConfigBackend_Monitoring_Schema>;\nexport type AppConfiguration_Database = z.infer<typeof AppConfigBackend_Database_Schema>;\nexport type AppConfiguration_JWT = z.infer<typeof AppConfiguration_JWT_Schema>;\nexport type AppConfiguration_Minions = z.infer<typeof AppConfiguration_MinionsSchema>;\nexport type AppConfiguration_Storage = z.infer<typeof AppConfiguration_StorageSchema>;\nexport type AppConfiguration_Storage_ManagedConnection = z.infer<typeof AppConfiguration_Storage_ManagedConnectionSchema>;\nexport type AppConfiguration_Storage_LocalDirectoryConnection = z.infer<typeof AppConfiguration_Storage_LocalDirectoryConnectionSchema>;\nexport type AppConfiguration = z.infer<typeof AppConfiguration_Schema>;\nexport type AppConfiguration_PreOverrideSeed = z.infer<typeof AppConfiguration_PreOverrideSeed_Schema>;\nexport type AppConfiguration_AppManagedConfiguration = z.infer<typeof _AppConfiguration_AppManagedConfiguration_Schema>;\nexport type AppConfiguration_PlatformManagedConfiguration = z.infer<typeof _AppConfiguration_PlatformManagedConfiguration_Schema>;\nexport type AppConfiguration_Identity = z.infer<typeof AppConfiguration_AppIdentity_Schema>;\nexport type AppConfiguration_Language = z.infer<typeof AppConfiguration_AppPreferencesLanguage_Schema>;\n"]}
1	+ {"version":3,"file":"app-config.backend.schemas.js","sourceRoot":"","sources":["../../../../../src/config/models/app-config.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,0CAA0C,EAC1C,qDAAqD,EACrD,kCAAkC,EAClC,wCAAwC,EACxC,uBAAuB,EACvB,4BAA4B,EAC5B,0BAA0B,EAC1B,gBAAgB,EAChB,qBAAqB,EACrB,0BAA0B,EAC1B,2BAA2B,EAC3B,6BAA6B,EAC7B,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtF,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sCAAsC,EAAE,MAAM,sCAAsC,CAAC;AAE9F,OAAO,EAAuB,yBAAyB,EAAE,MAAM,qEAAqE,CAAC;AACrI,OAAO,EAAiB,uBAAuB,EAAE,MAAM,wEAAwE,CAAC;AAChI,OAAO,EAAE,2BAA2B,EAAE,qCAAqC,EAAE,MAAM,yEAAyE,CAAC;AAE7J,MAAM,iCAAiC,GAAG,CAAC,CAAC,aAAa,CACvD,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACxB,CAAC,CAAC,YAAY,CAAC;IACb,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CACH,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAEd,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAC3C,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAC7C,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEjC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IAClD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5D,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAClD,CAAC,CAAC;AAEH,MAAM,6BAA6B,GAAG,CAAC,CAAC,YAAY,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACxD,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,CAAC,CAAC,YAAY,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,aAAa,CACxB,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACxB,6BAA6B,CAC9B,CAAC,QAAQ,EAAE;CACb,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAC9C,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,QAAQ,EAAE;IACpF,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,QAAQ,EAAE;IAC3E,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,QAAQ,EAAE;CAC5E,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,8BAA8B,GAAG,CAAC,CAAC,YAAY,CAAC;IACpD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACnE,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,MAAM,EAAE,oBAAoB;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,8BAA8B,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;CAC7F,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,0BAA0B,GAAG,CAAC,CAAC,YAAY,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9C,CAAC,CAAC;AAqDH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,0FAA0F;IAC1F,SAAS,EAAE,WAAW;IACtB,sEAAsE;IACtE,IAAI,EAAE,MAAM;CACJ,CAAC;AAIX,MAAM,kCAAkC,GAA4C,CAAC,CAAC,YAAY,CAAC;IACjG,cAAc,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IACrD,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5F,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE;IACvD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CACpD,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,kCAAkC,CACnC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAEd,gFAAgF;AAChF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CACpD,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,CAAC,CAAC,YAAY,CAAC;IACb,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC5B,CAAC;IACF,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC;QACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;KAC1D,CAAC;IACF,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,YAAY,CAAC;QACxB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACrC,CAAC,CAAC,QAAQ,EAAE;IACb,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC7B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;KACnE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CACH,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAEd;;oEAEoE;AAEpE,MAAM,CAAN,IAAY,UAIX;AAJD,WAAY,UAAU;IACpB,iCAAmB,CAAA;IACnB,iCAAmB,CAAA;IACnB,mCAAqB,CAAA;AACvB,CAAC,EAJW,UAAU,KAAV,UAAU,QAIrB;AAED,MAAM,CAAN,IAAY,uBAIX;AAJD,WAAY,uBAAuB;IACjC,gDAAqB,CAAA;IACrB,4DAAiC,CAAA;IACjC,sCAAW,CAAA;AACb,CAAC,EAJW,uBAAuB,KAAvB,uBAAuB,QAIlC;AAED,MAAM,CAAN,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,yCAAqB,CAAA;IACrB,2CAAuB,CAAA;IACvB,+CAA2B,CAAA;AAC7B,CAAC,EAJW,gBAAgB,KAAhB,gBAAgB,QAI3B;AAED,0EAA0E;AAC1E,MAAM,CAAN,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,gCAAa,CAAA;IACb,wCAAqB,CAAA;IACrB,oCAAiB,CAAA;IACjB,4CAAyB,CAAA;AAC3B,CAAC,EALW,eAAe,KAAf,eAAe,QAK1B;AAED,MAAM,CAAN,IAAY,aAIX;AAJD,WAAY,aAAa;IACvB,8BAAa,CAAA;IACb,kCAAiB,CAAA;IACjB,kCAAiB,CAAA;AACnB,CAAC,EAJW,aAAa,KAAb,aAAa,QAIxB;AAED;;oEAEoE;AAEpE,MAAM,CAAN,IAAY,eAGX;AAHD,WAAY,eAAe;IACzB,sCAAmB,CAAA;IACnB,8CAA2B,CAAA;AAC7B,CAAC,EAHW,eAAe,KAAf,eAAe,QAG1B;AAED,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IACxD,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC/B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC1C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,4DAA4D;IAC5D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,sDAAsD;IACtD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAC3C,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7C,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,uBAAuB;IAC/B,QAAQ,EAAE,yBAAyB;CACpC,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAC5C,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACxC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE;CAClC,CAAC,CAAC;AAEH;;;;;oEAKoE;AAEpE,MAAM,CAAC,MAAM,2BAA2B,GAAG,kCAAkC,CAAC,MAAM,CAAC;IACnF,wEAAwE;IACxE,qBAAqB,EAAE,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;IAE9D;;;;;;;OAOG;IACH,IAAI,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IAE5C;;;;;;OAMG;IACH,yBAAyB,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IAE3E;;;;;;;;;;OAUG;IACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1B,sGAAsG;QACtG,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACtC,6GAA6G;QAC7G,uBAAuB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC5C,CAAC,CAAC,QAAQ,EAAE;IAEb,wFAAwF;IACxF,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,MAAM,EAAE,2BAA2B,CAAC,QAAQ,EAAE;KAC/C,CAAC;IAEF,0EAA0E;IAC1E,+FAA+F;IAE/F,gHAAgH;IAChH,kBAAkB,EAAE,wBAAwB;IAE5C,2FAA2F;IAC3F,cAAc,EAAE,oBAAoB;IAEpC,kDAAkD;IAClD,oBAAoB,EAAE,0BAA0B;IAEhD,4CAA4C;IAC5C,eAAe,EAAE,qBAAqB;IAEtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,wCAAwC,CAAA;AAGzF,MAAM,CAAC,MAAM,mCAAmC,GAAI,0CAA0C,CAAA;AAC9F,MAAM,CAAC,MAAM,8CAA8C,GAAG,qDAAqD,CAAA;AAEnH;;;;;oEAKoE;AAEpE,0GAA0G;AAC1G,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAgC,aAA2B,EAAE,EAAE;IAC1H,OAAO,CAAC,CAAC,MAAM,CAAC;QACd;;;;WAIG;QACH,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;YACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACnC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACvB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC;;;;;;;;;;;;;;;;;;;;;;WAsBG;QACH,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC;YAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;YAChD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACtC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACtC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YAClC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YAC5B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YACnC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;YAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;YAClD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;SACjD,CAAC,CAAC,QAAQ,EAAE;KACd,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAG,6CAA6C,CAAsB,yBAAyB,CAAC,CAAC;AAE5I;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC;;;;;;;;;;;;OAYG;CACJ,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAI,CAAC,CAAC,MAAM,CAAC;IACrD,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IACrD;;;;;;;OAOG;IACH,2BAA2B,EAAE,CAAC,CAAC,OAAO,EAAE;IACxC,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE;IACpC,WAAW,EAAE,6BAA6B,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACjD,CAAC;CACH,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,gDAAgD;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACvC,gDAAgD;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,kFAAkF;IAClF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACrD;;;;;;;OAOG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,kDAAkD;IAClD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC;;;;;;;;;OASG;IACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IACnD,mDAAmD;IACnD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,uCAAuC;IACvC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC;IACrE,oCAAoC;IACpC,IAAI,EAAE,4BAA4B,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,+CAA+C;IAC/C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,2CAA2C;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;IAC9D,4BAA4B;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;IAC3E,0BAA0B;IAC1B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACjC,yBAAyB;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;QACxB,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACzC,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC;IAE9E;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAEzC,+DAA+D;IAC/D,UAAU,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAE/C,mEAAmE;IACnE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;QACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACtD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC;;;;;;;;;;;;;;;;;;WAkBG;QACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;IAEb,sEAAsE;IACtE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;QACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACtD;;;;;;;;;;;;;;;;;WAiBG;QACH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH,wFAAwF;AACxF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,6FAA6F;IAC7F,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,kCAAkC;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;;;;OAOG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CACpE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QACpC,IAAI,CAAC;YACH,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,EACF,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAClC;IACD;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7G,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;IACtC,mCAAmC;IACnC,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;CAC1D,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,uCAAuC;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,gEAAgE;IAChE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,gEAAgE;AAChE,MAAM,CAAC,MAAM,uDAAuD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,OAAO,EAAE,gDAAgD,CAAC,QAAQ,EAAE;IACpE,cAAc,EAAE,uDAAuD,CAAC,QAAQ,EAAE;CACnF,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACjC,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,iGAAiG;AACjG,6FAA6F;AAC7F,iGAAiG;AACjG,+FAA+F;AAC/F,gGAAgG;AAEhG,0EAA0E;AAC1E,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,SAAS,EAAE,qDAAqD,CAAC,QAAQ,EAAE;IAC3E,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,UAAU,EAAE,qDAAqD,CAAC,QAAQ,EAAE;KAC7E,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAyCH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,mCAAmC,CACjD,GAAqC;IAErC,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,gBAAgB;YACtB,CAAC,CAAC;gBACA,OAAO,EAAE;oBACP,QAAQ,EAAE,GAAG,CAAC,gBAAgB;oBAC9B,IAAI,EAAE,GAAG,CAAC,YAAY,IAAI,mBAAmB,CAAC,KAAK;oBACnD,MAAM,EAAE,GAAG,CAAC,eAAe,IAAI,KAAK;oBACpC,MAAM,EAAE,GAAG,CAAC,cAAc,IAAI,gBAAgB,CAAC,MAAM;oBACrD,gEAAgE;oBAChE,qEAAqE;oBACrE,mBAAmB;oBACnB,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClF;aACF;YACD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnG,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wCAAwC,CACtD,GAA0C;IAE1C,OAAO;QACL,YAAY,EAAE;YACZ,GAAG,CAAC,GAAG,CAAC,WAAW;gBACjB,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,IAAI,mBAAmB,EAAE,EAAE;gBACxF,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS;gBACjD,CAAC,CAAC;oBACA,IAAI,EAAE;wBACJ,OAAO,EAAE,GAAG,CAAC,YAAY,KAAK,IAAI;wBAClC,GAAG,CAAC,GAAG,CAAC,SAAS;4BACf,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,IAAI,iBAAiB,EAAE,EAAE;4BACnF,CAAC,CAAC,EAAE,CAAC;qBACR;iBACF;gBACD,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,GAAuC;IAEvC,MAAM,OAAO,GAAG,GAAG,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,GAAG,CAAC,6BAA6B,CAAC,eAAe,CAAC,CAAC;IACrE,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,gBAAgB,CAAC;YACrD,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,6BAA6B,CAAC,gBAAgB,CAAC,EAAE;YAC3E,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,cAAc,CAAC;YACnD,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,6BAA6B,CAAC,cAAc,CAAC,EAAE;YACvE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,qBAAqB,CAAC;YAC1D,CAAC,CAAC,EAAE,qBAAqB,EAAE,GAAG,CAAC,6BAA6B,CAAC,qBAAqB,CAAC,EAAE;YACrF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,sBAAsB,CAAC;YAC3D,CAAC,CAAC,EAAE,sBAAsB,EAAE,GAAG,CAAC,6BAA6B,CAAC,sBAAsB,CAAC,EAAE;YACvF,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,SAAS,qBAAqB,CAAC,GAAuC,EAAE,GAAW;IACjF,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yCAAyC,CACvD,GAAuC;IAEvC,MAAM,WAAW,GAAG,GAAG,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,EAAE,6BAA6B,CAAC,WAAW,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,EAAE,6BAA6B,CAAC,SAAS,CAAC,CAAC;IACrF,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,WAAW,CAAC;YAChD,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,6BAA6B,CAAC,WAAW,CAAC,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC;YAC9C,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2CAA2C,CACzD,GAAuC;IAEvC,OAAO;QACL,OAAO,EAAE,mCAAmC,CAAC,oCAAoC,CAAC,GAAG,CAAC,CAAC;QACvF,GAAG,wCAAwC,CAAC,yCAAyC,CAAC,GAAG,CAAC,CAAC;KAC5F,CAAC;AACJ,CAAC;AAED,MAAM,uCAAuC,GAAG,kCAAkC,CAAC,MAAM,CAAC;IACxF,qBAAqB,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IAC7D,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,MAAM,EAAE,2BAA2B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACzD,CAAC,CAAC,QAAQ,EAAE;IACb,kBAAkB,EAAE,wBAAwB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,MAAM,EAAE,uBAAuB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACpD,QAAQ,EAAE,yBAAyB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACzD,CAAC,CAAC,QAAQ,EAAE;IACb,oBAAoB,EAAE,0BAA0B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrE,eAAe,EAAE,qBAAqB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC5D,CAAC,CAAC;AAEH,MAAM,yCAAyC,GAAG,6BAA6B,CAAC,OAAO,CAAC;IACtF,2BAA2B,EAAE,IAAI;IACjC,uBAAuB,EAAE,IAAI;CAC9B,CAAC,CAAC;AAEH,MAAM,0CAA0C,GAAG,8BAA8B,CAAC,OAAO,EAAE,CAAC;AAE5F,MAAM,8CAA8C,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/B,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC9C,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,uCAAuC,GAAG,2BAA2B,CAAC,OAAO,CAAC;IAClF,0BAA0B,EAAE,IAAI;IAChC,4BAA4B,EAAE,IAAI;CACnC,CAAC,CAAC;AAEH;;;;;;oEAMoE;AAEpE,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IAEvE,WAAW,EAAE,mCAAmC;IAEhD;;;;;;;;;OASG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IAExD,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,SAAS,EAAE,8CAA8C;KAC1D,CAAC;IAEF,IAAI,EAAE,2BAA2B;IACjC,SAAS,EAAE,qBAAqB;IAChC,gBAAgB,EAAE,4BAA4B;IAC9C,iBAAiB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAC3D,UAAU,EAAE,iCAAiC;IAC7C,KAAK,EAAE,6BAA6B;IACpC,OAAO,EAAE,8BAA8B;IACvC,+EAA+E;IAC/E,+EAA+E;IAC/E,sEAAsE;IACtE,kEAAkE;IAClE,YAAY,EAAE,mCAAmC,CAAC,QAAQ,EAAE;IAC5D,UAAU,EAAE,kCAAkC;IAE9C,OAAO,EAAE,8BAA8B;IACvC,OAAO,EAAE,8BAA8B;IACvC,kBAAkB,EAAE,iCAAiC;IACrD,SAAS,EAAE,oBAAoB;IAC/B,sBAAsB,EAAE,4BAA4B;IACpD,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAC9C,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC3C,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,qCAAqC;IACrC,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAC/C,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC7C,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,6EAA6E;IAC7E,cAAc,EAAE,0BAA0B,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;oEAsBoE;AAEpE,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E;;;;OAIG;IACH,OAAO,EAAE,8BAA8B;IACvC;;;OAGG;IACH,QAAQ,EAAE,gCAAgC;IAC1C;;;;OAIG;IACH,GAAG,EAAE,2BAA2B;CACjC,CAAC,CAAC;AAEH;;;;;;;;;oEASoE;AAEpE;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,GAAG,gDAAgD,CAAC,KAAK;IACzD,GAAG,qDAAqD,CAAC,KAAK;IAC9D,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IACpD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACrD,CAAC;AAsCF,MAAM,CAAC,MAAM,uBAAuB,GAAwC,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAE9G,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,WAAW,EAAE,mCAAmC;IAChD,qFAAqF;IACrF,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IACxD,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,SAAS,EAAE,8CAA8C;KAC1D,CAAC;IACF,IAAI,EAAE,uCAAuC;IAC7C,SAAS,EAAE,qBAAqB;IAChC,gBAAgB,EAAE,4BAA4B;IAC9C,iBAAiB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAC3D,UAAU,EAAE,iCAAiC;IAC7C,KAAK,EAAE,yCAAyC;IAChD,OAAO,EAAE,0CAA0C;IACnD,YAAY,EAAE,mCAAmC,CAAC,QAAQ,EAAE;IAC5D,UAAU,EAAE,8CAA8C;IAC1D,OAAO,EAAE,8BAA8B;IACvC,OAAO,EAAE,8BAA8B;IACvC,kBAAkB,EAAE,iCAAiC;IACrD,SAAS,EAAE,oBAAoB;IAC/B,sBAAsB,EAAE,4BAA4B;IACpD,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAC9C,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAC/C,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC7C,cAAc,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IACrD,OAAO,EAAE,8BAA8B;IACvC,QAAQ,EAAE,gCAAgC;IAC1C,GAAG,EAAE,uCAAuC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IACpD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACrD,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG;IACzD,OAAO,EAAE,iCAAiC;IAC1C,OAAO,EAAE,oBAAoB;IAC7B,aAAa,EAAE,wCAAwC;IACvD,WAAW,EAAE,sBAAsB;IACnC,SAAS,EAAE,gCAAgC;CACnC,CAAC;AAoBX;;;;;;GAMG;AACH,MAAM,UAAU,uCAAuC,CACrD,KAAmD;IAEnD,OAAO,uCAAuC,CAAC,KAAK,CAAC;QACnD,WAAW,EAAE;YACX,OAAO,EAAE,2CAA2C,CAAC,OAAO;YAC5D,OAAO,EAAE,2CAA2C,CAAC,OAAO;SAC7D;QACD,cAAc,EAAE;YACd,SAAS,EAAE,EAAE;SACd;QACD,IAAI,EAAE;YACJ,aAAa,EAAE;gBACb,MAAM,EAAE,2CAA2C,CAAC,aAAa;gBACjE,IAAI,EAAE,2CAA2C,CAAC,WAAW;aAC9D;SACF;QACD,UAAU,EAAE,EAAE;QACd,KAAK,EAAE;YACL,IAAI,EAAE,2CAA2C,CAAC,SAAS;SAC5D;QACD,SAAS,EAAE,EAAE;QACb,gBAAgB,EAAE,EAAE;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;QAC5B,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,UAAU,EAAE;YACV,OAAO,EAAE,EAAE;SACZ;QACD,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,EAAE;QACX,OAAO,EAAE;YACP,SAAS,EAAE,KAAK,CAAC,gBAAgB;SAClC;QACD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,EAAE;KACrB,CAAC,CAAC;AACL,CAAC","sourcesContent":["/*\n Backend Application Configuration Schemas\n \n Complete backend configuration schemas with all necessary fields.\n * Frontend configuration is handled separately in saas-frontend-lib.\n /\n\nimport {\n AnalyticsConfigSchema,\n AuditTrailConfigSchema,\n AppConfiguration_Shared_AppIdentity_Schema,\n AppConfiguration_Shared_AppPreferencesLanguage_Schema,\n AppConfiguration_Shared_AuthSchema,\n AppConfiguration_Shared_ComplianceSchema,\n DataSeedingConfigSchema,\n FrontendServicesConfigSchema,\n BillingConfigurationSchema,\n EngineCapability,\n LifecycleConfigSchema,\n TenantTeardownConfigSchema,\n OAuth2ProvidersConfigSchema,\n OrganizationTypesConfigSchema,\n PersistenceAdapter,\n ResourceIdFormat,\n PostgreSQLSSLMode,\n RuntimeBrandAssetSchema,\n UserTypesConfigSchema,\n} from '@wildo-ai/saas-models';\nimport { INFRA_DEFAULT_PORTS, STORAGE_DEFAULTS } from '@wildo-ai/platform-config-lib';\nimport { ApplicationBackendDataEnvKeys } from '@wildo-ai/platform-core-shared';\nimport { z } from 'zod';\nimport { ExternalProvider_ConnectionShapeSchema } from '@wildo-ai/external-connectors-models';\n\nimport { AllApplicationTypes, AllApplicationTypesSchema } from '~wildo-backend-lib/applications/models/applications.backend.schemas';\nimport { JwtPublicKeys, VerifiableJwtKeysSchema } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport { CimdApplicationConfigSchema, DynamicClientRegistrationConfigSchema } from '~wildo-backend-lib/security/authentications/models/cimd.backend.schemas';\n\nconst EngineCapabilityActivationsSchema = z.partialRecord(\n z.enum(EngineCapability),\n z.strictObject({\n enabled: z.boolean(),\n required: z.boolean().optional(),\n }),\n).default({});\n\nconst ProviderConfigurationsSchema = z.record(\n z.string(),\n z.record(z.string(), z.unknown()).optional(),\n).optional().default(() => ({}));\n\nconst ProviderScopeSelectionSchema = z.strictObject({\n engineCapabilities: z.array(z.enum(EngineCapability)).default([]),\n providerCapabilities: z.array(z.string().min(1)).default([]),\n protocols: z.array(z.string().min(1)).default([]),\n});\n\nconst ProviderSelectionPolicySchema = z.strictObject({\n primary: z.string().min(1),\n whenUnavailable: z.array(z.string().min(1)).default([]),\n});\n\nconst RuntimeProviderScopeSchema = z.strictObject({\n providers: z.record(z.string().min(1), ProviderScopeSelectionSchema).default({}),\n selection: z.partialRecord(\n z.enum(EngineCapability),\n ProviderSelectionPolicySchema,\n ).optional(),\n});\n\nconst ProviderScopesSchema = z.strictObject({\n backend: RuntimeProviderScopeSchema.optional(),\n companion: RuntimeProviderScopeSchema.optional(),\n frontendServices: z.record(z.string().min(1), RuntimeProviderScopeSchema).optional(),\n minions: z.record(z.string().min(1), RuntimeProviderScopeSchema).optional(),\n workers: z.record(z.string().min(1), RuntimeProviderScopeSchema).optional(),\n});\n\n/\n WHICH of a provider's admissible connections this application permits.\n \n The runtime half of `providers.connections` in the SaaS config. The registry intersects it with the\n * provider's own catalogue record, so this can only ever SUBTRACT: an application cannot declare a\n * connection the vendor does not support into existence, and an absent entry means \"everything the\n * provider admits\" rather than \"nothing\".\n /\nconst ProviderConnectionPolicySchema = z.strictObject({\n admissible: z.array(ExternalProvider_ConnectionShapeSchema).min(1),\n});\n\nconst ProvidersBlockSchema = z.strictObject({\n scopes: ProviderScopesSchema,\n connections: z.record(z.string().min(1), ProviderConnectionPolicySchema).default(() => ({})),\n}).default(() => ({ scopes: {}, connections: {} }));\n\n/\n Minion runtime inventory materialized from the SaaS declaration.\n \n This branch intentionally carries only the runtime-facing minion metadata the\n * application process may need at boot. Today that is the per-minion\n * `resourceAccess` authority whitelist used by the minion kernel; execution\n * topology (`path`, cron mode, Docker wiring, ...) stays on the SaaS/deploy side.\n /\nconst MinionResourceAccessSchema = z.strictObject({\n read: z.array(z.string().min(1)).default([]),\n write: z.array(z.string().min(1)).default([]),\n});\n\n/\n One minion's runtime-facing entry, EXPLICITLY typed.\n \n The annotation is not decoration. `Wildo_Application_ResolvedConfig_Schema` in\n * apps-manager extends `AppConfiguration_Schema`, and that inferred type sits AT\n * the compiler's serialization ceiling: adding ANY field to this object — an\n * enum-backed one, a structural one, even an inline `z.string()` array — tipped\n * it over, and apps-manager stopped compiling with\n \n TS7056 The inferred type of this node exceeds the maximum length the compiler will serialize\n * TS2742 … cannot be named without a reference to '…/@wildo-ai/saas-models/src'\n \n Measured by removal: taking the field out cleared both, putting it back\n * restored them, three variants running. Naming the entry type here stops the\n * expansion at this node instead, which is the remedy TS7056 asks for.\n \n ## CORRECTION 2026-08-18 — this was per-node relief, and its closing claim was wrong\n \n The original ended \"…and the only one available — an explicit annotation on the giant schema\n * itself is not writable by hand.\" It is writable: hoist the composed shape into a value and\n * annotate against `typeof` it. That is what `AppConfiguration_Shape` /\n * `AppConfiguration_Schema` below now do, and what the two apps-manager schemas that extend them\n * now do in turn.\n \n The distinction matters because the two remedies differ in kind. Naming THIS node buys headroom\n * until the next field is added anywhere in the surface — the ceiling stays, and the next author\n * meets it with no idea why. Naming the TOP-LEVEL shape removes the consumer-side expansion\n * altogether. The prediction here (\"adding ANY field tipped it over\") was correct and came true\n * again on 2026-08-18, from growth in `saas-models` rather than a field added here — which is\n * exactly why the per-node form could not hold.\n \n Keep this annotation: it is still correct, and a `z.ZodType<T>` interface boundary on a nested\n * entry is good practice independent of the ceiling.\n /\nexport interface AppConfiguration_MinionEntry {\n resourceAccess?: { read: string[]; write: string[] };\n /* R4/R5 — see the platform-access axis. Structural on purpose; the closed\n * vocabulary is enforced at authoring and at the apps-manager door. /\n platformAccess?: { scopes?: string[] };\n /\n KD-12 — when `mode === 'cron'` and `schedule` is provided, the\n * backend-api's `cron-job-sync.backend.service.ts` registers a\n * `MINION_TICK` CronJob record on `platform-crontabs-batches-manager`\n * so the per-minion queue actually fires on schedule. Carried\n * through from `wildo.minion.config.ts` per the CLI merge in\n * `app-runtime-targets.service.ts`.\n /\n mode?: AppConfigurationMinionMode;\n schedule?: string;\n}\n\n/\n The named runtime source for the minion execution-mode vocabulary (KD-3).\n \n A const object rather than a nominal enum, deliberately: the AUTHORING surface for these values\n * is `defineMinionConfig` in `platform-config-lib`, which declares the same wire values\n * structurally, and the CLI merge in `app-runtime-targets.service.ts` carries them across that seam\n * as plain strings. A nominal enum here would break that seam's assignability while unifying\n * nothing. That reasoning is unchanged and is why this stays a const object.\n \n ## CORRECTION 2026-09-09 — the premise attached to it was false, and it was load-bearing\n \n This used to read \"`defineMinionConfig` in `platform-config-lib` (which this engine package must\n * not depend on ...)\". There is no such prohibition, and there never was one this file honoured:\n * `@wildo-ai/platform-config-lib` is a hard `dependencies` edge in this package's `package.json`,\n * and line 29 of THIS file imports two runtime values (`INFRA_DEFAULT_PORTS`, `STORAGE_DEFAULTS`)\n * across it. A boundary asserted in prose while the file beside it crosses the boundary is not a\n * policy; it is a claim nobody checked.\n \n It mattered because it was cited. `app-configuration-loader.backend.service.ts` pointed at this\n * note as the reason its bootstrap-response schema re-declared the managed minion and worker blocks\n * by hand instead of importing them — and that hand copy silently stripped `mode`/`schedule` (the\n * KD-12 cron-tick path, dead in production) and then `platformAccess`, because Zod deletes what a\n * schema does not declare. The loader now imports the platform's own schemas; only the two\n * declarations below remain, and they are held in step MECHANICALLY by\n * `config/__tests__/managed-runtime-inventory-parity.backend.test.ts` rather than by a sentence\n * asking the next author to remember. That pin covers this vocabulary too: adding a member here and\n * not in `define-minion-config.ts` (or the reverse) reddens it.\n /\nexport const APP_CONFIGURATION_MINION_MODES = {\n /* A long-running daemon; self-ticks from its own loop, never registered as a CronJob. /\n ALWAYS_UP: 'always-up',\n /* Fired on `schedule` via a `MINION_TICK` CronJob record (KD-12). /\n CRON: 'cron',\n} as const;\n\nexport type AppConfigurationMinionMode = (typeof APP_CONFIGURATION_MINION_MODES)[keyof typeof APP_CONFIGURATION_MINION_MODES];\n\nconst AppConfiguration_MinionEntrySchema: z.ZodType<AppConfiguration_MinionEntry> = z.strictObject({\n resourceAccess: MinionResourceAccessSchema.optional(),\n platformAccess: z.strictObject({ scopes: z.array(z.string().min(1)).optional() }).optional(),\n mode: z.enum(APP_CONFIGURATION_MINION_MODES).optional(),\n schedule: z.string().min(1).optional(),\n});\n\n/\n Exported ONLY so the parity pin can reach it — no production consumer imports either of these two\n * from outside this module.\n \n `config/__tests__/managed-runtime-inventory-parity.backend.test.ts` compares this declaration,\n * field for field, against `AdminAppManagedMinionsSchema` / `AdminAppManagedWorkersSchema` in\n * `@wildo-ai/platform-config-lib` — the schemas the apps-manager wire actually carries. The two\n * cannot simply be collapsed: this side is a `strictObject` annotated against a named interface for\n * the TS7056 serialization-ceiling reason recorded on `AppConfiguration_MinionEntry` above, and the\n * wire side must stay strip-tolerant so an additive platform change cannot brick an application\n * backend mid-deploy. Two declarations are therefore the design; two declarations DRIFTING is the\n * defect, and the pin is what separates the two.\n /\nexport const AppConfiguration_MinionsSchema = z.record(\n z.string().min(1),\n AppConfiguration_MinionEntrySchema,\n).default({});\n\n/* Exported for the parity pin — see `AppConfiguration_MinionsSchema` above. /\nexport const AppConfiguration_WorkersSchema = z.record(\n z.string().min(1),\n z.strictObject({\n name: z.string().min(1),\n displayName: z.string().min(1),\n description: z.string().optional(),\n runtime: z.strictObject({\n type: z.string().min(1),\n language: z.string().min(1),\n }),\n http: z.strictObject({\n port: z.number().int().positive(),\n healthPath: z.string().min(1).startsWith('/'),\n readyPath: z.string().min(1).startsWith('/'),\n metricsPath: z.string().min(1).startsWith('/').optional(),\n }),\n auth: z.literal('wildo-jwt'),\n replicas: z.number().int().positive(),\n resources: z.strictObject({\n cpu: z.string().min(1).optional(),\n memory: z.string().min(1).optional(),\n }).optional(),\n dataAccess: z.strictObject({\n database: z.enum(['read-only', 'read-write', 'none']).optional(),\n cache: z.boolean().optional(),\n queue: z.enum(['consumer', 'producer', 'both', 'none']).optional(),\n }).optional(),\n }),\n).default({});\n\n/* ──────────────────────────────────────────────────────────────\n * Auth Backend-Only Enums\n * ────────────────────────────────────────────────────────────── /\n\nexport enum Argon2Type {\n ARGON2D = 'argon2d',\n ARGON2I = 'argon2i',\n ARGON2ID = 'argon2id',\n}\n\nexport enum AuthenticatorAttachment {\n PLATFORM = 'platform',\n CROSS_PLATFORM = 'cross-platform',\n ANY = 'any',\n}\n\nexport enum UserVerification {\n REQUIRED = 'required',\n PREFERRED = 'preferred',\n DISCOURAGED = 'discouraged',\n}\n\n/* W3C AttestationConveyancePreference — all four values per the spec. /\nexport enum AttestationType {\n NONE = 'none',\n INDIRECT = 'indirect',\n DIRECT = 'direct',\n ENTERPRISE = 'enterprise',\n}\n\nexport enum TotpAlgorithm {\n SHA1 = 'SHA1',\n SHA256 = 'SHA256',\n SHA512 = 'SHA512',\n}\n\n/* ──────────────────────────────────────────────────────────────\n * Database & Infrastructure Enums\n * ────────────────────────────────────────────────────────────── /\n\nexport enum MongoDBProtocol {\n MONGODB = 'mongodb',\n MONGODB_SRV = 'mongodb+srv'\n}\n\nexport { PostgreSQLSSLMode } from '@wildo-ai/saas-models';\n\nconst Argon2PasswordHashingSchema = z.object({\n type: z.enum(Argon2Type),\n memoryCost: z.number(),\n timeCost: z.number(),\n parallelism: z.number(),\n});\n\nconst PasskeyOperationalSchema = z.object({\n authenticatorAttachment: z.enum(AuthenticatorAttachment),\n requireResidentKey: z.boolean(),\n userVerification: z.enum(UserVerification),\n timeoutSeconds: z.number().min(30).max(600),\n attestation: z.enum(AttestationType),\n});\n\nconst SmsOtpOperationalSchema = z.object({\n otpLength: z.number().min(4).max(8),\n expiryMinutes: z.number().min(1).max(30),\n /* Max SMS sends per phone per minute (burst protection) /\n rateLimitBurst: z.number().min(1).max(5),\n /* Max SMS sends per phone per hour (cost control) /\n rateLimitHourly: z.number().min(1).max(20),\n});\n\nconst EmailOtpOperationalSchema = z.object({\n otpLength: z.number().min(4).max(8),\n expiryMinutes: z.number().min(1).max(30),\n rateLimitPerMinute: z.number().min(1).max(5),\n});\n\nconst OtpOperationalSchema = z.object({\n smsOtp: SmsOtpOperationalSchema,\n emailOtp: EmailOtpOperationalSchema,\n});\n\nconst MagicLinkOperationalSchema = z.object({\n tokenExpiryMinutes: z.number().min(1).max(60),\n rateLimitPerMinute: z.number().min(1).max(5),\n rateLimitPerHour: z.number().min(1).max(20),\n});\n\nconst TotpOperationalSchema = z.object({\n issuer: z.string().optional(),\n algorithm: z.enum(TotpAlgorithm),\n digits: z.number().min(6).max(8),\n period: z.number().min(15).max(300),\n window: z.number().min(0).max(10),\n qrCodeSize: z.number().min(100).max(400),\n includeIssuerInLabel: z.boolean(),\n});\n\n/* ──────────────────────────────────────────────────────────────\n * Backend Auth Schema — extends shared auth with backend-only operational config.\n * The shared auth schema is the frontend-safe subset; this adds hashing,\n * lockout, OTP operational, passkey ceremony, TOTP, and magic link tuning.\n * toAppConfiguration_Shared() strips backend-only fields before sending to frontend.\n * ────────────────────────────────────────────────────────────── /\n\nexport const AppConfiguration_AuthSchema = AppConfiguration_Shared_AuthSchema.extend({\n /* Backend-only: full social OAuth2 provider authoring/config branch /\n socialOAuth2Providers: OAuth2ProvidersConfigSchema.default({}),\n\n /\n Backend-only: OAuth Client ID Metadata Documents posture (how much of the open internet this\n * deployment accepts as a client identity at `/oauth/authorize`).\n \n OPTIONAL, and absence means `DISABLED` — the fail-closed default. An application that never\n * mentions CIMD must never find itself fetching a stranger's URL, which is an SSRF surface it\n * did not ask for.\n /\n cimd: CimdApplicationConfigSchema.optional(),\n\n /\n Backend-only: RFC 7591 dynamic client registration (`POST /oauth/register`).\n \n OPTIONAL and off by default. Absent means the endpoint 404s and `registration_endpoint` is not\n * advertised — an anonymous row-creation primitive is not something an application should acquire\n * by upgrading the framework.\n /\n dynamicClientRegistration: DynamicClientRegistrationConfigSchema.optional(),\n\n /\n Backend-only: how long a remembered OAuth consent (\"remember this app\") stays valid, in days.\n \n OPTIONAL — absent means `OAUTH_CONSENT_GRANT_DEFAULT_LIFETIME_DAYS` (180), whose reasoning is\n * written at the constant. An application shortens it when its data is sensitive enough to want\n * re-affirmation sooner, or lengthens it for a long-lived integration.\n \n The ceiling is ten years rather than unbounded: a lifetime long enough to be indistinguishable\n * from \"never\" would reintroduce exactly the state this replaced, where a standing delegation of\n * authority to a third party outlived any memory of granting it. There is no \"never\" value.\n /\n consentGrantLifetimeDays: z.number().int().min(1).max(3650).optional(),\n\n /\n Backend-only: where an application's SCIM discovery document sends a directory administrator\n * for integration documentation — RFC 7643 §5's `documentationUri`, on the ServiceProviderConfig\n * itself and on its OAuth bearer-token authentication scheme.\n \n OPTIONAL, and absence means the FIELDS ARE OMITTED rather than emptied. The RFC marks both as\n * OPTIONAL, so a discovery document without them is conformant; a document carrying a URL that\n * answers nothing is not, in any sense that matters to the person reading it.\n \n spec-cite: RFC 7643 §5 — the ServiceProviderConfig `documentationUri` attribute and the\n * `authenticationSchemes` sub-attribute of the same name are each defined as \"An HTTP-addressable\n * URL pointing to the service provider's human-consumable help documentation. OPTIONAL.\" \n \n ## Why this is authored per application rather than defaulted\n \n The framework used to ship both values frozen, pointing at `docs.wildo.ai/scim` and\n * `/scim/auth` — a host with no DNS record at all, so every application built on Wildo told its\n * enterprise customers to go somewhere that does not resolve. Even had the pages existed, the\n * RFC defines the field as \"the SERVICE PROVIDER's human-consumable help documentation\", and the\n * service provider is the application, not the framework that built it. A directory\n * administrator integrating with an application should not be routed to that application's\n * vendor's vendor.\n \n So the value belongs to whoever has customers to send somewhere, and the default is silence.\n * An application with no SCIM documentation says nothing, which is true; one that has written\n * some says where, which is also true. There is no configuration that produces the previous\n * behaviour, deliberately.\n /\n scimDocumentation: z.object({\n /* RFC 7643 §5 `documentationUri` — how this application's SCIM implementation is integrated with. /\n serviceProviderUri: z.url().optional(),\n /* RFC 7643 §5 authentication-scheme `documentationUri` — how a caller obtains and uses its bearer token. /\n authenticationSchemeUri: z.url().optional(),\n }).optional(),\n\n /* Backend-only: password hashing configuration (rules are in shared passwordPolicy) /\n passwordHashing: z.object({\n argon2: Argon2PasswordHashingSchema.optional(),\n }),\n\n // W6.8: passwordExpiryDays, maxConcurrentSessions, lockoutPolicy REMOVED.\n // These are now per-user-type in userTypes[t].auth (entity-identity-config.shared.schemas.ts).\n\n /* Backend-only: passkey WebAuthn ceremony tuning (identity fields rpName/rpId stay in shared passkeyConfig) /\n passkeyOperational: PasskeyOperationalSchema,\n\n /* Backend-only: OTP operational config (enabled flags stay in shared smsOtp/magicLink) /\n otpOperational: OtpOperationalSchema,\n\n /* Backend-only: magic link operational config /\n magicLinkOperational: MagicLinkOperationalSchema,\n\n /* Backend-only: TOTP operational config /\n totpOperational: TotpOperationalSchema,\n\n /\n Backend-only: the `Domain` attribute for the anonymous-session\n * continuity cookie (`__wildo_anon_session`, set by\n * `AnonymousSessionBackendService.setSessionCookie`).\n \n The cookie carries the anonymous session across the marketing-site\n * apex → app subdomain → API cross-origin boundary so a lead / draft\n * captured on the public website transposes to the user's account on\n * signup / login with NO frontend handoff (the app's login reads the\n * session from this cookie as a fallback to the `x-anonymous-session`\n * header).\n \n - UNSET (default) ⇒ host-only cookie. Correct for local dev, where\n * the website / app / API all share the `localhost` host (cookies\n * ignore the port, so a host-only `localhost` cookie is already\n * shared across the dev ports).\n * - SET to the REGISTRABLE PARENT domain in production (e.g.\n * `wonder-todos.com`) so the cookie set by `api.<brand>` is\n * also sent to the apex marketing site AND the `app.<brand>`\n * subdomain. Author the value per-environment (it is derived from\n * the deployment's public domain), NOT as a single app-wide\n * constant — an env-specific parent domain set on a `localhost`\n * response would be rejected by the browser.\n \n Intentionally NOT public-suffix-derived: guessing the registrable\n * domain from the host is fragile (the PSL changes, multi-label\n * eTLDs exist). An explicit operator-authored value is the safe\n * contract. Frontend-invisible (backend-only) because only the\n * backend sets / reads the cookie — the browser carries it\n * transparently.\n /\n anonymousSessionCookieDomain: z.string().optional(),\n});\n\nexport const AppConfiguration_ComplianceSchema = AppConfiguration_Shared_ComplianceSchema\n\n\nexport const AppConfiguration_AppIdentity_Schema = AppConfiguration_Shared_AppIdentity_Schema\nexport const AppConfiguration_AppPreferencesLanguage_Schema = AppConfiguration_Shared_AppPreferencesLanguage_Schema\n\n/* ──────────────────────────────────────────────────────────────\n * Internal Schemas with z.ZodObject type annotation\n \n ✅ Preserves all ZodObject methods (.extend, .partial, .omit, .pick, .shape)\n * ✅ Compatible with isolatedDeclarations: true (OXC)\n * ────────────────────────────────────────────────────────────── /\n\n// Backend runtime schema builder: allows ALL application types (including platform) and exposes both URLs\nexport const appConfiguration_Backend_RuntimeSchemaBuilder = <T extends AllApplicationTypes>(appTypeSchema: z.ZodType<T>) => {\n return z.object({\n /\n URL map per application type. Platform service URLs and app endpoint URLs.\n * After T5, these are built from env vars + developer overrides (not fetched from apps-manager).\n * Empty default — the loading chain and developer overrides populate this.\n /\n endPoints: z.record(z.string(), z.object({\n publicUrl: z.string().optional(),\n internalUrl: z.string().optional(),\n })).default(() => ({})),\n appCustomRoot: z.string().optional(),\n /\n Optional partial override of the HTTP-server runtime configuration\n * baked into `RuntimeConfigurationSchema` (see\n * `engine/saas-backend-lib/src/runtime/models/runtime.backend.schemas.ts`).\n \n The Zod `.partial()` lets apps author only the fields they need to\n * change — everything else falls back to the schema's defaults during\n * the merge that happens inside\n * `HttpServerBackendService.extractRuntimeConfig`.\n \n Canonical use: the dev companion overrides the framework default\n * `requestTimeout: 300_000` (5 min) to ~30 min so long-running LLM\n * batch endpoints (`/api/companion/labelling/labellize`,\n * `/api/companion/labelling/translate`, email generation, market\n * generation) don't get killed mid-stream by Node's HTTP server\n * `requestTimeout`. The 5-min default is correct for app traffic;\n * the companion's LLM-bound endpoints legitimately exceed it.\n \n App authors generally do NOT touch this — the defaults are right\n * for production app traffic. Setting it loosely on a public-internet\n * app is a footgun (a slow client can hold a server thread for the\n * full timeout window).\n /\n httpServerConfiguration: z.object({\n requestTimeout: z.number().positive().optional(),\n bodyParserLimit: z.string().optional(),\n urlEncodedLimit: z.string().optional(),\n trustProxy: z.boolean().optional(),\n etag: z.boolean().optional(),\n compression: z.boolean().optional(),\n maxConnections: z.number().positive().optional(),\n keepAliveTimeout: z.number().positive().optional(),\n headersTimeout: z.number().positive().optional(),\n }).optional(),\n })\n}\n\nexport const AppConfiguration_RuntimeSchema = appConfiguration_Backend_RuntimeSchemaBuilder<AllApplicationTypes>(AllApplicationTypesSchema);\n\n/\n Simplified brand tokens for email templates.\n * App developers set high-level brand values; the email service\n * derives the full `EmailBrandTokens` palette (with fallback defaults).\n /\nexport const EmailBrandTokens_ConfigSchema = z.object({\n primaryColor: z.string().optional(),\n secondaryColor: z.string().optional(),\n fontFamily: z.string().optional(),\n /\n * NO `logoUrl` here, deliberately (#448). It was accepted by this schema and never mapped into\n * `EmailBrandTokens`, which has no logo field — so configuring it rendered nothing, on either of\n * the two routes that existed.\n \n The logo is NOT a brand token, because it is SCOPE-RESOLVED rather than configured: the\n * dispatcher and the three authentication paths resolve an email-optimised, absolute brand-asset\n * URL into `primaryScopeContext.logoUrl` (LOCKUP → EMAIL purpose, with the resolver's own\n * fallbacks, `undefined` when no asset has been generated). Every template reads it from there\n * and passes it to `EmailLayout`. Routing it through a config key instead would have needed new\n * plumbing for a value that already existed one field away, and would not have been per-scope —\n * which matters now that organisation branding is becoming a real layer (#410).\n /\n});\n\nexport type EmailBrandTokens_Config = z.infer<typeof EmailBrandTokens_ConfigSchema>;\n\nexport const AppConfiguration_Email_Schema = z.object({\n from: z.email({ error: 'Valid from email required' }),\n /\n * NO application-level `replyTo`. It was declared here and read by no send path — reply-to comes\n * only from the per-request `EmailSendRequest.replyTo`, which every provider module does forward\n * (`ReplyTo` on Postmark, `reply_to` on SendGrid and Resend, `h:Reply-To` on Mailgun, `replyTo`\n * on Brevo) and which the notification dispatcher and the authentication flows never set.\n * Removed 2026-09-08 (#447): reply-to is per-request by design. An application that wants one on\n * a framework-sent message needs the dispatcher to set it, not a config key nothing reads.\n /\n isTransactionalWildoManaged: z.boolean(),\n isMarketingWildoManaged: z.boolean(),\n brandTokens: EmailBrandTokens_ConfigSchema.optional(),\n});\n\n\nexport const AppConfigBackend_Monitoring_Schema = z.object({\n metrics: z.object({\n enabled: z.boolean().default(false),\n collectDefaultMetrics: z.boolean().default(true),\n }),\n});\n\n/\n PostgreSQL connection pool configuration\n /\nconst PostgreSQL_PoolConfig_Schema = z.object({\n /* Minimum number of connections in the pool /\n min: z.number().int().min(0).default(2),\n /* Maximum number of connections in the pool /\n max: z.number().int().min(1).default(10),\n /* Idle timeout in milliseconds (connections idle longer than this are closed) /\n idleTimeoutMs: z.number().int().min(0).default(30000),\n /\n How long to wait for a connection from the pool before failing.\n \n Read by `PostgreSQLDatabaseBackendService` (`connectionTimeoutMillis`) but never DECLARED here\n * — another field the `as any` on `pgConfig` concealed. Left OPTIONAL with no default on purpose:\n * `pg` treats absent as \"wait indefinitely\", and inventing a timeout would change the failure\n * behaviour of every existing deployment as a side effect of typing the field.\n /\n connectionTimeoutMs: z.number().int().min(0).optional(),\n});\n\n/\n PostgreSQL configuration schema\n /\nconst PostgreSQL_Config_Schema = z.object({\n /* Is PostgreSQL enabled for this application? /\n enabled: z.boolean().default(false),\n /\n Where the database lives. TOPOLOGY, mirroring MongoDB's `host` — credentials stay in\n * `secrets.database.postgresql`.\n \n These were MISSING from this schema while `PostgreSQLDatabaseBackendService` already read them\n * as `(pgConfig as any)?.host` / `?.port`. So the service consumed two fields the contract did not\n * declare, and the `as any` is what stopped the compiler from saying so — the exact shape this\n * workstream keeps finding. Adding them makes the read type-checked and lets the config loader\n * populate the branch from the environment at all.\n /\n host: z.string().min(1).optional(),\n port: z.number().int().min(1).max(65535).optional(),\n /* Database name (can be overridden in secrets) /\n databaseName: z.string().optional(),\n /* SSL mode for connection security /\n sslMode: z.enum(PostgreSQLSSLMode).default(PostgreSQLSSLMode.REQUIRE),\n /* Connection pool configuration /\n pool: PostgreSQL_PoolConfig_Schema.optional(),\n});\n\n/\n MongoDB configuration schema with enabled flag\n /\nconst MongoDB_Config_Schema = z.object({\n /* Is MongoDB enabled for this application? /\n enabled: z.boolean(),\n /* MongoDB host (cluster or standalone) /\n host: z.string().min(1, { error: 'MongoDB host is required' }),\n /* MongoDB database name /\n database: z.string().min(1, { error: 'MongoDB database name is required' }),\n /* Connection protocol /\n protocol: z.enum(MongoDBProtocol),\n /* Connection options /\n options: z.object({\n retryWrites: z.boolean(),\n w: z.union([z.string(), z.number()]),\n appName: z.string().optional(),\n authSource: z.string(),\n directConnection: z.boolean().optional(),\n })\n});\n\nexport const AppConfigBackend_Database_Schema = z.object({\n /\n Default persistence adapter for resources that don't specify one.\n * - 'mongodb': MongoDB with Mongoose ORM (default)\n * - 'postgresql': PostgreSQL (Kysely-based SQL adapter)\n \n In practice this is THE adapter, not merely the default. An application is wholly one\n * adapter unless a resource explicitly opts out, because two adapters cannot share a native\n * transaction — so a resource declaring `ResourceConfiguration.persistenceAdapter` with a\n * DIFFERENT value is refused at registration by `ResourcesRegistryBackendService`.\n \n A resource may override this only by declaring `ResourceConfiguration.persistenceAdapter`\n * together with `ResourceConfiguration.persistenceAdapterIsolation` — a named claim (see\n * `ResourcePersistenceAdapterIsolation`) that the resource takes part in no cross-adapter\n * atomic write. The admitted set is logged at startup, and the persistence unit of work still\n * refuses any real cross-adapter atomic boundary at runtime.\n \n This paragraph used to read \"Individual resources can override this via\n * ResourceConfiguration.persistenceAdapter\", which the registry had refused outright since the\n * one-adapter-per-application rule landed. Contract and behaviour now agree.\n /\n defaultAdapter: z.enum(PersistenceAdapter),\n\n /\n The format NEW resource identifiers are minted in.\n \n Declared, never derived from the adapter. It used to be a function of the persistence\n * adapter — MongoDB implied `OBJECT_ID`, PostgreSQL implied `UUID` — which made an application's\n * identity format a side effect of where its rows happen to live. Moving one resource to another\n * adapter then silently changed the shape of every id it minted, and made every id it had ALREADY\n * minted fail `validateForResource`, because that check compared a stored, historical value\n * against the currently-configured format.\n \n Identity format is an application-level decision (it reaches URLs, external references, exports\n * and integrations), so it is declared here and applies uniformly. Storage is free to change\n * underneath it; `formatForQuery` still adapts the value to each dialect, which is the part that\n * genuinely IS adapter-specific.\n \n Defaults to `OBJECT_ID`, which is what every existing application already mints.\n \n Deployment constraint, and it bites in exactly one place. On PostgreSQL the `_id` COLUMN\n * TYPE must be able to hold the declared format. The SQL planner already types it from the schema\n * (`z.string()` → `text`), so a migration built from the plan is correct for either format — but a\n * hand-written `_id uuid` column silently restricts the application to `UUID`, and rejects an\n * `OBJECT_ID` with `invalid input syntax for type uuid`. Two integration fixtures had exactly that\n * DDL and only passed while format was still derived from the adapter.\n \n For the same reason, do NOT give `_id` a database default (`gen_random_uuid()`): identity is\n * minted by `ResourceIdBackendService` so that one rule governs it, and a column default would\n * produce a second format for any row that reached the table another way.\n /\n resourceIdFormat: z.enum(ResourceIdFormat).default(ResourceIdFormat.OBJECT_ID),\n\n /\n MongoDB configuration — OPTIONAL, and absent when the environment supplies no MongoDB address.\n \n Host/database/protocol come from env (`MONGODB_HOST`, `MONGODB_DATABASE`, `MONGODB_PROTOCOL`).\n \n REQUIRED until 2026-08-28, while `postgresql` beside it was already optional — and the asymmetry\n * was a defect, for the precise reason that field's own JSDoc gives: a branch with `enabled: true`\n * and no host passes the registry's boot check (\"is the declared adapter enabled?\") and then fails\n * at the first connection, which is the wrong place to learn about it.\n \n Because the loader built this branch unconditionally, `database.mongodb.enabled` was `true` on\n * every runtime that has ever existed — including one with no mongod within reach — so nothing\n * could ask \"does this runtime have a MongoDB?\" and get a true answer. `wonder-crm` (PostgreSQL on\n * both planes, no mongod declared) is where that was met: its readiness gate probed a MongoDB it\n * does not have and would have reported 503 with no way to become ready.\n \n ABSENT now means exactly what it means for PostgreSQL: this runtime has no MongoDB.\n /\n mongodb: MongoDB_Config_Schema.optional(),\n\n /* PostgreSQL configuration (optional, disabled by default) /\n postgresql: PostgreSQL_Config_Schema.optional(),\n\n /* Redis configuration — after T5, host/port come from env vars /\n redis: z.object({\n host: z.string().default('localhost'),\n port: z.number().int().min(1).max(65535).default(6379),\n db: z.number().int().min(0).default(0),\n /\n Slice 3.6 (F-43) — canonical app-level Redis key namespace.\n \n Sourced from `wildo.saas.config.dataServices.redis.keyPrefix` and\n * threaded into the backend via the `REDIS_KEY_PREFIX` env. When\n * present here, `RedisService.connect()` adopts it as `appPrefix`\n * (replacing the legacy `secrets.database.redis.username`-derived\n * prefix). When unauthored, `RedisService.connect()` falls back to\n * the slug-derived `<appSlug>:` default (2026-05-26 ACL-alignment\n * fix — the previous literal `'saas:'` schema default was global\n * across every un-authored app and `NOPERM`-collided with the\n * per-app ACL grant `~<appSlug>:` provisioned by apps-manager).\n \n * NOTE: Without this field on the AppConfiguration redis schema, the\n * loader-injected `keyPrefix` would be silently stripped at schema\n * parse time (`z.object` strips unknown keys), defeating the entire\n * Slice 3.6 wiring. This is the boundary where the two schemas\n * (connection-tuning vs app config) intentionally overlap.\n /\n keyPrefix: z.string().optional(),\n }).optional(),\n\n /* RabbitMQ configuration — after T5, host/port come from env vars /\n rabbitmq: z.object({\n host: z.string().default('localhost'),\n port: z.number().int().min(1).max(65535).default(5672),\n /\n Optional virtual host. Slice 2.5c-3 of `infra-provider-planner.md`:\n * activates per-app vhost isolation when authored at\n * `wildo.infra.<envName>.config.ts > backingServices.rabbitmq.vhost`.\n * Apps-manager reads `RABBITMQ_VHOST` from process.env (written by\n * `env-vars-builder.service.ts`) and threads it here. The engine\n * `RabbitMQAdapterBackendService` reads it via\n * `appConfig.database.rabbitmq.vhost` and passes it to the broker\n * connection URL (`adapter.configure({...vhost})`); when omitted\n * the adapter falls back to the default vhost `/`.\n \n `RabbitmqSelfInfraProviderModule.mintAppCredentials` is\n * orchestrator-driven: when the lifecycle service supplies the\n * vhost via `applicationConfigInputs.vhost`, the module calls\n * `ensureVhost(...)` and sets permissions ON that vhost; otherwise\n * the per-app user lands on `/` with regex-based isolation\n * (legacy Slice 2 behavior).\n /\n vhost: z.string().optional(),\n }).optional()\n});\n\n\n\n/* L6: Schema for a rotated public key entry, including its kid for header matching. /\nexport const RotatedPublicKeyEntry_Schema = z.object({\n /* The key ID that was used when signing tokens with this key (matches JWT header `kid`). /\n kid: z.string(),\n /* The PEM-encoded public key. /\n publicKey: z.string(),\n /\n OPTIONAL self-retirement instant. When set, this rotated key STOPS being advertised in the JWKS and STOPS\n * verifying tokens once the instant has passed — so an operator can schedule a compromised or aged prior key\n * to expire WITHOUT a redeploy or a manual config removal. Absent = the key stays valid until it is removed\n * from config (the prior behavior; a rotated key was otherwise time-unbounded in code, fenced only by the\n * token's own `exp`). Coerced from an ISO-8601 string when authored as text.\n * assurance-control: WILDO.IDENTITY.SIGNING_KEY_LIFECYCLE — bounds a retired signing key's lifetime.\n /\n notAfter: z.coerce.date().optional(),\n});\n\nexport const AppConfiguration_JWT_Schema = z.object({\n /\n JWT public keys per verifiable key type.\n * After T5, these are the ONLY config fetched from apps-manager (dynamic, rotatable).\n * Defaults to empty — populated by fetchAndMergeFromAppsManager() at startup.\n /\n publicKey: z.record(z.string(), z.string()).default(() => ({})).refine(\n (val) => Object.keys(val).every(key => {\n try {\n VerifiableJwtKeysSchema.parse(key);\n return true;\n } catch {\n return false;\n }\n }),\n { error: 'Invalid JWT key type' }\n ),\n /\n L6: Previous public keys for key rotation. Maps key type to an array of { kid, publicKey } entries.\n * Verification decodes the JWT header `kid` and matches against these entries.\n * Sign always uses the current key. Remove rotated keys after their max token TTL has elapsed.\n /\n rotatedPublicKeys: z.record(z.string(), z.array(RotatedPublicKeyEntry_Schema)).optional().default(() => ({})),\n refreshTokenExpirationDays: z.number(),\n /* Access token TTL in minutes. /\n accessTokenExpirationMinutes: z.number().min(1).max(1440),\n});\n\n/\n Where the managed object store lives. Platform-injected topology, NOT a\n * credential — the credential is a short-lived, prefix-confined STS session\n * fetched from apps-manager and never appears in configuration.\n * See `.claude/plans/object-storage-root-credential-distribution.md`.\n /\nexport const AppConfiguration_Storage_ManagedConnectionSchema = z.object({\n /* Host or URL of the object store. /\n endpoint: z.string().min(1),\n port: z.number().int().positive(),\n useSsl: z.boolean(),\n /* Infra-controlled bucket. N applications share one bucket. /\n bucket: z.string().min(1),\n /\n Object-key namespace prefix, authored by the application. Cosmetic only:\n * isolation is enforced by the session policy, which keys on the\n * platform-minted `applicationId` and never on this value — an application\n * cannot be trusted to author its own boundary.\n /\n bucketPrefix: z.string().optional(),\n});\n\n/* Filesystem root for the local-directory storage provider. /\nexport const AppConfiguration_Storage_LocalDirectoryConnectionSchema = z.object({\n baseDir: z.string().min(1),\n});\n\n/\n Storage configuration — deliberately holding BOTH application policy and\n * platform-injected topology, mirroring `AppConfigBackend_Database_Schema`,\n * which carries `defaultAdapter` (an app decision) beside `mongodb.host` (a\n * platform-injected connection detail).\n \n The two halves have different owners and it is worth keeping that legible:\n * `maxFileSize` is authored by the application; `managed` / `localDirectory` are\n * injected by the configuration loader. Both connection blocks are OPTIONAL —\n * an application configures at most one storage provider, and an application\n * with no file feature configures neither.\n /\nexport const AppConfiguration_StorageSchema = z.object({\n maxFileSize: z.number(),\n managed: AppConfiguration_Storage_ManagedConnectionSchema.optional(),\n localDirectory: AppConfiguration_Storage_LocalDirectoryConnectionSchema.optional(),\n});\n\n/\n Default ports for the file-pipeline sidecars.\n \n They live HERE, with the derivation, rather than in each consuming service —\n * the consumer now receives a fully-resolved connection, so a default owned by\n * the consumer would be a second source that can disagree with the one the\n * configuration was built from. Values match the upstream images' own defaults\n * (ClamAV clamd 3310, the YARA sidecar 8080).\n /\nconst CLAMAV_DEFAULT_PORT = 3310;\nconst YARA_DEFAULT_PORT = 8080;\n\n// NOTE: `AppConfiguration_ConnectionScheme` (the inbound-dial http/https vocabulary) was deleted\n// on 2026-08-26 with the Weaviate RAG lane — its only consumers were the Weaviate connection\n// surfaces. The rule its JSDoc carried still holds and is restated here so it survives the enum:\n// an inbound dial scheme and a published edge scheme share wire values and nothing else, so if\n// either concept returns it gets its OWN named vocabulary rather than an inlined literal union.\n\n/* A scanning sidecar reachable over HTTP. Platform-injected topology. /\nexport const AppConfiguration_FileScanning_ServiceConnectionSchema = z.object({\n host: z.string().min(1),\n port: z.number().int().positive(),\n});\n\n/\n File-scanning configuration.\n \n `yara.enabled` and `yara.connection` are two INDEPENDENT axes and must stay\n * that way: the startup validator reports \"explicitly enabled but not\n * configured\" as its own issue, so collapsing them into one optional block\n * would silently turn a misconfiguration into \"scanning is simply off\".\n * ClamAV has no such opt-in — presence of a host IS the opt-in.\n /\nexport const AppConfiguration_FileScanningSchema = z.object({\n antivirus: AppConfiguration_FileScanning_ServiceConnectionSchema.optional(),\n yara: z.object({\n enabled: z.boolean(),\n connection: AppConfiguration_FileScanning_ServiceConnectionSchema.optional(),\n }).optional(),\n});\n\n/\n The environment slice that DEFINES object-storage topology, already coerced\n * (`STORAGE_PORT` a number, `STORAGE_USE_SSL` a boolean) — the shape\n * `ApplicationEnvConfigurationSchema` produces for these keys.\n /\nexport interface StorageTopologyEnvironmentSource {\n STORAGE_ENDPOINT?: string \| undefined;\n STORAGE_PORT?: number \| undefined;\n STORAGE_USE_SSL?: boolean \| undefined;\n STORAGE_BUCKET?: string \| undefined;\n STORAGE_BUCKET_PREFIX?: string \| undefined;\n STORAGE_LOCAL_BASE_DIR?: string \| undefined;\n}\n\n/\n The environment slice that DEFINES the file-pipeline service topology\n * (antivirus and YARA sidecars), already coerced — the shape\n * `ApplicationEnvConfigurationSchema` produces for these keys.\n /\nexport interface FileServicesTopologyEnvironmentSource {\n CLAMAV_HOST?: string \| undefined;\n CLAMAV_PORT?: number \| undefined;\n YARA_ENABLED?: boolean \| undefined;\n YARA_HOST?: string \| undefined;\n YARA_PORT?: number \| undefined;\n}\n\n/* Every platform-injected topology section, so a construction path seeds them together. /\nexport interface PlatformInjectedTopologySections {\n storage: AppConfiguration_StorageTopology;\n fileScanning: z.infer<typeof AppConfiguration_FileScanningSchema>;\n}\n\n/* The platform-injected half of {@link AppConfiguration_StorageSchema}. /\nexport type AppConfiguration_StorageTopology = Pick<\n z.infer<typeof AppConfiguration_StorageSchema>,\n 'managed' \| 'localDirectory'\n>;\n\n/\n Derive the platform-injected storage topology from environment material.\n \n ## Why this is a shared function rather than an inline mapping\n \n Storage consumers read `appConfigService.config.storage`, so the invariant is\n * \"EVERY path that constructs an `AppConfiguration` carries this topology\". That\n * is not one call site — it is the application loader plus every platform\n * service, each of which builds its configuration a different way:\n * `buildConfigFromEnv` (applications), `initializeWithMinimalConfig`\n * (crontabs-batches-manager and the shared platform startup base),\n * and two hand-authored `hydrateResolvedConfiguration` inputs (apps-manager,\n * module-registry). All four run the app-tier `WildoManagedStorageProvider` in\n * their own process, and the module registry publishes its artifacts through it.\n \n A path that omits the topology does not fail — the provider reports itself\n * UNCONFIGURED and the router SKIPS it, which disables the file feature in\n * silence. One shared derivation is what keeps a fifth construction path from\n * re-deriving this slightly differently, or forgetting it entirely.\n * See `.claude/rules/invariant-call-site-enumeration.md`.\n \n Each block is emitted ONLY when its defining value is present, for the same\n * reason: seeding a plausible default would make an unconfigured runtime look\n * configured, and it would fail later at an object operation rather than here.\n /\nexport function buildStorageTopologyFromEnvironment(\n env: StorageTopologyEnvironmentSource,\n): AppConfiguration_StorageTopology {\n return {\n ...(env.STORAGE_ENDPOINT\n ? {\n managed: {\n endpoint: env.STORAGE_ENDPOINT,\n port: env.STORAGE_PORT ?? INFRA_DEFAULT_PORTS.MINIO,\n useSsl: env.STORAGE_USE_SSL ?? false,\n bucket: env.STORAGE_BUCKET ?? STORAGE_DEFAULTS.BUCKET,\n // Absent rather than empty-string when unauthored: the provider\n // distinguishes \"no prefix\" from \"a prefix that is the empty string\"\n // only by absence.\n ...(env.STORAGE_BUCKET_PREFIX ? { bucketPrefix: env.STORAGE_BUCKET_PREFIX } : {}),\n },\n }\n : {}),\n ...(env.STORAGE_LOCAL_BASE_DIR ? { localDirectory: { baseDir: env.STORAGE_LOCAL_BASE_DIR } } : {}),\n };\n}\n\n/\n Coerce raw environment strings into {@link StorageTopologyEnvironmentSource}.\n \n For callers that never parse `ApplicationEnvConfigurationSchema` — the platform\n * services, which assemble their configuration by hand. The coercions MUST match\n * that schema's (`z.coerce.number()` for the port, the literal `'true'` test for\n * SSL); `storage-topology.backend.schemas.test.ts` pins the two against each\n * other so a change to one that is not made to the other fails rather than\n * quietly giving platform services a different topology than applications.\n /\n/\n Derive the file-pipeline service topology (antivirus, YARA) from environment\n * material. Same contract and same reasoning as\n * {@link buildStorageTopologyFromEnvironment}: a section is emitted only when its\n * defining value is present, because a plausible default reads as \"configured\"\n * to a subsystem whose whole configuration test is \"is a host set?\".\n \n The YARA block is emitted when EITHER key is present, precisely so\n * \"enabled but no host\" survives as a distinguishable state for the startup\n * validator to report.\n /\nexport function buildFileServicesTopologyFromEnvironment(\n env: FileServicesTopologyEnvironmentSource,\n): Pick<PlatformInjectedTopologySections, 'fileScanning'> {\n return {\n fileScanning: {\n ...(env.CLAMAV_HOST\n ? { antivirus: { host: env.CLAMAV_HOST, port: env.CLAMAV_PORT ?? CLAMAV_DEFAULT_PORT } }\n : {}),\n ...(env.YARA_ENABLED !== undefined \|\| env.YARA_HOST\n ? {\n yara: {\n enabled: env.YARA_ENABLED === true,\n ...(env.YARA_HOST\n ? { connection: { host: env.YARA_HOST, port: env.YARA_PORT ?? YARA_DEFAULT_PORT } }\n : {}),\n },\n }\n : {}),\n },\n };\n}\n\nexport function readStorageTopologyEnvironmentSource(\n raw: Record<string, string \| undefined>,\n): StorageTopologyEnvironmentSource {\n const rawPort = raw[ApplicationBackendDataEnvKeys.STORAGE_PORT];\n const rawUseSsl = raw[ApplicationBackendDataEnvKeys.STORAGE_USE_SSL];\n return {\n ...(raw[ApplicationBackendDataEnvKeys.STORAGE_ENDPOINT]\n ? { STORAGE_ENDPOINT: raw[ApplicationBackendDataEnvKeys.STORAGE_ENDPOINT] }\n : {}),\n ...(rawPort !== undefined && rawPort !== '' ? { STORAGE_PORT: Number(rawPort) } : {}),\n ...(rawUseSsl !== undefined ? { STORAGE_USE_SSL: rawUseSsl === 'true' } : {}),\n ...(raw[ApplicationBackendDataEnvKeys.STORAGE_BUCKET]\n ? { STORAGE_BUCKET: raw[ApplicationBackendDataEnvKeys.STORAGE_BUCKET] }\n : {}),\n ...(raw[ApplicationBackendDataEnvKeys.STORAGE_BUCKET_PREFIX]\n ? { STORAGE_BUCKET_PREFIX: raw[ApplicationBackendDataEnvKeys.STORAGE_BUCKET_PREFIX] }\n : {}),\n ...(raw[ApplicationBackendDataEnvKeys.STORAGE_LOCAL_BASE_DIR]\n ? { STORAGE_LOCAL_BASE_DIR: raw[ApplicationBackendDataEnvKeys.STORAGE_LOCAL_BASE_DIR] }\n : {}),\n };\n}\n\n/* Numeric coercion matching `z.coerce.number().optional()`: absent stays absent. /\nfunction readOptionalNumberEnv(raw: Record<string, string \| undefined>, key: string): number \| undefined {\n const value = raw[key];\n return value === undefined \|\| value === '' ? undefined : Number(value);\n}\n\n/\n Coerce raw environment strings into {@link FileServicesTopologyEnvironmentSource}.\n * The platform counterpart of {@link readStorageTopologyEnvironmentSource}; the same\n * parity pin covers it.\n /\nexport function readFileServicesTopologyEnvironmentSource(\n raw: Record<string, string \| undefined>,\n): FileServicesTopologyEnvironmentSource {\n const yaraEnabled = raw[ApplicationBackendDataEnvKeys.YARA_ENABLED];\n const clamavPort = readOptionalNumberEnv(raw, ApplicationBackendDataEnvKeys.CLAMAV_PORT);\n const yaraPort = readOptionalNumberEnv(raw, ApplicationBackendDataEnvKeys.YARA_PORT);\n return {\n ...(raw[ApplicationBackendDataEnvKeys.CLAMAV_HOST]\n ? { CLAMAV_HOST: raw[ApplicationBackendDataEnvKeys.CLAMAV_HOST] }\n : {}),\n ...(clamavPort !== undefined ? { CLAMAV_PORT: clamavPort } : {}),\n ...(yaraEnabled !== undefined ? { YARA_ENABLED: yaraEnabled === 'true' } : {}),\n ...(raw[ApplicationBackendDataEnvKeys.YARA_HOST]\n ? { YARA_HOST: raw[ApplicationBackendDataEnvKeys.YARA_HOST] }\n : {}),\n ...(yaraPort !== undefined ? { YARA_PORT: yaraPort } : {}),\n };\n}\n\n/\n Every platform-injected topology section, derived from raw environment in one\n * call.\n \n This exists so a config-construction path seeds them TOGETHER. Three of the\n * four paths hand-author an `AppConfiguration` (the platform services), which\n * means no type can force them to include a new section — the compiler never\n * sees the object as an `AppConfiguration`. One entry point is what keeps\n * \"remember to add the new section in four places\" from being the mechanism.\n * See `.claude/rules/invariant-call-site-enumeration.md`.\n /\nexport function buildPlatformInjectedTopologyFromProcessEnv(\n raw: Record<string, string \| undefined>,\n): PlatformInjectedTopologySections {\n return {\n storage: buildStorageTopologyFromEnvironment(readStorageTopologyEnvironmentSource(raw)),\n ...buildFileServicesTopologyFromEnvironment(readFileServicesTopologyEnvironmentSource(raw)),\n };\n}\n\nconst AppConfiguration_PreOverride_AuthSchema = AppConfiguration_Shared_AuthSchema.extend({\n socialOAuth2Providers: OAuth2ProvidersConfigSchema.optional(),\n passwordHashing: z.object({\n argon2: Argon2PasswordHashingSchema.partial().optional(),\n }).optional(),\n passkeyOperational: PasskeyOperationalSchema.partial().optional(),\n otpOperational: z.object({\n smsOtp: SmsOtpOperationalSchema.partial().optional(),\n emailOtp: EmailOtpOperationalSchema.partial().optional(),\n }).optional(),\n magicLinkOperational: MagicLinkOperationalSchema.partial().optional(),\n totpOperational: TotpOperationalSchema.partial().optional(),\n});\n\nconst AppConfiguration_PreOverride_Email_Schema = AppConfiguration_Email_Schema.partial({\n isTransactionalWildoManaged: true,\n isMarketingWildoManaged: true,\n});\n\nconst AppConfiguration_PreOverride_StorageSchema = AppConfiguration_StorageSchema.partial();\n\nconst AppConfiguration_PreOverride_Monitoring_Schema = z.object({\n metrics: z.object({\n enabled: z.boolean().optional(),\n collectDefaultMetrics: z.boolean().optional(),\n }).optional(),\n});\n\nconst AppConfiguration_PreOverride_JWT_Schema = AppConfiguration_JWT_Schema.partial({\n refreshTokenExpirationDays: true,\n accessTokenExpirationMinutes: true,\n});\n\n/* ──────────────────────────────────────────────────────────────\n * App-Managed Configuration\n \n Fields that application developers control via backend config files\n * (the config files in backend-api/src/config/). These define\n * the application's identity, behavior, and integrations.\n * ────────────────────────────────────────────────────────────── /\n\nexport const _AppConfiguration_AppManagedConfiguration_Schema = z.object({\n\n appIdentity: AppConfiguration_AppIdentity_Schema,\n\n /\n Generated brand assets — the runtime projection every logo/favicon/brand\n * consumer resolves against via `resolveBrandAsset` (composition × theme ×\n * purpose). This is a BACKEND-AUTHORABLE slot: it lives on the app-managed\n * config (NOT on the boundary-blocked `appIdentity`) and is NOT in the\n * backend-authored Omit set, so an app's `saas-config.backend.ts` composes it\n * from the CLI-generated `backend-api/src/brand-assets.generated.ts`\n * (`generatedBrandAssets`). Empty/absent until a brand is generated; backend\n * consumers fall back to undefined.\n /\n brandAssets: z.array(RuntimeBrandAssetSchema).optional(),\n\n appPreferences: z.object({\n languages: AppConfiguration_AppPreferencesLanguage_Schema,\n }),\n\n auth: AppConfiguration_AuthSchema,\n userTypes: UserTypesConfigSchema,\n frontendServices: FrontendServicesConfigSchema,\n organizationTypes: OrganizationTypesConfigSchema.optional(),\n compliance: AppConfiguration_ComplianceSchema,\n email: AppConfiguration_Email_Schema,\n storage: AppConfiguration_StorageSchema,\n // Platform-injected file-pipeline topology, seeded by the configuration loader\n // from environment material. Optional as a SECTION because an application with\n // no scanning sidecar configures none; the subsystems read absence as\n // \"not configured\" and skip, which is the pre-existing behaviour.\n fileScanning: AppConfiguration_FileScanningSchema.optional(),\n monitoring: AppConfigBackend_Monitoring_Schema,\n\n minions: AppConfiguration_MinionsSchema,\n workers: AppConfiguration_WorkersSchema,\n engineCapabilities: EngineCapabilityActivationsSchema,\n providers: ProvidersBlockSchema,\n providerConfigurations: ProviderConfigurationsSchema,\n billing: BillingConfigurationSchema.optional(),\n analytics: AnalyticsConfigSchema.optional(),\n lifecycle: LifecycleConfigSchema.optional(),\n // Phase 7 / Item 47 (Slice 5) — operator-tunable cron cadence for the\n // engine-owned `data-seeding:scheduled-rerun` batch. Optional: when\n // omitted, the batch factory falls back to the manifest's declared\n // default (currently `' * * * '`).\n dataSeeding: DataSeedingConfigSchema.optional(),\n // Audit Phase 5 / F1 — operator-tunable audit-log archival horizon consumed\n // by the engine-owned `compliance:audit-logs-archive` batch. Optional: when\n // omitted, no archival runs (records retained in AUDIT_LOGS indefinitely).\n auditTrail: AuditTrailConfigSchema.optional(),\n // WS-A tenant teardown — operator-tunable retention window, purge cron and\n // per-run bound consumed by the engine-owned `organization-purge` batch.\n // Optional: every field defaults, so omitting the block yields a working\n // 30-day window purged nightly rather than tenants that are never destroyed.\n tenantTeardown: TenantTeardownConfigSchema.optional(),\n});\n\n/* ──────────────────────────────────────────────────────────────\n * Platform-Managed Configuration\n \n Fields injected by the Wildo platform that developers do NOT\n * override (or only override infra-level details). These are\n * populated by the apps-manager / CLI / .env pipeline.\n \n Note: some sub-fields within these sections are conceptually\n * operator-tunable but NOT developer-tunable. The canonical example is\n * `jwt.{accessTokenExpirationMinutes, refreshTokenExpirationDays}`,\n * which Slice 3.3 moved out of `saas-config.backend.ts` and onto the\n * infra-environment policy (`wildo.infra.<env>.config.ts.serviceAuth`).\n * The application backend READS those values here at sign time, but\n * cannot author them — the apps-manager seeds the persisted\n * `Wildo_Application_Config.jwt.` from the operator-authored\n `serviceAuth` (with `WildoAuthConfigSchema` defaults of 15 min / 30\n * days when omitted \\u2014 access-token default tightened from 60 \\u2192\n * 15 in Auth-hardening Slice A Step 5 on 2026-04-13). The section as a\n * whole is classified by its\n * PRIMARY owner (the platform). Narrow app-authored seams inside\n * platform-managed sections must be modeled explicitly rather than\n * opened up as generic section patching.\n * ────────────────────────────────────────────────────────────── /\n\nexport const _AppConfiguration_PlatformManagedConfiguration_Schema = z.object({\n /\n `runtime.endPoints` is assembled from the env/bootstrap loading chain.\n * App backend authors declare service identities and policy, while runtime\n * topology stays outside the backendConfig contract.\n /\n runtime: AppConfiguration_RuntimeSchema,\n /\n After T5, database addresses come from env vars (MONGODB_, REDIS_, RABBITMQ_).\n The loading chain populates these explicit runtime values from env/bootstrap material.\n /\n database: AppConfigBackend_Database_Schema,\n /\n JWT public keys are fetched from apps-manager (dynamic, rotatable).\n * TTL values are app-authored policy and must be supplied by backendConfig\n * or another explicit config writer before final runtime parse.\n /\n jwt: AppConfiguration_JWT_Schema,\n});\n\n/* ──────────────────────────────────────────────────────────────\n * Full Application Configuration\n \n Composed from:\n * AppManagedConfiguration ∪ PlatformManagedConfiguration ∪ metadata\n \n The ApplicationEnvConfigurationSchema (from .env) contributes\n * values that get mapped into the runtime config via the loader\n * but is not merged here — it's parsed separately from process.env.\n * ────────────────────────────────────────────────────────────── /\n\n/\n The composed shape of {@link AppConfiguration_Schema}, hoisted into a value so the type below\n * has a NAME. Not a stylistic split — see the alias for why it is load-bearing.\n /\nexport const _AppConfiguration_Shape = {\n ..._AppConfiguration_AppManagedConfiguration_Schema.shape,\n ..._AppConfiguration_PlatformManagedConfiguration_Schema.shape,\n createdAt: z.coerce.date().default(() => new Date()),\n updatedAt: z.coerce.date().default(() => new Date()),\n};\n\n/\n ## Why this alias exists — it is load-bearing, not decoration\n \n Without an annotation, `AppConfiguration_Schema` infers a single ANONYMOUS `z.ZodObject<{…}>`\n * whose emitted declaration is ~570 lines of inline structural literal. A consumer that merely\n * `.parse()`s it is unaffected, but one that RE-INFERS from it (`.extend(...)`) must serialise that\n * literal again into its own `.d.ts`, plus whatever it adds. That crossed TypeScript's limit on\n * 2026-08-18 and broke the one such consumer with a pair of errors naming neither this file nor the\n * real cause:\n \n TS7056 The inferred type of this node exceeds the maximum length the compiler will serialize.\n * TS2742 The inferred type of 'X' cannot be named without a reference to\n * '../../node_modules/@wildo-ai/saas-models/src'.\n \n Nothing had changed here — this file was untouched for three days. Growth in the `saas-models`\n * types it composes pushed the INLINE form over the threshold, which is why the failure surfaced at\n * a consumer, during a rebuild, with no edit anywhere near it. That is the shape of this defect:\n * it is a function of SIZE, so it arrives without a culprit and it will arrive again for anything\n * that stays anonymous.\n \n Naming the shape fixes it for every consumer at once. The annotation emits\n * `z.ZodObject<AppConfiguration_Shape>`, so a consumer writes a NAME plus the two or three fields\n * it adds instead of re-expanding the whole configuration surface.\n \n Deliberately `z.ZodObject<…>` rather than `z.ZodType<AppConfiguration>`: consumers genuinely need\n * the object surface — `.extend()`, `.shape` and `.partial()` are all used against this schema and\n * the schemas derived from it — and `z.ZodType` erases every one of them.\n \n Built with `z.object(shape)` rather than `.extend()` because the spread produces a FLATTENED\n * object type that the annotation can restate exactly; `.extend()` returns Zod's internal `Extend<>`\n * mapped type, which an intersection alias is not assignable to (measured, not assumed). Both\n * component schemas are plain `z.object` with no catchall or modifiers, so the two forms are\n * equivalent at runtime — pinned by the `AppConfiguration_Schema` parse tests.\n /\nexport type AppConfiguration_Shape = typeof _AppConfiguration_Shape;\n\nexport const AppConfiguration_Schema: z.ZodObject<AppConfiguration_Shape> = z.object(_AppConfiguration_Shape);\n\nexport const AppConfiguration_PreOverrideSeed_Schema = z.object({\n appIdentity: AppConfiguration_AppIdentity_Schema,\n /* Optional pre-override — populated by the app's backendConfig brandAssets slot. /\n brandAssets: z.array(RuntimeBrandAssetSchema).optional(),\n appPreferences: z.object({\n languages: AppConfiguration_AppPreferencesLanguage_Schema,\n }),\n auth: AppConfiguration_PreOverride_AuthSchema,\n userTypes: UserTypesConfigSchema,\n frontendServices: FrontendServicesConfigSchema,\n organizationTypes: OrganizationTypesConfigSchema.optional(),\n compliance: AppConfiguration_ComplianceSchema,\n email: AppConfiguration_PreOverride_Email_Schema,\n storage: AppConfiguration_PreOverride_StorageSchema,\n fileScanning: AppConfiguration_FileScanningSchema.optional(),\n monitoring: AppConfiguration_PreOverride_Monitoring_Schema,\n minions: AppConfiguration_MinionsSchema,\n workers: AppConfiguration_WorkersSchema,\n engineCapabilities: EngineCapabilityActivationsSchema,\n providers: ProvidersBlockSchema,\n providerConfigurations: ProviderConfigurationsSchema,\n billing: BillingConfigurationSchema.optional(),\n analytics: AnalyticsConfigSchema.optional(),\n lifecycle: LifecycleConfigSchema.optional(),\n dataSeeding: DataSeedingConfigSchema.optional(),\n auditTrail: AuditTrailConfigSchema.optional(),\n tenantTeardown: TenantTeardownConfigSchema.optional(),\n runtime: AppConfiguration_RuntimeSchema,\n database: AppConfigBackend_Database_Schema,\n jwt: AppConfiguration_PreOverride_JWT_Schema,\n createdAt: z.coerce.date().default(() => new Date()),\n updatedAt: z.coerce.date().default(() => new Date()),\n});\n\n/\n Explicit synthetic placeholders used only for the pre-override startup seed.\n \n These are intentionally conspicuous so runtime validation can fail clearly if\n * a non-platform application reaches startup without replacing them via its\n * backendConfig.\n /\nexport const APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS = {\n appName: '__WILDO_PRE_OVERRIDE_APP_NAME__',\n version: '0.0.0-pre-override',\n passkeyRpName: '__WILDO_PRE_OVERRIDE_PASSKEY_RP_NAME__',\n passkeyRpId: 'pre-override.invalid',\n emailFrom: 'pre-override@invalid.localhost',\n} as const;\n\nexport interface BuildMinimalPreOverrideAppConfigurationInput {\n runtimeEndpoints: Record<string, { publicUrl?: string; internalUrl?: string }>;\n database: z.input<typeof AppConfigBackend_Database_Schema>;\n jwt?: Partial<z.input<typeof AppConfiguration_JWT_Schema>> \| undefined;\n /\n Object-storage topology, injected by the loader exactly as `database` is.\n \n Optional because an application may configure no storage provider at all —\n * and because it must stay absent rather than become a placeholder: the\n * storage provider treats a missing connection as UNCONFIGURED, and a\n * plausible-looking default would disable the file feature silently instead of\n * failing loudly. See `.claude/plans/application-runtime-topology-delivery.md`.\n /\n storage?: z.input<typeof AppConfiguration_PreOverride_StorageSchema> \| undefined;\n /* Same contract as `storage`: seeded from env by the loader, absent when unconfigured. /\n fileScanning?: z.input<typeof AppConfiguration_FileScanningSchema> \| undefined;\n}\n\n/\n Build the minimal config seed required before app-local overrides run.\n \n The backend loader is allowed to author runtime/env material plus the narrow\n * structural placeholders required to satisfy the full schema. It must not\n * invent believable app semantics inline.\n /\nexport function buildMinimalPreOverrideAppConfiguration(\n input: BuildMinimalPreOverrideAppConfigurationInput,\n): AppConfiguration_PreOverrideSeed {\n return AppConfiguration_PreOverrideSeed_Schema.parse({\n appIdentity: {\n appName: APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.appName,\n version: APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.version,\n },\n appPreferences: {\n languages: {},\n },\n auth: {\n passkeyConfig: {\n rpName: APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.passkeyRpName,\n rpId: APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.passkeyRpId,\n },\n },\n compliance: {},\n email: {\n from: APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.emailFrom,\n },\n userTypes: {},\n frontendServices: {},\n storage: input.storage ?? {},\n ...(input.fileScanning ? { fileScanning: input.fileScanning } : {}),\n monitoring: {\n metrics: {},\n },\n minions: {},\n workers: {},\n runtime: {\n endPoints: input.runtimeEndpoints,\n },\n database: input.database,\n jwt: input.jwt ?? {},\n });\n}\n\n/* ──────────────────────────────────────────────────────────────\n * Inferred Types (from schemas - no interface duplication)\n * ────────────────────────────────────────────────────────────── */\n\n\n\nexport type AppConfiguration_Auth = z.infer<typeof AppConfiguration_AuthSchema>;\nexport type PasswordHashing = AppConfiguration_Auth['passwordHashing'];\nexport type OtpOperational = AppConfiguration_Auth['otpOperational'];\nexport type MagicLinkOperational = AppConfiguration_Auth['magicLinkOperational'];\nexport type TotpOperational = AppConfiguration_Auth['totpOperational'];\nexport type PasskeyOperational = AppConfiguration_Auth['passkeyOperational'];\n\nexport type AppConfiguration_Compliance = z.infer<typeof AppConfiguration_ComplianceSchema>;\n\nexport type PostgreSQL_PoolConfig = z.infer<typeof PostgreSQL_PoolConfig_Schema>;\nexport type PostgreSQL_Config = z.infer<typeof PostgreSQL_Config_Schema>;\nexport type MongoDB_Config = z.infer<typeof MongoDB_Config_Schema>;\n\nexport type RotatedPublicKeyEntry = z.infer<typeof RotatedPublicKeyEntry_Schema>;\n\nexport type AppConfiguration_Runtime = z.infer<typeof AppConfiguration_RuntimeSchema>;\nexport type AppConfiguration_Email = z.infer<typeof AppConfiguration_Email_Schema>;\nexport type AppConfiguration_Monitoring = z.infer<typeof AppConfigBackend_Monitoring_Schema>;\nexport type AppConfiguration_Database = z.infer<typeof AppConfigBackend_Database_Schema>;\nexport type AppConfiguration_JWT = z.infer<typeof AppConfiguration_JWT_Schema>;\nexport type AppConfiguration_Minions = z.infer<typeof AppConfiguration_MinionsSchema>;\nexport type AppConfiguration_Storage = z.infer<typeof AppConfiguration_StorageSchema>;\nexport type AppConfiguration_Storage_ManagedConnection = z.infer<typeof AppConfiguration_Storage_ManagedConnectionSchema>;\nexport type AppConfiguration_Storage_LocalDirectoryConnection = z.infer<typeof AppConfiguration_Storage_LocalDirectoryConnectionSchema>;\nexport type AppConfiguration = z.infer<typeof AppConfiguration_Schema>;\nexport type AppConfiguration_PreOverrideSeed = z.infer<typeof AppConfiguration_PreOverrideSeed_Schema>;\nexport type AppConfiguration_AppManagedConfiguration = z.infer<typeof _AppConfiguration_AppManagedConfiguration_Schema>;\nexport type AppConfiguration_PlatformManagedConfiguration = z.infer<typeof _AppConfiguration_PlatformManagedConfiguration_Schema>;\nexport type AppConfiguration_Identity = z.infer<typeof AppConfiguration_AppIdentity_Schema>;\nexport type AppConfiguration_Language = z.infer<typeof AppConfiguration_AppPreferencesLanguage_Schema>;\n"]}

package/dist/esm/config/models/provider-runtime-artifact.backend.schemas.d.ts CHANGED Viewed

@@ -1,11 +1,46 @@
 import { z } from 'zod';
-import { EngineCapability } from '@wildo-ai/saas-models';
+import { EngineCapability, type FrontendProvidersBlock } from '@wildo-ai/saas-models';
+/**
+ * The per-service frontend bootstrap map, ANNOTATED rather than inferred.
+ *
+ * `FrontendProvidersBlockSchema` transitively references three atoms that `@wildo-ai/saas-models`
+ * publishes from `/public-runtime` alone, so a consumer that resolves this package's dependency to
+ * SOURCE — the minion and worker libraries do, deliberately — has no public specifier through which
+ * to NAME them. While the artifact object stayed small TypeScript inlined the shape and nobody
+ * noticed; the moment it grew one member past the inline threshold it needed the name and refused:
+ * `TS2742 … cannot be named without a reference to
+ * node_modules/@wildo-ai/saas-models/src/external-providers/provider-frontend-surface.shared.schemas`.
+ *
+ * Annotating here stops the expansion at `FrontendProvidersBlock`, which IS root-exported and
+ * therefore nameable everywhere. The underlying defect is a root-exported contract depending on a
+ * subpath-only module (`package-public-entrypoints.md`, "The root barrel must not DEPEND on a
+ * subpath-only surface"); that module is the frozen provider contract, so it is filed as #356 rather
+ * than fixed here. Nothing is lost: the schema's runtime behaviour is unchanged and consumers keep the
+ * same inferred field type.
+ */
+export interface ProviderRuntimeFrontendBootstraps {
+    [serviceKey: string]: FrontendProvidersBlock;
+}
 export declare const ProviderRuntimeArtifactSchema: z.ZodObject<{
     __AUTOGENERATED__: z.ZodString;
     generatedBy: z.ZodLiteral<"wildo provider-runtime-artifact">;
     generatedAt: z.ZodString;
     sourceDigest: z.ZodString;
     providerRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    /**
+     * `providerRef` -> the package specifier a host dynamic-imports to obtain that provider's backend
+     * module (#330).
+     *
+     * `providerRefs` says WHICH providers this process may expose; this says WHERE each one comes
+     * from, and it is what makes a provider shipped as its own npm package loadable at all — without
+     * it a host can only serve refs the engine itself ships.
+     *
+     * OPTIONAL rather than required, and that is load-bearing: an application whose artifact was
+     * generated before this field existed still parses, and every ref it names is engine-shipped, so
+     * the loader resolves all of them through the engine's own on-demand map. An un-resynced
+     * application therefore behaves exactly as it did before.
+     */
+    providerRuntimeImports: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     providerGraphDigest: z.ZodOptional<z.ZodString>;
     lockfileSectionDigest: z.ZodOptional<z.ZodString>;
     artifactKind: z.ZodLiteral<"backend">;
@@ -17,19 +52,7 @@ export declare const ProviderRuntimeArtifactSchema: z.ZodObject<{
         moduleIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
         moduleIdsByService: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
     }, z.core.$strict>;
-    frontendProviderBootstraps: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        providers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
-            metadata: z.ZodObject<{
-                ref: z.ZodString;
-                displayNameLabelKey: z.ZodOptional<z.ZodString>;
-                displayName: z.ZodOptional<z.ZodString>;
-                iconRef: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>;
-            providerCapabilities: z.ZodArray<z.ZodString>;
-            protocols: z.ZodArray<z.ZodString>;
-            publicConfig: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-        }, z.core.$strip>>>;
-    }, z.core.$strip>>>;
+    frontendProviderBootstraps: z.ZodOptional<z.ZodType<ProviderRuntimeFrontendBootstraps, unknown, z.core.$ZodTypeInternals<ProviderRuntimeFrontendBootstraps, unknown>>>;
     scope: z.ZodDefault<z.ZodObject<{
         providers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
             engineCapabilities: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof EngineCapability>>>;
@@ -38,7 +61,7 @@ export declare const ProviderRuntimeArtifactSchema: z.ZodObject<{
         }, z.core.$strict>>>;
         selection: z.ZodDefault<z.ZodRecord<z.ZodEnum<typeof EngineCapability> & z.core.$partial, z.ZodObject<{
             primary: z.ZodString;
-            fallbacks: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            whenUnavailable: z.ZodDefault<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;

package/dist/esm/config/models/provider-runtime-artifact.backend.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provider-runtime-artifact.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/config/models/provider-runtime-artifact.backend.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,~~EAEjB~~,MAAM,uBAAuB,CAAC;~~AA8B~~/B,eAAO,MAAM,6BAA6B~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAexC~~,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,sJAAsJ;AACtJ,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/C"}
1	+ {"version":3,"file":"provider-runtime-artifact.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/config/models/provider-runtime-artifact.backend.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAEhB,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,iCAAiC;IAChD,CAAC,UAAU,EAAE,MAAM,GAAG,sBAAsB,CAAC;CAC9C;AAiCD,eAAO,MAAM,6BAA6B;;;;;;IAMxC;;;;;;;;;;;;OAYG;;;;;;;;;;;;;;;;;;;;;;;;;kBAQH,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,sJAAsJ;AACtJ,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/C"}

package/dist/esm/config/models/provider-runtime-artifact.backend.schemas.js CHANGED Viewed

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { EngineCapability, FrontendProvidersBlockSchema, } from '@wildo-ai/saas-models';
+const FrontendProviderBootstrapsRecordSchema = z.record(z.string().min(1), FrontendProvidersBlockSchema);
 const ProviderRuntimeScopeSelectionSchema = z.strictObject({
     engineCapabilities: z.array(z.enum(EngineCapability)).default([]),
     providerCapabilities: z.array(z.string().min(1)).default([]),
@@ -7,7 +8,7 @@ const ProviderRuntimeScopeSelectionSchema = z.strictObject({
 });
 const ProviderRuntimeSelectionPolicySchema = z.strictObject({
     primary: z.string().min(1),
-    fallbacks: z.array(z.string().min(1)).default([]),
+    whenUnavailable: z.array(z.string().min(1)).default([]),
 });
 const ProviderRuntimeScopeArtifactSchema = z.strictObject({
     providers: z.record(z.string(), ProviderRuntimeScopeSelectionSchema).default({}),
@@ -27,11 +28,25 @@ export const ProviderRuntimeArtifactSchema = z.strictObject({
     generatedAt: z.string().datetime({ offset: true }),
     sourceDigest: z.string().min(1),
     providerRefs: z.array(z.string().min(1)).optional(),
+    /**
+     * `providerRef` -> the package specifier a host dynamic-imports to obtain that provider's backend
+     * module (#330).
+     *
+     * `providerRefs` says WHICH providers this process may expose; this says WHERE each one comes
+     * from, and it is what makes a provider shipped as its own npm package loadable at all — without
+     * it a host can only serve refs the engine itself ships.
+     *
+     * OPTIONAL rather than required, and that is load-bearing: an application whose artifact was
+     * generated before this field existed still parses, and every ref it names is engine-shipped, so
+     * the loader resolves all of them through the engine's own on-demand map. An un-resynced
+     * application therefore behaves exactly as it did before.
+     */
+    providerRuntimeImports: z.record(z.string().min(1), z.string().min(1)).optional(),
     providerGraphDigest: z.string().min(1).optional(),
     lockfileSectionDigest: z.string().min(1).optional(),
     artifactKind: z.literal('backend'),
     modules: ProviderRuntimeModulesArtifactSchema,
-    frontendProviderBootstraps: z.record(z.string().min(1), FrontendProvidersBlockSchema).optional(),
+    frontendProviderBootstraps: FrontendProviderBootstrapsRecordSchema.optional(),
     scope: ProviderRuntimeScopeArtifactSchema.default({ providers: {}, selection: {} }),
 });
 //# sourceMappingURL=provider-runtime-artifact.backend.schemas.js.map