npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.2 → 1.1.3 - Mend

@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (853) hide show

package/dist/esm/config/services/application-startup-config-validator.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"application-startup-config-validator.backend.service.js","sourceRoot":"","sources":["../../../../../src/config/services/application-startup-config-validator.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EACL,UAAU,EACV,SAAS,EACT,2BAA2B,EAC3B,iBAAiB,EACjB,2BAA2B,EAC3B,SAAS,EACT,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAE9B,mBAAmB,EACnB,gCAAgC,EAChC,+CAA+C,EAC/C,qBAAqB,EAIrB,6BAA6B,EAC7B,+BAA+B,EAC/B,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,8BAA8B,EAC9B,UAAU,EACV,YAAY,EACZ,0BAA0B,GAE3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,sCAAsC,GAEvC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAIrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AACrJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,wEAAwE,CAAC;AACpH,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAC3H,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAC1H,OAAO,EAAE,+BAA+B,EAAE,MAAM,sEAAsE,CAAC;AACvH,OAAO,EAAE,2BAA2B,EAAE,MAAM,kEAAkE,CAAC;AAC/G,OAAO,EAAE,yBAAyB,EAAE,MAAM,gEAAgE,CAAC;AAC3G,OAAO,EAAE,kCAAkC,EAAE,MAAM,uFAAuF,CAAC;AAC3I,OAAO,EACL,6CAA6C,GAC9C,MAAM,iGAAiG,CAAC;AAIzG,OAAO,EACL,qCAAqC,GACtC,MAAM,oFAAoF,CAAC;AAQ5F,OAAO,EACL,qCAAqC,EACrC,sDAAsD,EACtD,8BAA8B,GAC/B,MAAM,4GAA4G,CAAC;AACpH,OAAO,EACL,uCAAuC,EACvC,uCAAuC,EACvC,sBAAsB,EACtB,8CAA8C,EAC9C,8CAA8C,GAC/C,MAAM,4GAA4G,CAAC;AACpH,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,yCAAyC,EAAE,MAAM,+EAA+E,CAAC;AAK1I,OAAO,EACL,sCAAsC,EACtC,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,6DAA6D,CAAC;AACrE,OAAO,EAAE,gCAAgC,EAAE,MAAM,qEAAqE,CAAC;AACvH,OAAO,EACL,2CAA2C,EAC3C,sCAAsC,EACtC,yDAAyD,EACzD,sDAAsD,EACtD,kDAAkD,EAClD,wCAAwC,EACxC,4CAA4C,EAC5C,uCAAuC,EACvC,sCAAsC,EACtC,yCAAyC,EACzC,iCAAiC,GAClC,MAAM,4FAA4F,CAAC;AAEpG;;;;;;;;;;;;;;;;GAgBG;AAEI,IAAM,wCAAwC,GAA9C,MAAM,wCAAwC;;IAIG;IACa;IAEhD;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAGA;IAOA;IAGA;IAGA;IAQA;IA9CX,QAAQ,CAA+D;IAE/E,YACsD,MAAqB,EACR,YAAwC,EAExF,yBAAkE,EAElE,mBAA+C,EAE/C,iBAAkD,EAElD,kBAAoD,EAEpD,iBAAkD,EAElD,aAA0C,EAE1C,WAAsC,EAEtC,qBAA0D,EAE1D,kBAA+E,EAG/E,6BAC4B,EAM5B,uBAA+D,EAG/D,yBAA4D,EAG5D,gBAA0C,EAQ1C,cAA+B;QA3CI,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAExF,8BAAyB,GAAzB,yBAAyB,CAAyC;QAElE,wBAAmB,GAAnB,mBAAmB,CAA4B;QAE/C,sBAAiB,GAAjB,iBAAiB,CAAiC;QAElD,uBAAkB,GAAlB,kBAAkB,CAAkC;QAEpD,sBAAiB,GAAjB,iBAAiB,CAAiC;QAElD,kBAAa,GAAb,aAAa,CAA6B;QAE1C,gBAAW,GAAX,WAAW,CAA2B;QAEtC,0BAAqB,GAArB,qBAAqB,CAAqC;QAE1D,uBAAkB,GAAlB,kBAAkB,CAA6D;QAG/E,kCAA6B,GAA7B,6BAA6B,CACD;QAM5B,4BAAuB,GAAvB,uBAAuB,CAAwC;QAG/D,8BAAyB,GAAzB,yBAAyB,CAAmC;QAG5D,qBAAgB,GAAhB,gBAAgB,CAA0B;QAQ1C,mBAAc,GAAd,cAAc,CAAiB;QAEhD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAC;IACtF,CAAC;IAED,4EAA4E;IAC5E,sCAAsC;IACtC,4EAA4E;IAErE,QAAQ,CAAC,MAAwB;QACtC,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,sCAAsC,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,yCAAyC,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,yCAAyC,CAAC,MAAwB;QACxE,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,qBAAqB,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,qBAAqB,CAAC,QAAQ,EAAE,CAAC;YACpE,OAAO,CAAC,+DAA+D;QACzE,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4FAA4F,KAAK,MAAM;cACrG,wGAAwG;cACxG,uGAAuG;cACvG,wGAAwG;cACxG,wGAAwG;cACxG,iGAAiG;cACjG,wGAAwG,EAC1G,EAAE,qBAAqB,EAAE,KAAK,EAAE,CACjC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAU,mCAAmC,GAAG,GAAG,CAAC;IAElE;;;;;;;;;;;;;;OAcG;IACK,+BAA+B,CAAC,MAAwB;QAC9D,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC;QAC7D,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,CAAC,0CAA0C;QACpD,CAAC;QAED,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,uBAAuB,CAAC,WAAW,CAA4B,CAAC;QACvH,IAAI,cAAc,KAAK,uBAAuB,CAAC,WAAW,EAAE,CAAC;YAC3D,OAAO,CAAC,mDAAmD;QAC7D,CAAC;QAED,MAAM,KAAK,GAAG,0CAAwC,CAAC,mCAAmC,CAAC;QAC3F,IAAI,gBAAgB,GAAG,KAAK,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,gCAAgC,gBAAgB,sCAAsC,KAAK,QAAQ;wBACnG,mBAAmB,cAAc,iEAAiE;wBAClG,GAAG,KAAK,wEAAwE,KAAK,GAAG;wBACxF,iBAAiB,KAAK,yEAAyE;wBAC/F,sBAAsB;oBACxB,gBAAgB;oBAChB,SAAS,EAAE,KAAK;oBAChB,cAAc;iBACf;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,0DAA0D;IAC1D,4EAA4E;IAE5E;;;;;;;OAOG;IACH;;;;;;;;;;OAUG;IACK,gCAAgC;QACtC,OAAO;YACL,8FAA8F;YAC9F,yCAAyC;YACzC,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE;YACjC,wFAAwF;YACxF,GAAG,EAAE,CAAC,IAAI,CAAC,sDAAsD,EAAE;SACpE,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,yCAAyC,CAAC,MAAyB;QACzE,OAAO;YACL,GAAG,EAAE,CAAC,IAAI,CAAC,iDAAiD,EAAE;YAC9D,GAAG,EAAE,CAAC,IAAI,CAAC,6CAA6C,CAAC,MAAM,CAAC;YAChE,GAAG,EAAE,CAAC,IAAI,CAAC,2CAA2C,EAAE;YACxD,GAAG,EAAE,CAAC,IAAI,CAAC,gDAAgD,EAAE;SAC9D,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACK,yCAAyC;QAC/C,OAAO;YACL,GAAG,EAAE,CAAC,IAAI,CAAC,mCAAmC,EAAE;SACjD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,+BAA+B,CAAC,MAAyB;QAC/D,OAAO;YACL,GAAG,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE;YAClC,GAAG,EAAE,CAAC,IAAI,CAAC,iBAAiB,EAAE;YAC9B,GAAG,EAAE,CAAC,IAAI,CAAC,mDAAmD,CAAC,MAAM,CAAC;YACtE,GAAG,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE;SACtC,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,UAAoD;QACxE,MAAM,SAAS,GAAmC,EAAE,CAAC;QACrD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,SAAS,CAAC,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;sGACkG;IAC3F,mCAAmC,CAAC,MAAyB;QAClE,IAAI,CAAC,iBAAiB,CAAC,kDAAkD,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC,aAAa,CAAC;YACxB,GAAG,IAAI,CAAC,gCAAgC,EAAE;YAC1C,GAAG,IAAI,CAAC,yCAAyC,CAAC,MAAM,CAAC;YACzD,GAAG,IAAI,CAAC,yCAAyC,EAAE;YACnD,GAAG,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,2CAA2C,CAAC,MAAyB;QAC1E,OAAO,IAAI,CAAC,aAAa,CAAC;YACxB,GAAG,IAAI,CAAC,gCAAgC,EAAE;YAC1C,GAAG,IAAI,CAAC,yCAAyC,CAAC,MAAM,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACI,uCAAuC;QAC5C,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,gCAAgC,EAAE,CAAC,CAAC;IACrE,CAAC;IAGD;;;;;;;;;OASG;IACI,KAAK,CAAC,8CAA8C,CAAC,MAAwB;QAClF,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,2FAA2F;oBAC7F,MAAM,EAAE,uDAAuD;iBAChE;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAGlC,CAAC;QACJ,KACE,MAAM,OAAO,IACV,IAAI,CAAC,8CAA8C,CAAC,MAAM,CAAC,EAC9D,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,6BAA6B,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;YACnF,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;gBAC3B,mEAAmE;gBACnE,kEAAkE;gBAClE,MAAM,IAAI,CAAC,6BAA6B;qBACrC,0BAA0B,CAAC,OAAO,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,eAAe,KAAK,SAAS;mBAChE,CAAC,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,EACzD,CAAC;gBACD,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,qBAAqB,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,6BAA6B;qBACrC,0BAA0B,CAAC,OAAO,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACP,OAAO,EACL,wBAAwB,OAAO,6BAA6B;8BAC1D,qCAAqC,OAAO,CAAC,QAAQ,GAAG;wBAC5D,MAAM,EAAE,gDAAgD;wBACxD,OAAO;wBACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,aAAa,EAAE,KAAK,YAAY,KAAK;4BACnC,CAAC,CAAC,KAAK,CAAC,OAAO;4BACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAClB;iBACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACI,KAAK,CAAC,qCAAqC;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,+BAA+B,EAAE,CAAC;QAC5D,IAAI,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,+BAA+B;QAC3C,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAClC,qFAAqF;YACrF,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAmC,EAAE,CAAC;QAClD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAoB,CAAC;QAE1D,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACrE,IAAI,YAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,YAAY,GAAG,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,wFAAwF;gBACxF,uFAAuF;gBACvF,oEAAoE;gBACpE,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,GAAG,EACjC,mDAAmD,MAAM,CAAC,YAAY,CAAC,MAAM,mBAAmB,CAAC,KAAK,CAAC,EAAE,EACzG,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,CACvC,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,CAAC,YAAY;gBAAE,SAAS;YAE5B,MAAM,qBAAqB,GAAG,IAAI,CAAC,iBAAiB,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC;YAE/F,MAAM,cAAc,GAAG,IAAI,CAAC,gCAAgC,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;YAClG,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC5B,2FAA2F;gBAC3F,0FAA0F;gBAC1F,SAAS;YACX,CAAC;YAED,MAAM,eAAe,GAAG,qBAAqB,EAAE,kBAAkB,CAAC;YAClE,MAAM,OAAO,GAAG,yCAAyC,CAAC,eAAe,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAClG,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC1D,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;YACpC,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,qBAAqB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,qBAAqB,EAAE,CAAC;YAC7D;;;;;;eAMG;YACH,MAAM,OAAO,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,GAAG,EACjC,cAAc,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,oEAAoE;sBACxG,IAAI,OAAO,uCAAuC,EACpD,EAAE,aAAa,EAAE,OAAO,EAAE,CAC3B,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,QAAQ,OAAO,EAAE,CAAC;gBAChB,KAAK,oBAAoB,CAAC,UAAU;oBAClC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,aAAa,CAAC,CAAC,CAAC;oBACxE,MAAM;gBACR,KAAK,oBAAoB,CAAC,OAAO;oBAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAC,CAAC;oBACvE,MAAM;gBACR,KAAK,oBAAoB,CAAC,IAAI;oBAC5B,sFAAsF;oBACtF,sFAAsF;oBACtF,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,GAAG,EACjC,cAAc,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,uDAAuD;0BAC3F,IAAI,OAAO,uFAAuF;0BAClG,iGAAiG;0BACjG,mGAAmG;0BACnG,mFAAmF;wBACrF;;;;;;;;;;;2BAWG;0BACD,CAAC,OAAO,KAAK,kBAAkB,CAAC,QAAQ;4BACxC,CAAC,CAAC,kGAAkG;kCAChG,sGAAsG;kCACtG,wGAAwG;kCACxG,+EAA+E;kCAC/E,oCAAoC;4BACxC,CAAC,CAAC,EAAE,CAAC,EACP,EAAE,aAAa,EAAE,OAAO,EAAE,CAC3B,CAAC,CAAC;oBACH,MAAM;YACV,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IACK,gCAAgC,CACtC,YAAoB,EACpB,qBAA2D;QAE3D,MAAM,UAAU,GAAG,qBAAqB,EAAE,UAAU,CAAC;QACrD,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAElC,MAAM,QAAQ,GAAG,gCAAgC,CAAC,UAAmB,CAAC,CAAC;QACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAE5C,MAAM,aAAa,GAAG,IAAI,CAAC,uBAAuB;YAChD,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,qBAAqB,CAAC,YAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;YAC3G,CAAC,CAAC,EAAE,CAAC;QAEP,OAAO,UAAU,CACf,6BAA6B,CAAC,GAAG,EACjC,aAAa,MAAM,CAAC,YAAY,CAAC,2CAA2C;cAC1E,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B;cACpF,KAAK,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,4EAA4E;cACzG,uGAAuG;cACvG,mGAAmG;cACnG,qGAAqG;cACrG,oFAAoF;cACpF,iGAAiG;cACjG,yDAAyD;cACzD,oGAAoG;cACpG,qGAAqG;cACrG,sBAAsB,EACxB,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,CACpI,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACK,KAAK,CAAC,4BAA4B,CAAC,aAAuB;QAChE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,OAAO,CAAC,UAAU,CAChB,6BAA6B,CAAC,GAAG,EACjC,cAAc,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,kEAAkE;sBACtG,sGAAsG;sBACtG,4DAA4D,EAC9D,EAAE,aAAa,EAAE,CAClB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,sBAAsB,EAAE,CAAC;YACnD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,UAAU,CAChB,6BAA6B,CAAC,GAAG,EACjC,cAAc,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,mEAAmE;sBACvG,gEAAgE;sBAChE,yBAAyB,mBAAmB,CAAC,KAAK,CAAC,KAAK;sBACxD,wGAAwG;sBACxG,yGAAyG;sBACzG,wGAAwG;sBACxG,2GAA2G;sBAC3G,sGAAsG;sBACtG,0GAA0G;sBAC1G,gCAAgC,sCAAsC,GAAG,EAC3E,EAAE,aAAa,EAAE,CAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,+FAA+F;IACvF,KAAK,CAAC,6BAA6B,CAAC,aAAuB;QACjE,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACpC,OAAO,CAAC,UAAU,CAChB,6BAA6B,CAAC,GAAG,EACjC,cAAc,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,qEAAqE;sBACzG,yGAAyG;sBACzG,uDAAuD,EACzD,EAAE,aAAa,EAAE,CAClB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,yBAAyB,CAAC,sBAAsB,EAAE,CAAC;YAC9D,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,UAAU,CAChB,6BAA6B,CAAC,GAAG,EACjC,cAAc,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,sEAAsE;sBAC1G,0DAA0D;sBAC1D,2BAA2B,mBAAmB,CAAC,KAAK,CAAC,KAAK;sBAC1D,kFAAkF;sBAClF,kGAAkG;sBAClG,0GAA0G;sBAC1G,2GAA2G;sBAC3G,0DAA0D,EAC5D,EAAE,aAAa,EAAE,CAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,sBAAsB,CAAC,MAAqC;QAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,+BAA+B,CAAC,OAAO,CAAC,CAAC;QACrG,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,+BAA+B,CAAC,KAAK,CAAC,CAAC;QAEjG,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC,QAAQ,CAAC,2CAA2C,QAAQ,CAAC,MAAM,aAAa,CAAC,CAAC;YACzF,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEnF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACP,OAAO,EACL,sDAAsD,MAAM,CAAC,MAAM,cAAc;oBACjF,aAAa;gBACf,UAAU,EAAE,MAAM,CAAC,MAAM;gBACzB,YAAY,EAAE,QAAQ,CAAC,MAAM;gBAC7B,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;aACnD;SACF,CAAC,CAAC;IACL,CAAC;IAEO,+BAA+B,CAAC,IAAkC;QACxE,MAAM,OAAO,GAAG,IAA2C,CAAC;QAC5D,MAAM,aAAa,GAAG;YACpB,WAAW;YACX,oBAAoB;YACpB,iBAAiB;YACjB,cAAc;YACd,gBAAgB;YAChB,kBAAkB;YAClB,wBAAwB;YACxB,WAAW;YACX,QAAQ;SACA,CAAC;QAEX,MAAM,eAAe,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,IAAI,OAAO,CAAC,CAAC;QACrF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACP,OAAO,EACL,2CAA2C,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBACzE,gFAAgF;oBAChF,6EAA6E;oBAC7E,sFAAsF;aACzF;SACF,CAAC,CAAC;IACL,CAAC;IAEO,+BAA+B,CAAC,MAAwB;QAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QACzC,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC;QAEvD,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAI,OAA+B,EAAE,IAAI,CAAC;YACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,SAAS;YACX,CAAC;YAED,IAAI,QAAQ,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC;gBACnC,MAAM,mBAAmB,GAAG,SAAS,CAAC,sBAAsB,EAAE,CAAC;gBAC/D,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;gBACjG,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;wBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;wBACjE,OAAO,EAAE;4BACP,OAAO,EACL,8BAA8B,QAAQ,qCAAqC;gCAC3E,gEAAgE;gCAChE,2BAA2B,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;yBAC9D;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,iBAAiB,GAAG,QAAQ,CAAC,SAAS,EAAE,oBAAoB,IAAI,EAAE,CAAC;YACzE,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;gBACvC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,aAAa,QAAQ,oCAAoC,MAAM,+CAA+C,CAC/G,CAAC;gBACJ,CAAC;gBACD,oGAAoG;gBACpG,qGAAqG;gBACrG,oGAAoG;gBACpG,4FAA4F;gBAC5F,sGAAsG;gBACtG,iGAAiG;gBACjG,gGAAgG;gBAChG,yCAAyC;gBACzC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;oBACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,aAAa,QAAQ,oCAAoC,MAAM,cAAc;wBAC3E,GAAG,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,mEAAmE;wBACrG,sCAAsC,SAAS,CAAC,sBAAsB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,wGAAwG;YACxG,sGAAsG;YACtG,wGAAwG;YACxG,qGAAqG;YACrG,uGAAuG;YACvG,uGAAuG;YACvG,kGAAkG;YAClG,uEAAuE;YACvE,IAAI,QAAQ,CAAC,SAAS,EAAE,UAAU,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnE,oFAAoF;gBACpF,oGAAoG;gBACpG,kGAAkG;gBAClG,qGAAqG;gBACrG,oGAAoG;gBACpG,mGAAmG;gBACnG,MAAM,gBAAgB,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;gBAChE,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,MAAM,CAC/C,CAAC,MAAkB,EAAE,EAAE,CACrB,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC;uBAChC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,MAAM,CAAC;uBACvC,CAAC,CAAC,gBAAgB,IAAI,MAAM,KAAK,UAAU,CAAC,SAAS,CAAC,CAC5D,CAAC;gBACF,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;wBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;wBACjE,OAAO,EAAE;4BACP,OAAO,EACL,8BAA8B,QAAQ,yCAAyC;gCAC/E,yBAAyB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B;gCAClF,sDAAsD;gCACtD,CAAC,gBAAgB,CAAC,CAAC,CAAC,2CAA2C,UAAU,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gCAC5F,0FAA0F;gCAC1F,gBAAgB,SAAS,CAAC,sBAAsB,EAAE;qCAC/C,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,IAAI,MAAM,KAAK,UAAU,CAAC,SAAS,CAAC,CAAC;qCAC1E,IAAI,CAAC,IAAI,CAAC,4DAA4D;yBAC5E;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,IAAI,QAAQ,CAAC,SAAS,EAAE,UAAU,IAAI,QAAQ,CAAC,SAAS,EAAE,yBAAyB,KAAK,CAAC,EAAE,CAAC;gBAC1F,MAAM,iBAAiB,GAAI,QAAQ,CAAC,YAAgD,EAAE,iBAAiB,CAAC;gBACxG,IAAI,iBAAiB,KAAK,UAAU,EAAE,CAAC;oBACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,aAAa,QAAQ,qJAAqJ,CAC3K,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,gBAAgB,GAAG,QAAQ,CAAC,YAAY,EAAE,IAAoC,CAAC;YACrF,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,SAAS;YACX,CAAC;YAED,MAAM,6BAA6B,GAAG,gCAAgC,CACpE,gBAAgB,EAChB,8BAA8B,CAAC,mBAAmB,CACnD,CAAC;YACF,KAAK,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC5F,MAAM,cAAc,GAAI,qBAA6C,EAAE,eAAe,EAAE,CAAC,QAAQ,CAAC,CAAC;gBACnG,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,SAAS;gBACX,CAAC;gBAED,IAAI,CAAC,6BAA6B,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;oBAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,aAAa,QAAQ,wBAAwB,gBAAgB,2DAA2D,mBAAmB,oBAAoB,QAAQ,4DAA4D,CACpO,CAAC;gBACJ,CAAC;gBACD,IAAI,6BAA6B,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;oBAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,aAAa,QAAQ,wBAAwB,gBAAgB,0BAA0B,mBAAmB,oBAAoB,QAAQ,0EAA0E,CACjN,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,sCAAsC,CAAC,MAAwB;QACrE,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QACvE,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAED,KAAK,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,gBAAgB,EAAE,CAAC;YAC5E,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,mBAAmB,CAAC,CAAC;YACzE,IAAI,CAAC,eAAe,EAAE,SAAS,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,CAAC;gBACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACP,OAAO,EACL,oBAAoB,mBAAmB,sCAAsC,mBAAmB,GAAG;4BACnG,yHAAyH;wBAC3H,mBAAmB;qBACpB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEO,8BAA8B,CAAC,MAAwB;QAC7D,KAAK,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,EAAE,CAAC;YACzG,MAAM,cAAc,GAAI,qBAA6C,EAAE,eAAe,IAAI,EAAE,CAAC;YAC7F,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAE,KAA6B,EAAE,SAAS,CAAC,CAAC;YACvH,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oBAAoB,mBAAmB,yDAAyD,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,yDAAyD,CACvM,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,6BAA6B,CAAC,MAAwB;QAC5D,MAAM,cAAc,GAAG,IAAI,GAAG,EAAoB,CAAC;QAEnD,KAAK,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,EAAE,CAAC;YACvF,MAAM,cAAc,GAAI,UAAkC,EAAE,GAAG,EAAE,cAAsC,CAAC;YACxG,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,SAAS;YACX,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;gBACpC,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;gBAC9C,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;gBAC5D,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC3B,cAAc,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAED,KAAK,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oBAAoB,MAAM,gDAAgD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,uDAAuD,CACzJ,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,+BAA+B,CAAC,MAAwB;QAC9D,MAAM,qBAAqB,GAAG,MAAM,CAAC,IAAI,EAAE,qBAAqB,IAAI,EAAE,CAAC;QACvE,MAAM,+BAA+B,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC;aAC1E,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE;YAC7B,MAAM,WAAW,GAAG,cAAqC,CAAC;YAC1D,OAAO,kCAAkC,CAAC,WAAW,CAAC;mBACjD,CAAC,CAAC,WAAW,CAAC,cAAc,IAAI,WAAW,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;QAChF,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC;QAEzC,IAAI,+BAA+B,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QAED,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,MAAM,eAAe,GAAI,OAA+B,EAAE,IAAI,EAAE,eAAe,CAAC;YAChF,IAAI,eAAe,KAAK,IAAI,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,uBAAuB,QAAQ,6EAA6E,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,qGAAqG,CAC5P,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAEnE,oBAAoB;QAC1B,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QACnE,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,QAAQ,GAA2B;YACvC,qEAAqE;YACrE,wEAAwE;YACxE,yEAAyE;YACzE,wEAAwE;YACxE,iEAAiE;YACjE,0EAA0E;YAC1E,aAAa;YACb,CAAC,mBAAmB,CAAC,aAAa,CAAC,EACjC,kGAAkG;YACpG,CAAC,mBAAmB,CAAC,eAAe,CAAC,EAAE,wBAAwB;SAChE,CAAC;QAEF,MAAM,MAAM,GAAmC,EAAE,CAAC;QAElD,KAAK,MAAM,YAAY,IAAI,gBAAgB,EAAE,CAAC;YAC5C,IAAI,UAAU,CAAC;YACf,IAAI,CAAC;gBACH,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;gBAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC;gBACpD,MAAM,QAAQ,GAAG,GAAG,YAAY,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBAEtD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC;oBAC3F,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;wBAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC;wBACzD,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,OAAO,EACrC,GAAG,QAAQ,oFAAoF,IAAI,EAAE,EACrG,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAAE,CACnE,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;wBAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;wBACzD,OAAO,CAAC,EAAE,YAAY,EAAE,IAAI,KAAK,CAAC;oBACpC,CAAC,CAAC,CAAC;oBACH,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBACjE,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,OAAO,EACrC,GAAG,QAAQ,cAAc,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC,KAAK,EAAE,EACtF,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,CAC7C,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2EAA2E;IAEnE,qBAAqB;QAC3B,MAAM,MAAM,GAAmC,EAAE,CAAC;QAClD,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QACnE,MAAM,mBAAmB,GAAa,EAAE,CAAC;QAEzC,KAAK,MAAM,YAAY,IAAI,gBAAgB,EAAE,CAAC;YAC5C,IAAI,UAAU,CAAC;YACf,IAAI,CAAC;gBACH,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;gBAC/B,IAAI,KAAK,CAAC,YAAY,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;oBACjD,mBAAmB,CAAC,IAAI,CAAC,GAAG,YAAY,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,OAAO,EACrC,GAAG,mBAAmB,CAAC,MAAM,kHAAkH,EAC/I,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,yEAAyE,EAAE,CACjH,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,uEAAuE;IAE/D,iBAAiB;QACvB,MAAM,MAAM,GAAmC,EAAE,CAAC;QAElD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE;YAAE,OAAO,MAAM,CAAC;QAE3D,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,OAAO,EACrC,yFAAyF,EACzF,EAAE,IAAI,EAAE,gFAAgF,EAAE,CAC3F,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0EAA0E;IAE1E;;;;;;OAMG;IACK,mDAAmD,CAAC,MAAyB;QACnF,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAEvB,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC5C,KAAK,MAAM,gBAAgB,IAAI,MAAM,CAAC,MAAM,CAC1C,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAC/B,EAAE,CAAC;YACF,KACE,MAAM,QAAQ,IACX,gBAAgB,CAAC,cAAc;gBAChC,EAAE,4BAA4B,IAAI,EAAE,EACtC,CAAC;gBACD,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAmC,EAAE,CAAC;QAClD,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACrD,MAAM,OAAO,GAAG,+CAA+C,CAC7D,MAAM,CAAC,iBAAiB,EACxB,QAAQ,CACT,CAAC;YACF,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC;gBAAE,SAAS;YAElC,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,IAAI,EAClC,cAAc,QAAQ,kDAAkD;kBACpE,aAAa,OAAO;qBACnB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;kBACvD,0DAA0D,EAC9D;gBACE,MAAM,EACJ,mEAAmE;gBACrE,QAAQ;gBACR,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;aACjE,CACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;OASG;IACK,uDAAuD,CAAC,MAAwB;QACtF,MAAM,QAAQ,GAA2C,EAAE,CAAC;QAC5D,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,yBAAyB,GAAG,eAAe;aAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CACzB,gCAAgC,CAC9B,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EACjC,8BAA8B,CAAC,mBAAmB,CACnD;eACE,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,QAAQ,CACrD,UAAU,CAAC,QAAQ,CACpB,CACF;aACA,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;QAEjC,IAAI,yBAAyB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,yBAAyB,CAAC,CAAC;YAC7D,MAAM,qCAAqC,GAAG,MAAM,CAAC,MAAM,CACzD,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAC/B;iBACE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC;iBAC9C,MAAM,CACL,CAAC,MAAM,EAAwC,EAAE,CAC/C,MAAM,KAAK,SAAS;mBACjB,MAAM,CAAC,4BAA4B,CAAC,IAAI,CACzC,CAAC,QAAQ,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC9C,CACJ,CAAC;YACJ,MAAM,kCAAkC,GACtC,qCAAqC,CAAC,IAAI,CACxC,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,sBAAsB,CAAC,UAAU,CAC7D,CAAC;YACJ,MAAM,iCAAiC,GACrC,qCAAqC,CAAC,IAAI,CACxC,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,sBAAsB,CAAC,UAAU,CAC7D,CAAC;YACJ,QAAQ,CAAC,IAAI,CAAC,wCAAwC,CAAC;gBACrD,uEAAuE;gBACvE,wEAAwE;gBACxE,kBAAkB,EAAE,IAAI;gBACxB,sCAAsC,EACpC,kCAAkC;aACrC,CAAC,CAAC,CAAC;YACJ,IAAI,iCAAiC,EAAE,CAAC;gBACtC,QAAQ,CAAC,IAAI,CACX,sDAAsD,EAAE,CACzD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,oEAAoE;QACpE,uEAAuE;QACvE,yEAAyE;QACzE,2EAA2E;QAC3E,sEAAsE;QACtE,qEAAqE;QACrE,4EAA4E;QAC5E,uEAAuE;QACvE,gBAAgB;QAChB,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3D,QAAQ,CAAC,IAAI,CACX,kDAAkD,CAAC;gBACjD,kBAAkB,EAChB,6CAA6C,CAAC,MAAM,CAAC;aACxD,CAAC,EACF,yDAAyD,EAAE,CAC5D,CAAC;QACJ,CAAC;QAED,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,CAC5C,MAAM,CAAC,IAAI,EAAE,qBAAqB,IAAI,EAAE,CACzC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,kCAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnE,IAAI,wBAAwB,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACtD,MAAM,wBAAwB,GAAG,eAAe,CAAC,IAAI,CACnD,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CACjB,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,QAAQ,CAClD,UAAU,CAAC,eAAe,CAC3B;mBACE,gCAAgC,CACjC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EACjC,8BAA8B,CAAC,gBAAgB,CAChD,CACJ,CAAC;YACF,IAAI,wBAAwB,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3D,QAAQ,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAED,MAAM,6BAA6B,GACjC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CACtC,gCAAgC,CAC9B,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EACjC,8BAA8B,CAAC,kBAAkB,CAClD,CACF;eACE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,CACnD,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,gBAAgB,EAAE,OAAO,KAAK,IAAI,CAC9D,CAAC;QACJ,IAAI,6BAA6B,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CACX,sCAAsC,EACtC,2CAA2C,CAC5C,CAAC;YACF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3D,QAAQ,CAAC,IAAI,CACX,uCAAuC,EACvC,4CAA4C,CAC7C,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;OAOG;IACH;;;;;;;;;;;;;OAaG;IACK,uCAAuC;QAC7C,MAAM,QAAQ,GAA2C,EAAE,CAAC;QAE5D,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACrE,MAAM,iBAAiB,GAAG,IAAI,CAAC,qCAAqC,CAAC,YAAY,CAAC,CAAC;YACnF,IAAI,iBAAiB,KAAK,8BAA8B,CAAC,IAAI,EAAE,CAAC;gBAC9D,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,qCAAqC,CAAC;gBAClD,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC;gBAClC,iBAAiB;aAClB,CAAC,CAAC,CAAC;QACN,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,qCAAqC,CAC3C,YAAiF;QAEjF,IAAI,UAAU,CAAC;QACf,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;YAChF,4EAA4E;YAC5E,OAAO,8BAA8B,CAAC,IAAI,CAAC;QAC7C,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,8BAA8B,CAAC,IAAI,CAAC;QAC7C,CAAC;QAED,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,CAC1C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,KAAK,oBAAoB,CAAC,YAAY,CAC/F,CAAC;QAEF,OAAO,oBAAoB;YACzB,CAAC,CAAC,8BAA8B,CAAC,sBAAsB;YACvD,CAAC,CAAC,8BAA8B,CAAC,QAAQ,CAAC;IAC9C,CAAC;IAED;;;;;;;;;OASG;IACK,8CAA8C,CAAC,MAAyB;QAC9E,MAAM,QAAQ,GAAG;YACf,GAAG,CAAC,MAAM;gBACR,CAAC,CAAC,IAAI,CAAC,uDAAuD,CAAC,MAAM,CAAC;gBACtE,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QAEF,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACrE,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;YAErF,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;gBAClD,MAAM,QAAQ,GACZ,sDAAsD,CACpD,SAAS,EACT,IAAI,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAChE,CAAC;gBACJ,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,SAAS;gBACX,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;OAQG;IACK,6CAA6C,CAAC,MAAyB;QAC7E,MAAM,4BAA4B,GAAG,IAAI,CAAC,8CAA8C,CAAC,MAAM,CAAC,CAAC;QACjG,MAAM,qBAAqB,GAAG,IAAI,CAAC,uCAAuC,EAAE,CAAC;QAC7E,MAAM,QAAQ,GAAG,CAAC,GAAG,4BAA4B,EAAE,GAAG,qBAAqB,CAAC,CAAC;QAC7E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC;YACxC;;;;;eAKG;YACH,IAAI,4BAA4B,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9C,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,OAAO,CAAC,UAAU,CAChB,6BAA6B,CAAC,SAAS,EACvC,mEAAmE;sBAC/D,sDAAsD,EAC1D;oBACE,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;oBACvD,MAAM,EAAE,uDAAuD;iBAChE,CACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAmC,EAAE,CAAC;QAClD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,6BAA6B,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;YACnF,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;gBAC1B,SAAS;YACX,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,iCAAiC,CAAC;gBAC5D,CAAC,CAAC,6BAA6B,CAAC,SAAS;gBACzC,CAAC,CAAC,6BAA6B,CAAC,IAAI,EACtC,yBAAyB,OAAO,CAAC,QAAQ,mBAAmB;kBACxD,eAAe,UAAU,CAAC,MAAM,kCAAkC;kBAClE,sDAAsD,EAC1D;gBACE,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,mBAAmB,EAAE,UAAU,CAAC,MAAM;gBACtC,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;gBACzD,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;gBACjD,gCAAgC,EAC9B,UAAU,CAAC,gCAAgC;gBAC7C,eAAe,EAAE,UAAU,CAAC,eAAe;gBAC3C,eAAe,EAAE,UAAU,CAAC,eAAe;aAC5C,CACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;OASG;IACK,iDAAiD;QAEvD,MAAM,MAAM,GAAmC,EAAE,CAAC;QAElD,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACrE,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;YACrF,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;gBAClD,MAAM,QAAQ,GACZ,sDAAsD,CACpD,SAAS,EACT,IAAI,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAChE,CAAC;gBACJ,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC;oBAClC,SAAS;gBACX,CAAC;gBAED,MAAM,YAAY,GAAG,0CAAwC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAC3F,IAAI,QAAQ,CAAC,6BAA6B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtD,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,SAAS,EACvC,oCAAoC,YAAY,eAAe;0BAC3D,6DAA6D;0BAC7D,2CAA2C,EAC/C;wBACE,YAAY;wBACZ,yBAAyB,EACvB,QAAQ,CAAC,eAAe,KAAK,SAAS;wBACxC,+BAA+B,EAC7B,QAAQ,CAAC,+BAA+B;wBAC1C,6BAA6B,EAC3B,QAAQ,CAAC,6BAA6B;qBACzC,CACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;IACK,mCAAmC;QACzC,MAAM,MAAM,GAAmC,EAAE,CAAC;QAElD,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACrE,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;YACrF,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;gBAClD,IACE,CAAC,kBAAkB,CAAC,SAAS,CAAC;uBAC3B,CAAC,8BAA8B,CAAC,SAAS,CAAC,EAC7C,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,MAAM,YAAY,GAAG,0CAAwC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAC3F,MAAM,kBAAkB,GAAG,CAAC,SAAS,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,MAAM,CACnE,CAAC,YAAY,EAAE,EAAE,CACf,YAAY,CAAC,OAAO,KAAK,2BAA2B,CAAC,KAAK,CAC7D,CAAC;gBACF,uFAAuF;gBACvF,gFAAgF;gBAChF,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;gBACzD,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC;gBAE3D,KAAK,MAAM,YAAY,IAAI,kBAAkB,EAAE,CAAC;oBAC9C,MAAM,WAAW,GAAG,qCAAqC,CACvD;wBACE,kBAAkB,EAAE,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC;wBACxD,mBAAmB,EAAE,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC;wBAC1D,GAAG,CAAC,YAAY,IAAI,SAAS,IAAI,SAAS,CAAC,UAAU;4BACnD,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;4BAC9C,CAAC,CAAC,EAAE,CAAC;qBACR,EACD,YAAY,CACb,CAAC;oBAEF,IAAI,CAAC;wBACH,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,0BAA0B,CAAC,WAAW,CAAC,CAAC;wBAC5F,MAAM,qBAAqB,GACzB,gBAAgB,CAAC,UAAU,CAAC,IAAI;+BAC7B,iBAAiB,CAAC,aAAa,CAAC;wBACrC,IAAI,qBAAqB,KAAK,iBAAiB,CAAC,aAAa,EAAE,CAAC;4BAC9D,MAAM,CAAC,IAAI,CAAC,QAAQ,CAClB,6BAA6B,CAAC,SAAS,EACvC,6BAA6B,WAAW,QAAQ;kCAC5C,cAAc,YAAY,gBAAgB;kCAC1C,GAAG,qBAAqB,oBAAoB;kCAC5C,qBAAqB,iBAAiB,CAAC,aAAa,GAAG,EAC3D;gCACE,YAAY;gCACZ,WAAW;gCACX,cAAc,EAAE,gBAAgB,CAAC,cAAc;gCAC/C,qBAAqB;gCACrB,oBAAoB,EAAE,iBAAiB,CAAC,aAAa;6BACtD,CACF,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IACE,CAAC,mBAAmB,CAAC,KAAK,CAAC;+BACxB,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,aAAa,EACzC,CAAC;4BACD,MAAM,KAAK,CAAC;wBACd,CAAC;wBACD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAClB,6BAA6B,CAAC,SAAS,EACvC,GAAG,aAAa,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,WAAW,kBAAkB;8BACvE,IAAI,WAAW,oBAAoB,YAAY,iCAAiC;8BAChF,0CAA0C;8BAC1C,CAAC,aAAa;gCACd,CAAC,CAAC,sFAAsF;gCACxF,CAAC,CAAC,oFAAoF,CAAC;4BACzF,oFAAoF;4BACpF,0EAA0E;8BACxE,sCAAsC,WAAW,IAAI;8BACrD,8EAA8E,EAClF,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,CAC1D,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACK,2CAA2C;QACjD,MAAM,MAAM,GAAmC,EAAE,CAAC;QAElD,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACrE,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;YACrF,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;gBAClD,MAAM,OAAO,GAAG,8CAA8C,CAC5D,SAAS,EACT,IAAI,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAChE,CAAC;gBACF,MAAM,YAAY,GAAG,0CAAwC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAE3F,IACE,OAAO,CAAC,QAAQ,KAAK,uCAAuC,CAAC,aAAa;uBACvE,CAAC,OAAO,CAAC,eAAe,EAC3B,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,SAAS,EACvC,cAAc,YAAY,wDAAwD;0BAC9E,0EAA0E;0BAC1E,iFAAiF;0BACjF,4EAA4E;0BAC5E,4EAA4E,EAChF;wBACE,YAAY;wBACZ,MAAM,EAAE,OAAO,CAAC,mBAAmB;wBACnC,uBAAuB,EAAE,OAAO,CAAC,uBAAuB;wBACxD,SAAS,EAAE,SAAS,CAAC,SAAS;wBAC9B,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;qBACvD,CACF,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBAED,IACE,OAAO,CAAC,QAAQ,KAAK,uCAAuC,CAAC,aAAa;uBACvE,OAAO,CAAC,eAAe,EAC1B,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,SAAS,EACvC,cAAc,YAAY,mDAAmD;0BACzE,+EAA+E;0BAC/E,gEAAgE,EACpE;wBACE,YAAY;wBACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,qBAAqB,EAAE,OAAO,CAAC,eAAe,CAAC,MAAM;wBACrD,0BAA0B,EAAE,OAAO,CAAC,eAAe,CAAC,WAAW;qBAChE,CACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,gDAAgD;QACtD,MAAM,MAAM,GAAmC,EAAE,CAAC;QAElD,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACrE,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;YACrF,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;gBAClD,MAAM,YAAY,GAAoD,EAAE,CAAC;gBAEzE,MAAM,gBAAgB,GACpB,SACD,CAAC,mBAAmB,CAAC;gBACtB,IAAI,gBAAgB,EAAE,MAAM,EAAE,CAAC;oBAC7B,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAC/E,CAAC;gBAED,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC3F,IAAI,YAAY,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;wBAC7C,YAAY,CAAC,IAAI,CAAC;4BAChB,MAAM,EAAE,0BAA0B,YAAY,CAAC,UAAU,GAAG;4BAC5D,MAAM,EAAE,YAAY,CAAC,mBAAmB;yBACzC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAExC,MAAM,YAAY,GAAG,0CAAwC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAC3F,MAAM,eAAe,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;gBAE1D,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;oBACvC,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;oBACxF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;wBAAE,SAAS;oBAEzC,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,SAAS,EACvC,cAAc,YAAY,iCAAiC;0BACvD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,WAAW,CAAC,MAAM,QAAQ;0BAClE,GAAG,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,sCAAsC,GAAG;0BAChH,mFAAmF;0BACnF,+EAA+E;0BAC/E,6EAA6E;0BAC7E,gFAAgF;0BAChF,kBAAkB,EACtB;wBACE,YAAY;wBACZ,iBAAiB,EAAE,WAAW,CAAC,MAAM;wBACrC,aAAa;wBACb,eAAe,EAAE,CAAC,GAAG,eAAe,CAAC;qBACtC,CACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,sDAAsD;QAC5D,MAAM,MAAM,GAAmC,EAAE,CAAC;QAElD,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACrE,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;YACrF,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;gBAClD,MAAM,OAAO,GAAG,8CAA8C,CAAC,SAAS,CAAC,CAAC;gBAC1E,IACE,OAAO,CAAC,OAAO;wBACX,uCAAuC,CAAC,iCAAiC,EAC7E,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,MAAM,YAAY,GAAG,0CAAwC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAC3F,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,SAAS,EACvC,cAAc,YAAY,6DAA6D;sBACnF,qFAAqF;sBACrF,+EAA+E;sBAC/E,kFAAkF;sBAClF,gFAAgF;sBAChF,0EAA0E,EAC9E;oBACE,YAAY;oBACZ,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;oBACtD,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;iBACvD,CACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,iBAAiB,CAAC,SAIhC;QACC,OAAO;YACL,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC;YACpC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC;YACrC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IAED,2EAA2E;IAE3E;;;;;;;;OAQG;IACK,wBAAwB;QAC9B,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,uBAAuB,CAAC,WAAW,CAA4B,CAAC;QACvH,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;QAClE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAmC,EAAE,CAAC;QAElD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,wBAAwB,CAAC,MAAM,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClG,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAA0C,KAAK,CAAC,MAAM,CAAC;YACzE,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,CAAC;YAC7C,MAAM,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CAAC;YAC7D,MAAM,QAAQ,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;YAE3E,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAAC,WAAW,EAAE,sCAAsC,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBACjI,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,MAAM,EACpC,UAAU,KAAK,CAAC,GAAG,gBAAgB,WAAW,wCAAwC,EACtF,QAAQ,CACT,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,yBAAyB,CAAC,6BAA6B,CAAC,WAAW,CAAC,CAAC;YAC7F,MAAM,gBAAgB,GAAG,IAAI,CAAC,yBAAyB,CAAC,sCAAsC,CAC5F,WAAW,EACX,mBAAmB,CACpB,CAAC;YACF,IAAI,CAAC,UAAU,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACrC,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,MAAM,EACpC,UAAU,KAAK,CAAC,GAAG,yCAAyC,mBAAmB,aAAa,EAC5F,QAAQ,CACT,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC3E,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,MAAM,EACpC,UAAU,KAAK,CAAC,GAAG,gDAAgD,YAAY,CAAC,YAAY,GAAG,EAC/F,QAAQ,CACT,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,MAAM,EACpC,UAAU,KAAK,CAAC,GAAG,wDAAwD,YAAY,CAAC,KAAK,GAAG,EAChG,EAAE,GAAG,QAAQ,EAAE,eAAe,EAAE,UAAU,CAAC,eAAe,EAAE,CAC7D,CAAC,CAAC;YACL,CAAC;YAED,qEAAqE;YACrE,wEAAwE;YACxE,oDAAoD;YACpD,IAAI,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC9E,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,MAAM,EACpC,UAAU,KAAK,CAAC,GAAG,uEAAuE,cAAc,GAAG,EAC3G,EAAE,GAAG,QAAQ,EAAE,8BAA8B,EAAE,gBAAgB,CAAC,8BAA8B,EAAE,CACjG,CAAC,CAAC;YACL,CAAC;YAED,IACE,gBAAgB,CAAC,6BAA6B,EAAE,MAAM;mBACnD,CAAC,CAAC,qBAAqB,IAAI,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,EAC9G,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,MAAM,EACpC,UAAU,KAAK,CAAC,GAAG,oEAAoE,qBAAqB,IAAI,SAAS,GAAG,EAC5H,EAAE,GAAG,QAAQ,EAAE,6BAA6B,EAAE,gBAAgB,CAAC,6BAA6B,EAAE,CAC/F,CAAC,CAAC;YACL,CAAC;YAED,IACE,gBAAgB,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB;mBAChF,CAAC,IAAI,CAAC,yBAAyB,CAAC,4CAA4C,CAAC,WAAW,EAAE,mBAAmB,CAAC,EACjH,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,MAAM,EACpC,UAAU,KAAK,CAAC,GAAG,qFAAqF,EACxG,QAAQ,CACT,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;;AA37DU,wCAAwC;IADpD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;IAE3D,WAAA,MAAM,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,CAAA;IAErD,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAElD,WAAA,MAAM,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAA;IAEpD,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAE5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAA;IAE/C,WAAA,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;IAE7C,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAEhD,YAAA,MAAM,CAAC,kBAAkB,CAAC,oDAAoD,CAAC,CAAA;IAE/E,YAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAC/D,YAAA,QAAQ,EAAE,CAAA;IAMV,YAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,YAAA,QAAQ,EAAE,CAAA;IAEV,YAAA,MAAM,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAA;IACpD,YAAA,QAAQ,EAAE,CAAA;IAEV,YAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,YAAA,QAAQ,EAAE,CAAA;IAOV,YAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IACzC,YAAA,QAAQ,EAAE,CAAA;qCA1CiD,aAAa;QACM,0BAA0B;QAE7D,uCAAuC;QAE7C,0BAA0B;QAE5B,+BAA+B;QAE9B,gCAAgC;QAEjC,+BAA+B;QAEnC,2BAA2B;QAE7B,yBAAyB;GAnB9C,wCAAwC,CA47DpD","sourcesContent":["import { inject, injectable, optional } from 'inversify';\nimport {\n AuthMethod,\n AuthUtils,\n CoreUserNotificationChannel,\n EmailTemplateType,\n ErrorCustomMessageReference,\n ErrorType,\n FlowsActors_Agent_Status,\n OrganizationNameSource,\n RegistrationAcquisitionChannel,\n RegistrationMode,\n isWildoBackendError,\n isRegistrationAcquisitionAllowed,\n findOrganizationTypeRegistrationCreationMatches,\n ClientInstanceIdScope,\n type AppConfiguration_Shared_Auth,\n type ConfigurationValidationIssue,\n type ConfigurationValidationResult,\n ConfigurationValidationDomain,\n ConfigurationValidationSeverity,\n PersistenceAdapter,\n buildValidationResult,\n isApiCallOperation,\n isApiCallWithCallbackOperation,\n issueError,\n issueWarning,\n isCodingAgentConfiguration,\n type FlowsActors_Agent_CodingConfiguration,\n} from '@wildo-ai/saas-models';\nimport {\n APPLICATION_ENVIRONMENT,\n AgentClientProtocol_AuthMode,\n ExternalProvider_ExchangeProtocol_Kind,\n type LLMProvider_OperationKey,\n} from '@wildo-ai/external-connectors-models';\nimport { FileGenerationSource, FileStorageAccepted } from '@wildo-ai/zod-decorators';\nimport type {\n AppConfiguration,\n} from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\nimport { FlowsActorsRegistryService } from '~wildo-backend-lib/flows-actors/services/flows-actors-registry.service';\nimport { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport { FileFieldDetectionBackendService } from '~wildo-backend-lib/files/services/file-field-detection.backend.service';\nimport { FileStorageRouterBackendService } from '~wildo-backend-lib/files/storage/file-storage-router.backend.service';\nimport { ClamAVScannerBackendService } from '~wildo-backend-lib/files/scanning/clamav-scanner.backend.service';\nimport { YaraScannerBackendService } from '~wildo-backend-lib/files/scanning/yara-scanner.backend.service';\nimport { isEnabledSocialOAuth2LoginProvider } from '~wildo-backend-lib/security/authentications/utils/social-oauth2-purpose.backend.utils';\nimport {\n isPublicInvitationPasswordCredentialReachable,\n} from '~wildo-backend-lib/security/authentications/services/utils/auth-policy-resolution.backend.utils';\nimport type {\n EmailTemplateRegistryBackendService,\n} from '~wildo-backend-lib/notifications/email/services/email-template-registry.backend.service';\nimport {\n buildUserNotificationEmailTemplateRef,\n} from '~wildo-backend-lib/notifications/services/notifications-dispatcher.backend.service';\nimport type {\n ResourceOperationCustomImplementationRegistryBackendService,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation-registry.backend.service';\nimport type {\n ResourcePersistenceUnitOfWorkBackendService,\n ResourcePersistenceUnitOfWorkRequest,\n} from '~wildo-backend-lib/databases/services/resource-persistence-unit-of-work.backend.service';\nimport {\n createResourceWritePersistenceRequest,\n resolveResourceOperationTransactionPersistenceContract,\n ResourceWriteFileParticipation,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-transaction-persistence.backend.utils';\nimport {\n ResourceOperationImplementationCoverage,\n ResourceOperationRequestContractBreadth,\n getPersistedFieldNames,\n resolveResourceOperationImplementationCoverage,\n resolveResourceOperationRequestContractBreadth,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-implementation-coverage.backend.utils';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { resolvePersistenceAdapterForConfiguration } from '~wildo-backend-lib/databases/models/resolve-persistence-adapter.backend.utils';\nimport type { PostgreSQLDatabaseBackendService } from '~wildo-backend-lib/databases/services/postgresql-database.backend.service';\nimport type { MongoDBService } from '~wildo-backend-lib/databases/services/mongodb.service';\nimport type { RagSourceFieldDetectionBackendService } from '~wildo-backend-lib/files/services/rag-source-field-detection.backend.service';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport {\n MONGODB_RAG_CHUNK_STORE_TRACKING_ISSUE,\n RagChunkStoreHosting,\n resolveRagChunkStoreHosting,\n} from '~wildo-backend-lib/rag/models/rag-chunk-store.backend.types';\nimport { collectResourceRetentionPolicies } from '~wildo-backend-lib/resources/utils/resource-retention.backend.utils';\nimport {\n APPLICATION_EXISTING_USER_LINK_UNIT_OF_WORK,\n APPLICATION_USER_CREATION_UNIT_OF_WORK,\n createAuthenticatedInvitationAcceptancePersistenceRequest,\n createDeferredOrganizationOnboardingPersistenceRequest,\n createPublicInvitationAcceptancePersistenceRequest,\n createSelfRegistrationPersistenceRequest,\n ORGANIZATION_EXISTING_USER_LINK_UNIT_OF_WORK,\n ORGANIZATION_USER_CREATION_UNIT_OF_WORK,\n SOCIAL_EXISTING_USER_LINK_UNIT_OF_WORK,\n SOCIAL_INVITATION_ACCEPTANCE_UNIT_OF_WORK,\n SOCIAL_USER_CREATION_UNIT_OF_WORK,\n} from '~wildo-backend-lib/security/authentications/models/identity-persistence-boundaries.backend';\n\n/*\n Startup-only governance rules for application configuration.\n \n Two phases:\n \n 1. `validate(config)` — pre-registry checks on the raw AppConfiguration\n * (auth consistency, frontend service bindings, etc.)\n \n 2. `validateInitializedRuntimeContracts()` — post-registry cross-checks\n * that need the fully resolved registry (z_file() vs storage providers,\n * CLI-runtime agents, etc.). Uses the collector pattern: each validator\n * returns `ConfigurationValidationIssue[]`, the runner consolidates,\n * logs warnings, and throws on errors.\n \n Frontend will adopt the same `ConfigurationValidationIssue` contract\n * for its own post-registry checks (feature gating, launcher coherence, etc.).\n /\n@injectable()\nexport class ApplicationStartupConfigValidatorService {\n private logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService)\n private readonly externalProvidersRegistry: ExternalProvidersRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.FlowsActorsRegistryService)\n private readonly flowsActorsRegistry: FlowsActorsRegistryService,\n @inject(SAAS_SERVICE_TYPES.ResourceRegistryService)\n private readonly resourcesRegistry: ResourcesRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.FileFieldDetectionService)\n private readonly fileFieldDetection: FileFieldDetectionBackendService,\n @inject(SAAS_SERVICE_TYPES.FileStorageRouter)\n private readonly fileStorageRouter: FileStorageRouterBackendService,\n @inject(SAAS_SERVICE_TYPES.ClamAVScannerService)\n private readonly clamavScanner: ClamAVScannerBackendService,\n @inject(SAAS_SERVICE_TYPES.YaraScannerService)\n private readonly yaraScanner: YaraScannerBackendService,\n @inject(SAAS_SERVICE_TYPES.EmailTemplateRegistry)\n private readonly emailTemplateRegistry: EmailTemplateRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.ResourceOperationCustomImplementationRegistryService)\n private readonly customImplRegistry: ResourceOperationCustomImplementationRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.ResourcePersistenceUnitOfWorkService)\n @optional()\n private readonly resourcePersistenceUnitOfWork?:\n ResourcePersistenceUnitOfWorkBackendService,\n // RAG capability probe dependencies (appended LAST + optional: this constructor is invoked\n // POSITIONALLY in tests). Absent detection ⇒ the probe cannot see `.ragSource()` declarations\n // and no-ops — acceptable only because the real container always binds it.\n @inject(SAAS_SERVICE_TYPES.RagSourceFieldDetectionService)\n @optional()\n private readonly ragSourceFieldDetection?: RagSourceFieldDetectionBackendService,\n @inject(SAAS_SERVICE_TYPES.PostgreSQLDatabaseService)\n @optional()\n private readonly postgreSQLDatabaseService?: PostgreSQLDatabaseBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService)\n @optional()\n private readonly appConfigService?: AppConfigurationService,\n /\n The MongoDB half of the same probe (Phase 6). Appended LAST for the reason the block above\n * states: this constructor is invoked POSITIONALLY in tests, so a parameter inserted beside its\n * PostgreSQL sibling would silently shift every later argument into the wrong slot.\n /\n @inject(SAAS_SERVICE_TYPES.MongoDBService)\n @optional()\n private readonly mongoDBService?: MongoDBService,\n ) {\n this.logDebug = this.logger.debugByType('ApplicationStartupConfigValidatorService');\n }\n\n // ─────────────────────────────────────────────────────────────────────────\n // Phase 1: pre-registry config checks\n // ─────────────────────────────────────────────────────────────────────────\n\n public validate(config: AppConfiguration): void {\n this.assertNoRemovedGlobalAuthFields(config.auth);\n this.validateFrontendServiceRuntimeBindings(config);\n this.validateUserTypeAuthConsistency(config);\n this.validateAuditTrailArchivalFloor(config);\n this.warnOnMultipleDefaultUserTypes(config);\n this.warnOnDuplicateClaimedDomains(config);\n this.warnOnBroadAutoLinkSocialOAuth2(config);\n this.warnOnClientInstanceIdentificationEnabled(config);\n }\n\n /\n Warn when the application has opted into CLIENT-INSTALL identification\n * (`compliance.clientInstanceIdScope !== DISABLED`), naming the obligations that opt-in creates.\n \n Why a startup warning and not silence. `clientInstanceId` is a pseudonymous identifier stored on the\n * user's terminal equipment, so selecting `SESSION`/`PERSISTENT` engages ePrivacy Art 5(3) and creates\n * paperwork the framework cannot do on the application's behalf — a recorded legitimate-interest\n * assessment, and a decision about whether an erasure request scrubs the identifier from retained audit\n * evidence. Those are documented as owed, but a documented obligation with no mechanical firing pin is one\n * forgotten session away from drift, which is exactly the failure mode\n * `.claude/rules/capability-catalog-integration.md` names. This is that firing pin: the application cannot\n * turn the capability on without the reason it must act appearing in its own boot log.\n \n WARN, never ERROR: opting in is a legitimate, deliberate choice, and refusing to boot over an\n * app-authored privacy posture would be the framework overriding the controller's decision.\n \n assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — surfaces the compliance obligations attached to\n * collecting a device-stored pseudonymous identifier at the moment the collection is enabled.\n /\n private warnOnClientInstanceIdentificationEnabled(config: AppConfiguration): void {\n const scope = config.compliance?.clientInstanceIdScope;\n if (scope === undefined \|\| scope === ClientInstanceIdScope.DISABLED) {\n return; // The default posture — nothing is collected, nothing is owed.\n }\n\n this.logger.warn(\n `[compliance] Client-install identification is ENABLED (compliance.clientInstanceIdScope='${scope}'). `\n + 'Every request may now carry an `x-client-instance-id` that is recorded on audit rows and forwarded to '\n + 'the SIEM — a pseudonymous identifier under GDPR Art 4(5), stored on the user\\'s device. Confirm with '\n + 'counsel that (1) a legitimate-interest assessment is recorded for this processing, (2) the storage is '\n + 'lawful in your jurisdiction (ePrivacy Art 5(3); consent may be required, and PERSISTENT is the harder '\n + 'case), (3) your privacy notice discloses it, and (4) your erasure procedure states whether the '\n + 'identifier is scrubbed from retained audit evidence. Set clientInstanceIdScope to DISABLED to opt out.',\n { clientInstanceIdScope: scope },\n );\n }\n\n /\n Production floor for the audit-log archival horizon\n * (`auditTrail.archiveAfterDays`). Audit records must remain in the primary\n * store for at least this many days before they become archival-eligible in\n * a staging/production environment. Mirrors the SSO `auditConfig.retentionDays`\n * default (365) as the compliance minimum.\n /\n private static readonly AUDIT_ARCHIVE_PRODUCTION_FLOOR_DAYS = 365;\n\n /\n Enforce the production floor on `auditTrail.archiveAfterDays`.\n \n The schema-level `.min(1)` is the absolute floor; this raises it to\n * {@link AUDIT_ARCHIVE_PRODUCTION_FLOOR_DAYS} outside development. It lives\n * here — a RUNTIME validator — rather than in a Zod `.superRefine()` on the\n * shared schema, because the environment gate reads `process.env.APPLICATION_ENV`,\n * a runtime signal a pure, environment-agnostic shared schema must not touch\n * (mirrors the env-gated `.superRefine` in `define-infra-env-config.ts`, which\n * only works there because THAT schema carries the environment as a field).\n \n Development is exempt (dev convenience — mirrors the infra `!isLocalEnvironmentId`\n * gate); staging + production enforce the floor. Archival is opt-in, so an\n * unset `archiveAfterDays` is always allowed (nothing to floor).\n /\n private validateAuditTrailArchivalFloor(config: AppConfiguration): void {\n const archiveAfterDays = config.auditTrail?.archiveAfterDays;\n if (archiveAfterDays === undefined) {\n return; // Archival opt-out — no horizon to floor.\n }\n\n const applicationEnv = (process.env.APPLICATION_ENV ?? APPLICATION_ENVIRONMENT.DEVELOPMENT) as APPLICATION_ENVIRONMENT;\n if (applicationEnv === APPLICATION_ENVIRONMENT.DEVELOPMENT) {\n return; // Development is exempt from the compliance floor.\n }\n\n const floor = ApplicationStartupConfigValidatorService.AUDIT_ARCHIVE_PRODUCTION_FLOOR_DAYS;\n if (archiveAfterDays < floor) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `auditTrail.archiveAfterDays (${archiveAfterDays}) is below the production floor of ${floor} days ` +\n `in environment '${applicationEnv}'. Audit records must remain in the primary store for at least ` +\n `${floor} days before archival in staging/production. Set archiveAfterDays >= ${floor} ` +\n `(values below ${floor} are permitted only in development), or omit archiveAfterDays entirely ` +\n `to disable archival.`,\n archiveAfterDays,\n floorDays: floor,\n applicationEnv,\n },\n });\n }\n }\n\n // ─────────────────────────────────────────────────────────────────────────\n // Phase 2: post-registry cross-checks (collector pattern)\n // ─────────────────────────────────────────────────────────────────────────\n\n /\n Run all post-registry validators, collect issues, then report.\n \n To add a new cross-check:\n * 1. Write a private method returning `ConfigurationValidationIssue[]`\n * 2. Add its call to the `validators` array below\n * 3. The runner handles logging warnings and throwing on errors\n /\n /\n TIER 1 — DECLARATION-ONLY. Safe for ANY runtime that owns a resource registry.\n \n These read the resource DECLARATIONS and the infrastructure they name, and assert nothing about\n * whether the runtime implements those resources. A scheduler that registers core resources purely\n * so the controllers registry can initialize passes these, because it declares nothing it does not\n * honour.\n \n Classified by what each collector actually READS, not by its name — see\n * `collectImplementationBackedContractIssues` for why that distinction is load-bearing.\n /\n private collectDeclarationContractIssues(): (() => ConfigurationValidationIssue[])[] {\n return [\n // resources registry (file fields) + fileStorageRouter — do declared `z_file()` fields have a\n // provider that can actually store them?\n () => this.collectStorageIssues(),\n // resources registry only — is any operation's request contract wider than it declares?\n () => this.collectOverbroadResourceOperationRequestContractIssues(),\n ];\n }\n\n /\n TIER 2 — OPERATION-IMPLEMENTATION-BACKED. Only for a runtime that EXECUTES the operations it\n * registers.\n \n Every collector here cross-references the resource registry against the machinery that RUNS an\n * operation — `customImplRegistry` and the persistence unit of work. A runtime that registers\n * resources without implementing their operations fails all of them, and is not wrong to do so.\n \n Measured 2026-08-14: wiring these into `platform-crontabs-batches-manager` — a SCHEDULER that\n * registers the core resource set so `controllersRegistryService.initialize()` works, and\n * implements none of it — broke its boot with 83 `[LIFECYCLE] Operation 'organizations.…'` errors\n * from `collectUnimplementedResourceOperationIssues` alone. That is what proved a two-way split by\n * collector NAME was insufficient.\n /\n private collectImplementationBackedContractIssues(config?: AppConfiguration): (() => ConfigurationValidationIssue[])[] {\n return [\n () => this.collectResourceOperationTransactionContractIssues(),\n () => this.collectPersistenceBoundaryCompatibilityIssues(config),\n () => this.collectUnimplementedResourceOperationIssues(),\n () => this.collectResourceOperationAuthoritativeFieldIssues(),\n ];\n }\n\n /\n TIER 2N — NOTIFICATION-DELIVERY-BACKED. Only for a runtime that DELIVERS the notifications the\n * operations it registers declare.\n \n Split out of tier 2 on 2026-08-14 because \"implements the resources it registers\" turned out to\n * be TWO capabilities, not one, and the platform services hold exactly one of them. `platform-\n * apps-manager` and `platform-module-registry` DO execute core resource operations — they own\n * custom implementations and persistence — so tier 2 is correct for them. Neither DELIVERS an\n * application's user notifications: they register `organizationMembers` because the registry needs\n * the core set, and they ship none of its templates. Cross-referencing the resource registry\n * against `emailTemplateRegistry` therefore fails them on templates they are not the subject of.\n \n Measured: both crash-looped at boot on the same two ERRORs — the token-backed\n * `email.organizationMembers.create.user-self` and `…resend.user-self` — which are the only two\n * token-backed operations in the engine, hence the only two that escalate a missing template from\n * WARNING to ERROR (see `collectOperationEmailTemplateIssues`, where severity follows\n * `tokenGeneration`). The warning flood on the non-token-backed operations was harmless and is\n * what made the two fatal rows easy to miss in the log.\n \n Rejected alternative: moving this collector down to tier 3 (application FEATURES). Tier 3 reads\n * scanners, vector stores and provider config — optional product features. A declared operation\n * email is neither optional nor a feature: it is part of the operation's contract, and it must\n * stay adjacent to the tier that validates the rest of that contract for every runtime that does\n * own delivery.\n /\n private collectNotificationDeliveryContractIssues(): (() => ConfigurationValidationIssue[])[] {\n return [\n () => this.collectOperationEmailTemplateIssues(),\n ];\n }\n\n /\n TIER 3 — APPLICATION FEATURES. Only for an application runtime.\n \n Each validates an optional product feature a platform service does not own: virus scanning,\n * YARA rules, organization-registration policy, CLI runtime agents. They read\n * scanners, provider registries and config — not the resource contract.\n \n NOTE: the Weaviate-era RAG collector (`collectRAGIssues`) that used to run in this tier was\n * deleted with the Weaviate lane on 2026-08-26. Its fail-closed successor is\n * {@link validateInitializedRagStoreCapability} — ASYNC (it executes a probe on the live\n * database), so it runs as its own startup step beside the transaction-readiness proof rather\n * than inside these sync collector tiers.\n /\n private collectApplicationFeatureIssues(config?: AppConfiguration): (() => ConfigurationValidationIssue[])[] {\n return [\n () => this.collectScanningIssues(),\n () => this.collectYaraIssues(),\n () => this.collectOrganizationRegistrationCreationPolicyIssues(config),\n () => this.collectCodingAgentIssues(),\n ];\n }\n\n private runCollectors(collectors: (() => ConfigurationValidationIssue[])[]): ConfigurationValidationResult {\n const allIssues: ConfigurationValidationIssue[] = [];\n for (const collector of collectors) {\n allIssues.push(...collector());\n }\n const result = buildValidationResult(allIssues);\n this.reportValidationResult(result);\n return result;\n }\n\n /* Application runtimes: every tier. Unchanged behaviour — an application both executes its\n * operations and delivers their notifications, so it is the one runtime that owns all of them. /\n public validateInitializedRuntimeContracts(config?: AppConfiguration): ConfigurationValidationResult {\n this.resourcesRegistry.validateInitializedPersistenceAdapterConfiguration();\n return this.runCollectors([\n ...this.collectDeclarationContractIssues(),\n ...this.collectImplementationBackedContractIssues(config),\n ...this.collectNotificationDeliveryContractIssues(),\n ...this.collectApplicationFeatureIssues(config),\n ]);\n }\n\n /\n Platform services that IMPLEMENT the resources they register — the module registry, apps-manager.\n \n Tiers 1+2, and deliberately NOT tier 2N. Exists because `resolveApplicationConfigForStartup`\n * returns `undefined` unconditionally for `isPlatformApplication: true`, so the shared startup\n * skips post-registry validation entirely for every platform service — including\n * `collectStorageIssues()`, which is exactly the check that cross-references `z_file()` resources\n * against configured providers.\n \n A platform service EXECUTES core resource operations but DELIVERS none of their user\n * notifications, so `collectNotificationDeliveryContractIssues()` is excluded — see its JSDoc for\n * the boot failure that established the split.\n /\n public validateInitializedPlatformRuntimeContracts(config?: AppConfiguration): ConfigurationValidationResult {\n return this.runCollectors([\n ...this.collectDeclarationContractIssues(),\n ...this.collectImplementationBackedContractIssues(config),\n ]);\n }\n\n /\n Runtimes that REGISTER resources without implementing them — a scheduler, a companion, any\n * service initializing a registry only so another registry can start.\n \n Tier 1 only. Gives such a runtime the storage and declaration-shape guarantees while asserting\n * nothing about implementations it was never meant to provide.\n /\n public validateInitializedDeclarationContracts(): ConfigurationValidationResult {\n return this.runCollectors(this.collectDeclarationContractIssues());\n }\n\n\n /\n Prove that every adapter selected by an authored transaction-requiring\n * boundary can actually start, execute, and commit a native transaction.\n \n Adapter compatibility alone cannot distinguish a MongoDB replica set from\n * a standalone server. The adapter-owned probe executes a read-only command\n * inside the transaction; an empty callback would not start a MongoDB server\n * transaction. Probes are deduplicated to one request per selected adapter.\n * No controller is initialized until they succeed.\n /\n public async validateInitializedRuntimeTransactionReadiness(config: AppConfiguration): Promise<void> {\n if (!this.resourcePersistenceUnitOfWork) {\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n 'ResourcePersistenceUnitOfWorkService is unavailable during initialized runtime validation',\n reason: 'resource_persistence_unit_of_work_service_unavailable',\n },\n },\n );\n }\n\n const firstRequestByAdapter = new Map<\n string,\n ResourcePersistenceUnitOfWorkRequest\n >();\n for (\n const request\n of this.collectTransactionReadinessPersistenceRequests(config)\n ) {\n const assessment = this.resourcePersistenceUnitOfWork.assessCompatibility(request);\n if (!assessment.compatible) {\n // Preserve one canonical compatibility failure instead of silently\n // omitting an authored transaction boundary from readiness proof.\n await this.resourcePersistenceUnitOfWork\n .verifyTransactionReadiness(request);\n }\n if (assessment.compatible && assessment.selectedAdapter !== undefined\n && !firstRequestByAdapter.has(assessment.selectedAdapter)\n ) {\n firstRequestByAdapter.set(assessment.selectedAdapter, request);\n }\n }\n\n for (const [adapter, request] of firstRequestByAdapter) {\n try {\n await this.resourcePersistenceUnitOfWork\n .verifyTransactionReadiness(request);\n } catch (error) {\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Persistence adapter '${adapter}' cannot commit the native `\n + `transaction required by boundary '${request.boundary}'`,\n reason: 'persistence_transaction_readiness_probe_failed',\n adapter,\n boundary: request.boundary,\n originalError: error instanceof Error\n ? error.message\n : String(error),\n },\n },\n );\n }\n }\n }\n\n /\n RAG store capability probe — the fail-closed successor of the Weaviate-era `collectRAGIssues`\n * (plan `.claude/plans/resource-rag-capability.md`, M6 carry-over).\n \n For every registered resource that declares `.ragSource()` fields, two refusals:\n \n - row retention × RAG source → ERROR, before any store question is asked. See\n * {@link collectRagSourceRetentionRefusal}: DL3 enforced at RESOURCE level, which is the tier\n * the risk lives on (the `.ttl()` field and the `.ragSource()` field are ordinarily different\n * fields of the same row, so the decorator-level companion refusal cannot see the pair).\n \n …then prove the datastore its chunks would live in (D1: the resource's OWN persistence adapter)\n * can actually hold them:\n \n - PostgreSQL → EXECUTE a pgvector expression (`select '[1]'::vector`) on the live\n * connection. Executed rather than inferred from catalogs or config, per the toolchain rule\n * (\"verify a toolchain claim by executing it\") — a `pg_extension` row proves installation, not\n * that the type works on THIS connection's search path.\n * - MongoDB → ERROR unconditionally: the Mongo chunk store is gated on the 8.2 + mongot infra\n * bump ({@link MONGODB_RAG_CHUNK_STORE_TRACKING_ISSUE}).\n \n Fail-closed ERROR (never a warning), because the failure mode is not a degraded feature: an\n * application that has already WRITTEN chunk rows and then lost its store cannot honour an erasure\n * — the chunks hold copies of subject text that no removal seam can reach. Refusing to boot is the\n * only posture under which that dead-end cannot silently accumulate.\n \n An application with NO `.ragSource()` fields probes nothing and passes — the probe must never\n * force a database connection an application does not use.\n \n Async and separate from the sync collector tiers for the same reason as\n * {@link validateInitializedRuntimeTransactionReadiness}: it talks to a live database.\n \n assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — refuses a configuration whose derived\n * subject-text copies would be unreachable by the erasure seams.\n /\n public async validateInitializedRagStoreCapability(): Promise<void> {\n const issues = await this.collectRagStoreCapabilityIssues();\n this.reportValidationResult(buildValidationResult(issues));\n }\n\n private async collectRagStoreCapabilityIssues(): Promise<ConfigurationValidationIssue[]> {\n if (!this.ragSourceFieldDetection) {\n // No detection service bound (minimal harness) — nothing can be asserted either way.\n return [];\n }\n\n const issues: ConfigurationValidationIssue[] = [];\n const ragResourcesByAdapter = new Map<string, string[]>();\n\n for (const resourceType of this.resourcesRegistry.getResourceTypes()) {\n let hasRagFields: boolean;\n try {\n hasRagFields = this.ragSourceFieldDetection.hasRagSourceFields(resourceType);\n } catch (error) {\n // Detection itself refusing (incompatible/unsupported `.ragSource()` declarations) is a\n // configuration defect in its own right — surface it as this probe's ERROR rather than\n // letting an unrelated later consumer be the first to trip over it.\n issues.push(issueError(\n ConfigurationValidationDomain.RAG,\n `RAG source-field detection failed for resource '${String(resourceType)}': ${describeCaughtError(error)}`,\n { resourceType: String(resourceType) },\n ));\n continue;\n }\n if (!hasRagFields) continue;\n\n const resourceConfiguration = this.resourcesRegistry.tryGetResourceConfiguration(resourceType);\n\n const retentionIssue = this.collectRagSourceRetentionRefusal(resourceType, resourceConfiguration);\n if (retentionIssue) {\n issues.push(retentionIssue);\n // Already refused — do not also probe its store. The application will not boot either way,\n // and one precise diagnostic beats two that name the same resource for different reasons.\n continue;\n }\n\n const declaredAdapter = resourceConfiguration?.persistenceAdapter;\n const adapter = resolvePersistenceAdapterForConfiguration(declaredAdapter, this.appConfigService);\n const existing = ragResourcesByAdapter.get(adapter) ?? [];\n existing.push(String(resourceType));\n ragResourcesByAdapter.set(adapter, existing);\n }\n\n if (ragResourcesByAdapter.size === 0) {\n return issues;\n }\n\n for (const [adapter, resourceTypes] of ragResourcesByAdapter) {\n /\n Classified through the SAME total map the routing store uses\n * (`RAG_CHUNK_STORE_HOSTING_BY_ADAPTER`), so the boot refusal and the runtime refusal cannot\n * disagree about which adapters can hold chunks — and so a NEW adapter is a compile error at\n * that map rather than a silent arrival in the \"unrecognised\" branch here, where it would be\n * reported as a typo instead of as a capability decision.\n /\n const hosting = resolveRagChunkStoreHosting(adapter);\n if (hosting === undefined) {\n issues.push(issueError(\n ConfigurationValidationDomain.RAG,\n `Resources [${resourceTypes.join(', ')}] declare .ragSource() fields on unrecognised persistence adapter `\n + `'${adapter}' — no RAG chunk store exists for it.`,\n { resourceTypes, adapter },\n ));\n continue;\n }\n switch (hosting) {\n case RagChunkStoreHosting.POSTGRESQL:\n issues.push(...await this.probePostgresVectorCapability(resourceTypes));\n break;\n case RagChunkStoreHosting.MONGODB:\n issues.push(...await this.probeMongodbSearchCapability(resourceTypes));\n break;\n case RagChunkStoreHosting.NONE:\n // A DECLARED adapter with no chunk store — there is nothing to PROBE, and that is the\n // point: the refusal is about the adapter's nature, not about a reachable dependency.\n issues.push(issueError(\n ConfigurationValidationDomain.RAG,\n `Resources [${resourceTypes.join(', ')}] declare .ragSource() fields on persistence adapter `\n + `'${adapter}', which cannot host chunk rows. A chunk store holds COPIES of field text that every `\n + 'removal seam must be able to delete, and this adapter owns no local rows to delete — so chunks '\n + 'derived from these resources would be unreachable by every erasure path. Remove the .ragSource() '\n + 'declarations, or move these resources to a PostgreSQL- or MongoDB-backed adapter.'\n /\n * HTTP_API earns one extra sentence, and it is guidance rather than a second refusal.\n \n The generic text above says what is wrong; for a READ-THROUGH resource it stops one step short\n * of what to do instead, and \"move it to a PostgreSQL-backed adapter\" is not the answer — the\n * whole point of the resource is that its rows live elsewhere. RAG over remote content is designed\n * to ride a locally MATERIALIZED copy, where every existing RAG mechanism applies unchanged.\n \n Appended to the ONE typed refusal rather than restored as a separate `if (adapter ===\n * HTTP_API)` branch: the adapter→hosting map is the single place that decision belongs, and a\n * second branch beside it would be a second answer to the same question.\n /\n + (adapter === PersistenceAdapter.HTTP_API\n ? ' This resource is read-through: it has no local write path for ingestion, no local rows for the '\n + 'reconciliation sweep to enumerate, and no local rows for the erasure seams to key chunk removal to. '\n + 'RAG over remote content arrives with partial-resource coverage, where the declared field is a locally '\n + 'MATERIALIZED copy of the remote field and the ordinary RAG machinery applies '\n + '(partial-resource-coverage paper).'\n : ''),\n { resourceTypes, adapter },\n ));\n break;\n }\n }\n\n return issues;\n }\n\n /\n DL3 at the tier the risk actually lives on: a resource that declares BOTH a `.ttl()` field and\n * a `.ragSource()` field is refused, whichever fields they are.\n \n ## Why the field-level decorator refusal was not enough (corrected 2026-08-27)\n \n `RAG_SOURCE_REFUSED_COMPANIONS` in `zod.module-override.ts` refuses `.ttl()` and `.ragSource()`\n * on the SAME field, and four documents recorded that as closing DL3. It does not, because the\n * two decorators essentially cannot meet there: `.ttl()`'s applicable types are\n * `['ZodDate','ZodOptional']` and `.ragSource()`'s are `['ZodString','ZodOptional','ZodNullable','ZodDefault']`.\n * The reachable configuration is the ORDINARY one —\n \n expiresAt: z.date().ttl({ expireAfterSeconds: 0 }),\n * notes: z.string().ragSource(),\n \n — two different fields of one resource, which the field-level check cannot see. *A Mongo TTL\n index deletes the WHOLE DOCUMENT** (`hasTtl` → `expires` in the Mongoose convertor) with zero\n * application code running: no hook, no cascade, no post-commit effect, so the row's chunks —\n * copies of its text — survive it permanently. The risk is scoped to the ROW; the refusal was\n * scoped to the FIELD.\n \n On PostgreSQL `.ttl()` renders only a `comment on column` and the framework retention sweep\n * performs the deletes, which DOES call the chunk-removal seam. So today's exposure is\n * MongoDB-only and is additionally masked by the Mongo arm below refusing every Mongo-backed\n * `.ragSource()` resource pending {@link MONGODB_RAG_CHUNK_STORE_TRACKING_ISSUE}. That masking is\n * exactly why this is worth fixing now: it opens the day the Mongo adapter lands, in a change\n * whose author will have no reason to re-derive this reasoning.\n \n ## Why THIS enforcement point, and what was rejected\n \n Chosen: the startup capability probe. It is the earliest point that can ask BOTH existing\n * authorities — `collectRagSourceFieldSchemaMetadata` (through the detection service, cached) and\n * `collectResourceRetentionPolicies` — rather than re-deriving either, and it already walks every\n * registered resource. Its refusal is fail-closed at boot, before any process serves traffic or\n * runs a batch.\n \n Rejected: `validateDecoratorCombinations` in the resource-configuration factory\n * (`resources-config.shared.factory.ts`), which is genuinely earlier — module load — and is where\n * this repository's other resource-level decorator refusals live. It cannot reach either\n * authority: both live in `saas-backend-lib`, and the factory is in `saas-models`, which\n * `saas-backend-lib` depends ON. A factory check would therefore need a THIRD derivation of\n * \"which fields declare a RAG source\", and the only cheap form available there — `getRagSourceConfig`\n * over the top-level `getZodObjectShape`, the shape every neighbouring check in that function\n * uses — is TOP-LEVEL ONLY. It would miss a nested declaration (`profile.bio`), i.e. under-detect,\n * i.e. fail OPEN in a refusal. Moving the walker into `saas-models` would fix that and is the\n * right long-term shape, but it is a public-entrypoint reshape touching every RAG consumer, not\n * a fix to this finding.\n \n The field-level refusal is KEPT — it is cheap, correct, and catches the one configuration this\n * check would only report at boot rather than at authoring time.\n \n assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — refuses a configuration whose derived\n * subject-text copies could outlive the row they were derived from, unreachably.\n /\n private collectRagSourceRetentionRefusal(\n resourceType: string,\n resourceConfiguration: { mainSchema?: unknown } \| undefined,\n ): ConfigurationValidationIssue \| undefined {\n const mainSchema = resourceConfiguration?.mainSchema;\n if (!mainSchema) return undefined;\n\n const policies = collectResourceRetentionPolicies(mainSchema as never);\n if (policies.length === 0) return undefined;\n\n const ragFieldNames = this.ragSourceFieldDetection\n ? this.ragSourceFieldDetection.detectRagSourceFields(resourceType as never).map((field) => field.fieldName)\n : [];\n\n return issueError(\n ConfigurationValidationDomain.RAG,\n `Resource '${String(resourceType)}' declares BOTH row retention (.ttl() on `\n + `[${policies.map((policy) => policy.fieldName).join(', ')}]) and RAG source fields `\n + `([${ragFieldNames.join(', ')}]). Refused (plan resource-rag-capability DL3): a store that expires rows `\n + 'NATIVELY — MongoDB\\'s TTL monitor deletes the whole document — runs no application code, so no hook, '\n + 'cascade or post-commit effect can remove the derived chunks, and they keep serving copies of the '\n + 'expired row\\'s text forever. Note the refusal is at RESOURCE level because the risk is: the .ttl() '\n + 'field and the .ragSource() field are ordinarily DIFFERENT fields of the same row. '\n + 'Remove the .ragSource() declarations, or drop the .ttl() and let the framework retention sweep '\n + 'perform the deletes (it calls the chunk-removal seam). '\n + 'THE DOOR: this refusal lifts when the backstop reconciliation sweep reconciles chunk sets against '\n + 'vanished parent rows, at which point natively-expired rows become a bounded serving window instead '\n + 'of a permanent leak.',\n { resourceType: String(resourceType), retentionFields: policies.map((policy) => policy.fieldName), ragSourceFields: ragFieldNames },\n );\n }\n\n /\n EXECUTE a search-index command on the live MongoDB connection — the `mongot` half of the RAG\n * store capability probe, and the sibling of {@link probePostgresVectorCapability}.\n \n ## Reachability is PROVEN, never inferred, and never dispatched on a brand\n \n `MongoDBService.verifySearchCapability` runs `$listSearchIndexes`, which `mongod` PROXIES to\n * `mongot`. A version string cannot answer this question: a MongoDB 8.2 server with search NOT\n * configured reports 8.2 truthfully and throws `SearchNotEnabled`; a configured-but-down `mongot`\n * reports the same version and fails as a connection error; and a Mongo-compatible managed service\n * reports a MongoDB version it did not implement. This is the toolchain baseline's rule (\"verify a\n * claim by executing it\") applied to a second process rather than to a compiler.\n \n `aws-documentdb` — the documented managed Mongo-compatible backing service — cannot run\n * `mongot` and therefore fails this probe NATURALLY, on the same command, for the same reason a\n * mis-configured self-managed deployment does. There is deliberately no provider-name check: that\n * would be a second, hand-maintained list of which products have search, wrong the day one of them\n * gains it and silently wrong the day a self-managed deployment loses its sidecar.\n \n Fail-closed ERROR for the same reason as the PostgreSQL arm: an application that has already\n * WRITTEN chunk documents and then lost its store cannot honour an erasure, because the chunks\n * hold copies of subject text that no removal seam can reach.\n \n assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — refuses a configuration whose derived\n * subject-text copies would be unreachable by the erasure seams.\n /\n private async probeMongodbSearchCapability(resourceTypes: string[]): Promise<ConfigurationValidationIssue[]> {\n if (!this.mongoDBService) {\n return [issueError(\n ConfigurationValidationDomain.RAG,\n `Resources [${resourceTypes.join(', ')}] declare .ragSource() fields on MongoDB-backed storage, but no `\n + 'MongoDB database service is bound in this container — their chunk store would be unreachable, which '\n + 'is an erasure dead-end the moment a chunk document exists.',\n { resourceTypes },\n )];\n }\n try {\n await this.mongoDBService.verifySearchCapability();\n return [];\n } catch (error) {\n return [issueError(\n ConfigurationValidationDomain.RAG,\n `Resources [${resourceTypes.join(', ')}] declare .ragSource() fields on MongoDB-backed storage, but the `\n + 'MongoDB Search capability probe FAILED on the live connection '\n + `($listSearchIndexes → ${describeCaughtError(error)}). `\n + 'RAG on MongoDB is served by native $vectorSearch/$search, which require MongoDB 8.2 or later WITH the '\n + 'separate `mongot` process configured and reachable (it mirrors the collection through change streams). '\n + 'Configure a search-capable deployment, move these resources to PostgreSQL, or remove the .ragSource() '\n + `declarations. Note a Mongo-COMPATIBLE managed service (aws-documentdb) cannot run mongot and will always `\n + `fail this probe. Fail-closed: if this application has already written chunk documents, a store that `\n + `stopped answering is an erasure dead-end, so booting without it would let unreachable copies of subject `\n + `text accumulate. Background: ${MONGODB_RAG_CHUNK_STORE_TRACKING_ISSUE}.`,\n { resourceTypes },\n )];\n }\n }\n\n /* EXECUTE a pgvector expression on the live PostgreSQL connection (see the probe's JSDoc). /\n private async probePostgresVectorCapability(resourceTypes: string[]): Promise<ConfigurationValidationIssue[]> {\n if (!this.postgreSQLDatabaseService) {\n return [issueError(\n ConfigurationValidationDomain.RAG,\n `Resources [${resourceTypes.join(', ')}] declare .ragSource() fields on PostgreSQL-backed storage, but no `\n + 'PostgreSQL database service is bound in this container — their chunk store would be unreachable, which '\n + 'is an erasure dead-end the moment a chunk row exists.',\n { resourceTypes },\n )];\n }\n try {\n await this.postgreSQLDatabaseService.verifyVectorCapability();\n return [];\n } catch (error) {\n return [issueError(\n ConfigurationValidationDomain.RAG,\n `Resources [${resourceTypes.join(', ')}] declare .ragSource() fields on PostgreSQL-backed storage, but the `\n + 'pgvector capability probe FAILED on the live connection '\n + `(select '[1]'::vector → ${describeCaughtError(error)}). `\n + 'The application database must have the pgvector extension available and created '\n + '(`CREATE EXTENSION IF NOT EXISTS vector` — provisioned per application database by the platform '\n + 'PostgreSQL manager; the baseline image is pgvector/pgvector:pg17). Fail-closed: if this application has '\n + 'already written chunk rows, a store that stopped answering is an erasure dead-end, so booting without it '\n + 'would let unreachable copies of subject text accumulate.',\n { resourceTypes },\n )];\n }\n }\n\n /\n Log warnings and throw a consolidated error if any ERROR-severity\n * issues were collected.\n /\n private reportValidationResult(result: ConfigurationValidationResult): void {\n const warnings = result.issues.filter((i) => i.severity === ConfigurationValidationSeverity.WARNING);\n const errors = result.issues.filter((i) => i.severity === ConfigurationValidationSeverity.ERROR);\n\n for (const warning of warnings) {\n this.logger.warn(`[${warning.domain}] ${warning.message}`, warning.context);\n }\n\n if (errors.length === 0) {\n if (warnings.length > 0) {\n this.logDebug(`Post-registry validation completed with ${warnings.length} warning(s)`);\n }\n return;\n }\n\n const errorMessages = errors.map((e) => ` [${e.domain}] ${e.message}`).join('\\n');\n\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Post-registry configuration validation failed with ${errors.length} error(s):\\n` +\n errorMessages,\n errorCount: errors.length,\n warningCount: warnings.length,\n domains: [...new Set(errors.map((e) => e.domain))],\n },\n });\n }\n\n private assertNoRemovedGlobalAuthFields(auth: AppConfiguration_Shared_Auth): void {\n const rawAuth = auth as Record<string, unknown> \| undefined;\n const removedFields = [\n 'mfaPolicy',\n 'authMethodsEnabled',\n 'autoLinkByEmail',\n 'registration',\n 'passwordPolicy',\n 'methodManagement',\n 'sessionDurationMinutes',\n 'magicLink',\n 'smsOtp',\n ] as const;\n\n const foundDeprecated = removedFields.filter((field) => rawAuth && field in rawAuth);\n if (foundDeprecated.length === 0) {\n return;\n }\n\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Deprecated auth config fields detected: ${foundDeprecated.join(', ')}. ` +\n `These fields were removed in W6.8. Migrate them to userTypes[typeName].auth. ` +\n `(see entity-identity-config.shared.schemas.ts → UserTypeAuthPolicySchema). ` +\n `Remove them from your auth config and configure per-user-type auth policies instead.`,\n },\n });\n }\n\n private validateUserTypeAuthConsistency(config: AppConfiguration): void {\n const userTypes = config.userTypes ?? {};\n const frontendServices = config.frontendServices ?? {};\n\n for (const [typeName, typeDef] of Object.entries(userTypes)) {\n const typeAuth = (typeDef as Record<string, any>)?.auth;\n if (!typeAuth) {\n continue;\n }\n\n if (typeAuth.mfaPolicy?.requireMFA) {\n const secondFactorMethods = AuthUtils.getSecondFactorMethods();\n const hasEnabled = secondFactorMethods.some((method) => !!typeAuth.authMethodsEnabled?.[method]);\n if (!hasEnabled) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Config deadlock: userTypes.${typeName}.auth.mfaPolicy.requireMFA is true ` +\n `but no second-factor method is enabled in authMethodsEnabled. ` +\n `Enable at least one of: ${secondFactorMethods.join(', ')}`,\n },\n });\n }\n }\n\n const acceptableMethods = typeAuth.mfaPolicy?.acceptableMFAMethods ?? [];\n for (const method of acceptableMethods) {\n if (!typeAuth.authMethodsEnabled?.[method]) {\n this.logger.warn(\n `userTypes.${typeName}: acceptableMFAMethods includes '${method}' but it is not enabled in authMethodsEnabled`,\n );\n }\n // S0.1: a method that is INTRINSICALLY first-factor-only can never be a second factor, whatever the\n // app config says. `AUTH_METHOD_FACTOR_MAP` pins SSO redirect flows (ORG_SAML / ORG_OPENID_CONNECT /\n // EXTERNAL_OAUTH2) plus PASSWORD and MAGIC_LINK as FIRST_ONLY — SSO deliberately so, because an IdP\n // redirect is not an MFA ceremony (B-SEC-1). Listing one here is silently INERT at runtime:\n // `_getAvailableSecondFactorMethods` derives its candidates from `AuthUtils.getSecondFactorMethods()`\n // and uses `acceptableMFAMethods` only as a NARROWING filter, so such an entry can never add the\n // method — it can only subtract real ones. Warn so the author learns that instead of trusting a\n // second factor that was never in force.\n if (!AuthUtils.canBeSecondFactor(method)) {\n this.logger.warn(\n `userTypes.${typeName}: acceptableMFAMethods includes '${method}', which is ` +\n `${AuthUtils.getFactorType(method)} and can NEVER act as a second factor — the entry has no effect. ` +\n `Second-factor-capable methods are: ${AuthUtils.getSecondFactorMethods().join(', ')}.`,\n );\n }\n }\n\n // S0.1 (deadlock variant): the block above throws when requireMFA is set and NO second-factor method is\n // enabled at all. This is the same deadlock reached a different way — second factors ARE enabled, but\n // `acceptableMFAMethods` filters every one of them out (e.g. it lists only SSO methods, or only methods\n // left disabled). The runtime then resolves an EMPTY `usableSecondFactorMethods` while `requiresMFA`\n // stays true, and `_isAuthenticationComplete` refuses to complete a first-factor-only session forever:\n // every user of this type is locked out, and the MFA challenge screen can only render its `no_methods`\n // error. Fail at STARTUP with the same CONFIGURATION severity as the sibling deadlock rather than\n // letting it surface as an unexplained per-user lockout in production.\n if (typeAuth.mfaPolicy?.requireMFA && acceptableMethods.length > 0) {\n // The predicate must mirror `_resolveUsableMfaMethods` EXACTLY, including its final\n // `requireStrongMFA` step, or this validation gives false assurance. That step drops EMAIL_OTP from\n // the usable set, so `requireStrongMFA` + `acceptableMFAMethods:[EMAIL_OTP]` resolves to an empty\n // usable list at runtime even though EMAIL_OTP is both second-factor-capable AND enabled — the exact\n // lockout this check exists to prevent, reached by a third route. (EMAIL_OTP is the only method the\n // runtime strips; if that ever generalises to a \"weak methods\" set, generalise this alongside it.)\n const requireStrongMFA = !!typeAuth.mfaPolicy?.requireStrongMFA;\n const usableAcceptable = acceptableMethods.filter(\n (method: AuthMethod) =>\n AuthUtils.canBeSecondFactor(method)\n && !!typeAuth.authMethodsEnabled?.[method]\n && !(requireStrongMFA && method === AuthMethod.EMAIL_OTP),\n );\n if (usableAcceptable.length === 0) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Config deadlock: userTypes.${typeName}.auth.mfaPolicy.requireMFA is true but ` +\n `acceptableMFAMethods (${acceptableMethods.join(', ')}) leaves no method that is ` +\n `second-factor-capable, enabled in authMethodsEnabled` +\n (requireStrongMFA ? `, and strong (requireStrongMFA excludes ${AuthMethod.EMAIL_OTP})` : '') +\n `. Every user of this type would be unable to complete MFA. Include at least one enabled ` +\n `method from: ${AuthUtils.getSecondFactorMethods()\n .filter((method) => !(requireStrongMFA && method === AuthMethod.EMAIL_OTP))\n .join(', ')}, or drop acceptableMFAMethods to accept all enabled ones.`,\n },\n });\n }\n }\n\n if (typeAuth.mfaPolicy?.requireMFA && typeAuth.mfaPolicy?.enrollmentGracePeriodDays === 0) {\n const emailVerification = (typeAuth.registration as Record<string, any> \| undefined)?.emailVerification;\n if (emailVerification === 'deferred') {\n this.logger.warn(\n `userTypes.${typeName}: enrollmentGracePeriodDays=0 with emailVerification=deferred — users must enroll MFA immediately on deferred-verified accounts (valid but poor UX)`,\n );\n }\n }\n\n const registrationMode = typeAuth.registration?.mode as RegistrationMode \| undefined;\n if (!registrationMode) {\n continue;\n }\n\n const allowsSelfServiceRegistration = isRegistrationAcquisitionAllowed(\n registrationMode,\n RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n );\n for (const [frontendServiceName, frontendServiceConfig] of Object.entries(frontendServices)) {\n const userManagement = (frontendServiceConfig as Record<string, any>)?.usersManagement?.[typeName];\n if (!userManagement) {\n continue;\n }\n\n if (!allowsSelfServiceRegistration && userManagement.register) {\n this.logger.warn(\n `userTypes.${typeName}: registration.mode='${registrationMode}' blocks self-service registration but frontendServices.${frontendServiceName}.usersManagement.${typeName}.register=true — registration will be blocked at API level`,\n );\n }\n if (allowsSelfServiceRegistration && !userManagement.register) {\n this.logger.warn(\n `userTypes.${typeName}: registration.mode='${registrationMode}' but frontendServices.${frontendServiceName}.usersManagement.${typeName}.register=false — registration will be blocked at frontend service level`,\n );\n }\n }\n }\n }\n\n private validateFrontendServiceRuntimeBindings(config: AppConfiguration): void {\n const frontendServices = Object.entries(config.frontendServices ?? {});\n if (frontendServices.length === 0) {\n return;\n }\n\n for (const [frontendServiceName, frontendServiceConfig] of frontendServices) {\n const runtimeEndpoint = config.runtime?.endPoints?.[frontendServiceName];\n if (!runtimeEndpoint?.publicUrl \|\| !runtimeEndpoint?.internalUrl) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `frontendServices.${frontendServiceName} is declared but runtime.endPoints.${frontendServiceName} ` +\n `is missing a matching publicUrl/internalUrl binding. Runtime topology must materialize every declared frontend service.`,\n frontendServiceName,\n },\n });\n }\n }\n }\n\n private warnOnMultipleDefaultUserTypes(config: AppConfiguration): void {\n for (const [frontendServiceName, frontendServiceConfig] of Object.entries(config.frontendServices ?? {})) {\n const userManagement = (frontendServiceConfig as Record<string, any>)?.usersManagement ?? {};\n const defaultEntries = Object.entries(userManagement).filter(([, value]) => (value as Record<string, any>)?.isDefault);\n if (defaultEntries.length > 1) {\n this.logger.warn(\n `frontendServices.${frontendServiceName}: multiple isDefault:true entries in usersManagement: ${defaultEntries.map(([key]) => key).join(', ')}. Only the first will be used for user-type resolution.`,\n );\n }\n }\n }\n\n private warnOnDuplicateClaimedDomains(config: AppConfiguration): void {\n const domainClaimMap = new Map<string, string[]>();\n\n for (const [orgTypeName, orgTypeDef] of Object.entries(config.organizationTypes ?? {})) {\n const claimedDomains = (orgTypeDef as Record<string, any>)?.sso?.claimedDomains as string[] \| undefined;\n if (!claimedDomains) {\n continue;\n }\n\n for (const domain of claimedDomains) {\n const normalizedDomain = domain.toLowerCase();\n const orgTypes = domainClaimMap.get(normalizedDomain) ?? [];\n orgTypes.push(orgTypeName);\n domainClaimMap.set(normalizedDomain, orgTypes);\n }\n }\n\n for (const [domain, orgTypeNames] of domainClaimMap.entries()) {\n if (orgTypeNames.length > 1) {\n this.logger.warn(\n `E-VER-9: Domain \"${domain}\" is claimed by multiple organization types: ${orgTypeNames.join(', ')}. Domain-to-org resolution will be non-deterministic.`,\n );\n }\n }\n }\n\n private warnOnBroadAutoLinkSocialOAuth2(config: AppConfiguration): void {\n const socialOAuth2Providers = config.auth?.socialOAuth2Providers ?? {};\n const socialProvidersWithEmptyDomains = Object.entries(socialOAuth2Providers)\n .filter(([, providerConfig]) => {\n const typedConfig = providerConfig as Record<string, any>;\n return isEnabledSocialOAuth2LoginProvider(typedConfig)\n && (!typedConfig.allowedDomains \|\| typedConfig.allowedDomains.length === 0);\n })\n .map(([providerName]) => providerName);\n\n if (socialProvidersWithEmptyDomains.length === 0) {\n return;\n }\n\n for (const [typeName, typeDef] of Object.entries(config.userTypes ?? {})) {\n const autoLinkByEmail = (typeDef as Record<string, any>)?.auth?.autoLinkByEmail;\n if (autoLinkByEmail === true \|\| autoLinkByEmail === undefined) {\n this.logger.warn(\n `E-VER-11: userTypes.${typeName}.auth.autoLinkByEmail is true (or defaulted) and social OAuth2 providers [${socialProvidersWithEmptyDomains.join(', ')}] have empty allowedDomains. Any verified email from these IdPs can auto-link to existing accounts.`,\n );\n }\n }\n }\n\n // ─── Storage ────────────────────────────────────────────────────────────\n\n private collectStorageIssues(): ConfigurationValidationIssue[] {\n const allResourceTypes = this.resourcesRegistry.getResourceTypes();\n if (allResourceTypes.length === 0) {\n return [];\n }\n\n const envHints: Record<string, string> = {\n // Managed storage no longer takes a credential from env — it fetches\n // short-lived, prefix-confined sessions from apps-manager — so the hint\n // names the endpoint plus the bootstrap contract that authenticates that\n // fetch. Naming the retired `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY`\n // here would send an operator hunting for variables the platform\n // deliberately no longer emits, and `isConfigured()` gates on exactly the\n // set below.\n [FileStorageAccepted.WILDO_MANAGED]:\n 'STORAGE_ENDPOINT, PLATFORM_APPS_MANAGER_URL, PLATFORM_APPLICATION_PRIMARY_SECRET, APPLICATION_ID',\n [FileStorageAccepted.LOCAL_DIRECTORY]: 'STORAGE_LOCAL_BASE_DIR',\n };\n\n const issues: ConfigurationValidationIssue[] = [];\n\n for (const resourceType of allResourceTypes) {\n let fileFields;\n try {\n fileFields = this.fileFieldDetection.detectFileFields(resourceType);\n } catch {\n continue;\n }\n\n for (const field of fileFields) {\n const accepted = field.fileMetadata.storageAccepted;\n const fieldRef = `${resourceType}.${field.fieldName}`;\n\n if (!accepted \|\| accepted.length === 0) {\n const provider = this.fileStorageRouter.getProviderById(FileStorageAccepted.WILDO_MANAGED);\n if (!provider \|\| !provider.isConfigured()) {\n const hint = envHints[FileStorageAccepted.WILDO_MANAGED];\n issues.push(issueError(\n ConfigurationValidationDomain.STORAGE,\n `${fieldRef}: no storageAccepted specified and default WILDO_MANAGED is not configured — set ${hint}`,\n { fieldRef, storageAccepted: [FileStorageAccepted.WILDO_MANAGED] },\n ));\n }\n } else {\n const hasSatisfied = accepted.some((provId) => {\n const p = this.fileStorageRouter.getProviderById(provId);\n return p?.isConfigured() ?? false;\n });\n if (!hasSatisfied) {\n const hints = accepted.map((p) => envHints[p] ?? p).join(' or ');\n issues.push(issueError(\n ConfigurationValidationDomain.STORAGE,\n `${fieldRef}: accepts [${accepted.join(', ')}] but none are configured — set ${hints}`,\n { fieldRef, storageAccepted: [...accepted] },\n ));\n }\n }\n }\n }\n\n return issues;\n }\n\n // ─── Scanning (ClamAV) ──────────────────────────────────────────────────\n\n private collectScanningIssues(): ConfigurationValidationIssue[] {\n const issues: ConfigurationValidationIssue[] = [];\n const allResourceTypes = this.resourcesRegistry.getResourceTypes();\n const fieldsRequiringScan: string[] = [];\n\n for (const resourceType of allResourceTypes) {\n let fileFields;\n try {\n fileFields = this.fileFieldDetection.detectFileFields(resourceType);\n } catch {\n continue;\n }\n\n for (const field of fileFields) {\n if (field.fileMetadata.scanPolicy === 'required') {\n fieldsRequiringScan.push(`${resourceType}.${field.fieldName}`);\n }\n }\n }\n\n if (fieldsRequiringScan.length === 0) {\n return issues;\n }\n\n if (!this.clamavScanner.isConfigured()) {\n issues.push(issueError(\n ConfigurationValidationDomain.STORAGE,\n `${fieldsRequiringScan.length} z_file() field(s) declare scanPolicy: 'required' but ClamAV is not configured — set CLAMAV_HOST and CLAMAV_PORT`,\n { fields: fieldsRequiringScan, hint: 'Set CLAMAV_HOST env var or remove scanPolicy from z_file() declarations' },\n ));\n }\n\n return issues;\n }\n\n // ─── YARA (platform-level pattern scanning) ─────────────────────────\n\n private collectYaraIssues(): ConfigurationValidationIssue[] {\n const issues: ConfigurationValidationIssue[] = [];\n\n if (!this.yaraScanner.isExplicitlyEnabled()) return issues;\n\n if (!this.yaraScanner.isConfigured()) {\n issues.push(issueError(\n ConfigurationValidationDomain.STORAGE,\n 'YARA_ENABLED is true but YARA_HOST is not set — the YARA scanner service is unreachable',\n { hint: 'Set YARA_HOST to the YARA scanner Docker service hostname (e.g., yara-scanner)' },\n ));\n }\n\n return issues;\n }\n\n // ─── Authentication persistence boundaries ─────────────────────────────\n\n /*\n One registering user type may own at most one automatic organization\n * creation policy. The shared schema enforces this for parsed declarations;\n * this initialized-runtime border intentionally repeats the same canonical\n * lookup so programmatic or otherwise type-erased configuration cannot boot\n * into a frontend/backend ambiguity.\n /\n private collectOrganizationRegistrationCreationPolicyIssues(config?: AppConfiguration): ConfigurationValidationIssue[] {\n if (!config) return [];\n\n const authoredUserTypes = new Set<string>();\n for (const organizationType of Object.values(\n config.organizationTypes ?? {},\n )) {\n for (\n const userType\n of organizationType.creationPolicy\n ?.createOnUserTypeRegistration ?? []\n ) {\n authoredUserTypes.add(userType);\n }\n }\n\n const issues: ConfigurationValidationIssue[] = [];\n for (const userType of [...authoredUserTypes].sort()) {\n const matches = findOrganizationTypeRegistrationCreationMatches(\n config.organizationTypes,\n userType,\n );\n if (matches.length <= 1) continue;\n\n issues.push(issueError(\n ConfigurationValidationDomain.AUTH,\n `User type '${userType}' is assigned to multiple organization-creation `\n + `policies [${matches\n .map((match) => match.organizationType).join(', ')}]. `\n + 'Registration must resolve exactly one organization type.',\n {\n reason:\n 'registration_user_type_has_ambiguous_organization_creation_policy',\n userType,\n matchingOrgTypes: matches.map((match) => match.organizationType),\n },\n ));\n }\n\n return issues;\n }\n\n /\n Build the complete set of identity transactions reachable from authored\n * application capabilities.\n \n Runtime methods use the same request builders. Startup intentionally\n * validates the broadest supported variant of each enabled boundary (for\n * example optional password creation is still part of self-registration's\n * capability) so a configuration cannot boot with only a subset of one\n * feature working.\n /\n private collectEnabledAuthenticationPersistenceBoundaryRequests(config: AppConfiguration): ResourcePersistenceUnitOfWorkRequest[] {\n const requests: ResourcePersistenceUnitOfWorkRequest[] = [];\n const userTypeEntries = Object.entries(config.userTypes ?? {});\n const selfRegistrationUserTypes = userTypeEntries\n .filter(([, definition]) =>\n isRegistrationAcquisitionAllowed(\n definition.auth.registration.mode,\n RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n )\n && definition.auth.registration.allowedMethods.includes(\n AuthMethod.PASSWORD,\n ),\n )\n .map(([userType]) => userType);\n\n if (selfRegistrationUserTypes.length > 0) {\n const eligibleUserTypes = new Set(selfRegistrationUserTypes);\n const reachableOrganizationCreationPolicies = Object.values(\n config.organizationTypes ?? {},\n )\n .map((definition) => definition.creationPolicy)\n .filter(\n (policy): policy is NonNullable<typeof policy> =>\n policy !== undefined\n && policy.createOnUserTypeRegistration.some(\n (userType) => eligibleUserTypes.has(userType),\n ),\n );\n const hasSynchronousOrganizationCreation =\n reachableOrganizationCreationPolicies.some(\n (policy) =>\n policy.orgNameSource !== OrganizationNameSource.ONBOARDING,\n );\n const hasDeferredOrganizationOnboarding =\n reachableOrganizationCreationPolicies.some(\n (policy) =>\n policy.orgNameSource === OrganizationNameSource.ONBOARDING,\n );\n requests.push(createSelfRegistrationPersistenceRequest({\n // PASSWORD is an allowed method. Even when a particular call omits it,\n // the authored self-registration capability includes credential writes.\n includeCredentials: true,\n includeSynchronousOrganizationCreation:\n hasSynchronousOrganizationCreation,\n }));\n if (hasDeferredOrganizationOnboarding) {\n requests.push(\n createDeferredOrganizationOnboardingPersistenceRequest(),\n );\n }\n }\n\n // Invitation acceptance has identity-level persistence boundaries distinct\n // from the organization-member CREATE operation. The presence of an\n // organization type makes these boundaries reachable even when all its\n // grant modes are ADMIN_ONLY/DISABLED: invitation policy applies only to\n // newly acquired user types, so an existing holder (or an org type with no\n // grants) can still be invited. There is currently no authored global\n // invitation-disable switch. Invitation issuance itself is validated\n // exactly once by the generic resource-operation transaction resolver below\n // (operation resource + declared custom participants + framework token\n // participant).\n if (Object.keys(config.organizationTypes ?? {}).length > 0) {\n requests.push(\n createPublicInvitationAcceptancePersistenceRequest({\n includeCredentials:\n isPublicInvitationPasswordCredentialReachable(config),\n }),\n createAuthenticatedInvitationAcceptancePersistenceRequest(),\n );\n }\n\n const hasEnabledSocialProvider = Object.values(\n config.auth?.socialOAuth2Providers ?? {},\n ).some((provider) => isEnabledSocialOAuth2LoginProvider(provider));\n if (hasEnabledSocialProvider) {\n requests.push(SOCIAL_EXISTING_USER_LINK_UNIT_OF_WORK);\n const socialJitCreationEnabled = userTypeEntries.some(\n ([, definition]) =>\n definition.auth.registration.allowedMethods.includes(\n AuthMethod.EXTERNAL_OAUTH2,\n )\n && isRegistrationAcquisitionAllowed(\n definition.auth.registration.mode,\n RegistrationAcquisitionChannel.SOCIAL_OAUTH_JIT,\n ),\n );\n if (socialJitCreationEnabled) {\n requests.push(SOCIAL_USER_CREATION_UNIT_OF_WORK);\n }\n if (Object.keys(config.organizationTypes ?? {}).length > 0) {\n requests.push(SOCIAL_INVITATION_ACCEPTANCE_UNIT_OF_WORK);\n }\n }\n\n const enterpriseProvisioningEnabled =\n userTypeEntries.some(([, definition]) =>\n isRegistrationAcquisitionAllowed(\n definition.auth.registration.mode,\n RegistrationAcquisitionChannel.ENTERPRISE_SSO_JIT,\n ),\n )\n \|\| Object.values(config.organizationTypes ?? {}).some(\n (definition) => definition.scimProvisioning?.enabled === true,\n );\n if (enterpriseProvisioningEnabled) {\n requests.push(\n APPLICATION_USER_CREATION_UNIT_OF_WORK,\n APPLICATION_EXISTING_USER_LINK_UNIT_OF_WORK,\n );\n if (Object.keys(config.organizationTypes ?? {}).length > 0) {\n requests.push(\n ORGANIZATION_USER_CREATION_UNIT_OF_WORK,\n ORGANIZATION_EXISTING_USER_LINK_UNIT_OF_WORK,\n );\n }\n }\n\n return requests;\n }\n\n /\n How FILES participates in writes to this resource, derived from the schema alone.\n \n A generated document must land in the SAME commit as the row that references it,\n * so it is ATOMIC and a cross-adapter boundary is refused. Ordinary file METADATA is\n * compensatable — it may commit separately, which the service layer already handles\n * and already documents as an at-least-once obligation.\n /\n /\n Resource-WRITE boundaries — declared separately from transaction-readiness ones,\n * and deliberately NOT mixed into them.\n \n `collectTransactionReadinessPersistenceRequests` feeds a live probe that opens a\n * real transaction per adapter. A write whose only extra participant is COMPENSATABLE\n * file metadata requires no transaction at all, so folding these in would claim a\n * transaction requirement that does not exist — and would report a missing unit of\n * work as \"transaction-requiring boundaries are configured\", which is false.\n \n These are assessed for COMPATIBILITY only. That is the whole point: it is what\n * turns \"a resource writes files across an adapter boundary\" from a per-request\n * runtime discovery into a boot-time answer.\n /\n private collectResourceWritePersistenceRequests(): ResourcePersistenceUnitOfWorkRequest[] {\n const requests: ResourcePersistenceUnitOfWorkRequest[] = [];\n\n for (const resourceType of this.resourcesRegistry.getResourceTypes()) {\n const fileParticipation = this.resolveResourceWriteFileParticipation(resourceType);\n if (fileParticipation === ResourceWriteFileParticipation.NONE) {\n continue;\n }\n requests.push(createResourceWritePersistenceRequest({\n resourceType: String(resourceType),\n fileParticipation,\n }));\n }\n\n return requests;\n }\n\n private resolveResourceWriteFileParticipation(\n resourceType: Parameters<FileFieldDetectionBackendService['detectFileFields']>[0],\n ): ResourceWriteFileParticipation {\n let fileFields;\n try {\n fileFields = this.fileFieldDetection.detectFileFields(resourceType);\n } catch {\n // Detection is schema-driven; a resource it cannot read contributes no boundary\n // rather than failing startup on a diagnostic that is not itself a control.\n return ResourceWriteFileParticipation.NONE;\n }\n\n if (fileFields.length === 0) {\n return ResourceWriteFileParticipation.NONE;\n }\n\n const hasGeneratedDocument = fileFields.some(\n (fileField) => fileField.fileMetadata.generation?.source === FileGenerationSource.PDF_TEMPLATE,\n );\n\n return hasGeneratedDocument\n ? ResourceWriteFileParticipation.ATOMIC_MATERIALIZATION\n : ResourceWriteFileParticipation.METADATA;\n }\n\n /\n Collect every statically authored boundary that requires a native\n * transaction before traffic is accepted.\n \n Identity services declare their multi-resource units of work explicitly.\n * Resource operations additionally require a transaction when they generate\n * tokens or a custom implementation opts into `transactionalCore`.\n * Token-coupled operations include the token resource in the same request so\n * startup and runtime enforce the same adapter boundary.\n /\n private collectTransactionReadinessPersistenceRequests(config?: AppConfiguration): ResourcePersistenceUnitOfWorkRequest[] {\n const requests = [\n ...(config\n ? this.collectEnabledAuthenticationPersistenceBoundaryRequests(config)\n : []),\n ];\n\n for (const resourceType of this.resourcesRegistry.getResourceTypes()) {\n const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType);\n\n for (const operation of resourceConfig.operations) {\n const contract =\n resolveResourceOperationTransactionPersistenceContract(\n operation,\n this.customImplRegistry.getRegistrationsForOperation(operation),\n );\n if (!contract.request) {\n continue;\n }\n requests.push(contract.request);\n }\n }\n\n return requests;\n }\n\n /\n Assess every declared native transaction boundary through the same UoW\n * contract runtime execution uses.\n \n This deliberately stays generic. Identity boundaries and resource\n * operations contribute requests, while adapter resolution, mixed-store\n * detection, required-adapter constraints, and database availability remain\n * owned by `ResourcePersistenceUnitOfWorkBackendService`.\n /\n private collectPersistenceBoundaryCompatibilityIssues(config?: AppConfiguration): ConfigurationValidationIssue[] {\n const transactionRequiringRequests = this.collectTransactionReadinessPersistenceRequests(config);\n const resourceWriteRequests = this.collectResourceWritePersistenceRequests();\n const requests = [...transactionRequiringRequests, ...resourceWriteRequests];\n if (requests.length === 0) {\n return [];\n }\n if (!this.resourcePersistenceUnitOfWork) {\n /\n Unchanged semantics: a missing unit of work is only an ISSUE when a boundary\n * genuinely requires a transaction. Resource-write boundaries cannot be assessed\n * without it either, but their absence is not itself a misconfiguration — and\n * reporting one here would fire on every application that merely has file fields.\n /\n if (transactionRequiringRequests.length === 0) {\n return [];\n }\n return [issueError(\n ConfigurationValidationDomain.LIFECYCLE,\n 'Transaction-requiring persistence boundaries are configured, but '\n + 'ResourcePersistenceUnitOfWorkService is unavailable.',\n {\n boundaries: requests.map((request) => request.boundary),\n reason: 'resource_persistence_unit_of_work_service_unavailable',\n },\n )];\n }\n\n const issues: ConfigurationValidationIssue[] = [];\n for (const request of requests) {\n const assessment = this.resourcePersistenceUnitOfWork.assessCompatibility(request);\n if (assessment.compatible) {\n continue;\n }\n\n issues.push(issueError(\n request.boundary.startsWith('resource-operation-transaction:')\n ? ConfigurationValidationDomain.LIFECYCLE\n : ConfigurationValidationDomain.AUTH,\n `Persistence boundary '${request.boundary}' cannot execute `\n + `atomically (${assessment.status}). Every named participant must `\n + 'resolve to one supported native persistence adapter.',\n {\n boundary: request.boundary,\n compatibilityStatus: assessment.status,\n participantResourceMap: assessment.participantResourceMap,\n resourceAdapterMap: assessment.resourceAdapterMap,\n unresolvedParticipantResourceMap:\n assessment.unresolvedParticipantResourceMap,\n requiredAdapter: assessment.requiredAdapter,\n selectedAdapter: assessment.selectedAdapter,\n },\n ));\n }\n return issues;\n }\n\n /\n Reject operation pipelines whose synchronous result-transforming terminal\n * hooks cannot be reconciled with a framework-owned transaction.\n \n The custom-implementation registry catches transactional-registration\n * combinations during normal initialization. This startup border repeats the\n * complete operation-level check because token generation, authentication,\n * or revocation can require a transaction even when no custom registration\n * opted into one.\n /\n private collectResourceOperationTransactionContractIssues():\n ConfigurationValidationIssue[] {\n const issues: ConfigurationValidationIssue[] = [];\n\n for (const resourceType of this.resourcesRegistry.getResourceTypes()) {\n const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType);\n for (const operation of resourceConfig.operations) {\n const contract =\n resolveResourceOperationTransactionPersistenceContract(\n operation,\n this.customImplRegistry.getRegistrationsForOperation(operation),\n );\n if (!contract.transactionRequired) {\n continue;\n }\n\n const operationRef = ApplicationStartupConfigValidatorService.buildOperationRef(operation);\n if (contract.overrideAllRegistrationLabels.length > 0) {\n issues.push(issueError(\n ConfigurationValidationDomain.LIFECYCLE,\n `Transaction-requiring operation '${operationRef}' cannot use `\n + 'OVERRIDE_ALL because that mode replaces and returns before '\n + 'the framework-owned transaction pipeline.',\n {\n operationRef,\n tokenGenerationConfigured:\n contract.tokenGeneration !== undefined,\n transactionalRegistrationLabels:\n contract.transactionalRegistrationLabels,\n overrideAllRegistrationLabels:\n contract.overrideAllRegistrationLabels,\n },\n ));\n }\n }\n }\n\n return issues;\n }\n\n /\n Validate the template side of EVERY operation email before traffic is accepted.\n \n ## What binds an operation to a template\n \n A `userNotifications` entry with `channel: EMAIL` never names its template. The dispatcher\n * DERIVES one — `email.<resource>.<operation>[.<variantKey>].<target-kebab>` — and the\n * application must ship a template folder of exactly that name. Nothing in the type system\n * connects the two: the declaration is a config object, the template is a directory.\n \n ## Why this used to cover only token-backed operations, and why that was the bug\n \n The check opened with `if (!operation.tokenGeneration) continue;`, so an operation that merely\n * NOTIFIES was never validated. Combined with dispatch being post-commit and fire-and-forget by\n * design (a mutation must not fail because an email could not render), an unresolvable ref was\n * invisible everywhere: not in typecheck, not in the suites, not at boot, not in e2e lanes that\n * drove the very operations.\n \n That is not hypothetical. Moving the member notification off `ORGANIZATIONS \| delete` onto\n * `request_deletion` (2026-08-05) moved the declaration and left the template directory behind,\n * producing three unresolvable refs and two orphaned templates with zero signal. It was found by\n * hand, months of boots later, only because someone went looking.\n \n ## Why severity SPLITS rather than failing everything closed\n \n The consequence of a missing template genuinely differs, so the report does too:\n \n - Token-backed → ERROR. The email carries a consumable token, so failing to send does not\n * merely lose a notice — the user cannot accept the invitation or reset the password. The\n * operation is functionally broken, and starting is worse than refusing to.\n * - Informational → WARNING. The operation completed correctly and a courtesy notice was not\n * delivered. Refusing to START an application because a notice is unauthored trades a missing\n * email for a total outage, which is the worse failure — an application must be able to boot\n * while its notification copy is still being written.\n \n The warning is not a shrug. It is emitted PER unresolvable ref, names the declaring operation,\n * and prints the exact directory the application has to create — so it is actionable at the first\n * boot rather than after an audit. Silence was the defect; a specific, repeated, remediable\n * warning is not silence.\n \n ## Scope\n \n This proves that runtime dispatch can RESOLVE every authored email through the configured\n * locale chain, and that a template cannot override transactional routing with a marketing\n * provider class. It deliberately says nothing about durable delivery, which has its own\n * (best-effort, post-commit) reliability boundary.\n /\n private collectOperationEmailTemplateIssues(): ConfigurationValidationIssue[] {\n const issues: ConfigurationValidationIssue[] = [];\n\n for (const resourceType of this.resourcesRegistry.getResourceTypes()) {\n const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType);\n for (const operation of resourceConfig.operations) {\n if (\n !isApiCallOperation(operation)\n && !isApiCallWithCallbackOperation(operation)\n ) {\n continue;\n }\n\n const operationRef = ApplicationStartupConfigValidatorService.buildOperationRef(operation);\n const emailNotifications = (operation.userNotifications ?? []).filter(\n (notification) =>\n notification.channel === CoreUserNotificationChannel.EMAIL,\n );\n // Token-backed emails carry a consumable token, so a missing template BREAKS the flow;\n // informational ones only lose a notice. Severity follows that, not uniformity.\n const isTokenBacked = Boolean(operation.tokenGeneration);\n const issueFor = isTokenBacked ? issueError : issueWarning;\n\n for (const notification of emailNotifications) {\n const templateRef = buildUserNotificationEmailTemplateRef(\n {\n resourceIdentifier: String(operation.resourceIdentifier),\n operationIdentifier: String(operation.operationIdentifier),\n ...('variantKey' in operation && operation.variantKey\n ? { variantKey: String(operation.variantKey) }\n : {}),\n },\n notification,\n );\n\n try {\n const resolvedTemplate = this.emailTemplateRegistry.resolveForConfiguredLocale(templateRef);\n const effectiveTemplateType =\n resolvedTemplate.definition.type\n ?? EmailTemplateType.TRANSACTIONAL;\n if (effectiveTemplateType !== EmailTemplateType.TRANSACTIONAL) {\n issues.push(issueFor(\n ConfigurationValidationDomain.LIFECYCLE,\n `Operation email template '${templateRef}' for `\n + `operation '${operationRef}' resolves as `\n + `${effectiveTemplateType}; operation email `\n + `delivery requires ${EmailTemplateType.TRANSACTIONAL}.`,\n {\n operationRef,\n templateRef,\n resolvedLocale: resolvedTemplate.resolvedLocale,\n effectiveTemplateType,\n requiredTemplateType: EmailTemplateType.TRANSACTIONAL,\n },\n ));\n }\n } catch (error) {\n if (\n !isWildoBackendError(error)\n \|\| error.type !== ErrorType.CONFIGURATION\n ) {\n throw error;\n }\n issues.push(issueFor(\n ConfigurationValidationDomain.LIFECYCLE,\n `${isTokenBacked ? 'Token-backed operation' : 'Operation'} email template `\n + `'${templateRef}' for operation '${operationRef}' does not resolve through the `\n + 'configured primary/fallback locale chain'\n + (isTokenBacked\n ? ' — this email carries a consumable token, so the flow it belongs to cannot complete.'\n : ' — the operation still succeeds, but its notification is silently never delivered.')\n // The remedy, spelled out: the ref IS the directory name, and an author who has not\n // met this derivation before has no way to guess it from the declaration.\n + ` Create the template folder named '${templateRef}' `\n + '(template.tsx + labels.<locale>.ts), or remove the notification declaration.',\n { operationRef, templateRef, tokenBacked: isTokenBacked },\n ));\n }\n }\n }\n }\n\n return issues;\n }\n\n /\n Refuse to start when a configured operation cannot fulfil the contract it declares.\n \n A custom operation whose `requestDto` nothing consumes does not fail — it falls through to\n * the generic core path, writes nothing, and answers HTTP 200 with the unchanged row. A\n * hostile e2e probe caught `organizationMembers \| promote` doing that on 2026-08-01, and a\n * catalogue sweep found 41 routed operations sharing the shape (8 CRITICAL, 11 HIGH). Nothing\n * escalates, which is why every security lane stayed green — the damage is that a destructive\n * verb reports success it never performed, so every runbook, script, and UI that trusts the\n * 2xx is wrong.\n \n The verdict comes from `resolveResourceOperationImplementationCoverage`, the same resolver\n * the dispatcher consults before executing. Sharing it is the point: a predicate that lived in\n * two places could bless an operation at boot that still answers 2xx on the first request.\n \n The check is BIDIRECTIONAL, and both directions are fail-closed:\n \n - unserviceable and unacknowledged — a new silent no-op cannot ship. Implement the\n * operation, remove the declaration, or acknowledge the gap deliberately.\n * - acknowledged but serviceable — a stale marker cannot survive someone implementing the\n * operation, which would otherwise leave a working operation permanently refusing.\n \n Every violation is aggregated into one throw, so one boot surfaces the whole set rather than\n * one restart per operation.\n \n assurance-control: WILDO.OPERATIONS.EXECUTION_INTEGRITY — an interface must not report success for an\n * action it did not perform.\n /\n private collectUnimplementedResourceOperationIssues(): ConfigurationValidationIssue[] {\n const issues: ConfigurationValidationIssue[] = [];\n\n for (const resourceType of this.resourcesRegistry.getResourceTypes()) {\n const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType);\n for (const operation of resourceConfig.operations) {\n const verdict = resolveResourceOperationImplementationCoverage(\n operation,\n this.customImplRegistry.getRegistrationsForOperation(operation),\n );\n const operationRef = ApplicationStartupConfigValidatorService.buildOperationRef(operation);\n\n if (\n verdict.coverage === ResourceOperationImplementationCoverage.UNSERVICEABLE\n && !verdict.acknowledgement\n ) {\n issues.push(issueError(\n ConfigurationValidationDomain.LIFECYCLE,\n `Operation '${operationRef}' is routed but nothing consumes its declared request `\n + 'contract, so it would answer a success status having performed nothing. '\n + 'Implement it (a custom implementation bound to this exact operation path, or a '\n + 'declarative side effect), remove the declaration, or declare the gap with '\n + '`unimplementedAcknowledgement` — which also makes the request fail closed.',\n {\n operationRef,\n reason: verdict.unserviceableReason,\n unconsumedRequestFields: verdict.unconsumedRequestFields,\n riskLevel: operation.riskLevel,\n resourceOperationLike: operation.resourceOperationLike,\n },\n ));\n continue;\n }\n\n if (\n verdict.coverage !== ResourceOperationImplementationCoverage.UNSERVICEABLE\n && verdict.acknowledgement\n ) {\n issues.push(issueError(\n ConfigurationValidationDomain.LIFECYCLE,\n `Operation '${operationRef}' declares 'unimplementedAcknowledgement' but is `\n + 'serviceable. The acknowledgement makes every request to it fail closed, so a '\n + 'stale marker silently disables a working operation. Remove it.',\n {\n operationRef,\n coverage: verdict.coverage,\n acknowledgementReason: verdict.acknowledgement.reason,\n acknowledgementTrackingRef: verdict.acknowledgement.trackingRef,\n },\n ));\n }\n }\n }\n\n return issues;\n }\n\n /\n Refuse to start when an `authoritativeFields` declaration names something that is not a\n * persisted field of the resource.\n \n `authoritativeFields` is what carries a hook-authored value past the repository's strict\n * `requestDto` re-parse even when the caller also supplied the key. It is typed `readonly\n * string[]` rather than `keyof` the main schema, because the declaration is shared by the\n * authoring parameters and the type-erased built operation (where `keyof` collapses to `never`),\n * and because custom-implementation registrations declare plain strings with no schema generic\n * available at all.\n \n So the name check has to happen here. A typo is the dangerous case: a misspelled field\n * declares nothing, the hook's value silently reverts to the added-key inference, and the first\n * caller who supplies that key turns the operation back into a success response that wrote\n * nothing — the precise defect `unimplementedAcknowledgement` exists to prevent. Failing at boot\n * makes that impossible to ship.\n \n Both declaration sites are covered: the operation-variant `authoritativeFields` (which pairs\n * with `basicPrefixOperation`) and every custom-implementation registration bound to the\n * operation path.\n \n assurance-control: WILDO.SOFTWARE.AUTHORITY_INTEGRITY — a server-owned field must have exactly one named\n * authority, and that authority must be provable at boot rather than assumed.\n /\n private collectResourceOperationAuthoritativeFieldIssues(): ConfigurationValidationIssue[] {\n const issues: ConfigurationValidationIssue[] = [];\n\n for (const resourceType of this.resourcesRegistry.getResourceTypes()) {\n const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType);\n for (const operation of resourceConfig.operations) {\n const declarations: { source: string; fields: readonly string[] }[] = [];\n\n const configuredFields = (\n operation as { authoritativeFields?: readonly string[] }\n ).authoritativeFields;\n if (configuredFields?.length) {\n declarations.push({ source: 'operation variant', fields: configuredFields });\n }\n\n for (const registration of this.customImplRegistry.getRegistrationsForOperation(operation)) {\n if (registration.authoritativeFields?.length) {\n declarations.push({\n source: `custom implementation '${registration.debugLabel}'`,\n fields: registration.authoritativeFields,\n });\n }\n }\n\n if (declarations.length === 0) continue;\n\n const operationRef = ApplicationStartupConfigValidatorService.buildOperationRef(operation);\n const persistedFields = getPersistedFieldNames(operation);\n\n for (const declaration of declarations) {\n const unknownFields = declaration.fields.filter((field) => !persistedFields.has(field));\n if (unknownFields.length === 0) continue;\n\n issues.push(issueError(\n ConfigurationValidationDomain.LIFECYCLE,\n `Operation '${operationRef}' declares authoritativeFields `\n + `[${unknownFields.join(', ')}] on its ${declaration.source}, but `\n + `${unknownFields.length === 1 ? 'that name is not a persisted field' : 'those names are not persisted fields'} `\n + 'of the resource. A name that matches nothing declares nothing: the hook\\'s value '\n + 'falls back to being inferred from the keys it added, so the first caller who '\n + 'supplies that key makes the write silently empty while the operation still '\n + 'answers success. Fix the spelling, or drop the declaration if the field is no '\n + 'longer authored.',\n {\n operationRef,\n declarationSource: declaration.source,\n unknownFields,\n persistedFields: [...persistedFields],\n },\n ));\n }\n }\n }\n\n return issues;\n }\n\n /\n Refuse to start when a custom write-like verb never authored the request contract it exposes.\n \n The DTO builder synthesizes a contract for an operation that does not author one, and for a\n * write-like `resourceOperationLike` that synthesis is the resource's ENTIRE create/update\n * contract. A verb then advertises far more than it names: `applicationApiKeys \| deactivate`\n * accepted `status` (so it could activate) and `roles` (on a resource whose only role gate runs\n * when minting); `organizationOAuthClients \| regenerate` accepted `redirectUris`.\n \n This is a DIFFERENT defect from an unserviceable operation and gets its own resolver — those\n * operations write nothing, these write too much, and several of these have full custom\n * implementations. `unimplementedAcknowledgement` is deliberately NOT the escape hatch here: the\n * fix is to author the contract. An operation that really does accept the whole resource\n * contract declares it explicitly, which is visible at the declaration site and in review.\n \n assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — least privilege applies to a request contract as\n * much as to a role.\n /\n private collectOverbroadResourceOperationRequestContractIssues(): ConfigurationValidationIssue[] {\n const issues: ConfigurationValidationIssue[] = [];\n\n for (const resourceType of this.resourcesRegistry.getResourceTypes()) {\n const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType);\n for (const operation of resourceConfig.operations) {\n const verdict = resolveResourceOperationRequestContractBreadth(operation);\n if (\n verdict.breadth\n !== ResourceOperationRequestContractBreadth.OVERBROAD_INHERITED_FULL_CONTRACT\n ) {\n continue;\n }\n\n const operationRef = ApplicationStartupConfigValidatorService.buildOperationRef(operation);\n issues.push(issueError(\n ConfigurationValidationDomain.LIFECYCLE,\n `Operation '${operationRef}' declares no 'requestDto', so it inherited its resource's `\n + 'ENTIRE update contract and accepts every field listed below — including fields the '\n + 'verb contradicts. Author a `requestDto` naming exactly what the verb accepts '\n + '(`z.object({})` when the transition is server-decided) and force the transition '\n + 'from a `prefixCoreOperations` / `basicPrefixOperation` hook. If the operation '\n + 'really does accept the whole contract, declare that contract explicitly.',\n {\n operationRef,\n inheritedRequestFields: verdict.inheritedRequestFields,\n riskLevel: operation.riskLevel,\n resourceOperationLike: operation.resourceOperationLike,\n },\n ));\n }\n }\n\n return issues;\n }\n\n private static buildOperationRef(operation: {\n resourceIdentifier: unknown;\n operationIdentifier: unknown;\n variantKey?: unknown;\n }): string {\n return [\n String(operation.resourceIdentifier),\n String(operation.operationIdentifier),\n ...(operation.variantKey ? [String(operation.variantKey)] : []),\n ].join('.');\n }\n\n // ─── CLI Runtime Agents ─────────────────────────────────────────────────\n\n /\n Refuse at STARTUP an active coding agent whose ACP transport cannot serve it.\n \n Replaces the CLI-runtime validator this transport superseded, and keeps its\n * purpose: an agent whose provider, profile, model or environment does not\n * line up should fail while an operator is reading startup output, not on the\n * first dispatch — where the same misconfiguration surfaces minutes into a\n * journey, after a task row already exists.\n */\n private collectCodingAgentIssues(): ConfigurationValidationIssue[] {\n const applicationEnv = (process.env.APPLICATION_ENV ?? APPLICATION_ENVIRONMENT.DEVELOPMENT) as APPLICATION_ENVIRONMENT;\n const platformEnvironmentId = process.env.PLATFORM_ENVIRONMENT_ID;\n const agents = Object.values(this.flowsActorsRegistry.getRegistry().agents);\n const issues: ConfigurationValidationIssue[] = [];\n\n for (const agent of agents) {\n if (agent.status !== FlowsActors_Agent_Status.ACTIVE \|\| !isCodingAgentConfiguration(agent.config)) {\n continue;\n }\n\n const codingConfig: FlowsActors_Agent_CodingConfiguration = agent.config;\n const providerRef = codingConfig.providerRef;\n const executionProfileRef = codingConfig.executionProfileRef;\n const agentCtx = { agentRef: agent.ref, providerRef, executionProfileRef };\n\n if (!this.externalProvidersRegistry.isProviderEnabled(providerRef, ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL)) {\n issues.push(issueError(\n ConfigurationValidationDomain.AGENTS,\n `Agent '${agent.ref}': provider '${providerRef}' has no enabled Agent Client Protocol`,\n agentCtx,\n ));\n continue;\n }\n\n const acpProfile = this.externalProvidersRegistry.getAgentClientProtocolProfile(providerRef);\n const executionProfile = this.externalProvidersRegistry.getAgentClientProtocolExecutionProfile(\n providerRef,\n executionProfileRef,\n );\n if (!acpProfile \|\| !executionProfile) {\n issues.push(issueError(\n ConfigurationValidationDomain.AGENTS,\n `Agent '${agent.ref}': ACP metadata or execution profile '${executionProfileRef}' not found`,\n agentCtx,\n ));\n continue;\n }\n\n if (!acpProfile.supportedOperationKeys.includes(codingConfig.operationKey)) {\n issues.push(issueError(\n ConfigurationValidationDomain.AGENTS,\n `Agent '${agent.ref}': ACP transport does not support operation '${codingConfig.operationKey}'`,\n agentCtx,\n ));\n }\n\n if (!acpProfile.supportedModels.includes(codingConfig.model)) {\n issues.push(issueError(\n ConfigurationValidationDomain.AGENTS,\n `Agent '${agent.ref}': ACP transport does not declare support for model '${codingConfig.model}'`,\n { ...agentCtx, supportedModels: acpProfile.supportedModels },\n ));\n }\n\n // The environment gate, checked at startup as well as at dispatch. A\n // profile that can never run here is a configuration error worth naming\n // now rather than a refusal discovered mid-journey.\n if (!executionProfile.allowedApplicationEnvironments.includes(applicationEnv)) {\n issues.push(issueError(\n ConfigurationValidationDomain.AGENTS,\n `Agent '${agent.ref}': ACP execution profile is not allowed in application environment '${applicationEnv}'`,\n { ...agentCtx, allowedApplicationEnvironments: executionProfile.allowedApplicationEnvironments },\n ));\n }\n\n if (\n executionProfile.allowedPlatformEnvironmentIds?.length\n && (!platformEnvironmentId \|\| !executionProfile.allowedPlatformEnvironmentIds.includes(platformEnvironmentId))\n ) {\n issues.push(issueError(\n ConfigurationValidationDomain.AGENTS,\n `Agent '${agent.ref}': ACP execution profile is not allowed in platform environment '${platformEnvironmentId ?? '(unset)'}'`,\n { ...agentCtx, allowedPlatformEnvironmentIds: executionProfile.allowedPlatformEnvironmentIds },\n ));\n }\n\n if (\n executionProfile.authMode === AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n && !this.externalProvidersRegistry.getAgentClientProtocolExecutionProfileSecret(providerRef, executionProfileRef)\n ) {\n issues.push(issueError(\n ConfigurationValidationDomain.AGENTS,\n `Agent '${agent.ref}': ACP execution profile declares secret injection but its secret is not resolvable`,\n agentCtx,\n ));\n }\n }\n\n return issues;\n }\n}\n"]}
1	+ {"version":3,"file":"application-startup-config-validator.backend.service.js","sourceRoot":"","sources":["../../../../../src/config/services/application-startup-config-validator.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EACL,UAAU,EACV,SAAS,EACT,2BAA2B,EAC3B,iBAAiB,EACjB,2BAA2B,EAC3B,SAAS,EACT,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAE9B,mBAAmB,EACnB,gCAAgC,EAChC,+CAA+C,EAC/C,qBAAqB,EAIrB,6BAA6B,EAC7B,+BAA+B,EAC/B,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,8BAA8B,EAC9B,UAAU,EACV,YAAY,EACZ,0BAA0B,GAE3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,sCAAsC,GAEvC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAIrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AACrJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,wEAAwE,CAAC;AACpH,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAC3H,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAC1H,OAAO,EAAE,+BAA+B,EAAE,MAAM,sEAAsE,CAAC;AACvH,OAAO,EAAE,2BAA2B,EAAE,MAAM,kEAAkE,CAAC;AAC/G,OAAO,EAAE,yBAAyB,EAAE,MAAM,gEAAgE,CAAC;AAC3G,OAAO,EAAE,kCAAkC,EAAE,MAAM,uFAAuF,CAAC;AAC3I,OAAO,EACL,6CAA6C,GAC9C,MAAM,iGAAiG,CAAC;AAIzG,OAAO,EACL,qCAAqC,GACtC,MAAM,oFAAoF,CAAC;AAQ5F,OAAO,EACL,qCAAqC,EACrC,sDAAsD,EACtD,8BAA8B,GAC/B,MAAM,4GAA4G,CAAC;AACpH,OAAO,EACL,uCAAuC,EACvC,uCAAuC,EACvC,sBAAsB,EACtB,8CAA8C,EAC9C,8CAA8C,GAC/C,MAAM,4GAA4G,CAAC;AACpH,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,yCAAyC,EAAE,MAAM,+EAA+E,CAAC;AAK1I,OAAO,EACL,sCAAsC,EACtC,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,6DAA6D,CAAC;AACrE,OAAO,EAAE,gCAAgC,EAAE,MAAM,qEAAqE,CAAC;AACvH,OAAO,EACL,2CAA2C,EAC3C,sCAAsC,EACtC,yDAAyD,EACzD,sDAAsD,EACtD,kDAAkD,EAClD,wCAAwC,EACxC,4CAA4C,EAC5C,uCAAuC,EACvC,sCAAsC,EACtC,yCAAyC,EACzC,iCAAiC,GAClC,MAAM,4FAA4F,CAAC;AAEpG;;;;;;;;;;;;;;;;GAgBG;AAEI,IAAM,wCAAwC,GAA9C,MAAM,wCAAwC;;IAIG;IACa;IAEhD;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAEA;IAGA;IAOA;IAGA;IAGA;IAQA;IA9CX,QAAQ,CAA+D;IAE/E,YACsD,MAAqB,EACR,YAAwC,EAExF,yBAAkE,EAElE,mBAA+C,EAE/C,iBAAkD,EAElD,kBAAoD,EAEpD,iBAAkD,EAElD,aAA0C,EAE1C,WAAsC,EAEtC,qBAA0D,EAE1D,kBAA+E,EAG/E,6BAC4B,EAM5B,uBAA+D,EAG/D,yBAA4D,EAG5D,gBAA0C,EAQ1C,cAA+B;QA3CI,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAExF,8BAAyB,GAAzB,yBAAyB,CAAyC;QAElE,wBAAmB,GAAnB,mBAAmB,CAA4B;QAE/C,sBAAiB,GAAjB,iBAAiB,CAAiC;QAElD,uBAAkB,GAAlB,kBAAkB,CAAkC;QAEpD,sBAAiB,GAAjB,iBAAiB,CAAiC;QAElD,kBAAa,GAAb,aAAa,CAA6B;QAE1C,gBAAW,GAAX,WAAW,CAA2B;QAEtC,0BAAqB,GAArB,qBAAqB,CAAqC;QAE1D,uBAAkB,GAAlB,kBAAkB,CAA6D;QAG/E,kCAA6B,GAA7B,6BAA6B,CACD;QAM5B,4BAAuB,GAAvB,uBAAuB,CAAwC;QAG/D,8BAAyB,GAAzB,yBAAyB,CAAmC;QAG5D,qBAAgB,GAAhB,gBAAgB,CAA0B;QAQ1C,mBAAc,GAAd,cAAc,CAAiB;QAEhD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAC;IACtF,CAAC;IAED,4EAA4E;IAC5E,sCAAsC;IACtC,4EAA4E;IAErE,QAAQ,CAAC,MAAwB;QACtC,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,sCAAsC,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,yCAAyC,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,yCAAyC,CAAC,MAAwB;QACxE,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,qBAAqB,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,qBAAqB,CAAC,QAAQ,EAAE,CAAC;YACpE,OAAO,CAAC,+DAA+D;QACzE,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4FAA4F,KAAK,MAAM;cACrG,wGAAwG;cACxG,uGAAuG;cACvG,wGAAwG;cACxG,wGAAwG;cACxG,iGAAiG;cACjG,wGAAwG,EAC1G,EAAE,qBAAqB,EAAE,KAAK,EAAE,CACjC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAU,mCAAmC,GAAG,GAAG,CAAC;IAElE;;;;;;;;;;;;;;OAcG;IACK,+BAA+B,CAAC,MAAwB;QAC9D,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC;QAC7D,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,CAAC,0CAA0C;QACpD,CAAC;QAED,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,uBAAuB,CAAC,WAAW,CAA4B,CAAC;QACvH,IAAI,cAAc,KAAK,uBAAuB,CAAC,WAAW,EAAE,CAAC;YAC3D,OAAO,CAAC,mDAAmD;QAC7D,CAAC;QAED,MAAM,KAAK,GAAG,0CAAwC,CAAC,mCAAmC,CAAC;QAC3F,IAAI,gBAAgB,GAAG,KAAK,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,gCAAgC,gBAAgB,sCAAsC,KAAK,QAAQ;wBACnG,mBAAmB,cAAc,iEAAiE;wBAClG,GAAG,KAAK,wEAAwE,KAAK,GAAG;wBACxF,iBAAiB,KAAK,yEAAyE;wBAC/F,sBAAsB;oBACxB,gBAAgB;oBAChB,SAAS,EAAE,KAAK;oBAChB,cAAc;iBACf;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,0DAA0D;IAC1D,4EAA4E;IAE5E;;;;;;;OAOG;IACH;;;;;;;;;;OAUG;IACK,gCAAgC;QACtC,OAAO;YACL,8FAA8F;YAC9F,yCAAyC;YACzC,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE;YACjC,wFAAwF;YACxF,GAAG,EAAE,CAAC,IAAI,CAAC,sDAAsD,EAAE;SACpE,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,yCAAyC,CAAC,MAAyB;QACzE,OAAO;YACL,GAAG,EAAE,CAAC,IAAI,CAAC,iDAAiD,EAAE;YAC9D,GAAG,EAAE,CAAC,IAAI,CAAC,6CAA6C,CAAC,MAAM,CAAC;YAChE,GAAG,EAAE,CAAC,IAAI,CAAC,2CAA2C,EAAE;YACxD,GAAG,EAAE,CAAC,IAAI,CAAC,gDAAgD,EAAE;SAC9D,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACK,yCAAyC;QAC/C,OAAO;YACL,GAAG,EAAE,CAAC,IAAI,CAAC,mCAAmC,EAAE;SACjD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,+BAA+B,CAAC,MAAyB;QAC/D,OAAO;YACL,GAAG,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE;YAClC,GAAG,EAAE,CAAC,IAAI,CAAC,iBAAiB,EAAE;YAC9B,GAAG,EAAE,CAAC,IAAI,CAAC,mDAAmD,CAAC,MAAM,CAAC;YACtE,GAAG,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE;SACtC,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,UAAoD;QACxE,MAAM,SAAS,GAAmC,EAAE,CAAC;QACrD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,SAAS,CAAC,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;sGACkG;IAC3F,mCAAmC,CAAC,MAAyB;QAClE,IAAI,CAAC,iBAAiB,CAAC,kDAAkD,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC,aAAa,CAAC;YACxB,GAAG,IAAI,CAAC,gCAAgC,EAAE;YAC1C,GAAG,IAAI,CAAC,yCAAyC,CAAC,MAAM,CAAC;YACzD,GAAG,IAAI,CAAC,yCAAyC,EAAE;YACnD,GAAG,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,2CAA2C,CAAC,MAAyB;QAC1E,OAAO,IAAI,CAAC,aAAa,CAAC;YACxB,GAAG,IAAI,CAAC,gCAAgC,EAAE;YAC1C,GAAG,IAAI,CAAC,yCAAyC,CAAC,MAAM,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACI,uCAAuC;QAC5C,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,gCAAgC,EAAE,CAAC,CAAC;IACrE,CAAC;IAGD;;;;;;;;;OASG;IACI,KAAK,CAAC,8CAA8C,CAAC,MAAwB;QAClF,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,2FAA2F;oBAC7F,MAAM,EAAE,uDAAuD;iBAChE;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAGlC,CAAC;QACJ,KACE,MAAM,OAAO,IACV,IAAI,CAAC,8CAA8C,CAAC,MAAM,CAAC,EAC9D,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,6BAA6B,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;YACnF,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;gBAC3B,mEAAmE;gBACnE,kEAAkE;gBAClE,MAAM,IAAI,CAAC,6BAA6B;qBACrC,0BAA0B,CAAC,OAAO,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,eAAe,KAAK,SAAS;mBAChE,CAAC,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,EACzD,CAAC;gBACD,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,qBAAqB,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,6BAA6B;qBACrC,0BAA0B,CAAC,OAAO,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACP,OAAO,EACL,wBAAwB,OAAO,6BAA6B;8BAC1D,qCAAqC,OAAO,CAAC,QAAQ,GAAG;wBAC5D,MAAM,EAAE,gDAAgD;wBACxD,OAAO;wBACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,aAAa,EAAE,KAAK,YAAY,KAAK;4BACnC,CAAC,CAAC,KAAK,CAAC,OAAO;4BACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAClB;iBACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACI,KAAK,CAAC,qCAAqC;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,+BAA+B,EAAE,CAAC;QAC5D,IAAI,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,+BAA+B;QAC3C,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAClC,qFAAqF;YACrF,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAmC,EAAE,CAAC;QAClD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAoB,CAAC;QAE1D,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACrE,IAAI,YAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,YAAY,GAAG,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,wFAAwF;gBACxF,uFAAuF;gBACvF,oEAAoE;gBACpE,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,GAAG,EACjC,mDAAmD,MAAM,CAAC,YAAY,CAAC,MAAM,mBAAmB,CAAC,KAAK,CAAC,EAAE,EACzG,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,CACvC,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,CAAC,YAAY;gBAAE,SAAS;YAE5B,MAAM,qBAAqB,GAAG,IAAI,CAAC,iBAAiB,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC;YAE/F,MAAM,cAAc,GAAG,IAAI,CAAC,gCAAgC,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;YAClG,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC5B,2FAA2F;gBAC3F,0FAA0F;gBAC1F,SAAS;YACX,CAAC;YAED,MAAM,eAAe,GAAG,qBAAqB,EAAE,kBAAkB,CAAC;YAClE,MAAM,OAAO,GAAG,yCAAyC,CAAC,eAAe,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAClG,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC1D,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;YACpC,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,qBAAqB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,qBAAqB,EAAE,CAAC;YAC7D;;;;;;eAMG;YACH,MAAM,OAAO,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,GAAG,EACjC,cAAc,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,oEAAoE;sBACxG,IAAI,OAAO,uCAAuC,EACpD,EAAE,aAAa,EAAE,OAAO,EAAE,CAC3B,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,QAAQ,OAAO,EAAE,CAAC;gBAChB,KAAK,oBAAoB,CAAC,UAAU;oBAClC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,aAAa,CAAC,CAAC,CAAC;oBACxE,MAAM;gBACR,KAAK,oBAAoB,CAAC,OAAO;oBAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAC,CAAC;oBACvE,MAAM;gBACR,KAAK,oBAAoB,CAAC,IAAI;oBAC5B,sFAAsF;oBACtF,sFAAsF;oBACtF,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,GAAG,EACjC,cAAc,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,uDAAuD;0BAC3F,IAAI,OAAO,uFAAuF;0BAClG,iGAAiG;0BACjG,mGAAmG;0BACnG,mFAAmF;wBACrF;;;;;;;;;;;2BAWG;0BACD,CAAC,OAAO,KAAK,kBAAkB,CAAC,QAAQ;4BACxC,CAAC,CAAC,kGAAkG;kCAChG,sGAAsG;kCACtG,wGAAwG;kCACxG,+EAA+E;kCAC/E,oCAAoC;4BACxC,CAAC,CAAC,EAAE,CAAC,EACP,EAAE,aAAa,EAAE,OAAO,EAAE,CAC3B,CAAC,CAAC;oBACH,MAAM;YACV,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IACK,gCAAgC,CACtC,YAAoB,EACpB,qBAA2D;QAE3D,MAAM,UAAU,GAAG,qBAAqB,EAAE,UAAU,CAAC;QACrD,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAElC,MAAM,QAAQ,GAAG,gCAAgC,CAAC,UAAmB,CAAC,CAAC;QACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAE5C,MAAM,aAAa,GAAG,IAAI,CAAC,uBAAuB;YAChD,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,qBAAqB,CAAC,YAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;YAC3G,CAAC,CAAC,EAAE,CAAC;QAEP,OAAO,UAAU,CACf,6BAA6B,CAAC,GAAG,EACjC,aAAa,MAAM,CAAC,YAAY,CAAC,2CAA2C;cAC1E,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B;cACpF,KAAK,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,4EAA4E;cACzG,uGAAuG;cACvG,mGAAmG;cACnG,qGAAqG;cACrG,oFAAoF;cACpF,iGAAiG;cACjG,yDAAyD;cACzD,oGAAoG;cACpG,qGAAqG;cACrG,sBAAsB,EACxB,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,CACpI,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACK,KAAK,CAAC,4BAA4B,CAAC,aAAuB;QAChE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,OAAO,CAAC,UAAU,CAChB,6BAA6B,CAAC,GAAG,EACjC,cAAc,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,kEAAkE;sBACtG,sGAAsG;sBACtG,4DAA4D,EAC9D,EAAE,aAAa,EAAE,CAClB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,sBAAsB,EAAE,CAAC;YACnD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,UAAU,CAChB,6BAA6B,CAAC,GAAG,EACjC,cAAc,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,mEAAmE;sBACvG,gEAAgE;sBAChE,yBAAyB,mBAAmB,CAAC,KAAK,CAAC,KAAK;sBACxD,wGAAwG;sBACxG,yGAAyG;sBACzG,wGAAwG;sBACxG,2GAA2G;sBAC3G,sGAAsG;sBACtG,0GAA0G;sBAC1G,gCAAgC,sCAAsC,GAAG,EAC3E,EAAE,aAAa,EAAE,CAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,+FAA+F;IACvF,KAAK,CAAC,6BAA6B,CAAC,aAAuB;QACjE,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACpC,OAAO,CAAC,UAAU,CAChB,6BAA6B,CAAC,GAAG,EACjC,cAAc,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,qEAAqE;sBACzG,yGAAyG;sBACzG,uDAAuD,EACzD,EAAE,aAAa,EAAE,CAClB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,yBAAyB,CAAC,sBAAsB,EAAE,CAAC;YAC9D,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,UAAU,CAChB,6BAA6B,CAAC,GAAG,EACjC,cAAc,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,sEAAsE;sBAC1G,0DAA0D;sBAC1D,2BAA2B,mBAAmB,CAAC,KAAK,CAAC,KAAK;sBAC1D,kFAAkF;sBAClF,kGAAkG;sBAClG,0GAA0G;sBAC1G,2GAA2G;sBAC3G,0DAA0D,EAC5D,EAAE,aAAa,EAAE,CAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,sBAAsB,CAAC,MAAqC;QAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,+BAA+B,CAAC,OAAO,CAAC,CAAC;QACrG,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,+BAA+B,CAAC,KAAK,CAAC,CAAC;QAEjG,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC,QAAQ,CAAC,2CAA2C,QAAQ,CAAC,MAAM,aAAa,CAAC,CAAC;YACzF,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEnF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACP,OAAO,EACL,sDAAsD,MAAM,CAAC,MAAM,cAAc;oBACjF,aAAa;gBACf,UAAU,EAAE,MAAM,CAAC,MAAM;gBACzB,YAAY,EAAE,QAAQ,CAAC,MAAM;gBAC7B,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;aACnD;SACF,CAAC,CAAC;IACL,CAAC;IAEO,+BAA+B,CAAC,IAAkC;QACxE,MAAM,OAAO,GAAG,IAA2C,CAAC;QAC5D,MAAM,aAAa,GAAG;YACpB,WAAW;YACX,oBAAoB;YACpB,iBAAiB;YACjB,cAAc;YACd,gBAAgB;YAChB,kBAAkB;YAClB,wBAAwB;YACxB,WAAW;YACX,QAAQ;SACA,CAAC;QAEX,MAAM,eAAe,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,IAAI,OAAO,CAAC,CAAC;QACrF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACP,OAAO,EACL,2CAA2C,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBACzE,gFAAgF;oBAChF,6EAA6E;oBAC7E,sFAAsF;aACzF;SACF,CAAC,CAAC;IACL,CAAC;IAEO,+BAA+B,CAAC,MAAwB;QAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QACzC,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC;QAEvD,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAI,OAA+B,EAAE,IAAI,CAAC;YACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,SAAS;YACX,CAAC;YAED,IAAI,QAAQ,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC;gBACnC,MAAM,mBAAmB,GAAG,SAAS,CAAC,sBAAsB,EAAE,CAAC;gBAC/D,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;gBACjG,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;wBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;wBACjE,OAAO,EAAE;4BACP,OAAO,EACL,8BAA8B,QAAQ,qCAAqC;gCAC3E,gEAAgE;gCAChE,2BAA2B,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;yBAC9D;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,iBAAiB,GAAG,QAAQ,CAAC,SAAS,EAAE,oBAAoB,IAAI,EAAE,CAAC;YACzE,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;gBACvC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,aAAa,QAAQ,oCAAoC,MAAM,+CAA+C,CAC/G,CAAC;gBACJ,CAAC;gBACD,oGAAoG;gBACpG,qGAAqG;gBACrG,oGAAoG;gBACpG,4FAA4F;gBAC5F,sGAAsG;gBACtG,iGAAiG;gBACjG,gGAAgG;gBAChG,yCAAyC;gBACzC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;oBACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,aAAa,QAAQ,oCAAoC,MAAM,cAAc;wBAC3E,GAAG,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,mEAAmE;wBACrG,sCAAsC,SAAS,CAAC,sBAAsB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,wGAAwG;YACxG,sGAAsG;YACtG,wGAAwG;YACxG,qGAAqG;YACrG,uGAAuG;YACvG,uGAAuG;YACvG,kGAAkG;YAClG,uEAAuE;YACvE,IAAI,QAAQ,CAAC,SAAS,EAAE,UAAU,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnE,oFAAoF;gBACpF,oGAAoG;gBACpG,kGAAkG;gBAClG,qGAAqG;gBACrG,oGAAoG;gBACpG,mGAAmG;gBACnG,MAAM,gBAAgB,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;gBAChE,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,MAAM,CAC/C,CAAC,MAAkB,EAAE,EAAE,CACrB,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC;uBAChC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,MAAM,CAAC;uBACvC,CAAC,CAAC,gBAAgB,IAAI,MAAM,KAAK,UAAU,CAAC,SAAS,CAAC,CAC5D,CAAC;gBACF,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;wBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;wBACjE,OAAO,EAAE;4BACP,OAAO,EACL,8BAA8B,QAAQ,yCAAyC;gCAC/E,yBAAyB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B;gCAClF,sDAAsD;gCACtD,CAAC,gBAAgB,CAAC,CAAC,CAAC,2CAA2C,UAAU,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gCAC5F,0FAA0F;gCAC1F,gBAAgB,SAAS,CAAC,sBAAsB,EAAE;qCAC/C,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,IAAI,MAAM,KAAK,UAAU,CAAC,SAAS,CAAC,CAAC;qCAC1E,IAAI,CAAC,IAAI,CAAC,4DAA4D;yBAC5E;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,IAAI,QAAQ,CAAC,SAAS,EAAE,UAAU,IAAI,QAAQ,CAAC,SAAS,EAAE,yBAAyB,KAAK,CAAC,EAAE,CAAC;gBAC1F,MAAM,iBAAiB,GAAI,QAAQ,CAAC,YAAgD,EAAE,iBAAiB,CAAC;gBACxG,IAAI,iBAAiB,KAAK,UAAU,EAAE,CAAC;oBACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,aAAa,QAAQ,qJAAqJ,CAC3K,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,gBAAgB,GAAG,QAAQ,CAAC,YAAY,EAAE,IAAoC,CAAC;YACrF,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,SAAS;YACX,CAAC;YAED,MAAM,6BAA6B,GAAG,gCAAgC,CACpE,gBAAgB,EAChB,8BAA8B,CAAC,mBAAmB,CACnD,CAAC;YACF,KAAK,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC5F,MAAM,cAAc,GAAI,qBAA6C,EAAE,eAAe,EAAE,CAAC,QAAQ,CAAC,CAAC;gBACnG,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,SAAS;gBACX,CAAC;gBAED,IAAI,CAAC,6BAA6B,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;oBAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,aAAa,QAAQ,wBAAwB,gBAAgB,2DAA2D,mBAAmB,oBAAoB,QAAQ,4DAA4D,CACpO,CAAC;gBACJ,CAAC;gBACD,IAAI,6BAA6B,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;oBAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,aAAa,QAAQ,wBAAwB,gBAAgB,0BAA0B,mBAAmB,oBAAoB,QAAQ,0EAA0E,CACjN,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,sCAAsC,CAAC,MAAwB;QACrE,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QACvE,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAED,KAAK,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,gBAAgB,EAAE,CAAC;YAC5E,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,mBAAmB,CAAC,CAAC;YACzE,IAAI,CAAC,eAAe,EAAE,SAAS,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,CAAC;gBACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACP,OAAO,EACL,oBAAoB,mBAAmB,sCAAsC,mBAAmB,GAAG;4BACnG,yHAAyH;wBAC3H,mBAAmB;qBACpB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEO,8BAA8B,CAAC,MAAwB;QAC7D,KAAK,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,EAAE,CAAC;YACzG,MAAM,cAAc,GAAI,qBAA6C,EAAE,eAAe,IAAI,EAAE,CAAC;YAC7F,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAE,KAA6B,EAAE,SAAS,CAAC,CAAC;YACvH,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oBAAoB,mBAAmB,yDAAyD,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,yDAAyD,CACvM,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,6BAA6B,CAAC,MAAwB;QAC5D,MAAM,cAAc,GAAG,IAAI,GAAG,EAAoB,CAAC;QAEnD,KAAK,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,EAAE,CAAC;YACvF,MAAM,cAAc,GAAI,UAAkC,EAAE,GAAG,EAAE,cAAsC,CAAC;YACxG,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,SAAS;YACX,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;gBACpC,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;gBAC9C,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;gBAC5D,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC3B,cAAc,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAED,KAAK,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oBAAoB,MAAM,gDAAgD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,uDAAuD,CACzJ,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,+BAA+B,CAAC,MAAwB;QAC9D,MAAM,qBAAqB,GAAG,MAAM,CAAC,IAAI,EAAE,qBAAqB,IAAI,EAAE,CAAC;QACvE,MAAM,+BAA+B,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC;aAC1E,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE;YAC7B,MAAM,WAAW,GAAG,cAAqC,CAAC;YAC1D,OAAO,kCAAkC,CAAC,WAAW,CAAC;mBACjD,CAAC,CAAC,WAAW,CAAC,cAAc,IAAI,WAAW,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;QAChF,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC;QAEzC,IAAI,+BAA+B,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QAED,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,MAAM,eAAe,GAAI,OAA+B,EAAE,IAAI,EAAE,eAAe,CAAC;YAChF,IAAI,eAAe,KAAK,IAAI,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,uBAAuB,QAAQ,6EAA6E,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,qGAAqG,CAC5P,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAEnE,oBAAoB;QAC1B,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QACnE,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,QAAQ,GAA2B;YACvC,qEAAqE;YACrE,wEAAwE;YACxE,yEAAyE;YACzE,wEAAwE;YACxE,iEAAiE;YACjE,0EAA0E;YAC1E,aAAa;YACb,CAAC,mBAAmB,CAAC,aAAa,CAAC,EACjC,kGAAkG;YACpG,CAAC,mBAAmB,CAAC,eAAe,CAAC,EAAE,wBAAwB;SAChE,CAAC;QAEF,MAAM,MAAM,GAAmC,EAAE,CAAC;QAElD,KAAK,MAAM,YAAY,IAAI,gBAAgB,EAAE,CAAC;YAC5C,IAAI,UAAU,CAAC;YACf,IAAI,CAAC;gBACH,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;gBAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC;gBACpD,MAAM,QAAQ,GAAG,GAAG,YAAY,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBAEtD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC;oBAC3F,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;wBAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC;wBACzD,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,OAAO,EACrC,GAAG,QAAQ,oFAAoF,IAAI,EAAE,EACrG,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAAE,CACnE,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;wBAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;wBACzD,OAAO,CAAC,EAAE,YAAY,EAAE,IAAI,KAAK,CAAC;oBACpC,CAAC,CAAC,CAAC;oBACH,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBACjE,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,OAAO,EACrC,GAAG,QAAQ,cAAc,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC,KAAK,EAAE,EACtF,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,CAC7C,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2EAA2E;IAE3E;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACK,qBAAqB;QAC3B,MAAM,MAAM,GAAmC,EAAE,CAAC;QAClD,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QACnE,MAAM,mBAAmB,GAAa,EAAE,CAAC;QAEzC,KAAK,MAAM,YAAY,IAAI,gBAAgB,EAAE,CAAC;YAC5C,IAAI,UAAU,CAAC;YACf,IAAI,CAAC;gBACH,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;gBAC/B,IAAI,KAAK,CAAC,YAAY,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;oBACjD,mBAAmB,CAAC,IAAI,CAAC,GAAG,YAAY,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,OAAO,EACrC,GAAG,mBAAmB,CAAC,MAAM,kHAAkH,EAC/I,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,yEAAyE,EAAE,CACjH,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,uEAAuE;IAE/D,iBAAiB;QACvB,MAAM,MAAM,GAAmC,EAAE,CAAC;QAElD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE;YAAE,OAAO,MAAM,CAAC;QAE3D,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,OAAO,EACrC,yFAAyF,EACzF,EAAE,IAAI,EAAE,gFAAgF,EAAE,CAC3F,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0EAA0E;IAE1E;;;;;;OAMG;IACK,mDAAmD,CAAC,MAAyB;QACnF,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAEvB,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC5C,KAAK,MAAM,gBAAgB,IAAI,MAAM,CAAC,MAAM,CAC1C,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAC/B,EAAE,CAAC;YACF,KACE,MAAM,QAAQ,IACX,gBAAgB,CAAC,cAAc;gBAChC,EAAE,4BAA4B,IAAI,EAAE,EACtC,CAAC;gBACD,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAmC,EAAE,CAAC;QAClD,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACrD,MAAM,OAAO,GAAG,+CAA+C,CAC7D,MAAM,CAAC,iBAAiB,EACxB,QAAQ,CACT,CAAC;YACF,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC;gBAAE,SAAS;YAElC,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,IAAI,EAClC,cAAc,QAAQ,kDAAkD;kBACpE,aAAa,OAAO;qBACnB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;kBACvD,0DAA0D,EAC9D;gBACE,MAAM,EACJ,mEAAmE;gBACrE,QAAQ;gBACR,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;aACjE,CACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;OASG;IACK,uDAAuD,CAAC,MAAwB;QACtF,MAAM,QAAQ,GAA2C,EAAE,CAAC;QAC5D,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,yBAAyB,GAAG,eAAe;aAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CACzB,gCAAgC,CAC9B,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EACjC,8BAA8B,CAAC,mBAAmB,CACnD;YACD;;;;;;;;;;;;eAYG;eACA,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC7D,MAAM,KAAK,UAAU,CAAC,QAAQ;mBAC3B,MAAM,KAAK,UAAU,CAAC,UAAU;mBAChC,MAAM,KAAK,UAAU,CAAC,OAAO,CACjC,CACF;aACA,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;QAEjC,IAAI,yBAAyB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,yBAAyB,CAAC,CAAC;YAC7D,MAAM,qCAAqC,GAAG,MAAM,CAAC,MAAM,CACzD,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAC/B;iBACE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC;iBAC9C,MAAM,CACL,CAAC,MAAM,EAAwC,EAAE,CAC/C,MAAM,KAAK,SAAS;mBACjB,MAAM,CAAC,4BAA4B,CAAC,IAAI,CACzC,CAAC,QAAQ,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC9C,CACJ,CAAC;YACJ,MAAM,kCAAkC,GACtC,qCAAqC,CAAC,IAAI,CACxC,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,sBAAsB,CAAC,UAAU,CAC7D,CAAC;YACJ,MAAM,iCAAiC,GACrC,qCAAqC,CAAC,IAAI,CACxC,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,sBAAsB,CAAC,UAAU,CAC7D,CAAC;YACJ,QAAQ,CAAC,IAAI,CAAC,wCAAwC,CAAC;gBACrD,uEAAuE;gBACvE,wEAAwE;gBACxE,kBAAkB,EAAE,IAAI;gBACxB,sCAAsC,EACpC,kCAAkC;aACrC,CAAC,CAAC,CAAC;YACJ,IAAI,iCAAiC,EAAE,CAAC;gBACtC,QAAQ,CAAC,IAAI,CACX,sDAAsD,EAAE,CACzD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,oEAAoE;QACpE,uEAAuE;QACvE,yEAAyE;QACzE,2EAA2E;QAC3E,sEAAsE;QACtE,qEAAqE;QACrE,4EAA4E;QAC5E,uEAAuE;QACvE,gBAAgB;QAChB,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3D,QAAQ,CAAC,IAAI,CACX,kDAAkD,CAAC;gBACjD,kBAAkB,EAChB,6CAA6C,CAAC,MAAM,CAAC;aACxD,CAAC,EACF,yDAAyD,EAAE,CAC5D,CAAC;QACJ,CAAC;QAED,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,CAC5C,MAAM,CAAC,IAAI,EAAE,qBAAqB,IAAI,EAAE,CACzC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,kCAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnE,IAAI,wBAAwB,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACtD,MAAM,wBAAwB,GAAG,eAAe,CAAC,IAAI,CACnD,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CACjB,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,QAAQ,CAClD,UAAU,CAAC,eAAe,CAC3B;mBACE,gCAAgC,CACjC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EACjC,8BAA8B,CAAC,gBAAgB,CAChD,CACJ,CAAC;YACF,IAAI,wBAAwB,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3D,QAAQ,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAED,MAAM,6BAA6B,GACjC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CACtC,gCAAgC,CAC9B,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EACjC,8BAA8B,CAAC,kBAAkB,CAClD,CACF;eACE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,CACnD,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,gBAAgB,EAAE,OAAO,KAAK,IAAI,CAC9D,CAAC;QACJ,IAAI,6BAA6B,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CACX,sCAAsC,EACtC,2CAA2C,CAC5C,CAAC;YACF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3D,QAAQ,CAAC,IAAI,CACX,uCAAuC,EACvC,4CAA4C,CAC7C,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;OAOG;IACH;;;;;;;;;;;;;OAaG;IACK,uCAAuC;QAC7C,MAAM,QAAQ,GAA2C,EAAE,CAAC;QAE5D,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACrE,MAAM,iBAAiB,GAAG,IAAI,CAAC,qCAAqC,CAAC,YAAY,CAAC,CAAC;YACnF,IAAI,iBAAiB,KAAK,8BAA8B,CAAC,IAAI,EAAE,CAAC;gBAC9D,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,qCAAqC,CAAC;gBAClD,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC;gBAClC,iBAAiB;aAClB,CAAC,CAAC,CAAC;QACN,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,qCAAqC,CAC3C,YAAiF;QAEjF,IAAI,UAAU,CAAC;QACf,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;YAChF,4EAA4E;YAC5E,OAAO,8BAA8B,CAAC,IAAI,CAAC;QAC7C,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,8BAA8B,CAAC,IAAI,CAAC;QAC7C,CAAC;QAED,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,CAC1C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,KAAK,oBAAoB,CAAC,YAAY,CAC/F,CAAC;QAEF,OAAO,oBAAoB;YACzB,CAAC,CAAC,8BAA8B,CAAC,sBAAsB;YACvD,CAAC,CAAC,8BAA8B,CAAC,QAAQ,CAAC;IAC9C,CAAC;IAED;;;;;;;;;OASG;IACK,8CAA8C,CAAC,MAAyB;QAC9E,MAAM,QAAQ,GAAG;YACf,GAAG,CAAC,MAAM;gBACR,CAAC,CAAC,IAAI,CAAC,uDAAuD,CAAC,MAAM,CAAC;gBACtE,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QAEF,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACrE,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;YAErF,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;gBAClD,MAAM,QAAQ,GACZ,sDAAsD,CACpD,SAAS,EACT,IAAI,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAChE,CAAC;gBACJ,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,SAAS;gBACX,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;OAQG;IACK,6CAA6C,CAAC,MAAyB;QAC7E,MAAM,4BAA4B,GAAG,IAAI,CAAC,8CAA8C,CAAC,MAAM,CAAC,CAAC;QACjG,MAAM,qBAAqB,GAAG,IAAI,CAAC,uCAAuC,EAAE,CAAC;QAC7E,MAAM,QAAQ,GAAG,CAAC,GAAG,4BAA4B,EAAE,GAAG,qBAAqB,CAAC,CAAC;QAC7E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC;YACxC;;;;;eAKG;YACH,IAAI,4BAA4B,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9C,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,OAAO,CAAC,UAAU,CAChB,6BAA6B,CAAC,SAAS,EACvC,mEAAmE;sBAC/D,sDAAsD,EAC1D;oBACE,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;oBACvD,MAAM,EAAE,uDAAuD;iBAChE,CACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAmC,EAAE,CAAC;QAClD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,6BAA6B,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;YACnF,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;gBAC1B,SAAS;YACX,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,iCAAiC,CAAC;gBAC5D,CAAC,CAAC,6BAA6B,CAAC,SAAS;gBACzC,CAAC,CAAC,6BAA6B,CAAC,IAAI,EACtC,yBAAyB,OAAO,CAAC,QAAQ,mBAAmB;kBACxD,eAAe,UAAU,CAAC,MAAM,kCAAkC;kBAClE,sDAAsD,EAC1D;gBACE,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,mBAAmB,EAAE,UAAU,CAAC,MAAM;gBACtC,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;gBACzD,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;gBACjD,gCAAgC,EAC9B,UAAU,CAAC,gCAAgC;gBAC7C,eAAe,EAAE,UAAU,CAAC,eAAe;gBAC3C,eAAe,EAAE,UAAU,CAAC,eAAe;aAC5C,CACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;OASG;IACK,iDAAiD;QAEvD,MAAM,MAAM,GAAmC,EAAE,CAAC;QAElD,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACrE,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;YACrF,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;gBAClD,MAAM,QAAQ,GACZ,sDAAsD,CACpD,SAAS,EACT,IAAI,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAChE,CAAC;gBACJ,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC;oBAClC,SAAS;gBACX,CAAC;gBAED,MAAM,YAAY,GAAG,0CAAwC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAC3F,IAAI,QAAQ,CAAC,6BAA6B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtD,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,SAAS,EACvC,oCAAoC,YAAY,eAAe;0BAC3D,6DAA6D;0BAC7D,2CAA2C,EAC/C;wBACE,YAAY;wBACZ,yBAAyB,EACvB,QAAQ,CAAC,eAAe,KAAK,SAAS;wBACxC,+BAA+B,EAC7B,QAAQ,CAAC,+BAA+B;wBAC1C,6BAA6B,EAC3B,QAAQ,CAAC,6BAA6B;qBACzC,CACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;IACK,mCAAmC;QACzC,MAAM,MAAM,GAAmC,EAAE,CAAC;QAElD,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACrE,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;YACrF,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;gBAClD,IACE,CAAC,kBAAkB,CAAC,SAAS,CAAC;uBAC3B,CAAC,8BAA8B,CAAC,SAAS,CAAC,EAC7C,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,MAAM,YAAY,GAAG,0CAAwC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAC3F,MAAM,kBAAkB,GAAG,CAAC,SAAS,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,MAAM,CACnE,CAAC,YAAY,EAAE,EAAE,CACf,YAAY,CAAC,OAAO,KAAK,2BAA2B,CAAC,KAAK,CAC7D,CAAC;gBACF,uFAAuF;gBACvF,gFAAgF;gBAChF,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;gBACzD,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC;gBAE3D,KAAK,MAAM,YAAY,IAAI,kBAAkB,EAAE,CAAC;oBAC9C,MAAM,WAAW,GAAG,qCAAqC,CACvD;wBACE,kBAAkB,EAAE,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC;wBACxD,mBAAmB,EAAE,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC;wBAC1D,GAAG,CAAC,YAAY,IAAI,SAAS,IAAI,SAAS,CAAC,UAAU;4BACnD,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;4BAC9C,CAAC,CAAC,EAAE,CAAC;qBACR,EACD,YAAY,CACb,CAAC;oBAEF,IAAI,CAAC;wBACH,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,0BAA0B,CAAC,WAAW,CAAC,CAAC;wBAC5F,MAAM,qBAAqB,GACzB,gBAAgB,CAAC,UAAU,CAAC,IAAI;+BAC7B,iBAAiB,CAAC,aAAa,CAAC;wBACrC,IAAI,qBAAqB,KAAK,iBAAiB,CAAC,aAAa,EAAE,CAAC;4BAC9D,MAAM,CAAC,IAAI,CAAC,QAAQ,CAClB,6BAA6B,CAAC,SAAS,EACvC,6BAA6B,WAAW,QAAQ;kCAC5C,cAAc,YAAY,gBAAgB;kCAC1C,GAAG,qBAAqB,oBAAoB;kCAC5C,qBAAqB,iBAAiB,CAAC,aAAa,GAAG,EAC3D;gCACE,YAAY;gCACZ,WAAW;gCACX,cAAc,EAAE,gBAAgB,CAAC,cAAc;gCAC/C,qBAAqB;gCACrB,oBAAoB,EAAE,iBAAiB,CAAC,aAAa;6BACtD,CACF,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IACE,CAAC,mBAAmB,CAAC,KAAK,CAAC;+BACxB,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,aAAa,EACzC,CAAC;4BACD,MAAM,KAAK,CAAC;wBACd,CAAC;wBACD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAClB,6BAA6B,CAAC,SAAS,EACvC,GAAG,aAAa,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,WAAW,kBAAkB;8BACvE,IAAI,WAAW,oBAAoB,YAAY,iCAAiC;8BAChF,0CAA0C;8BAC1C,CAAC,aAAa;gCACd,CAAC,CAAC,sFAAsF;gCACxF,CAAC,CAAC,oFAAoF,CAAC;4BACzF,oFAAoF;4BACpF,0EAA0E;8BACxE,sCAAsC,WAAW,IAAI;8BACrD,8EAA8E,EAClF,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,CAC1D,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACK,2CAA2C;QACjD,MAAM,MAAM,GAAmC,EAAE,CAAC;QAElD,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACrE,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;YACrF,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;gBAClD,MAAM,OAAO,GAAG,8CAA8C,CAC5D,SAAS,EACT,IAAI,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAChE,CAAC;gBACF,MAAM,YAAY,GAAG,0CAAwC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAE3F,IACE,OAAO,CAAC,QAAQ,KAAK,uCAAuC,CAAC,aAAa;uBACvE,CAAC,OAAO,CAAC,eAAe,EAC3B,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,SAAS,EACvC,cAAc,YAAY,wDAAwD;0BAC9E,0EAA0E;0BAC1E,iFAAiF;0BACjF,4EAA4E;0BAC5E,4EAA4E,EAChF;wBACE,YAAY;wBACZ,MAAM,EAAE,OAAO,CAAC,mBAAmB;wBACnC,uBAAuB,EAAE,OAAO,CAAC,uBAAuB;wBACxD,SAAS,EAAE,SAAS,CAAC,SAAS;wBAC9B,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;qBACvD,CACF,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBAED,IACE,OAAO,CAAC,QAAQ,KAAK,uCAAuC,CAAC,aAAa;uBACvE,OAAO,CAAC,eAAe,EAC1B,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,SAAS,EACvC,cAAc,YAAY,mDAAmD;0BACzE,+EAA+E;0BAC/E,gEAAgE,EACpE;wBACE,YAAY;wBACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,qBAAqB,EAAE,OAAO,CAAC,eAAe,CAAC,MAAM;wBACrD,0BAA0B,EAAE,OAAO,CAAC,eAAe,CAAC,WAAW;qBAChE,CACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,gDAAgD;QACtD,MAAM,MAAM,GAAmC,EAAE,CAAC;QAElD,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACrE,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;YACrF,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;gBAClD,MAAM,YAAY,GAAoD,EAAE,CAAC;gBAEzE,MAAM,gBAAgB,GACpB,SACD,CAAC,mBAAmB,CAAC;gBACtB,IAAI,gBAAgB,EAAE,MAAM,EAAE,CAAC;oBAC7B,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAC/E,CAAC;gBAED,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC3F,IAAI,YAAY,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;wBAC7C,YAAY,CAAC,IAAI,CAAC;4BAChB,MAAM,EAAE,0BAA0B,YAAY,CAAC,UAAU,GAAG;4BAC5D,MAAM,EAAE,YAAY,CAAC,mBAAmB;yBACzC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAExC,MAAM,YAAY,GAAG,0CAAwC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAC3F,MAAM,eAAe,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;gBAE1D,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;oBACvC,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;oBACxF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;wBAAE,SAAS;oBAEzC,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,SAAS,EACvC,cAAc,YAAY,iCAAiC;0BACvD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,WAAW,CAAC,MAAM,QAAQ;0BAClE,GAAG,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,sCAAsC,GAAG;0BAChH,mFAAmF;0BACnF,+EAA+E;0BAC/E,6EAA6E;0BAC7E,gFAAgF;0BAChF,kBAAkB,EACtB;wBACE,YAAY;wBACZ,iBAAiB,EAAE,WAAW,CAAC,MAAM;wBACrC,aAAa;wBACb,eAAe,EAAE,CAAC,GAAG,eAAe,CAAC;qBACtC,CACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,sDAAsD;QAC5D,MAAM,MAAM,GAAmC,EAAE,CAAC;QAElD,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACrE,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;YACrF,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;gBAClD,MAAM,OAAO,GAAG,8CAA8C,CAAC,SAAS,CAAC,CAAC;gBAC1E,IACE,OAAO,CAAC,OAAO;wBACX,uCAAuC,CAAC,iCAAiC,EAC7E,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,MAAM,YAAY,GAAG,0CAAwC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAC3F,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,SAAS,EACvC,cAAc,YAAY,6DAA6D;sBACnF,qFAAqF;sBACrF,+EAA+E;sBAC/E,kFAAkF;sBAClF,gFAAgF;sBAChF,0EAA0E,EAC9E;oBACE,YAAY;oBACZ,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;oBACtD,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;iBACvD,CACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,iBAAiB,CAAC,SAIhC;QACC,OAAO;YACL,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC;YACpC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC;YACrC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IAED,2EAA2E;IAE3E;;;;;;;;OAQG;IACK,wBAAwB;QAC9B,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,uBAAuB,CAAC,WAAW,CAA4B,CAAC;QACvH,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;QAClE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAmC,EAAE,CAAC;QAElD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,wBAAwB,CAAC,MAAM,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClG,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAA0C,KAAK,CAAC,MAAM,CAAC;YACzE,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,CAAC;YAC7C,MAAM,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CAAC;YAC7D,MAAM,QAAQ,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;YAE3E,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAAC,WAAW,EAAE,sCAAsC,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBACjI,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,MAAM,EACpC,UAAU,KAAK,CAAC,GAAG,gBAAgB,WAAW,wCAAwC,EACtF,QAAQ,CACT,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,yBAAyB,CAAC,6BAA6B,CAAC,WAAW,CAAC,CAAC;YAC7F,MAAM,gBAAgB,GAAG,IAAI,CAAC,yBAAyB,CAAC,sCAAsC,CAC5F,WAAW,EACX,mBAAmB,CACpB,CAAC;YACF,IAAI,CAAC,UAAU,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACrC,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,MAAM,EACpC,UAAU,KAAK,CAAC,GAAG,yCAAyC,mBAAmB,aAAa,EAC5F,QAAQ,CACT,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC3E,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,MAAM,EACpC,UAAU,KAAK,CAAC,GAAG,gDAAgD,YAAY,CAAC,YAAY,GAAG,EAC/F,QAAQ,CACT,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,MAAM,EACpC,UAAU,KAAK,CAAC,GAAG,wDAAwD,YAAY,CAAC,KAAK,GAAG,EAChG,EAAE,GAAG,QAAQ,EAAE,eAAe,EAAE,UAAU,CAAC,eAAe,EAAE,CAC7D,CAAC,CAAC;YACL,CAAC;YAED,qEAAqE;YACrE,wEAAwE;YACxE,oDAAoD;YACpD,IAAI,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC9E,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,MAAM,EACpC,UAAU,KAAK,CAAC,GAAG,uEAAuE,cAAc,GAAG,EAC3G,EAAE,GAAG,QAAQ,EAAE,8BAA8B,EAAE,gBAAgB,CAAC,8BAA8B,EAAE,CACjG,CAAC,CAAC;YACL,CAAC;YAED,IACE,gBAAgB,CAAC,6BAA6B,EAAE,MAAM;mBACnD,CAAC,CAAC,qBAAqB,IAAI,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,EAC9G,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,MAAM,EACpC,UAAU,KAAK,CAAC,GAAG,oEAAoE,qBAAqB,IAAI,SAAS,GAAG,EAC5H,EAAE,GAAG,QAAQ,EAAE,6BAA6B,EAAE,gBAAgB,CAAC,6BAA6B,EAAE,CAC/F,CAAC,CAAC;YACL,CAAC;YAED,IACE,gBAAgB,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB;mBAChF,CAAC,IAAI,CAAC,yBAAyB,CAAC,4CAA4C,CAAC,WAAW,EAAE,mBAAmB,CAAC,EACjH,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,UAAU,CACpB,6BAA6B,CAAC,MAAM,EACpC,UAAU,KAAK,CAAC,GAAG,qFAAqF,EACxG,QAAQ,CACT,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;;AAn+DU,wCAAwC;IADpD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;IAE3D,WAAA,MAAM,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,CAAA;IAErD,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAElD,WAAA,MAAM,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAA;IAEpD,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAE5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAA;IAE/C,WAAA,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;IAE7C,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAEhD,YAAA,MAAM,CAAC,kBAAkB,CAAC,oDAAoD,CAAC,CAAA;IAE/E,YAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAC/D,YAAA,QAAQ,EAAE,CAAA;IAMV,YAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,YAAA,QAAQ,EAAE,CAAA;IAEV,YAAA,MAAM,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAA;IACpD,YAAA,QAAQ,EAAE,CAAA;IAEV,YAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,YAAA,QAAQ,EAAE,CAAA;IAOV,YAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IACzC,YAAA,QAAQ,EAAE,CAAA;qCA1CiD,aAAa;QACM,0BAA0B;QAE7D,uCAAuC;QAE7C,0BAA0B;QAE5B,+BAA+B;QAE9B,gCAAgC;QAEjC,+BAA+B;QAEnC,2BAA2B;QAE7B,yBAAyB;GAnB9C,wCAAwC,CAo+DpD","sourcesContent":["import { inject, injectable, optional } from 'inversify';\nimport {\n AuthMethod,\n AuthUtils,\n CoreUserNotificationChannel,\n EmailTemplateType,\n ErrorCustomMessageReference,\n ErrorType,\n FlowsActors_Agent_Status,\n OrganizationNameSource,\n RegistrationAcquisitionChannel,\n RegistrationMode,\n isWildoBackendError,\n isRegistrationAcquisitionAllowed,\n findOrganizationTypeRegistrationCreationMatches,\n ClientInstanceIdScope,\n type AppConfiguration_Shared_Auth,\n type ConfigurationValidationIssue,\n type ConfigurationValidationResult,\n ConfigurationValidationDomain,\n ConfigurationValidationSeverity,\n PersistenceAdapter,\n buildValidationResult,\n isApiCallOperation,\n isApiCallWithCallbackOperation,\n issueError,\n issueWarning,\n isCodingAgentConfiguration,\n type FlowsActors_Agent_CodingConfiguration,\n} from '@wildo-ai/saas-models';\nimport {\n APPLICATION_ENVIRONMENT,\n AgentClientProtocol_AuthMode,\n ExternalProvider_ExchangeProtocol_Kind,\n type LLMProvider_OperationKey,\n} from '@wildo-ai/external-connectors-models';\nimport { FileGenerationSource, FileStorageAccepted } from '@wildo-ai/zod-decorators';\nimport type {\n AppConfiguration,\n} from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\nimport { FlowsActorsRegistryService } from '~wildo-backend-lib/flows-actors/services/flows-actors-registry.service';\nimport { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport { FileFieldDetectionBackendService } from '~wildo-backend-lib/files/services/file-field-detection.backend.service';\nimport { FileStorageRouterBackendService } from '~wildo-backend-lib/files/storage/file-storage-router.backend.service';\nimport { ClamAVScannerBackendService } from '~wildo-backend-lib/files/scanning/clamav-scanner.backend.service';\nimport { YaraScannerBackendService } from '~wildo-backend-lib/files/scanning/yara-scanner.backend.service';\nimport { isEnabledSocialOAuth2LoginProvider } from '~wildo-backend-lib/security/authentications/utils/social-oauth2-purpose.backend.utils';\nimport {\n isPublicInvitationPasswordCredentialReachable,\n} from '~wildo-backend-lib/security/authentications/services/utils/auth-policy-resolution.backend.utils';\nimport type {\n EmailTemplateRegistryBackendService,\n} from '~wildo-backend-lib/notifications/email/services/email-template-registry.backend.service';\nimport {\n buildUserNotificationEmailTemplateRef,\n} from '~wildo-backend-lib/notifications/services/notifications-dispatcher.backend.service';\nimport type {\n ResourceOperationCustomImplementationRegistryBackendService,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation-registry.backend.service';\nimport type {\n ResourcePersistenceUnitOfWorkBackendService,\n ResourcePersistenceUnitOfWorkRequest,\n} from '~wildo-backend-lib/databases/services/resource-persistence-unit-of-work.backend.service';\nimport {\n createResourceWritePersistenceRequest,\n resolveResourceOperationTransactionPersistenceContract,\n ResourceWriteFileParticipation,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-transaction-persistence.backend.utils';\nimport {\n ResourceOperationImplementationCoverage,\n ResourceOperationRequestContractBreadth,\n getPersistedFieldNames,\n resolveResourceOperationImplementationCoverage,\n resolveResourceOperationRequestContractBreadth,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-implementation-coverage.backend.utils';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { resolvePersistenceAdapterForConfiguration } from '~wildo-backend-lib/databases/models/resolve-persistence-adapter.backend.utils';\nimport type { PostgreSQLDatabaseBackendService } from '~wildo-backend-lib/databases/services/postgresql-database.backend.service';\nimport type { MongoDBService } from '~wildo-backend-lib/databases/services/mongodb.service';\nimport type { RagSourceFieldDetectionBackendService } from '~wildo-backend-lib/files/services/rag-source-field-detection.backend.service';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport {\n MONGODB_RAG_CHUNK_STORE_TRACKING_ISSUE,\n RagChunkStoreHosting,\n resolveRagChunkStoreHosting,\n} from '~wildo-backend-lib/rag/models/rag-chunk-store.backend.types';\nimport { collectResourceRetentionPolicies } from '~wildo-backend-lib/resources/utils/resource-retention.backend.utils';\nimport {\n APPLICATION_EXISTING_USER_LINK_UNIT_OF_WORK,\n APPLICATION_USER_CREATION_UNIT_OF_WORK,\n createAuthenticatedInvitationAcceptancePersistenceRequest,\n createDeferredOrganizationOnboardingPersistenceRequest,\n createPublicInvitationAcceptancePersistenceRequest,\n createSelfRegistrationPersistenceRequest,\n ORGANIZATION_EXISTING_USER_LINK_UNIT_OF_WORK,\n ORGANIZATION_USER_CREATION_UNIT_OF_WORK,\n SOCIAL_EXISTING_USER_LINK_UNIT_OF_WORK,\n SOCIAL_INVITATION_ACCEPTANCE_UNIT_OF_WORK,\n SOCIAL_USER_CREATION_UNIT_OF_WORK,\n} from '~wildo-backend-lib/security/authentications/models/identity-persistence-boundaries.backend';\n\n/*\n Startup-only governance rules for application configuration.\n \n Two phases:\n \n 1. `validate(config)` — pre-registry checks on the raw AppConfiguration\n * (auth consistency, frontend service bindings, etc.)\n \n 2. `validateInitializedRuntimeContracts()` — post-registry cross-checks\n * that need the fully resolved registry (z_file() vs storage providers,\n * CLI-runtime agents, etc.). Uses the collector pattern: each validator\n * returns `ConfigurationValidationIssue[]`, the runner consolidates,\n * logs warnings, and throws on errors.\n \n Frontend will adopt the same `ConfigurationValidationIssue` contract\n * for its own post-registry checks (feature gating, launcher coherence, etc.).\n /\n@injectable()\nexport class ApplicationStartupConfigValidatorService {\n private logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService)\n private readonly externalProvidersRegistry: ExternalProvidersRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.FlowsActorsRegistryService)\n private readonly flowsActorsRegistry: FlowsActorsRegistryService,\n @inject(SAAS_SERVICE_TYPES.ResourceRegistryService)\n private readonly resourcesRegistry: ResourcesRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.FileFieldDetectionService)\n private readonly fileFieldDetection: FileFieldDetectionBackendService,\n @inject(SAAS_SERVICE_TYPES.FileStorageRouter)\n private readonly fileStorageRouter: FileStorageRouterBackendService,\n @inject(SAAS_SERVICE_TYPES.ClamAVScannerService)\n private readonly clamavScanner: ClamAVScannerBackendService,\n @inject(SAAS_SERVICE_TYPES.YaraScannerService)\n private readonly yaraScanner: YaraScannerBackendService,\n @inject(SAAS_SERVICE_TYPES.EmailTemplateRegistry)\n private readonly emailTemplateRegistry: EmailTemplateRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.ResourceOperationCustomImplementationRegistryService)\n private readonly customImplRegistry: ResourceOperationCustomImplementationRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.ResourcePersistenceUnitOfWorkService)\n @optional()\n private readonly resourcePersistenceUnitOfWork?:\n ResourcePersistenceUnitOfWorkBackendService,\n // RAG capability probe dependencies (appended LAST + optional: this constructor is invoked\n // POSITIONALLY in tests). Absent detection ⇒ the probe cannot see `.ragSource()` declarations\n // and no-ops — acceptable only because the real container always binds it.\n @inject(SAAS_SERVICE_TYPES.RagSourceFieldDetectionService)\n @optional()\n private readonly ragSourceFieldDetection?: RagSourceFieldDetectionBackendService,\n @inject(SAAS_SERVICE_TYPES.PostgreSQLDatabaseService)\n @optional()\n private readonly postgreSQLDatabaseService?: PostgreSQLDatabaseBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService)\n @optional()\n private readonly appConfigService?: AppConfigurationService,\n /\n The MongoDB half of the same probe (Phase 6). Appended LAST for the reason the block above\n * states: this constructor is invoked POSITIONALLY in tests, so a parameter inserted beside its\n * PostgreSQL sibling would silently shift every later argument into the wrong slot.\n /\n @inject(SAAS_SERVICE_TYPES.MongoDBService)\n @optional()\n private readonly mongoDBService?: MongoDBService,\n ) {\n this.logDebug = this.logger.debugByType('ApplicationStartupConfigValidatorService');\n }\n\n // ─────────────────────────────────────────────────────────────────────────\n // Phase 1: pre-registry config checks\n // ─────────────────────────────────────────────────────────────────────────\n\n public validate(config: AppConfiguration): void {\n this.assertNoRemovedGlobalAuthFields(config.auth);\n this.validateFrontendServiceRuntimeBindings(config);\n this.validateUserTypeAuthConsistency(config);\n this.validateAuditTrailArchivalFloor(config);\n this.warnOnMultipleDefaultUserTypes(config);\n this.warnOnDuplicateClaimedDomains(config);\n this.warnOnBroadAutoLinkSocialOAuth2(config);\n this.warnOnClientInstanceIdentificationEnabled(config);\n }\n\n /\n Warn when the application has opted into CLIENT-INSTALL identification\n * (`compliance.clientInstanceIdScope !== DISABLED`), naming the obligations that opt-in creates.\n \n Why a startup warning and not silence. `clientInstanceId` is a pseudonymous identifier stored on the\n * user's terminal equipment, so selecting `SESSION`/`PERSISTENT` engages ePrivacy Art 5(3) and creates\n * paperwork the framework cannot do on the application's behalf — a recorded legitimate-interest\n * assessment, and a decision about whether an erasure request scrubs the identifier from retained audit\n * evidence. Those are documented as owed, but a documented obligation with no mechanical firing pin is one\n * forgotten session away from drift, which is exactly the failure mode\n * `.claude/rules/capability-catalog-integration.md` names. This is that firing pin: the application cannot\n * turn the capability on without the reason it must act appearing in its own boot log.\n \n WARN, never ERROR: opting in is a legitimate, deliberate choice, and refusing to boot over an\n * app-authored privacy posture would be the framework overriding the controller's decision.\n \n assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — surfaces the compliance obligations attached to\n * collecting a device-stored pseudonymous identifier at the moment the collection is enabled.\n /\n private warnOnClientInstanceIdentificationEnabled(config: AppConfiguration): void {\n const scope = config.compliance?.clientInstanceIdScope;\n if (scope === undefined \|\| scope === ClientInstanceIdScope.DISABLED) {\n return; // The default posture — nothing is collected, nothing is owed.\n }\n\n this.logger.warn(\n `[compliance] Client-install identification is ENABLED (compliance.clientInstanceIdScope='${scope}'). `\n + 'Every request may now carry an `x-client-instance-id` that is recorded on audit rows and forwarded to '\n + 'the SIEM — a pseudonymous identifier under GDPR Art 4(5), stored on the user\\'s device. Confirm with '\n + 'counsel that (1) a legitimate-interest assessment is recorded for this processing, (2) the storage is '\n + 'lawful in your jurisdiction (ePrivacy Art 5(3); consent may be required, and PERSISTENT is the harder '\n + 'case), (3) your privacy notice discloses it, and (4) your erasure procedure states whether the '\n + 'identifier is scrubbed from retained audit evidence. Set clientInstanceIdScope to DISABLED to opt out.',\n { clientInstanceIdScope: scope },\n );\n }\n\n /\n Production floor for the audit-log archival horizon\n * (`auditTrail.archiveAfterDays`). Audit records must remain in the primary\n * store for at least this many days before they become archival-eligible in\n * a staging/production environment. Mirrors the SSO `auditConfig.retentionDays`\n * default (365) as the compliance minimum.\n /\n private static readonly AUDIT_ARCHIVE_PRODUCTION_FLOOR_DAYS = 365;\n\n /\n Enforce the production floor on `auditTrail.archiveAfterDays`.\n \n The schema-level `.min(1)` is the absolute floor; this raises it to\n * {@link AUDIT_ARCHIVE_PRODUCTION_FLOOR_DAYS} outside development. It lives\n * here — a RUNTIME validator — rather than in a Zod `.superRefine()` on the\n * shared schema, because the environment gate reads `process.env.APPLICATION_ENV`,\n * a runtime signal a pure, environment-agnostic shared schema must not touch\n * (mirrors the env-gated `.superRefine` in `define-infra-env-config.ts`, which\n * only works there because THAT schema carries the environment as a field).\n \n Development is exempt (dev convenience — mirrors the infra `!isLocalEnvironmentId`\n * gate); staging + production enforce the floor. Archival is opt-in, so an\n * unset `archiveAfterDays` is always allowed (nothing to floor).\n /\n private validateAuditTrailArchivalFloor(config: AppConfiguration): void {\n const archiveAfterDays = config.auditTrail?.archiveAfterDays;\n if (archiveAfterDays === undefined) {\n return; // Archival opt-out — no horizon to floor.\n }\n\n const applicationEnv = (process.env.APPLICATION_ENV ?? APPLICATION_ENVIRONMENT.DEVELOPMENT) as APPLICATION_ENVIRONMENT;\n if (applicationEnv === APPLICATION_ENVIRONMENT.DEVELOPMENT) {\n return; // Development is exempt from the compliance floor.\n }\n\n const floor = ApplicationStartupConfigValidatorService.AUDIT_ARCHIVE_PRODUCTION_FLOOR_DAYS;\n if (archiveAfterDays < floor) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `auditTrail.archiveAfterDays (${archiveAfterDays}) is below the production floor of ${floor} days ` +\n `in environment '${applicationEnv}'. Audit records must remain in the primary store for at least ` +\n `${floor} days before archival in staging/production. Set archiveAfterDays >= ${floor} ` +\n `(values below ${floor} are permitted only in development), or omit archiveAfterDays entirely ` +\n `to disable archival.`,\n archiveAfterDays,\n floorDays: floor,\n applicationEnv,\n },\n });\n }\n }\n\n // ─────────────────────────────────────────────────────────────────────────\n // Phase 2: post-registry cross-checks (collector pattern)\n // ─────────────────────────────────────────────────────────────────────────\n\n /\n Run all post-registry validators, collect issues, then report.\n \n To add a new cross-check:\n * 1. Write a private method returning `ConfigurationValidationIssue[]`\n * 2. Add its call to the `validators` array below\n * 3. The runner handles logging warnings and throwing on errors\n /\n /\n TIER 1 — DECLARATION-ONLY. Safe for ANY runtime that owns a resource registry.\n \n These read the resource DECLARATIONS and the infrastructure they name, and assert nothing about\n * whether the runtime implements those resources. A scheduler that registers core resources purely\n * so the controllers registry can initialize passes these, because it declares nothing it does not\n * honour.\n \n Classified by what each collector actually READS, not by its name — see\n * `collectImplementationBackedContractIssues` for why that distinction is load-bearing.\n /\n private collectDeclarationContractIssues(): (() => ConfigurationValidationIssue[])[] {\n return [\n // resources registry (file fields) + fileStorageRouter — do declared `z_file()` fields have a\n // provider that can actually store them?\n () => this.collectStorageIssues(),\n // resources registry only — is any operation's request contract wider than it declares?\n () => this.collectOverbroadResourceOperationRequestContractIssues(),\n ];\n }\n\n /\n TIER 2 — OPERATION-IMPLEMENTATION-BACKED. Only for a runtime that EXECUTES the operations it\n * registers.\n \n Every collector here cross-references the resource registry against the machinery that RUNS an\n * operation — `customImplRegistry` and the persistence unit of work. A runtime that registers\n * resources without implementing their operations fails all of them, and is not wrong to do so.\n \n Measured 2026-08-14: wiring these into `platform-crontabs-batches-manager` — a SCHEDULER that\n * registers the core resource set so `controllersRegistryService.initialize()` works, and\n * implements none of it — broke its boot with 83 `[LIFECYCLE] Operation 'organizations.…'` errors\n * from `collectUnimplementedResourceOperationIssues` alone. That is what proved a two-way split by\n * collector NAME was insufficient.\n /\n private collectImplementationBackedContractIssues(config?: AppConfiguration): (() => ConfigurationValidationIssue[])[] {\n return [\n () => this.collectResourceOperationTransactionContractIssues(),\n () => this.collectPersistenceBoundaryCompatibilityIssues(config),\n () => this.collectUnimplementedResourceOperationIssues(),\n () => this.collectResourceOperationAuthoritativeFieldIssues(),\n ];\n }\n\n /\n TIER 2N — NOTIFICATION-DELIVERY-BACKED. Only for a runtime that DELIVERS the notifications the\n * operations it registers declare.\n \n Split out of tier 2 on 2026-08-14 because \"implements the resources it registers\" turned out to\n * be TWO capabilities, not one, and the platform services hold exactly one of them. `platform-\n * apps-manager` and `platform-module-registry` DO execute core resource operations — they own\n * custom implementations and persistence — so tier 2 is correct for them. Neither DELIVERS an\n * application's user notifications: they register `organizationMembers` because the registry needs\n * the core set, and they ship none of its templates. Cross-referencing the resource registry\n * against `emailTemplateRegistry` therefore fails them on templates they are not the subject of.\n \n Measured: both crash-looped at boot on the same two ERRORs — the token-backed\n * `email.organizationMembers.create.user-self` and `…resend.user-self` — which are the only two\n * token-backed operations in the engine, hence the only two that escalate a missing template from\n * WARNING to ERROR (see `collectOperationEmailTemplateIssues`, where severity follows\n * `tokenGeneration`). The warning flood on the non-token-backed operations was harmless and is\n * what made the two fatal rows easy to miss in the log.\n \n Rejected alternative: moving this collector down to tier 3 (application FEATURES). Tier 3 reads\n * scanners, vector stores and provider config — optional product features. A declared operation\n * email is neither optional nor a feature: it is part of the operation's contract, and it must\n * stay adjacent to the tier that validates the rest of that contract for every runtime that does\n * own delivery.\n /\n private collectNotificationDeliveryContractIssues(): (() => ConfigurationValidationIssue[])[] {\n return [\n () => this.collectOperationEmailTemplateIssues(),\n ];\n }\n\n /\n TIER 3 — APPLICATION FEATURES. Only for an application runtime.\n \n Each validates an optional product feature a platform service does not own: virus scanning,\n * YARA rules, organization-registration policy, CLI runtime agents. They read\n * scanners, provider registries and config — not the resource contract.\n \n NOTE: the Weaviate-era RAG collector (`collectRAGIssues`) that used to run in this tier was\n * deleted with the Weaviate lane on 2026-08-26. Its fail-closed successor is\n * {@link validateInitializedRagStoreCapability} — ASYNC (it executes a probe on the live\n * database), so it runs as its own startup step beside the transaction-readiness proof rather\n * than inside these sync collector tiers.\n /\n private collectApplicationFeatureIssues(config?: AppConfiguration): (() => ConfigurationValidationIssue[])[] {\n return [\n () => this.collectScanningIssues(),\n () => this.collectYaraIssues(),\n () => this.collectOrganizationRegistrationCreationPolicyIssues(config),\n () => this.collectCodingAgentIssues(),\n ];\n }\n\n private runCollectors(collectors: (() => ConfigurationValidationIssue[])[]): ConfigurationValidationResult {\n const allIssues: ConfigurationValidationIssue[] = [];\n for (const collector of collectors) {\n allIssues.push(...collector());\n }\n const result = buildValidationResult(allIssues);\n this.reportValidationResult(result);\n return result;\n }\n\n /* Application runtimes: every tier. Unchanged behaviour — an application both executes its\n * operations and delivers their notifications, so it is the one runtime that owns all of them. /\n public validateInitializedRuntimeContracts(config?: AppConfiguration): ConfigurationValidationResult {\n this.resourcesRegistry.validateInitializedPersistenceAdapterConfiguration();\n return this.runCollectors([\n ...this.collectDeclarationContractIssues(),\n ...this.collectImplementationBackedContractIssues(config),\n ...this.collectNotificationDeliveryContractIssues(),\n ...this.collectApplicationFeatureIssues(config),\n ]);\n }\n\n /\n Platform services that IMPLEMENT the resources they register — the module registry, apps-manager.\n \n Tiers 1+2, and deliberately NOT tier 2N. Exists because `resolveApplicationConfigForStartup`\n * returns `undefined` unconditionally for `isPlatformApplication: true`, so the shared startup\n * skips post-registry validation entirely for every platform service — including\n * `collectStorageIssues()`, which is exactly the check that cross-references `z_file()` resources\n * against configured providers.\n \n A platform service EXECUTES core resource operations but DELIVERS none of their user\n * notifications, so `collectNotificationDeliveryContractIssues()` is excluded — see its JSDoc for\n * the boot failure that established the split.\n /\n public validateInitializedPlatformRuntimeContracts(config?: AppConfiguration): ConfigurationValidationResult {\n return this.runCollectors([\n ...this.collectDeclarationContractIssues(),\n ...this.collectImplementationBackedContractIssues(config),\n ]);\n }\n\n /\n Runtimes that REGISTER resources without implementing them — a scheduler, a companion, any\n * service initializing a registry only so another registry can start.\n \n Tier 1 only. Gives such a runtime the storage and declaration-shape guarantees while asserting\n * nothing about implementations it was never meant to provide.\n /\n public validateInitializedDeclarationContracts(): ConfigurationValidationResult {\n return this.runCollectors(this.collectDeclarationContractIssues());\n }\n\n\n /\n Prove that every adapter selected by an authored transaction-requiring\n * boundary can actually start, execute, and commit a native transaction.\n \n Adapter compatibility alone cannot distinguish a MongoDB replica set from\n * a standalone server. The adapter-owned probe executes a read-only command\n * inside the transaction; an empty callback would not start a MongoDB server\n * transaction. Probes are deduplicated to one request per selected adapter.\n * No controller is initialized until they succeed.\n /\n public async validateInitializedRuntimeTransactionReadiness(config: AppConfiguration): Promise<void> {\n if (!this.resourcePersistenceUnitOfWork) {\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n 'ResourcePersistenceUnitOfWorkService is unavailable during initialized runtime validation',\n reason: 'resource_persistence_unit_of_work_service_unavailable',\n },\n },\n );\n }\n\n const firstRequestByAdapter = new Map<\n string,\n ResourcePersistenceUnitOfWorkRequest\n >();\n for (\n const request\n of this.collectTransactionReadinessPersistenceRequests(config)\n ) {\n const assessment = this.resourcePersistenceUnitOfWork.assessCompatibility(request);\n if (!assessment.compatible) {\n // Preserve one canonical compatibility failure instead of silently\n // omitting an authored transaction boundary from readiness proof.\n await this.resourcePersistenceUnitOfWork\n .verifyTransactionReadiness(request);\n }\n if (assessment.compatible && assessment.selectedAdapter !== undefined\n && !firstRequestByAdapter.has(assessment.selectedAdapter)\n ) {\n firstRequestByAdapter.set(assessment.selectedAdapter, request);\n }\n }\n\n for (const [adapter, request] of firstRequestByAdapter) {\n try {\n await this.resourcePersistenceUnitOfWork\n .verifyTransactionReadiness(request);\n } catch (error) {\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Persistence adapter '${adapter}' cannot commit the native `\n + `transaction required by boundary '${request.boundary}'`,\n reason: 'persistence_transaction_readiness_probe_failed',\n adapter,\n boundary: request.boundary,\n originalError: error instanceof Error\n ? error.message\n : String(error),\n },\n },\n );\n }\n }\n }\n\n /\n RAG store capability probe — the fail-closed successor of the Weaviate-era `collectRAGIssues`\n * (plan `.claude/plans/resource-rag-capability.md`, M6 carry-over).\n \n For every registered resource that declares `.ragSource()` fields, two refusals:\n \n - row retention × RAG source → ERROR, before any store question is asked. See\n * {@link collectRagSourceRetentionRefusal}: DL3 enforced at RESOURCE level, which is the tier\n * the risk lives on (the `.ttl()` field and the `.ragSource()` field are ordinarily different\n * fields of the same row, so the decorator-level companion refusal cannot see the pair).\n \n …then prove the datastore its chunks would live in (D1: the resource's OWN persistence adapter)\n * can actually hold them:\n \n - PostgreSQL → EXECUTE a pgvector expression (`select '[1]'::vector`) on the live\n * connection. Executed rather than inferred from catalogs or config, per the toolchain rule\n * (\"verify a toolchain claim by executing it\") — a `pg_extension` row proves installation, not\n * that the type works on THIS connection's search path.\n * - MongoDB → ERROR unconditionally: the Mongo chunk store is gated on the 8.2 + mongot infra\n * bump ({@link MONGODB_RAG_CHUNK_STORE_TRACKING_ISSUE}).\n \n Fail-closed ERROR (never a warning), because the failure mode is not a degraded feature: an\n * application that has already WRITTEN chunk rows and then lost its store cannot honour an erasure\n * — the chunks hold copies of subject text that no removal seam can reach. Refusing to boot is the\n * only posture under which that dead-end cannot silently accumulate.\n \n An application with NO `.ragSource()` fields probes nothing and passes — the probe must never\n * force a database connection an application does not use.\n \n Async and separate from the sync collector tiers for the same reason as\n * {@link validateInitializedRuntimeTransactionReadiness}: it talks to a live database.\n \n assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — refuses a configuration whose derived\n * subject-text copies would be unreachable by the erasure seams.\n /\n public async validateInitializedRagStoreCapability(): Promise<void> {\n const issues = await this.collectRagStoreCapabilityIssues();\n this.reportValidationResult(buildValidationResult(issues));\n }\n\n private async collectRagStoreCapabilityIssues(): Promise<ConfigurationValidationIssue[]> {\n if (!this.ragSourceFieldDetection) {\n // No detection service bound (minimal harness) — nothing can be asserted either way.\n return [];\n }\n\n const issues: ConfigurationValidationIssue[] = [];\n const ragResourcesByAdapter = new Map<string, string[]>();\n\n for (const resourceType of this.resourcesRegistry.getResourceTypes()) {\n let hasRagFields: boolean;\n try {\n hasRagFields = this.ragSourceFieldDetection.hasRagSourceFields(resourceType);\n } catch (error) {\n // Detection itself refusing (incompatible/unsupported `.ragSource()` declarations) is a\n // configuration defect in its own right — surface it as this probe's ERROR rather than\n // letting an unrelated later consumer be the first to trip over it.\n issues.push(issueError(\n ConfigurationValidationDomain.RAG,\n `RAG source-field detection failed for resource '${String(resourceType)}': ${describeCaughtError(error)}`,\n { resourceType: String(resourceType) },\n ));\n continue;\n }\n if (!hasRagFields) continue;\n\n const resourceConfiguration = this.resourcesRegistry.tryGetResourceConfiguration(resourceType);\n\n const retentionIssue = this.collectRagSourceRetentionRefusal(resourceType, resourceConfiguration);\n if (retentionIssue) {\n issues.push(retentionIssue);\n // Already refused — do not also probe its store. The application will not boot either way,\n // and one precise diagnostic beats two that name the same resource for different reasons.\n continue;\n }\n\n const declaredAdapter = resourceConfiguration?.persistenceAdapter;\n const adapter = resolvePersistenceAdapterForConfiguration(declaredAdapter, this.appConfigService);\n const existing = ragResourcesByAdapter.get(adapter) ?? [];\n existing.push(String(resourceType));\n ragResourcesByAdapter.set(adapter, existing);\n }\n\n if (ragResourcesByAdapter.size === 0) {\n return issues;\n }\n\n for (const [adapter, resourceTypes] of ragResourcesByAdapter) {\n /\n Classified through the SAME total map the routing store uses\n * (`RAG_CHUNK_STORE_HOSTING_BY_ADAPTER`), so the boot refusal and the runtime refusal cannot\n * disagree about which adapters can hold chunks — and so a NEW adapter is a compile error at\n * that map rather than a silent arrival in the \"unrecognised\" branch here, where it would be\n * reported as a typo instead of as a capability decision.\n /\n const hosting = resolveRagChunkStoreHosting(adapter);\n if (hosting === undefined) {\n issues.push(issueError(\n ConfigurationValidationDomain.RAG,\n `Resources [${resourceTypes.join(', ')}] declare .ragSource() fields on unrecognised persistence adapter `\n + `'${adapter}' — no RAG chunk store exists for it.`,\n { resourceTypes, adapter },\n ));\n continue;\n }\n switch (hosting) {\n case RagChunkStoreHosting.POSTGRESQL:\n issues.push(...await this.probePostgresVectorCapability(resourceTypes));\n break;\n case RagChunkStoreHosting.MONGODB:\n issues.push(...await this.probeMongodbSearchCapability(resourceTypes));\n break;\n case RagChunkStoreHosting.NONE:\n // A DECLARED adapter with no chunk store — there is nothing to PROBE, and that is the\n // point: the refusal is about the adapter's nature, not about a reachable dependency.\n issues.push(issueError(\n ConfigurationValidationDomain.RAG,\n `Resources [${resourceTypes.join(', ')}] declare .ragSource() fields on persistence adapter `\n + `'${adapter}', which cannot host chunk rows. A chunk store holds COPIES of field text that every `\n + 'removal seam must be able to delete, and this adapter owns no local rows to delete — so chunks '\n + 'derived from these resources would be unreachable by every erasure path. Remove the .ragSource() '\n + 'declarations, or move these resources to a PostgreSQL- or MongoDB-backed adapter.'\n /\n * HTTP_API earns one extra sentence, and it is guidance rather than a second refusal.\n \n The generic text above says what is wrong; for a READ-THROUGH resource it stops one step short\n * of what to do instead, and \"move it to a PostgreSQL-backed adapter\" is not the answer — the\n * whole point of the resource is that its rows live elsewhere. RAG over remote content is designed\n * to ride a locally MATERIALIZED copy, where every existing RAG mechanism applies unchanged.\n \n Appended to the ONE typed refusal rather than restored as a separate `if (adapter ===\n * HTTP_API)` branch: the adapter→hosting map is the single place that decision belongs, and a\n * second branch beside it would be a second answer to the same question.\n /\n + (adapter === PersistenceAdapter.HTTP_API\n ? ' This resource is read-through: it has no local write path for ingestion, no local rows for the '\n + 'reconciliation sweep to enumerate, and no local rows for the erasure seams to key chunk removal to. '\n + 'RAG over remote content arrives with partial-resource coverage, where the declared field is a locally '\n + 'MATERIALIZED copy of the remote field and the ordinary RAG machinery applies '\n + '(partial-resource-coverage paper).'\n : ''),\n { resourceTypes, adapter },\n ));\n break;\n }\n }\n\n return issues;\n }\n\n /\n DL3 at the tier the risk actually lives on: a resource that declares BOTH a `.ttl()` field and\n * a `.ragSource()` field is refused, whichever fields they are.\n \n ## Why the field-level decorator refusal was not enough (corrected 2026-08-27)\n \n `RAG_SOURCE_REFUSED_COMPANIONS` in `zod.module-override.ts` refuses `.ttl()` and `.ragSource()`\n * on the SAME field, and four documents recorded that as closing DL3. It does not, because the\n * two decorators essentially cannot meet there: `.ttl()`'s applicable types are\n * `['ZodDate','ZodOptional']` and `.ragSource()`'s are `['ZodString','ZodOptional','ZodNullable','ZodDefault']`.\n * The reachable configuration is the ORDINARY one —\n \n expiresAt: z.date().ttl({ expireAfterSeconds: 0 }),\n * notes: z.string().ragSource(),\n \n — two different fields of one resource, which the field-level check cannot see. *A Mongo TTL\n index deletes the WHOLE DOCUMENT** (`hasTtl` → `expires` in the Mongoose convertor) with zero\n * application code running: no hook, no cascade, no post-commit effect, so the row's chunks —\n * copies of its text — survive it permanently. The risk is scoped to the ROW; the refusal was\n * scoped to the FIELD.\n \n On PostgreSQL `.ttl()` renders only a `comment on column` and the framework retention sweep\n * performs the deletes, which DOES call the chunk-removal seam. So today's exposure is\n * MongoDB-only and is additionally masked by the Mongo arm below refusing every Mongo-backed\n * `.ragSource()` resource pending {@link MONGODB_RAG_CHUNK_STORE_TRACKING_ISSUE}. That masking is\n * exactly why this is worth fixing now: it opens the day the Mongo adapter lands, in a change\n * whose author will have no reason to re-derive this reasoning.\n \n ## Why THIS enforcement point, and what was rejected\n \n Chosen: the startup capability probe. It is the earliest point that can ask BOTH existing\n * authorities — `collectRagSourceFieldSchemaMetadata` (through the detection service, cached) and\n * `collectResourceRetentionPolicies` — rather than re-deriving either, and it already walks every\n * registered resource. Its refusal is fail-closed at boot, before any process serves traffic or\n * runs a batch.\n \n Rejected: `validateDecoratorCombinations` in the resource-configuration factory\n * (`resources-config.shared.factory.ts`), which is genuinely earlier — module load — and is where\n * this repository's other resource-level decorator refusals live. It cannot reach either\n * authority: both live in `saas-backend-lib`, and the factory is in `saas-models`, which\n * `saas-backend-lib` depends ON. A factory check would therefore need a THIRD derivation of\n * \"which fields declare a RAG source\", and the only cheap form available there — `getRagSourceConfig`\n * over the top-level `getZodObjectShape`, the shape every neighbouring check in that function\n * uses — is TOP-LEVEL ONLY. It would miss a nested declaration (`profile.bio`), i.e. under-detect,\n * i.e. fail OPEN in a refusal. Moving the walker into `saas-models` would fix that and is the\n * right long-term shape, but it is a public-entrypoint reshape touching every RAG consumer, not\n * a fix to this finding.\n \n The field-level refusal is KEPT — it is cheap, correct, and catches the one configuration this\n * check would only report at boot rather than at authoring time.\n \n assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — refuses a configuration whose derived\n * subject-text copies could outlive the row they were derived from, unreachably.\n /\n private collectRagSourceRetentionRefusal(\n resourceType: string,\n resourceConfiguration: { mainSchema?: unknown } \| undefined,\n ): ConfigurationValidationIssue \| undefined {\n const mainSchema = resourceConfiguration?.mainSchema;\n if (!mainSchema) return undefined;\n\n const policies = collectResourceRetentionPolicies(mainSchema as never);\n if (policies.length === 0) return undefined;\n\n const ragFieldNames = this.ragSourceFieldDetection\n ? this.ragSourceFieldDetection.detectRagSourceFields(resourceType as never).map((field) => field.fieldName)\n : [];\n\n return issueError(\n ConfigurationValidationDomain.RAG,\n `Resource '${String(resourceType)}' declares BOTH row retention (.ttl() on `\n + `[${policies.map((policy) => policy.fieldName).join(', ')}]) and RAG source fields `\n + `([${ragFieldNames.join(', ')}]). Refused (plan resource-rag-capability DL3): a store that expires rows `\n + 'NATIVELY — MongoDB\\'s TTL monitor deletes the whole document — runs no application code, so no hook, '\n + 'cascade or post-commit effect can remove the derived chunks, and they keep serving copies of the '\n + 'expired row\\'s text forever. Note the refusal is at RESOURCE level because the risk is: the .ttl() '\n + 'field and the .ragSource() field are ordinarily DIFFERENT fields of the same row. '\n + 'Remove the .ragSource() declarations, or drop the .ttl() and let the framework retention sweep '\n + 'perform the deletes (it calls the chunk-removal seam). '\n + 'THE DOOR: this refusal lifts when the backstop reconciliation sweep reconciles chunk sets against '\n + 'vanished parent rows, at which point natively-expired rows become a bounded serving window instead '\n + 'of a permanent leak.',\n { resourceType: String(resourceType), retentionFields: policies.map((policy) => policy.fieldName), ragSourceFields: ragFieldNames },\n );\n }\n\n /\n EXECUTE a search-index command on the live MongoDB connection — the `mongot` half of the RAG\n * store capability probe, and the sibling of {@link probePostgresVectorCapability}.\n \n ## Reachability is PROVEN, never inferred, and never dispatched on a brand\n \n `MongoDBService.verifySearchCapability` runs `$listSearchIndexes`, which `mongod` PROXIES to\n * `mongot`. A version string cannot answer this question: a MongoDB 8.2 server with search NOT\n * configured reports 8.2 truthfully and throws `SearchNotEnabled`; a configured-but-down `mongot`\n * reports the same version and fails as a connection error; and a Mongo-compatible managed service\n * reports a MongoDB version it did not implement. This is the toolchain baseline's rule (\"verify a\n * claim by executing it\") applied to a second process rather than to a compiler.\n \n `aws-documentdb` — the documented managed Mongo-compatible backing service — cannot run\n * `mongot` and therefore fails this probe NATURALLY, on the same command, for the same reason a\n * mis-configured self-managed deployment does. There is deliberately no provider-name check: that\n * would be a second, hand-maintained list of which products have search, wrong the day one of them\n * gains it and silently wrong the day a self-managed deployment loses its sidecar.\n \n Fail-closed ERROR for the same reason as the PostgreSQL arm: an application that has already\n * WRITTEN chunk documents and then lost its store cannot honour an erasure, because the chunks\n * hold copies of subject text that no removal seam can reach.\n \n assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — refuses a configuration whose derived\n * subject-text copies would be unreachable by the erasure seams.\n /\n private async probeMongodbSearchCapability(resourceTypes: string[]): Promise<ConfigurationValidationIssue[]> {\n if (!this.mongoDBService) {\n return [issueError(\n ConfigurationValidationDomain.RAG,\n `Resources [${resourceTypes.join(', ')}] declare .ragSource() fields on MongoDB-backed storage, but no `\n + 'MongoDB database service is bound in this container — their chunk store would be unreachable, which '\n + 'is an erasure dead-end the moment a chunk document exists.',\n { resourceTypes },\n )];\n }\n try {\n await this.mongoDBService.verifySearchCapability();\n return [];\n } catch (error) {\n return [issueError(\n ConfigurationValidationDomain.RAG,\n `Resources [${resourceTypes.join(', ')}] declare .ragSource() fields on MongoDB-backed storage, but the `\n + 'MongoDB Search capability probe FAILED on the live connection '\n + `($listSearchIndexes → ${describeCaughtError(error)}). `\n + 'RAG on MongoDB is served by native $vectorSearch/$search, which require MongoDB 8.2 or later WITH the '\n + 'separate `mongot` process configured and reachable (it mirrors the collection through change streams). '\n + 'Configure a search-capable deployment, move these resources to PostgreSQL, or remove the .ragSource() '\n + `declarations. Note a Mongo-COMPATIBLE managed service (aws-documentdb) cannot run mongot and will always `\n + `fail this probe. Fail-closed: if this application has already written chunk documents, a store that `\n + `stopped answering is an erasure dead-end, so booting without it would let unreachable copies of subject `\n + `text accumulate. Background: ${MONGODB_RAG_CHUNK_STORE_TRACKING_ISSUE}.`,\n { resourceTypes },\n )];\n }\n }\n\n /* EXECUTE a pgvector expression on the live PostgreSQL connection (see the probe's JSDoc). /\n private async probePostgresVectorCapability(resourceTypes: string[]): Promise<ConfigurationValidationIssue[]> {\n if (!this.postgreSQLDatabaseService) {\n return [issueError(\n ConfigurationValidationDomain.RAG,\n `Resources [${resourceTypes.join(', ')}] declare .ragSource() fields on PostgreSQL-backed storage, but no `\n + 'PostgreSQL database service is bound in this container — their chunk store would be unreachable, which '\n + 'is an erasure dead-end the moment a chunk row exists.',\n { resourceTypes },\n )];\n }\n try {\n await this.postgreSQLDatabaseService.verifyVectorCapability();\n return [];\n } catch (error) {\n return [issueError(\n ConfigurationValidationDomain.RAG,\n `Resources [${resourceTypes.join(', ')}] declare .ragSource() fields on PostgreSQL-backed storage, but the `\n + 'pgvector capability probe FAILED on the live connection '\n + `(select '[1]'::vector → ${describeCaughtError(error)}). `\n + 'The application database must have the pgvector extension available and created '\n + '(`CREATE EXTENSION IF NOT EXISTS vector` — provisioned per application database by the platform '\n + 'PostgreSQL manager; the baseline image is pgvector/pgvector:pg17). Fail-closed: if this application has '\n + 'already written chunk rows, a store that stopped answering is an erasure dead-end, so booting without it '\n + 'would let unreachable copies of subject text accumulate.',\n { resourceTypes },\n )];\n }\n }\n\n /\n Log warnings and throw a consolidated error if any ERROR-severity\n * issues were collected.\n /\n private reportValidationResult(result: ConfigurationValidationResult): void {\n const warnings = result.issues.filter((i) => i.severity === ConfigurationValidationSeverity.WARNING);\n const errors = result.issues.filter((i) => i.severity === ConfigurationValidationSeverity.ERROR);\n\n for (const warning of warnings) {\n this.logger.warn(`[${warning.domain}] ${warning.message}`, warning.context);\n }\n\n if (errors.length === 0) {\n if (warnings.length > 0) {\n this.logDebug(`Post-registry validation completed with ${warnings.length} warning(s)`);\n }\n return;\n }\n\n const errorMessages = errors.map((e) => ` [${e.domain}] ${e.message}`).join('\\n');\n\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Post-registry configuration validation failed with ${errors.length} error(s):\\n` +\n errorMessages,\n errorCount: errors.length,\n warningCount: warnings.length,\n domains: [...new Set(errors.map((e) => e.domain))],\n },\n });\n }\n\n private assertNoRemovedGlobalAuthFields(auth: AppConfiguration_Shared_Auth): void {\n const rawAuth = auth as Record<string, unknown> \| undefined;\n const removedFields = [\n 'mfaPolicy',\n 'authMethodsEnabled',\n 'autoLinkByEmail',\n 'registration',\n 'passwordPolicy',\n 'methodManagement',\n 'sessionDurationMinutes',\n 'magicLink',\n 'smsOtp',\n ] as const;\n\n const foundDeprecated = removedFields.filter((field) => rawAuth && field in rawAuth);\n if (foundDeprecated.length === 0) {\n return;\n }\n\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Deprecated auth config fields detected: ${foundDeprecated.join(', ')}. ` +\n `These fields were removed in W6.8. Migrate them to userTypes[typeName].auth. ` +\n `(see entity-identity-config.shared.schemas.ts → UserTypeAuthPolicySchema). ` +\n `Remove them from your auth config and configure per-user-type auth policies instead.`,\n },\n });\n }\n\n private validateUserTypeAuthConsistency(config: AppConfiguration): void {\n const userTypes = config.userTypes ?? {};\n const frontendServices = config.frontendServices ?? {};\n\n for (const [typeName, typeDef] of Object.entries(userTypes)) {\n const typeAuth = (typeDef as Record<string, any>)?.auth;\n if (!typeAuth) {\n continue;\n }\n\n if (typeAuth.mfaPolicy?.requireMFA) {\n const secondFactorMethods = AuthUtils.getSecondFactorMethods();\n const hasEnabled = secondFactorMethods.some((method) => !!typeAuth.authMethodsEnabled?.[method]);\n if (!hasEnabled) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Config deadlock: userTypes.${typeName}.auth.mfaPolicy.requireMFA is true ` +\n `but no second-factor method is enabled in authMethodsEnabled. ` +\n `Enable at least one of: ${secondFactorMethods.join(', ')}`,\n },\n });\n }\n }\n\n const acceptableMethods = typeAuth.mfaPolicy?.acceptableMFAMethods ?? [];\n for (const method of acceptableMethods) {\n if (!typeAuth.authMethodsEnabled?.[method]) {\n this.logger.warn(\n `userTypes.${typeName}: acceptableMFAMethods includes '${method}' but it is not enabled in authMethodsEnabled`,\n );\n }\n // S0.1: a method that is INTRINSICALLY first-factor-only can never be a second factor, whatever the\n // app config says. `AUTH_METHOD_FACTOR_MAP` pins SSO redirect flows (ORG_SAML / ORG_OPENID_CONNECT /\n // EXTERNAL_OAUTH2) plus PASSWORD and MAGIC_LINK as FIRST_ONLY — SSO deliberately so, because an IdP\n // redirect is not an MFA ceremony (B-SEC-1). Listing one here is silently INERT at runtime:\n // `_getAvailableSecondFactorMethods` derives its candidates from `AuthUtils.getSecondFactorMethods()`\n // and uses `acceptableMFAMethods` only as a NARROWING filter, so such an entry can never add the\n // method — it can only subtract real ones. Warn so the author learns that instead of trusting a\n // second factor that was never in force.\n if (!AuthUtils.canBeSecondFactor(method)) {\n this.logger.warn(\n `userTypes.${typeName}: acceptableMFAMethods includes '${method}', which is ` +\n `${AuthUtils.getFactorType(method)} and can NEVER act as a second factor — the entry has no effect. ` +\n `Second-factor-capable methods are: ${AuthUtils.getSecondFactorMethods().join(', ')}.`,\n );\n }\n }\n\n // S0.1 (deadlock variant): the block above throws when requireMFA is set and NO second-factor method is\n // enabled at all. This is the same deadlock reached a different way — second factors ARE enabled, but\n // `acceptableMFAMethods` filters every one of them out (e.g. it lists only SSO methods, or only methods\n // left disabled). The runtime then resolves an EMPTY `usableSecondFactorMethods` while `requiresMFA`\n // stays true, and `_isAuthenticationComplete` refuses to complete a first-factor-only session forever:\n // every user of this type is locked out, and the MFA challenge screen can only render its `no_methods`\n // error. Fail at STARTUP with the same CONFIGURATION severity as the sibling deadlock rather than\n // letting it surface as an unexplained per-user lockout in production.\n if (typeAuth.mfaPolicy?.requireMFA && acceptableMethods.length > 0) {\n // The predicate must mirror `_resolveUsableMfaMethods` EXACTLY, including its final\n // `requireStrongMFA` step, or this validation gives false assurance. That step drops EMAIL_OTP from\n // the usable set, so `requireStrongMFA` + `acceptableMFAMethods:[EMAIL_OTP]` resolves to an empty\n // usable list at runtime even though EMAIL_OTP is both second-factor-capable AND enabled — the exact\n // lockout this check exists to prevent, reached by a third route. (EMAIL_OTP is the only method the\n // runtime strips; if that ever generalises to a \"weak methods\" set, generalise this alongside it.)\n const requireStrongMFA = !!typeAuth.mfaPolicy?.requireStrongMFA;\n const usableAcceptable = acceptableMethods.filter(\n (method: AuthMethod) =>\n AuthUtils.canBeSecondFactor(method)\n && !!typeAuth.authMethodsEnabled?.[method]\n && !(requireStrongMFA && method === AuthMethod.EMAIL_OTP),\n );\n if (usableAcceptable.length === 0) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Config deadlock: userTypes.${typeName}.auth.mfaPolicy.requireMFA is true but ` +\n `acceptableMFAMethods (${acceptableMethods.join(', ')}) leaves no method that is ` +\n `second-factor-capable, enabled in authMethodsEnabled` +\n (requireStrongMFA ? `, and strong (requireStrongMFA excludes ${AuthMethod.EMAIL_OTP})` : '') +\n `. Every user of this type would be unable to complete MFA. Include at least one enabled ` +\n `method from: ${AuthUtils.getSecondFactorMethods()\n .filter((method) => !(requireStrongMFA && method === AuthMethod.EMAIL_OTP))\n .join(', ')}, or drop acceptableMFAMethods to accept all enabled ones.`,\n },\n });\n }\n }\n\n if (typeAuth.mfaPolicy?.requireMFA && typeAuth.mfaPolicy?.enrollmentGracePeriodDays === 0) {\n const emailVerification = (typeAuth.registration as Record<string, any> \| undefined)?.emailVerification;\n if (emailVerification === 'deferred') {\n this.logger.warn(\n `userTypes.${typeName}: enrollmentGracePeriodDays=0 with emailVerification=deferred — users must enroll MFA immediately on deferred-verified accounts (valid but poor UX)`,\n );\n }\n }\n\n const registrationMode = typeAuth.registration?.mode as RegistrationMode \| undefined;\n if (!registrationMode) {\n continue;\n }\n\n const allowsSelfServiceRegistration = isRegistrationAcquisitionAllowed(\n registrationMode,\n RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n );\n for (const [frontendServiceName, frontendServiceConfig] of Object.entries(frontendServices)) {\n const userManagement = (frontendServiceConfig as Record<string, any>)?.usersManagement?.[typeName];\n if (!userManagement) {\n continue;\n }\n\n if (!allowsSelfServiceRegistration && userManagement.register) {\n this.logger.warn(\n `userTypes.${typeName}: registration.mode='${registrationMode}' blocks self-service registration but frontendServices.${frontendServiceName}.usersManagement.${typeName}.register=true — registration will be blocked at API level`,\n );\n }\n if (allowsSelfServiceRegistration && !userManagement.register) {\n this.logger.warn(\n `userTypes.${typeName}: registration.mode='${registrationMode}' but frontendServices.${frontendServiceName}.usersManagement.${typeName}.register=false — registration will be blocked at frontend service level`,\n );\n }\n }\n }\n }\n\n private validateFrontendServiceRuntimeBindings(config: AppConfiguration): void {\n const frontendServices = Object.entries(config.frontendServices ?? {});\n if (frontendServices.length === 0) {\n return;\n }\n\n for (const [frontendServiceName, frontendServiceConfig] of frontendServices) {\n const runtimeEndpoint = config.runtime?.endPoints?.[frontendServiceName];\n if (!runtimeEndpoint?.publicUrl \|\| !runtimeEndpoint?.internalUrl) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `frontendServices.${frontendServiceName} is declared but runtime.endPoints.${frontendServiceName} ` +\n `is missing a matching publicUrl/internalUrl binding. Runtime topology must materialize every declared frontend service.`,\n frontendServiceName,\n },\n });\n }\n }\n }\n\n private warnOnMultipleDefaultUserTypes(config: AppConfiguration): void {\n for (const [frontendServiceName, frontendServiceConfig] of Object.entries(config.frontendServices ?? {})) {\n const userManagement = (frontendServiceConfig as Record<string, any>)?.usersManagement ?? {};\n const defaultEntries = Object.entries(userManagement).filter(([, value]) => (value as Record<string, any>)?.isDefault);\n if (defaultEntries.length > 1) {\n this.logger.warn(\n `frontendServices.${frontendServiceName}: multiple isDefault:true entries in usersManagement: ${defaultEntries.map(([key]) => key).join(', ')}. Only the first will be used for user-type resolution.`,\n );\n }\n }\n }\n\n private warnOnDuplicateClaimedDomains(config: AppConfiguration): void {\n const domainClaimMap = new Map<string, string[]>();\n\n for (const [orgTypeName, orgTypeDef] of Object.entries(config.organizationTypes ?? {})) {\n const claimedDomains = (orgTypeDef as Record<string, any>)?.sso?.claimedDomains as string[] \| undefined;\n if (!claimedDomains) {\n continue;\n }\n\n for (const domain of claimedDomains) {\n const normalizedDomain = domain.toLowerCase();\n const orgTypes = domainClaimMap.get(normalizedDomain) ?? [];\n orgTypes.push(orgTypeName);\n domainClaimMap.set(normalizedDomain, orgTypes);\n }\n }\n\n for (const [domain, orgTypeNames] of domainClaimMap.entries()) {\n if (orgTypeNames.length > 1) {\n this.logger.warn(\n `E-VER-9: Domain \"${domain}\" is claimed by multiple organization types: ${orgTypeNames.join(', ')}. Domain-to-org resolution will be non-deterministic.`,\n );\n }\n }\n }\n\n private warnOnBroadAutoLinkSocialOAuth2(config: AppConfiguration): void {\n const socialOAuth2Providers = config.auth?.socialOAuth2Providers ?? {};\n const socialProvidersWithEmptyDomains = Object.entries(socialOAuth2Providers)\n .filter(([, providerConfig]) => {\n const typedConfig = providerConfig as Record<string, any>;\n return isEnabledSocialOAuth2LoginProvider(typedConfig)\n && (!typedConfig.allowedDomains \|\| typedConfig.allowedDomains.length === 0);\n })\n .map(([providerName]) => providerName);\n\n if (socialProvidersWithEmptyDomains.length === 0) {\n return;\n }\n\n for (const [typeName, typeDef] of Object.entries(config.userTypes ?? {})) {\n const autoLinkByEmail = (typeDef as Record<string, any>)?.auth?.autoLinkByEmail;\n if (autoLinkByEmail === true \|\| autoLinkByEmail === undefined) {\n this.logger.warn(\n `E-VER-11: userTypes.${typeName}.auth.autoLinkByEmail is true (or defaulted) and social OAuth2 providers [${socialProvidersWithEmptyDomains.join(', ')}] have empty allowedDomains. Any verified email from these IdPs can auto-link to existing accounts.`,\n );\n }\n }\n }\n\n // ─── Storage ────────────────────────────────────────────────────────────\n\n private collectStorageIssues(): ConfigurationValidationIssue[] {\n const allResourceTypes = this.resourcesRegistry.getResourceTypes();\n if (allResourceTypes.length === 0) {\n return [];\n }\n\n const envHints: Record<string, string> = {\n // Managed storage no longer takes a credential from env — it fetches\n // short-lived, prefix-confined sessions from apps-manager — so the hint\n // names the endpoint plus the bootstrap contract that authenticates that\n // fetch. Naming the retired `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY`\n // here would send an operator hunting for variables the platform\n // deliberately no longer emits, and `isConfigured()` gates on exactly the\n // set below.\n [FileStorageAccepted.WILDO_MANAGED]:\n 'STORAGE_ENDPOINT, PLATFORM_APPS_MANAGER_URL, PLATFORM_APPLICATION_PRIMARY_SECRET, APPLICATION_ID',\n [FileStorageAccepted.LOCAL_DIRECTORY]: 'STORAGE_LOCAL_BASE_DIR',\n };\n\n const issues: ConfigurationValidationIssue[] = [];\n\n for (const resourceType of allResourceTypes) {\n let fileFields;\n try {\n fileFields = this.fileFieldDetection.detectFileFields(resourceType);\n } catch {\n continue;\n }\n\n for (const field of fileFields) {\n const accepted = field.fileMetadata.storageAccepted;\n const fieldRef = `${resourceType}.${field.fieldName}`;\n\n if (!accepted \|\| accepted.length === 0) {\n const provider = this.fileStorageRouter.getProviderById(FileStorageAccepted.WILDO_MANAGED);\n if (!provider \|\| !provider.isConfigured()) {\n const hint = envHints[FileStorageAccepted.WILDO_MANAGED];\n issues.push(issueError(\n ConfigurationValidationDomain.STORAGE,\n `${fieldRef}: no storageAccepted specified and default WILDO_MANAGED is not configured — set ${hint}`,\n { fieldRef, storageAccepted: [FileStorageAccepted.WILDO_MANAGED] },\n ));\n }\n } else {\n const hasSatisfied = accepted.some((provId) => {\n const p = this.fileStorageRouter.getProviderById(provId);\n return p?.isConfigured() ?? false;\n });\n if (!hasSatisfied) {\n const hints = accepted.map((p) => envHints[p] ?? p).join(' or ');\n issues.push(issueError(\n ConfigurationValidationDomain.STORAGE,\n `${fieldRef}: accepts [${accepted.join(', ')}] but none are configured — set ${hints}`,\n { fieldRef, storageAccepted: [...accepted] },\n ));\n }\n }\n }\n }\n\n return issues;\n }\n\n // ─── Scanning (ClamAV) ──────────────────────────────────────────────────\n\n /*\n Refuse to boot an application whose file fields DECLARE a required scan with nothing to scan them.\n \n Keyed on the per-field `scanPolicy: 'required'` declaration only, and that is complete rather than a\n * gap — the reasoning is worth recording because the obvious second branch is dead code.\n \n `FileScanningBackendService.isGlobalScanningEnabled()` (the application-wide default for a field that\n * declares no policy) is DERIVED from the scanner topology: it is\n * `clamavScanner.isConfigured() \|\| yaraScanner.isEnabled()`. So \"scanning is globally on and no scanner\n * is reachable\" is not a state this configuration can be in, and a branch reporting it would be\n * `false && …` at every boot of every application — a check that can never fire, which reports a clean\n * configuration and a broken checker identically. It was considered on 2026-09-09, when the dead global\n * switch was repaired, and deliberately not added; it becomes necessary the day that switch is turned\n * back into a separately-declared boolean, which is one of the three reasons it was not.\n \n The remaining route into \"a scan was requested with no scanner\" is therefore exactly the per-field\n * declaration this collector already walks — plus any field this walk MISSES, which the `catch\n * { continue; }` below makes possible and which is why `executeScan` also refuses at runtime rather\n * than trusting that boot has already answered.\n \n ClamAV specifically, not \"any scanner\": YARA is a pattern layer documented as running on top of\n * signature AV, not a replacement for it, so a `required` field is not satisfied by YARA alone. That is\n * a posture, not an oversight — relaxing it would let an application satisfy `scanPolicy: 'required'`\n * with no signature scanning at all.\n /\n private collectScanningIssues(): ConfigurationValidationIssue[] {\n const issues: ConfigurationValidationIssue[] = [];\n const allResourceTypes = this.resourcesRegistry.getResourceTypes();\n const fieldsRequiringScan: string[] = [];\n\n for (const resourceType of allResourceTypes) {\n let fileFields;\n try {\n fileFields = this.fileFieldDetection.detectFileFields(resourceType);\n } catch {\n continue;\n }\n\n for (const field of fileFields) {\n if (field.fileMetadata.scanPolicy === 'required') {\n fieldsRequiringScan.push(`${resourceType}.${field.fieldName}`);\n }\n }\n }\n\n if (fieldsRequiringScan.length === 0) {\n return issues;\n }\n\n if (!this.clamavScanner.isConfigured()) {\n issues.push(issueError(\n ConfigurationValidationDomain.STORAGE,\n `${fieldsRequiringScan.length} z_file() field(s) declare scanPolicy: 'required' but ClamAV is not configured — set CLAMAV_HOST and CLAMAV_PORT`,\n { fields: fieldsRequiringScan, hint: 'Set CLAMAV_HOST env var or remove scanPolicy from z_file() declarations' },\n ));\n }\n\n return issues;\n }\n\n // ─── YARA (platform-level pattern scanning) ─────────────────────────\n\n private collectYaraIssues(): ConfigurationValidationIssue[] {\n const issues: ConfigurationValidationIssue[] = [];\n\n if (!this.yaraScanner.isExplicitlyEnabled()) return issues;\n\n if (!this.yaraScanner.isConfigured()) {\n issues.push(issueError(\n ConfigurationValidationDomain.STORAGE,\n 'YARA_ENABLED is true but YARA_HOST is not set — the YARA scanner service is unreachable',\n { hint: 'Set YARA_HOST to the YARA scanner Docker service hostname (e.g., yara-scanner)' },\n ));\n }\n\n return issues;\n }\n\n // ─── Authentication persistence boundaries ─────────────────────────────\n\n /\n One registering user type may own at most one automatic organization\n * creation policy. The shared schema enforces this for parsed declarations;\n * this initialized-runtime border intentionally repeats the same canonical\n * lookup so programmatic or otherwise type-erased configuration cannot boot\n * into a frontend/backend ambiguity.\n /\n private collectOrganizationRegistrationCreationPolicyIssues(config?: AppConfiguration): ConfigurationValidationIssue[] {\n if (!config) return [];\n\n const authoredUserTypes = new Set<string>();\n for (const organizationType of Object.values(\n config.organizationTypes ?? {},\n )) {\n for (\n const userType\n of organizationType.creationPolicy\n ?.createOnUserTypeRegistration ?? []\n ) {\n authoredUserTypes.add(userType);\n }\n }\n\n const issues: ConfigurationValidationIssue[] = [];\n for (const userType of [...authoredUserTypes].sort()) {\n const matches = findOrganizationTypeRegistrationCreationMatches(\n config.organizationTypes,\n userType,\n );\n if (matches.length <= 1) continue;\n\n issues.push(issueError(\n ConfigurationValidationDomain.AUTH,\n `User type '${userType}' is assigned to multiple organization-creation `\n + `policies [${matches\n .map((match) => match.organizationType).join(', ')}]. `\n + 'Registration must resolve exactly one organization type.',\n {\n reason:\n 'registration_user_type_has_ambiguous_organization_creation_policy',\n userType,\n matchingOrgTypes: matches.map((match) => match.organizationType),\n },\n ));\n }\n\n return issues;\n }\n\n /\n Build the complete set of identity transactions reachable from authored\n * application capabilities.\n \n Runtime methods use the same request builders. Startup intentionally\n * validates the broadest supported variant of each enabled boundary (for\n * example optional password creation is still part of self-registration's\n * capability) so a configuration cannot boot with only a subset of one\n * feature working.\n /\n private collectEnabledAuthenticationPersistenceBoundaryRequests(config: AppConfiguration): ResourcePersistenceUnitOfWorkRequest[] {\n const requests: ResourcePersistenceUnitOfWorkRequest[] = [];\n const userTypeEntries = Object.entries(config.userTypes ?? {});\n const selfRegistrationUserTypes = userTypeEntries\n .filter(([, definition]) =>\n isRegistrationAcquisitionAllowed(\n definition.auth.registration.mode,\n RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n )\n /\n * Any method whose signup runs through `createSelfRegistrationPersistenceRequest`, not\n * PASSWORD alone (#463).\n \n MAGIC_LINK and PASSKEY gained public registration and use the SAME persistence path — they\n * differ only in holding no credential and minting a link afterwards. Left as `PASSWORD`\n * alone, an application enabling ONLY password-less signup would not have this boundary\n * declared, and its first registration would fail at the transaction rather than at\n * configuration time.\n \n EXTERNAL_OAUTH2 is deliberately NOT here: social JIT creation has its own boundary\n * request, collected below.\n /\n && definition.auth.registration.allowedMethods.some((method) =>\n method === AuthMethod.PASSWORD\n \|\| method === AuthMethod.MAGIC_LINK\n \|\| method === AuthMethod.PASSKEY,\n ),\n )\n .map(([userType]) => userType);\n\n if (selfRegistrationUserTypes.length > 0) {\n const eligibleUserTypes = new Set(selfRegistrationUserTypes);\n const reachableOrganizationCreationPolicies = Object.values(\n config.organizationTypes ?? {},\n )\n .map((definition) => definition.creationPolicy)\n .filter(\n (policy): policy is NonNullable<typeof policy> =>\n policy !== undefined\n && policy.createOnUserTypeRegistration.some(\n (userType) => eligibleUserTypes.has(userType),\n ),\n );\n const hasSynchronousOrganizationCreation =\n reachableOrganizationCreationPolicies.some(\n (policy) =>\n policy.orgNameSource !== OrganizationNameSource.ONBOARDING,\n );\n const hasDeferredOrganizationOnboarding =\n reachableOrganizationCreationPolicies.some(\n (policy) =>\n policy.orgNameSource === OrganizationNameSource.ONBOARDING,\n );\n requests.push(createSelfRegistrationPersistenceRequest({\n // PASSWORD is an allowed method. Even when a particular call omits it,\n // the authored self-registration capability includes credential writes.\n includeCredentials: true,\n includeSynchronousOrganizationCreation:\n hasSynchronousOrganizationCreation,\n }));\n if (hasDeferredOrganizationOnboarding) {\n requests.push(\n createDeferredOrganizationOnboardingPersistenceRequest(),\n );\n }\n }\n\n // Invitation acceptance has identity-level persistence boundaries distinct\n // from the organization-member CREATE operation. The presence of an\n // organization type makes these boundaries reachable even when all its\n // grant modes are ADMIN_ONLY/DISABLED: invitation policy applies only to\n // newly acquired user types, so an existing holder (or an org type with no\n // grants) can still be invited. There is currently no authored global\n // invitation-disable switch. Invitation issuance itself is validated\n // exactly once by the generic resource-operation transaction resolver below\n // (operation resource + declared custom participants + framework token\n // participant).\n if (Object.keys(config.organizationTypes ?? {}).length > 0) {\n requests.push(\n createPublicInvitationAcceptancePersistenceRequest({\n includeCredentials:\n isPublicInvitationPasswordCredentialReachable(config),\n }),\n createAuthenticatedInvitationAcceptancePersistenceRequest(),\n );\n }\n\n const hasEnabledSocialProvider = Object.values(\n config.auth?.socialOAuth2Providers ?? {},\n ).some((provider) => isEnabledSocialOAuth2LoginProvider(provider));\n if (hasEnabledSocialProvider) {\n requests.push(SOCIAL_EXISTING_USER_LINK_UNIT_OF_WORK);\n const socialJitCreationEnabled = userTypeEntries.some(\n ([, definition]) =>\n definition.auth.registration.allowedMethods.includes(\n AuthMethod.EXTERNAL_OAUTH2,\n )\n && isRegistrationAcquisitionAllowed(\n definition.auth.registration.mode,\n RegistrationAcquisitionChannel.SOCIAL_OAUTH_JIT,\n ),\n );\n if (socialJitCreationEnabled) {\n requests.push(SOCIAL_USER_CREATION_UNIT_OF_WORK);\n }\n if (Object.keys(config.organizationTypes ?? {}).length > 0) {\n requests.push(SOCIAL_INVITATION_ACCEPTANCE_UNIT_OF_WORK);\n }\n }\n\n const enterpriseProvisioningEnabled =\n userTypeEntries.some(([, definition]) =>\n isRegistrationAcquisitionAllowed(\n definition.auth.registration.mode,\n RegistrationAcquisitionChannel.ENTERPRISE_SSO_JIT,\n ),\n )\n \|\| Object.values(config.organizationTypes ?? {}).some(\n (definition) => definition.scimProvisioning?.enabled === true,\n );\n if (enterpriseProvisioningEnabled) {\n requests.push(\n APPLICATION_USER_CREATION_UNIT_OF_WORK,\n APPLICATION_EXISTING_USER_LINK_UNIT_OF_WORK,\n );\n if (Object.keys(config.organizationTypes ?? {}).length > 0) {\n requests.push(\n ORGANIZATION_USER_CREATION_UNIT_OF_WORK,\n ORGANIZATION_EXISTING_USER_LINK_UNIT_OF_WORK,\n );\n }\n }\n\n return requests;\n }\n\n /\n How FILES participates in writes to this resource, derived from the schema alone.\n \n A generated document must land in the SAME commit as the row that references it,\n * so it is ATOMIC and a cross-adapter boundary is refused. Ordinary file METADATA is\n * compensatable — it may commit separately, which the service layer already handles\n * and already documents as an at-least-once obligation.\n /\n /\n Resource-WRITE boundaries — declared separately from transaction-readiness ones,\n * and deliberately NOT mixed into them.\n \n `collectTransactionReadinessPersistenceRequests` feeds a live probe that opens a\n * real transaction per adapter. A write whose only extra participant is COMPENSATABLE\n * file metadata requires no transaction at all, so folding these in would claim a\n * transaction requirement that does not exist — and would report a missing unit of\n * work as \"transaction-requiring boundaries are configured\", which is false.\n \n These are assessed for COMPATIBILITY only. That is the whole point: it is what\n * turns \"a resource writes files across an adapter boundary\" from a per-request\n * runtime discovery into a boot-time answer.\n /\n private collectResourceWritePersistenceRequests(): ResourcePersistenceUnitOfWorkRequest[] {\n const requests: ResourcePersistenceUnitOfWorkRequest[] = [];\n\n for (const resourceType of this.resourcesRegistry.getResourceTypes()) {\n const fileParticipation = this.resolveResourceWriteFileParticipation(resourceType);\n if (fileParticipation === ResourceWriteFileParticipation.NONE) {\n continue;\n }\n requests.push(createResourceWritePersistenceRequest({\n resourceType: String(resourceType),\n fileParticipation,\n }));\n }\n\n return requests;\n }\n\n private resolveResourceWriteFileParticipation(\n resourceType: Parameters<FileFieldDetectionBackendService['detectFileFields']>[0],\n ): ResourceWriteFileParticipation {\n let fileFields;\n try {\n fileFields = this.fileFieldDetection.detectFileFields(resourceType);\n } catch {\n // Detection is schema-driven; a resource it cannot read contributes no boundary\n // rather than failing startup on a diagnostic that is not itself a control.\n return ResourceWriteFileParticipation.NONE;\n }\n\n if (fileFields.length === 0) {\n return ResourceWriteFileParticipation.NONE;\n }\n\n const hasGeneratedDocument = fileFields.some(\n (fileField) => fileField.fileMetadata.generation?.source === FileGenerationSource.PDF_TEMPLATE,\n );\n\n return hasGeneratedDocument\n ? ResourceWriteFileParticipation.ATOMIC_MATERIALIZATION\n : ResourceWriteFileParticipation.METADATA;\n }\n\n /\n Collect every statically authored boundary that requires a native\n * transaction before traffic is accepted.\n \n Identity services declare their multi-resource units of work explicitly.\n * Resource operations additionally require a transaction when they generate\n * tokens or a custom implementation opts into `transactionalCore`.\n * Token-coupled operations include the token resource in the same request so\n * startup and runtime enforce the same adapter boundary.\n /\n private collectTransactionReadinessPersistenceRequests(config?: AppConfiguration): ResourcePersistenceUnitOfWorkRequest[] {\n const requests = [\n ...(config\n ? this.collectEnabledAuthenticationPersistenceBoundaryRequests(config)\n : []),\n ];\n\n for (const resourceType of this.resourcesRegistry.getResourceTypes()) {\n const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType);\n\n for (const operation of resourceConfig.operations) {\n const contract =\n resolveResourceOperationTransactionPersistenceContract(\n operation,\n this.customImplRegistry.getRegistrationsForOperation(operation),\n );\n if (!contract.request) {\n continue;\n }\n requests.push(contract.request);\n }\n }\n\n return requests;\n }\n\n /\n Assess every declared native transaction boundary through the same UoW\n * contract runtime execution uses.\n \n This deliberately stays generic. Identity boundaries and resource\n * operations contribute requests, while adapter resolution, mixed-store\n * detection, required-adapter constraints, and database availability remain\n * owned by `ResourcePersistenceUnitOfWorkBackendService`.\n /\n private collectPersistenceBoundaryCompatibilityIssues(config?: AppConfiguration): ConfigurationValidationIssue[] {\n const transactionRequiringRequests = this.collectTransactionReadinessPersistenceRequests(config);\n const resourceWriteRequests = this.collectResourceWritePersistenceRequests();\n const requests = [...transactionRequiringRequests, ...resourceWriteRequests];\n if (requests.length === 0) {\n return [];\n }\n if (!this.resourcePersistenceUnitOfWork) {\n /\n Unchanged semantics: a missing unit of work is only an ISSUE when a boundary\n * genuinely requires a transaction. Resource-write boundaries cannot be assessed\n * without it either, but their absence is not itself a misconfiguration — and\n * reporting one here would fire on every application that merely has file fields.\n /\n if (transactionRequiringRequests.length === 0) {\n return [];\n }\n return [issueError(\n ConfigurationValidationDomain.LIFECYCLE,\n 'Transaction-requiring persistence boundaries are configured, but '\n + 'ResourcePersistenceUnitOfWorkService is unavailable.',\n {\n boundaries: requests.map((request) => request.boundary),\n reason: 'resource_persistence_unit_of_work_service_unavailable',\n },\n )];\n }\n\n const issues: ConfigurationValidationIssue[] = [];\n for (const request of requests) {\n const assessment = this.resourcePersistenceUnitOfWork.assessCompatibility(request);\n if (assessment.compatible) {\n continue;\n }\n\n issues.push(issueError(\n request.boundary.startsWith('resource-operation-transaction:')\n ? ConfigurationValidationDomain.LIFECYCLE\n : ConfigurationValidationDomain.AUTH,\n `Persistence boundary '${request.boundary}' cannot execute `\n + `atomically (${assessment.status}). Every named participant must `\n + 'resolve to one supported native persistence adapter.',\n {\n boundary: request.boundary,\n compatibilityStatus: assessment.status,\n participantResourceMap: assessment.participantResourceMap,\n resourceAdapterMap: assessment.resourceAdapterMap,\n unresolvedParticipantResourceMap:\n assessment.unresolvedParticipantResourceMap,\n requiredAdapter: assessment.requiredAdapter,\n selectedAdapter: assessment.selectedAdapter,\n },\n ));\n }\n return issues;\n }\n\n /\n Reject operation pipelines whose synchronous result-transforming terminal\n * hooks cannot be reconciled with a framework-owned transaction.\n \n The custom-implementation registry catches transactional-registration\n * combinations during normal initialization. This startup border repeats the\n * complete operation-level check because token generation, authentication,\n * or revocation can require a transaction even when no custom registration\n * opted into one.\n /\n private collectResourceOperationTransactionContractIssues():\n ConfigurationValidationIssue[] {\n const issues: ConfigurationValidationIssue[] = [];\n\n for (const resourceType of this.resourcesRegistry.getResourceTypes()) {\n const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType);\n for (const operation of resourceConfig.operations) {\n const contract =\n resolveResourceOperationTransactionPersistenceContract(\n operation,\n this.customImplRegistry.getRegistrationsForOperation(operation),\n );\n if (!contract.transactionRequired) {\n continue;\n }\n\n const operationRef = ApplicationStartupConfigValidatorService.buildOperationRef(operation);\n if (contract.overrideAllRegistrationLabels.length > 0) {\n issues.push(issueError(\n ConfigurationValidationDomain.LIFECYCLE,\n `Transaction-requiring operation '${operationRef}' cannot use `\n + 'OVERRIDE_ALL because that mode replaces and returns before '\n + 'the framework-owned transaction pipeline.',\n {\n operationRef,\n tokenGenerationConfigured:\n contract.tokenGeneration !== undefined,\n transactionalRegistrationLabels:\n contract.transactionalRegistrationLabels,\n overrideAllRegistrationLabels:\n contract.overrideAllRegistrationLabels,\n },\n ));\n }\n }\n }\n\n return issues;\n }\n\n /\n Validate the template side of EVERY operation email before traffic is accepted.\n \n ## What binds an operation to a template\n \n A `userNotifications` entry with `channel: EMAIL` never names its template. The dispatcher\n * DERIVES one — `email.<resource>.<operation>[.<variantKey>].<target-kebab>` — and the\n * application must ship a template folder of exactly that name. Nothing in the type system\n * connects the two: the declaration is a config object, the template is a directory.\n \n ## Why this used to cover only token-backed operations, and why that was the bug\n \n The check opened with `if (!operation.tokenGeneration) continue;`, so an operation that merely\n * NOTIFIES was never validated. Combined with dispatch being post-commit and fire-and-forget by\n * design (a mutation must not fail because an email could not render), an unresolvable ref was\n * invisible everywhere: not in typecheck, not in the suites, not at boot, not in e2e lanes that\n * drove the very operations.\n \n That is not hypothetical. Moving the member notification off `ORGANIZATIONS \| delete` onto\n * `request_deletion` (2026-08-05) moved the declaration and left the template directory behind,\n * producing three unresolvable refs and two orphaned templates with zero signal. It was found by\n * hand, months of boots later, only because someone went looking.\n \n ## Why severity SPLITS rather than failing everything closed\n \n The consequence of a missing template genuinely differs, so the report does too:\n \n - Token-backed → ERROR. The email carries a consumable token, so failing to send does not\n * merely lose a notice — the user cannot accept the invitation or reset the password. The\n * operation is functionally broken, and starting is worse than refusing to.\n * - Informational → WARNING. The operation completed correctly and a courtesy notice was not\n * delivered. Refusing to START an application because a notice is unauthored trades a missing\n * email for a total outage, which is the worse failure — an application must be able to boot\n * while its notification copy is still being written.\n \n The warning is not a shrug. It is emitted PER unresolvable ref, names the declaring operation,\n * and prints the exact directory the application has to create — so it is actionable at the first\n * boot rather than after an audit. Silence was the defect; a specific, repeated, remediable\n * warning is not silence.\n \n ## Scope\n \n This proves that runtime dispatch can RESOLVE every authored email through the configured\n * locale chain, and that a template cannot override transactional routing with a marketing\n * provider class. It deliberately says nothing about durable delivery, which has its own\n * (best-effort, post-commit) reliability boundary.\n /\n private collectOperationEmailTemplateIssues(): ConfigurationValidationIssue[] {\n const issues: ConfigurationValidationIssue[] = [];\n\n for (const resourceType of this.resourcesRegistry.getResourceTypes()) {\n const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType);\n for (const operation of resourceConfig.operations) {\n if (\n !isApiCallOperation(operation)\n && !isApiCallWithCallbackOperation(operation)\n ) {\n continue;\n }\n\n const operationRef = ApplicationStartupConfigValidatorService.buildOperationRef(operation);\n const emailNotifications = (operation.userNotifications ?? []).filter(\n (notification) =>\n notification.channel === CoreUserNotificationChannel.EMAIL,\n );\n // Token-backed emails carry a consumable token, so a missing template BREAKS the flow;\n // informational ones only lose a notice. Severity follows that, not uniformity.\n const isTokenBacked = Boolean(operation.tokenGeneration);\n const issueFor = isTokenBacked ? issueError : issueWarning;\n\n for (const notification of emailNotifications) {\n const templateRef = buildUserNotificationEmailTemplateRef(\n {\n resourceIdentifier: String(operation.resourceIdentifier),\n operationIdentifier: String(operation.operationIdentifier),\n ...('variantKey' in operation && operation.variantKey\n ? { variantKey: String(operation.variantKey) }\n : {}),\n },\n notification,\n );\n\n try {\n const resolvedTemplate = this.emailTemplateRegistry.resolveForConfiguredLocale(templateRef);\n const effectiveTemplateType =\n resolvedTemplate.definition.type\n ?? EmailTemplateType.TRANSACTIONAL;\n if (effectiveTemplateType !== EmailTemplateType.TRANSACTIONAL) {\n issues.push(issueFor(\n ConfigurationValidationDomain.LIFECYCLE,\n `Operation email template '${templateRef}' for `\n + `operation '${operationRef}' resolves as `\n + `${effectiveTemplateType}; operation email `\n + `delivery requires ${EmailTemplateType.TRANSACTIONAL}.`,\n {\n operationRef,\n templateRef,\n resolvedLocale: resolvedTemplate.resolvedLocale,\n effectiveTemplateType,\n requiredTemplateType: EmailTemplateType.TRANSACTIONAL,\n },\n ));\n }\n } catch (error) {\n if (\n !isWildoBackendError(error)\n \|\| error.type !== ErrorType.CONFIGURATION\n ) {\n throw error;\n }\n issues.push(issueFor(\n ConfigurationValidationDomain.LIFECYCLE,\n `${isTokenBacked ? 'Token-backed operation' : 'Operation'} email template `\n + `'${templateRef}' for operation '${operationRef}' does not resolve through the `\n + 'configured primary/fallback locale chain'\n + (isTokenBacked\n ? ' — this email carries a consumable token, so the flow it belongs to cannot complete.'\n : ' — the operation still succeeds, but its notification is silently never delivered.')\n // The remedy, spelled out: the ref IS the directory name, and an author who has not\n // met this derivation before has no way to guess it from the declaration.\n + ` Create the template folder named '${templateRef}' `\n + '(template.tsx + labels.<locale>.ts), or remove the notification declaration.',\n { operationRef, templateRef, tokenBacked: isTokenBacked },\n ));\n }\n }\n }\n }\n\n return issues;\n }\n\n /\n Refuse to start when a configured operation cannot fulfil the contract it declares.\n \n A custom operation whose `requestDto` nothing consumes does not fail — it falls through to\n * the generic core path, writes nothing, and answers HTTP 200 with the unchanged row. A\n * hostile e2e probe caught `organizationMembers \| promote` doing that on 2026-08-01, and a\n * catalogue sweep found 41 routed operations sharing the shape (8 CRITICAL, 11 HIGH). Nothing\n * escalates, which is why every security lane stayed green — the damage is that a destructive\n * verb reports success it never performed, so every runbook, script, and UI that trusts the\n * 2xx is wrong.\n \n The verdict comes from `resolveResourceOperationImplementationCoverage`, the same resolver\n * the dispatcher consults before executing. Sharing it is the point: a predicate that lived in\n * two places could bless an operation at boot that still answers 2xx on the first request.\n \n The check is BIDIRECTIONAL, and both directions are fail-closed:\n \n - unserviceable and unacknowledged — a new silent no-op cannot ship. Implement the\n * operation, remove the declaration, or acknowledge the gap deliberately.\n * - acknowledged but serviceable — a stale marker cannot survive someone implementing the\n * operation, which would otherwise leave a working operation permanently refusing.\n \n Every violation is aggregated into one throw, so one boot surfaces the whole set rather than\n * one restart per operation.\n \n assurance-control: WILDO.OPERATIONS.EXECUTION_INTEGRITY — an interface must not report success for an\n * action it did not perform.\n /\n private collectUnimplementedResourceOperationIssues(): ConfigurationValidationIssue[] {\n const issues: ConfigurationValidationIssue[] = [];\n\n for (const resourceType of this.resourcesRegistry.getResourceTypes()) {\n const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType);\n for (const operation of resourceConfig.operations) {\n const verdict = resolveResourceOperationImplementationCoverage(\n operation,\n this.customImplRegistry.getRegistrationsForOperation(operation),\n );\n const operationRef = ApplicationStartupConfigValidatorService.buildOperationRef(operation);\n\n if (\n verdict.coverage === ResourceOperationImplementationCoverage.UNSERVICEABLE\n && !verdict.acknowledgement\n ) {\n issues.push(issueError(\n ConfigurationValidationDomain.LIFECYCLE,\n `Operation '${operationRef}' is routed but nothing consumes its declared request `\n + 'contract, so it would answer a success status having performed nothing. '\n + 'Implement it (a custom implementation bound to this exact operation path, or a '\n + 'declarative side effect), remove the declaration, or declare the gap with '\n + '`unimplementedAcknowledgement` — which also makes the request fail closed.',\n {\n operationRef,\n reason: verdict.unserviceableReason,\n unconsumedRequestFields: verdict.unconsumedRequestFields,\n riskLevel: operation.riskLevel,\n resourceOperationLike: operation.resourceOperationLike,\n },\n ));\n continue;\n }\n\n if (\n verdict.coverage !== ResourceOperationImplementationCoverage.UNSERVICEABLE\n && verdict.acknowledgement\n ) {\n issues.push(issueError(\n ConfigurationValidationDomain.LIFECYCLE,\n `Operation '${operationRef}' declares 'unimplementedAcknowledgement' but is `\n + 'serviceable. The acknowledgement makes every request to it fail closed, so a '\n + 'stale marker silently disables a working operation. Remove it.',\n {\n operationRef,\n coverage: verdict.coverage,\n acknowledgementReason: verdict.acknowledgement.reason,\n acknowledgementTrackingRef: verdict.acknowledgement.trackingRef,\n },\n ));\n }\n }\n }\n\n return issues;\n }\n\n /\n Refuse to start when an `authoritativeFields` declaration names something that is not a\n * persisted field of the resource.\n \n `authoritativeFields` is what carries a hook-authored value past the repository's strict\n * `requestDto` re-parse even when the caller also supplied the key. It is typed `readonly\n * string[]` rather than `keyof` the main schema, because the declaration is shared by the\n * authoring parameters and the type-erased built operation (where `keyof` collapses to `never`),\n * and because custom-implementation registrations declare plain strings with no schema generic\n * available at all.\n \n So the name check has to happen here. A typo is the dangerous case: a misspelled field\n * declares nothing, the hook's value silently reverts to the added-key inference, and the first\n * caller who supplies that key turns the operation back into a success response that wrote\n * nothing — the precise defect `unimplementedAcknowledgement` exists to prevent. Failing at boot\n * makes that impossible to ship.\n \n Both declaration sites are covered: the operation-variant `authoritativeFields` (which pairs\n * with `basicPrefixOperation`) and every custom-implementation registration bound to the\n * operation path.\n \n assurance-control: WILDO.SOFTWARE.AUTHORITY_INTEGRITY — a server-owned field must have exactly one named\n * authority, and that authority must be provable at boot rather than assumed.\n /\n private collectResourceOperationAuthoritativeFieldIssues(): ConfigurationValidationIssue[] {\n const issues: ConfigurationValidationIssue[] = [];\n\n for (const resourceType of this.resourcesRegistry.getResourceTypes()) {\n const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType);\n for (const operation of resourceConfig.operations) {\n const declarations: { source: string; fields: readonly string[] }[] = [];\n\n const configuredFields = (\n operation as { authoritativeFields?: readonly string[] }\n ).authoritativeFields;\n if (configuredFields?.length) {\n declarations.push({ source: 'operation variant', fields: configuredFields });\n }\n\n for (const registration of this.customImplRegistry.getRegistrationsForOperation(operation)) {\n if (registration.authoritativeFields?.length) {\n declarations.push({\n source: `custom implementation '${registration.debugLabel}'`,\n fields: registration.authoritativeFields,\n });\n }\n }\n\n if (declarations.length === 0) continue;\n\n const operationRef = ApplicationStartupConfigValidatorService.buildOperationRef(operation);\n const persistedFields = getPersistedFieldNames(operation);\n\n for (const declaration of declarations) {\n const unknownFields = declaration.fields.filter((field) => !persistedFields.has(field));\n if (unknownFields.length === 0) continue;\n\n issues.push(issueError(\n ConfigurationValidationDomain.LIFECYCLE,\n `Operation '${operationRef}' declares authoritativeFields `\n + `[${unknownFields.join(', ')}] on its ${declaration.source}, but `\n + `${unknownFields.length === 1 ? 'that name is not a persisted field' : 'those names are not persisted fields'} `\n + 'of the resource. A name that matches nothing declares nothing: the hook\\'s value '\n + 'falls back to being inferred from the keys it added, so the first caller who '\n + 'supplies that key makes the write silently empty while the operation still '\n + 'answers success. Fix the spelling, or drop the declaration if the field is no '\n + 'longer authored.',\n {\n operationRef,\n declarationSource: declaration.source,\n unknownFields,\n persistedFields: [...persistedFields],\n },\n ));\n }\n }\n }\n\n return issues;\n }\n\n /\n Refuse to start when a custom write-like verb never authored the request contract it exposes.\n \n The DTO builder synthesizes a contract for an operation that does not author one, and for a\n * write-like `resourceOperationLike` that synthesis is the resource's ENTIRE create/update\n * contract. A verb then advertises far more than it names: `applicationApiKeys \| deactivate`\n * accepted `status` (so it could activate) and `roles` (on a resource whose only role gate runs\n * when minting); `organizationOAuthClients \| regenerate` accepted `redirectUris`.\n \n This is a DIFFERENT defect from an unserviceable operation and gets its own resolver — those\n * operations write nothing, these write too much, and several of these have full custom\n * implementations. `unimplementedAcknowledgement` is deliberately NOT the escape hatch here: the\n * fix is to author the contract. An operation that really does accept the whole resource\n * contract declares it explicitly, which is visible at the declaration site and in review.\n \n assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — least privilege applies to a request contract as\n * much as to a role.\n /\n private collectOverbroadResourceOperationRequestContractIssues(): ConfigurationValidationIssue[] {\n const issues: ConfigurationValidationIssue[] = [];\n\n for (const resourceType of this.resourcesRegistry.getResourceTypes()) {\n const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType);\n for (const operation of resourceConfig.operations) {\n const verdict = resolveResourceOperationRequestContractBreadth(operation);\n if (\n verdict.breadth\n !== ResourceOperationRequestContractBreadth.OVERBROAD_INHERITED_FULL_CONTRACT\n ) {\n continue;\n }\n\n const operationRef = ApplicationStartupConfigValidatorService.buildOperationRef(operation);\n issues.push(issueError(\n ConfigurationValidationDomain.LIFECYCLE,\n `Operation '${operationRef}' declares no 'requestDto', so it inherited its resource's `\n + 'ENTIRE update contract and accepts every field listed below — including fields the '\n + 'verb contradicts. Author a `requestDto` naming exactly what the verb accepts '\n + '(`z.object({})` when the transition is server-decided) and force the transition '\n + 'from a `prefixCoreOperations` / `basicPrefixOperation` hook. If the operation '\n + 'really does accept the whole contract, declare that contract explicitly.',\n {\n operationRef,\n inheritedRequestFields: verdict.inheritedRequestFields,\n riskLevel: operation.riskLevel,\n resourceOperationLike: operation.resourceOperationLike,\n },\n ));\n }\n }\n\n return issues;\n }\n\n private static buildOperationRef(operation: {\n resourceIdentifier: unknown;\n operationIdentifier: unknown;\n variantKey?: unknown;\n }): string {\n return [\n String(operation.resourceIdentifier),\n String(operation.operationIdentifier),\n ...(operation.variantKey ? [String(operation.variantKey)] : []),\n ].join('.');\n }\n\n // ─── CLI Runtime Agents ─────────────────────────────────────────────────\n\n /\n Refuse at STARTUP an active coding agent whose ACP transport cannot serve it.\n \n Replaces the CLI-runtime validator this transport superseded, and keeps its\n * purpose: an agent whose provider, profile, model or environment does not\n * line up should fail while an operator is reading startup output, not on the\n * first dispatch — where the same misconfiguration surfaces minutes into a\n * journey, after a task row already exists.\n */\n private collectCodingAgentIssues(): ConfigurationValidationIssue[] {\n const applicationEnv = (process.env.APPLICATION_ENV ?? APPLICATION_ENVIRONMENT.DEVELOPMENT) as APPLICATION_ENVIRONMENT;\n const platformEnvironmentId = process.env.PLATFORM_ENVIRONMENT_ID;\n const agents = Object.values(this.flowsActorsRegistry.getRegistry().agents);\n const issues: ConfigurationValidationIssue[] = [];\n\n for (const agent of agents) {\n if (agent.status !== FlowsActors_Agent_Status.ACTIVE \|\| !isCodingAgentConfiguration(agent.config)) {\n continue;\n }\n\n const codingConfig: FlowsActors_Agent_CodingConfiguration = agent.config;\n const providerRef = codingConfig.providerRef;\n const executionProfileRef = codingConfig.executionProfileRef;\n const agentCtx = { agentRef: agent.ref, providerRef, executionProfileRef };\n\n if (!this.externalProvidersRegistry.isProviderEnabled(providerRef, ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL)) {\n issues.push(issueError(\n ConfigurationValidationDomain.AGENTS,\n `Agent '${agent.ref}': provider '${providerRef}' has no enabled Agent Client Protocol`,\n agentCtx,\n ));\n continue;\n }\n\n const acpProfile = this.externalProvidersRegistry.getAgentClientProtocolProfile(providerRef);\n const executionProfile = this.externalProvidersRegistry.getAgentClientProtocolExecutionProfile(\n providerRef,\n executionProfileRef,\n );\n if (!acpProfile \|\| !executionProfile) {\n issues.push(issueError(\n ConfigurationValidationDomain.AGENTS,\n `Agent '${agent.ref}': ACP metadata or execution profile '${executionProfileRef}' not found`,\n agentCtx,\n ));\n continue;\n }\n\n if (!acpProfile.supportedOperationKeys.includes(codingConfig.operationKey)) {\n issues.push(issueError(\n ConfigurationValidationDomain.AGENTS,\n `Agent '${agent.ref}': ACP transport does not support operation '${codingConfig.operationKey}'`,\n agentCtx,\n ));\n }\n\n if (!acpProfile.supportedModels.includes(codingConfig.model)) {\n issues.push(issueError(\n ConfigurationValidationDomain.AGENTS,\n `Agent '${agent.ref}': ACP transport does not declare support for model '${codingConfig.model}'`,\n { ...agentCtx, supportedModels: acpProfile.supportedModels },\n ));\n }\n\n // The environment gate, checked at startup as well as at dispatch. A\n // profile that can never run here is a configuration error worth naming\n // now rather than a refusal discovered mid-journey.\n if (!executionProfile.allowedApplicationEnvironments.includes(applicationEnv)) {\n issues.push(issueError(\n ConfigurationValidationDomain.AGENTS,\n `Agent '${agent.ref}': ACP execution profile is not allowed in application environment '${applicationEnv}'`,\n { ...agentCtx, allowedApplicationEnvironments: executionProfile.allowedApplicationEnvironments },\n ));\n }\n\n if (\n executionProfile.allowedPlatformEnvironmentIds?.length\n && (!platformEnvironmentId \|\| !executionProfile.allowedPlatformEnvironmentIds.includes(platformEnvironmentId))\n ) {\n issues.push(issueError(\n ConfigurationValidationDomain.AGENTS,\n `Agent '${agent.ref}': ACP execution profile is not allowed in platform environment '${platformEnvironmentId ?? '(unset)'}'`,\n { ...agentCtx, allowedPlatformEnvironmentIds: executionProfile.allowedPlatformEnvironmentIds },\n ));\n }\n\n if (\n executionProfile.authMode === AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n && !this.externalProvidersRegistry.getAgentClientProtocolExecutionProfileSecret(providerRef, executionProfileRef)\n ) {\n issues.push(issueError(\n ConfigurationValidationDomain.AGENTS,\n `Agent '${agent.ref}': ACP execution profile declares secret injection but its secret is not resolvable`,\n agentCtx,\n ));\n }\n }\n\n return issues;\n }\n}\n"]}