npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.2 → 1.1.4 - Mend

@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1358) hide show

package/dist/esm/security/authentications/services/auth-token-issuer.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-token-issuer.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/auth-token-issuer.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAE3H,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAyB,8BAA8B,EAAE,WAAW,EAAE,SAAS,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACjL,OAAO,EACL,oCAAoC,EACpC,gCAAgC,GAEjC,MAAM,oFAAoF,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,oCAAoC,EAAE,MAAM,2EAA2E,CAAC;AAC/K,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,wBAAwB,EACxB,iCAAiC,GAClC,MAAM,sGAAsG,CAAC;AAC9G,OAAO,EAAE,kCAAkC,EAAE,MAAM,oEAAoE,CAAC;AACxH,OAAO,EAAE,gCAAgC,EAAE,MAAM,sEAAsE,CAAC;AACxH,OAAO,EACL,2BAA2B,GAE5B,MAAM,6FAA6F,CAAC;AAErG,0DAA0D;AAC1D,MAAM,+BAA+B,GAAG,EAAE,CAAC;AA6B3C;;;;;GAKG;AACH,MAAM,8BAA8B,GAAG,MAAM,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;AAExF;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAmB,KAAQ,EAAE,MAA+B;IACpG,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,8BAA8B,EAAE;QAC3D,KAAK,EAAE,MAAM;QACb,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,KAAK;QACf,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC3D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,8BAA8B,IAAI,KAAK,EAAE,CAAC;QAC3F,OAAQ,KAAgF,CAAC,8BAA8B,CAAC,CAAC;IAC3H,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AAEI,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAIc;IACU;IACC;IACE;IACP;IACkB;IACH;IAQxD;IAjBF,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACX,gBAAyC,EACxC,UAA6B,EAC3B,YAAwC,EAC/C,YAA0B,EACR,uBAA8D,EACjE,aAAwD,EAQhH,mBAAmD,IAAI;QAdpB,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QACxC,eAAU,GAAV,UAAU,CAAmB;QAC3B,iBAAY,GAAZ,YAAY,CAA4B;QAC/C,iBAAY,GAAZ,YAAY,CAAc;QACR,4BAAuB,GAAvB,uBAAuB,CAAuC;QACjE,kBAAa,GAAb,aAAa,CAA2C;QAQhH,qBAAgB,GAAhB,gBAAgB,CAAuC;QAExE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,WAAW,CACtB,OAA8B,EAC9B,UAAoG,EAAE;QAEtG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAE9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;gBAC7F,OAAO,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,mBAAmB,IAAI,IAAI,EAAE;YAC9F,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,IAAI,SAAS;SAC9E,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,kBAAkB,CAC7B,MAAc,EACd,SAAkB,EAClB,YAIC,EACD,OAGC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IAClF,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,mBAAmB,CAC/B,MAAc,EACd,SAAkB,EAClB,sBAA+B,IAAI,EACnC,YAIC,EACD,OASC;QAED,IAAI,aAAkC,CAAC;QACvC,IAAI,sBAAsB,GAAG,YAAY,EAAE,cAAc,CAAC;QAE1D,0EAA0E;QAC1E,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mCAAmC,CAC1E,MAAM,EACN,IAAI,CAAC,aAAa,CAAC,yBAAyB,EAAE,CAC/C,CAAC;QACF,MAAM,IAAI,GACR,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACrC,gBAAgB,CAAC,KAAK,EACtB,OAAO,EACP,EAAE,GAAG,EAAE,MAAM,EAAE,CAChB,CAAC;QACJ,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,IAAI,oBAAoB,KAAK,IAAI,EAAE,CAAC;YAC3C,0FAA0F;YAC1F,0FAA0F;YAC1F,8FAA8F;YAC9F,8FAA8F;YAC9F,2EAA2E;YAC3E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,4BAA4B;gBAC1D,OAAO,EAAE;oBACP,MAAM,EAAE,IAAI;wBACV,CAAC,CAAC,uCAAuC;wBACzC,CAAC,CAAC,oCAAoC;oBACxC,MAAM;oBACN,qFAAqF;oBACrF,2CAA2C;oBAC3C,wBAAwB,EAAE,OAAQ,IAA0C,EAAE,QAAQ;oBACtF,UAAU,EAAE,IAAI,EAAE,MAAM;iBACzB;aACF,CACF,CAAC;QACJ,CAAC;QACD,IACE,OAAO,EAAE,4BAA4B,KAAK,SAAS;eAChD,oBAAoB,KAAK,OAAO,CAAC,4BAA4B,EAChE,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,4BAA4B;gBAC1D,OAAO,EAAE;oBACP,MAAM,EAAE,oDAAoD;oBAC5D,MAAM;iBACP;aACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YACtC,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,oBAAoB,EAAE,CAAC;YAC3D,aAAa,GAAG,KAAK,CAAC;QACxB,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,wCAAwC;QACxC,IAAI,sBAAsB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,sBAAsB,CAAC,EAC7E,CAAC;YACD,sBAAsB,GAAG,SAAS,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,sBAAsB,IAAI,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;YACtD,sBAAsB,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,mBAAmB,GAAG,YAAY,EAAE,mBAAmB,CAAC;QAE9D,MAAM,WAAW,GAAG,oCAAoC,CAAC,KAAK,CAAC;YAC7D,IAAI,EAAE,8BAA8B,CAAC,YAAY;YACjD,MAAM;YACN,oBAAoB;YACpB,WAAW,EAAE,YAAY,EAAE,WAAW,IAAI,WAAW,CAAC,UAAU;YAChE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,yGAAyG;YACzG,uGAAuG;YACvG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAC3E,+DAA+D;QAC/D,qEAAqE;QACrE,2EAA2E;QAC3E,6DAA6D;QAC7D,qEAAqE;QACrE,mEAAmE;QACnE,uEAAuE;QACvE,2CAA2C;QAC3C,MAAM,kBAAkB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC;QACzF,MAAM,2BAA2B,GAAG,kBAAkB,GAAG,EAAE,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAEzF,IAAI,YAAgC,CAAC;QACrC,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAChC,MAAM,YAAY,GAAuC;gBACvD,IAAI,EAAE,8BAA8B,CAAC,YAAY;gBACjD,MAAM;gBACN,oBAAoB;gBACpB,GAAG;gBACH,SAAS,EAAE,SAAS;gBACpB,WAAW,EAAE,YAAY,EAAE,WAAW,IAAI,WAAW,CAAC,UAAU;gBAChE,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,GAAG,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjI,CAAC;YAEF,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CACrD,YAAY,EACZ,OAAO,EAAE,qBAAqB;gBAC5B,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE;gBAC9G,CAAC,CAAC,SAAS,CACd,CAAC;YAEF,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;YAC/E,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,OAAO;YACL,WAAW;YACX,YAAY;YACZ,SAAS,EAAE,2BAA2B;SACvC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAClD,qFAAqF;QACrF,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CACF,CAAC;QACJ,CAAC;QAED,4DAA4D;QAC5D,MAAM,WAAW,GAAG,gCAAgC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACjG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC;QAEhC,0EAA0E;QAC1E,yEAAyE;QACzE,oDAAoD;QACpD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mCAAmC,CACrE,MAAM,CAAC,MAAM,EACb,IAAI,CAAC,aAAa,CAAC,yBAAyB,EAAE,CAC/C,CAAC;QACF,MAAM,WAAW,GACf,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACrC,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CACvB,CAAC;QACJ,MAAM,2BAA2B,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;QAC7E,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;gBACpD,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,WAAW;aAC/C,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,6BAA6B;gBAC3D,OAAO,EAAE;oBACP,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,WAAW;oBAC9C,MAAM,EAAE,eAAe;iBACxB;aACF,CACF,CAAC;QACJ,CAAC;QACD,IACE,2BAA2B,KAAK,IAAI;eACjC,2BAA2B,KAAK,MAAM,CAAC,oBAAoB,EAC9D,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4DAA4D,EAC5D;gBACE,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,yBAAyB,EAAE,MAAM,CAAC,oBAAoB;gBACtD,2BAA2B;aAC5B,CACF,CAAC;YACF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,4BAA4B;gBAC1D,OAAO,EAAE,EAAE,MAAM,EAAE,oCAAoC,EAAE;aAC1D,CACF,CAAC;QACJ,CAAC;QAED,iEAAiE;QACjE,0EAA0E;QAC1E,uEAAuE;QACvE,2CAA2C;QAC3C,gGAAgG;QAChG,oGAAoG;QACpG,oGAAoG;QACpG,sGAAsG;QACtG,qGAAqG;QACrG,uFAAuF;QACvF,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,MAAM,kCAAkC,CAC3E,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAC7C,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE;gBACtE,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,GAAG;gBACpB,aAAa;aACd,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,4BAA4B;aAC3D,CACF,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,iGAAiG;QACjG,8FAA8F;QAC9F,8FAA8F;QAC9F,MAAM,YAAY,GAAG,MAAM,gCAAgC,CACzD,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAChD,CAAC;QACF,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;gBACvE,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,MAAM,CAAC,GAAG;gBACpB,aAAa,EAAE,YAAY,CAAC,aAAa;aAC1C,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,4BAA4B;aAC3D,CACF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAS,GAAG,eAAe,CAAC,iBAAiB,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAChH,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,cAAc,KAAK,2BAA2B,CAAC,OAAO,EAAE,CAAC;gBAC3D,uEAAuE;gBACvE,sEAAsE;gBACtE,uEAAuE;gBACvE,8DAA8D;gBAC9D,sEAAsE;gBACtE,sEAAsE;gBACtE,kEAAkE;gBAClE,sEAAsE;gBACtE,oEAAoE;gBACpE,8DAA8D;gBAC9D,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAChD,GAAG,eAAe,CAAC,uBAAuB,GAAG,MAAM,CAAC,GAAG,EAAE,CAC1D,CAAC;gBACF,IAAI,cAAc,EAAE,CAAC;oBACnB,oEAAoE;oBACpE,qEAAqE;oBACrE,kEAAkE;oBAClE,qDAAqD;oBACrD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2GAA2G,EAAE;wBAC5H,GAAG,EAAE,MAAM,CAAC,GAAG;wBACf,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,IAAI,EAAE,MAAM,CAAC,IAAI;qBAClB,CAAC,CAAC;oBACH,OAAO,cAAc,CAAC;gBACxB,CAAC;gBAED,qEAAqE;gBACrE,sDAAsD;gBACtD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mFAAmF,EAAE;oBACpG,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,MAAM,EAAG,MAAM,CAAC,MAAM;oBACtB,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC,CAAC;gBACH,kEAAkE;gBAClE,sEAAsE;gBACtE,iEAAiE;gBACjE,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC;gBACrF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,EACzD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAC7B,EAAE,GAAG,EAAE,gBAAgB,GAAG,KAAK,EAAE,CAClC,CAAC;gBACF,+FAA+F;gBAC/F,kGAAkG;gBAClG,gGAAgG;gBAChG,mGAAmG;gBACnG,kGAAkG;gBAClG,MAAM,0BAA0B,CAC9B,IAAI,CAAC,YAAY,CAAC,UAAU,CAC1B,SAAS,CAAC,cAAc,EACxB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B,EAAE,CAC3E,EACX;oBACE,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,SAAS,EAAE,MAAM,CAAC,GAAG;oBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,aAAa,EAAE,IAAI;iBACpB,CACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CACF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,wEAAwE;QACxE,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE,EAAE,MAAM,EAAG,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1G,MAAM,iBAAiB,GAAG,MAAM,CAAC,mBAAmB,CAAC;QACrD,MAAM,qBAAqB,GAAG,MAAM,CAAC,cAAc,CAAC;QACpD,MAAM,kBAAkB,GAAG,MAAM,CAAC,WAAW,CAAC;QAC9C,MAAM,0BAA0B,GAAG,MAAM,CAAC,qBAAqB,CAAC;QAEhE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAC9C,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,SAAS,EAChB,IAAI,EACJ;YACE,mBAAmB,EAAE,iBAAiB;YACtC,cAAc,EAAE,qBAAqB;YACrC,WAAW,EAAE,kBAAkB,IAAI,WAAW,CAAC,UAAU;SAC1D,EACD;YACE,GAAG,CAAC,kBAAkB,KAAK,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,IAAI,CAAC,0BAA0B,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7G,4BAA4B,EAAE,MAAM,CAAC,oBAAoB;SAC1D,CACF,CAAC;QAEF,gEAAgE;QAChE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;QACzD,IAAI,GAAG,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,iBAAiB,GAAG,MAAM,CAAC,GAAG,EAAE,EACnD,2BAA2B,CAAC,OAAO,EACnC,EAAE,GAAG,EAAE,CACR,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,kDAAkD,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YAE5F,yEAAyE;YACzE,wEAAwE;YACxE,yEAAyE;YACzE,sEAAsE;YACtE,0EAA0E;YAC1E,yEAAyE;YACzE,EAAE;YACF,wEAAwE;YACxE,sEAAsE;YACtE,gEAAgE;YAChE,uEAAuE;YACvE,sEAAsE;YACtE,uEAAuE;YACvE,iEAAiE;YACjE,wEAAwE;YACxE,wEAAwE;YACxE,mEAAmE;YACnE,sEAAsE;YACtE,oEAAoE;YACpE,sEAAsE;YACtE,0EAA0E;YAC1E,yEAAyE;YACzE,iEAAiE;YACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;YACrE,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,uBAAuB,GAAG,MAAM,CAAC,GAAG,EAAE,EACzD,SAAS,EACT,EAAE,GAAG,EAAE,QAAQ,EAAE,CAClB,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,uDAAuD,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;YACxG,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAClD,mEAAmE;QACnE,yDAAyD;QACzD,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;YACvD,IAAI,CAAC,QAAQ,CAAC,gEAAgE,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,gCAAgC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,yDAAyD,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC;QACtC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,2CAA2C,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,wDAAwD;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAE,GAAc,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe;QACvE,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,qDAAqD,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,iBAAiB,GAAG,GAAG,EAAE,EAAE,2BAA2B,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAExH,4CAA4C;QAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,mBAAmB,GAAG,MAAM,EAAE,CAAC,CAAC;YAC7F,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gDAAgD,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAClG,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,0BAA0B,CAAC,MAAc;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACrF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,oBAAoB,GAAG,MAAM,EAAE,EAClD,UAAU,EACV,EAAE,GAAG,EAAE,gBAAgB,GAAG,KAAK,EAAE,CAClC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACrF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,sBAAsB,GAAG,SAAS,EAAE,EACvD,UAAU,EACV,EAAE,GAAG,EAAE,gBAAgB,GAAG,KAAK,EAAE,CAClC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;IACzG,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,4BAA4B,CAAC,MAAc,EAAE,MAAc,EAAE,cAAuB;QAChG,MAAM,cAAc,GAAG,cAAc;YACnC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,cAAc,CAAC;YAC1D,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,aAAa,GAAG,cAAc,EAAE,IAAI,EAAE,qBAAqB,CAAC;QAClE,MAAM,WAAW,GAAG,CAAC,aAAa,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,+BAA+B,CAAC;QAC3G,gEAAgE;QAChE,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACrF,MAAM,MAAM,GAAG,gBAAgB,GAAG,KAAK,CAAC;QACxC,MAAM,eAAe,GAAG,yBAAyB,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,mBAAmB,GAAG,MAAM,EAAE,CAAC,CAAC;QAE7F,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAC/C,+BAA+B,EAC/B,CAAC,MAAM,CAAC,EACR,CAAC,MAAM,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CACpD,CAAC;YAErB,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,+FAA+F;gBAC/F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChD,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC5B,MAAM,YAAY,GAAG,iCAAiC,CAAC;wBACrD,QAAQ,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC;wBAC7B,eAAe;wBACf,sBAAsB,EAAE,MAAM;qBAC/B,CAAC,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,iBAAiB,GAAG,GAAG,EAAE,EAC5C,2BAA2B,CAAC,OAAO,EACnC,EAAE,GAAG,EAAE,YAAY,EAAE,CACtB,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,2DAA2D,EAAE;oBACzE,MAAM;oBACN,YAAY,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC;oBACrC,WAAW;iBACZ,CAAC,CAAC;gBACH,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0DAA0D;YAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE;gBACnE,MAAM;gBACN,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACK,eAAe,CAAC,KAKvB;QACC,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAC/C,IAAI,OAAO,gBAAgB,EAAE,qBAAqB,KAAK,UAAU;YAAE,OAAO;QAE1E,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAClE,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC1B,MAAM,oBAAoB,GAAG,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;YACrF,IAAI,CAAC;gBACH,KAAK,gBAAgB,CAAC,qBAAqB,CAAC;oBAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,UAAU;oBACV,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;oBAClG,iBAAiB,EAAE,KAAK,CAAC,WAAW;oBACpC,aAAa,EAAE,KAAK,CAAC,WAAW;iBACjC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,2DAA2D;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAA;AA1uBY,6BAA6B;IADzC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAC5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IAOtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;qCAbI,aAAa;QACO,uBAAuB;QAC5B,iBAAiB;QACb,0BAA0B;QACjC,YAAY,YAEI,yCAAyC;QAQ9F,uBAAuB;GAlBjD,6BAA6B,CA0uBzC","sourcesContent":["import 'reflect-metadata';\nimport crypto from 'crypto';\nimport { inject, injectable, optional } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport { AuthenticationSession, ExecutionContext_ExecutionType, SessionType, ErrorType, ErrorCustomMessageReference, CoreResourceType, UserStatus } from '@wildo-ai/saas-models';\nimport {\n JwtClaim_App_Auth_UserRequest_Schema,\n JwtClaim_App_RefreshToken_Schema,\n Jwt_RefreshToken_CreationParameter,\n} from '~wildo-backend-lib/security/authentications/models/authentications.backend.schemas';\nimport { AUTH_REDIS_KEYS, RefreshTokenBlacklistReason, REFRESH_TOKEN_ROTATION_GRACE_SECONDS } from '~wildo-backend-lib/security/authentications/models/auth-constants.backend';\nimport {\n buildSessionOrderingScore,\n CONCURRENT_SESSION_EVICTION_LUA,\n readIssuedAtMilliseconds,\n resolveEvictedJtiBlacklistSeconds,\n} from '~wildo-backend-lib/security/authentications/services/utils/concurrent-session-eviction.backend.utils';\nimport { evaluateUserTokenInvalidationFence } from '~wildo-backend-lib/security/token-invalidation-fence.backend.utils';\nimport { evaluateSessionInvalidationFence } from '~wildo-backend-lib/security/session-invalidation-fence.backend.utils';\nimport {\n getUserAuthorizationVersion,\n type AuthorizationVersionedUser,\n} from '~wildo-backend-lib/security/authentications/models/user-authorization-version.backend.utils';\n\n/** L3: Default max concurrent refresh tokens per user. /\nconst DEFAULT_MAX_CONCURRENT_SESSIONS = 10;\n\n/\n Result of token issuance.\n /\nexport interface AuthTokens {\n accessToken: string;\n refreshToken?: string;\n expiresIn?: number;\n}\n\n/\n A-9 — the machine-readable signal a refresh-token REUSE rejection carries so a CALLER can audit the\n * theft. This issuer performs the family-wide revocation itself but deliberately does NOT audit\n * (see the class JSDoc — TRAP 13: callers decide what to audit); instead it TAGS its thrown rejection\n * with this signal, and each refresh caller reads it via {@link extractRefreshTokenReuseSignal} and\n * emits `USER_REFRESH_TOKEN_REUSE_DETECTED`. Never carries the raw token — only the reused `jti`.\n /\nexport interface RefreshTokenReuseSignal {\n /* The user whose whole token family was revoked (the victim). /\n userId: string;\n /* The reused refresh token's `jti` (the replayed credential id). /\n reusedJti: string;\n /* The session the reused token belonged to, when present on the claim. /\n sessionId?: string;\n /* Whether the `TOKEN_INVALID_BEFORE` family-revoke was written (the action the issuer took). /\n familyRevoked: boolean;\n}\n\n/\n Symbol-keyed so the signal rides the thrown rejection object WITHOUT ever appearing in a string-key\n * serialization or the error sanitizer (the reuse detail is internal, for the auditing caller only).\n * `Symbol.for` (the global registry, not a per-module `Symbol()`) so tag ⇄ extract still match if this\n * module is loaded under both ESM and CJS.\n /\nconst REFRESH_TOKEN_REUSE_SIGNAL_KEY = Symbol.for('wildo.auth.refreshTokenReuseSignal');\n\n/\n Tag a refresh-rejection error with the reuse signal (A-9). The issuer calls this after performing the\n * family revoke; the CALLER reads it back and emits the audit — preserving the issuer's no-audit boundary.\n /\nexport function tagRefreshTokenReuseSignal<E extends object>(error: E, signal: RefreshTokenReuseSignal): E {\n Object.defineProperty(error, REFRESH_TOKEN_REUSE_SIGNAL_KEY, {\n value: signal,\n enumerable: false,\n writable: false,\n configurable: false,\n });\n return error;\n}\n\n/\n Read the refresh-reuse signal off a caught error, or `null` when it is not a reuse rejection (a plain\n * revoked/expired/invalid refresh). A caller uses this to emit `USER_REFRESH_TOKEN_REUSE_DETECTED` for\n * the theft case ONLY, then map the error to its own rejection.\n /\nexport function extractRefreshTokenReuseSignal(error: unknown): RefreshTokenReuseSignal \| null {\n if (error !== null && typeof error === 'object' && REFRESH_TOKEN_REUSE_SIGNAL_KEY in error) {\n return (error as Record<typeof REFRESH_TOKEN_REUSE_SIGNAL_KEY, RefreshTokenReuseSignal>)[REFRESH_TOKEN_REUSE_SIGNAL_KEY];\n }\n return null;\n}\n\n/\n AuthTokenIssuerBackendService\n \n Responsibilities:\n * - Issue access tokens (delegates to JwtBackendService)\n * - Issue refresh tokens (delegates to JwtBackendService)\n \n This service does NOT:\n * - Manage sessions (that's AuthSessionStore)\n * - Verify credentials (that's AuthCredentialVerifier)\n * - Audit log (TRAP 13: callers decide what to audit based on full context)\n /\n@injectable()\nexport class AuthTokenIssuerBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.JwtBackendService) private readonly jwtService: JwtBackendService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,\n @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory) private readonly authEcFactory: AuthExecutionContextFactoryBackendService,\n /\n * The audit trail, `@optional()` and APPENDED LAST — the constructor-parameter discipline, and\n * optional for a second reason: this service sits on the token-issuance path, so a host that\n * binds no audit service must still be able to issue tokens. An observer may never be able to\n * fail the thing it observes.\n /\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) @optional()\n private readonly auditLogsService: AuditLogsBackendService \| null = null,\n ) {\n this.logDebug = this.logger.debugByType('AuthTokenIssuer');\n this.logger.setDebugTypeLogging('AuthTokenIssuer', false);\n }\n\n /\n Issue access + refresh tokens for a completed authentication session.\n /\n public async issueTokens(\n session: AuthenticationSession,\n options: { includeRefreshToken?: boolean; lastAuthenticatedAt?: number; activeUserType?: string } = {},\n ): Promise<AuthTokens> {\n const userId = session.userId;\n\n if (!userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_NOT_FOUND,\n context: { missingField: 'userId' },\n });\n }\n\n return this._issueTokensForUser(userId, session.sessionId, options.includeRefreshToken ?? true, {\n lastAuthenticatedAt: options.lastAuthenticatedAt,\n activeUserType: options.activeUserType ?? session.activeUserType ?? undefined,\n });\n }\n\n /\n Issue tokens for an user directly (without a full session).\n * Used by OAuth2/SAML/registration callback flows (TRAP 12) which bypass the session state machine.\n * `activeUserType` is resolved internally from the user record when not provided.\n /\n public async issueTokensForUser(\n userId: string,\n sessionId?: string,\n stepUpClaims?: {\n lastAuthenticatedAt?: number;\n activeUserType?: string;\n sessionType?: SessionType;\n },\n options?: {\n skipSessionTracking?: boolean;\n refreshTokenExpiresAt?: Date;\n },\n ): Promise<AuthTokens> {\n return this._issueTokensForUser(userId, sessionId, true, stepUpClaims, options);\n }\n\n /\n Internal implementation for token issuance.\n * Resolves `activeUserType` from the user DB record when not provided by the caller (N-2).\n /\n private async _issueTokensForUser(\n userId: string,\n sessionId?: string,\n includeRefreshToken: boolean = true,\n stepUpClaims?: {\n lastAuthenticatedAt?: number;\n activeUserType?: string;\n sessionType?: SessionType;\n },\n options?: {\n skipSessionTracking?: boolean;\n refreshTokenExpiresAt?: Date;\n /\n Refresh rotation passes the predecessor's durable authorization\n * version. Rechecking it on the issuance read closes the gap between the\n * refresh preflight read and successor signing.\n /\n expectedAuthorizationVersion?: number;\n },\n ): Promise<AuthTokens> {\n let emailVerified: boolean \| undefined;\n let resolvedActiveUserType = stepUpClaims?.activeUserType;\n\n // Token issuance is a security decision, so the User read and its durable\n // version are mandatory. A best-effort read here would mint an unfenced\n // token precisely when the database boundary is unavailable.\n const tokenEc = await this.authEcFactory.createForAuthenticatedAuthOperation(\n userId,\n this.authEcFactory.getUsersReadOperationPath(),\n );\n const user =\n await this.servicesRegistryHandler.read<AuthorizationVersionedUser>(\n CoreResourceType.USERS,\n tokenEc,\n { _id: userId },\n );\n const authorizationVersion = getUserAuthorizationVersion(user);\n if (!user \|\| authorizationVersion === null) {\n // Two very different faults, deliberately reported apart. Collapsing them into one reason\n // string sent a production investigation looking for a missing version field when the row\n // itself may simply not have been readable — the caller-facing answer is identical either way\n // (fail closed), but the operator-facing one is not: \"no such row\" points at the read's scope\n // or at write visibility, \"no version\" points at the persistence contract.\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: {\n reason: user\n ? 'user_authorization_version_unreadable'\n : 'user_row_not_readable_for_issuance',\n userId,\n // Only ever the SHAPE of what came back — never the value, which is an authorization\n // fence and does not belong in a log line.\n authorizationVersionType: typeof (user as AuthorizationVersionedUser \| null)?._version,\n userStatus: user?.status,\n },\n },\n );\n }\n if (\n options?.expectedAuthorizationVersion !== undefined\n && authorizationVersion !== options.expectedAuthorizationVersion\n ) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: {\n reason: 'user_authorization_version_changed_during_issuance',\n userId,\n },\n },\n );\n }\n\n if (user.status === UserStatus.ACTIVE) {\n emailVerified = true;\n } else if (user.status === UserStatus.PENDING_VERIFICATION) {\n emailVerified = false;\n }\n\n // A caller-carried active type is valid only while the live User still\n // owns it. This prevents direct issuance from preserving a removed auth\n // policy even outside refresh rotation.\n if (resolvedActiveUserType && !user.userTypes?.includes(resolvedActiveUserType)\n ) {\n resolvedActiveUserType = undefined;\n }\n if (!resolvedActiveUserType && user.userTypes?.length) {\n resolvedActiveUserType = user.userTypes[0];\n }\n\n const lastAuthenticatedAt = stepUpClaims?.lastAuthenticatedAt;\n\n const accessClaim = JwtClaim_App_Auth_UserRequest_Schema.parse({\n type: ExecutionContext_ExecutionType.USER_REQUEST,\n userId,\n authorizationVersion,\n sessionType: stepUpClaims?.sessionType ?? SessionType.PERSISTENT,\n ...(emailVerified !== undefined ? { emailVerified } : {}),\n ...(lastAuthenticatedAt !== undefined ? { lastAuthenticatedAt } : {}),\n ...(resolvedActiveUserType ? { activeUserType: resolvedActiveUserType } : {}),\n // revocation-C: carry the session id onto the ACCESS claim (it was already on the refresh claim), so the\n // access-token guard can enforce a per-session revocation fence and the OIDC id_token can carry `sid`.\n ...(sessionId ? { sessionId } : {}),\n });\n\n const accessToken = await this.jwtService.createJwtForAppAuth(accessClaim);\n // Resolved AppConfiguration always has this field (required on\n // `AppConfiguration_JWT_Schema`); operator-authored value flows from\n // `wildo.infra.<env>.config.ts` `serviceAuth.accessTokenExpirationMinutes`\n // through apps-manager bootstrap material and is overlaid by\n // `app-configuration-loader.backend.service.ts`. No literal fallback\n // here on purpose — F-24 (Slice 3.3) made `serviceAuth` the single\n // source of truth, so a missing value should fail the boot rather than\n // silently downgrade to a 15-minute floor.\n const accessTokenMinutes = this.appConfigService.config.jwt.accessTokenExpirationMinutes;\n const accessTokenExpiresInSeconds = accessTokenMinutes 60;\n this.logDebug('Access token issued', { userId, expiresIn: accessTokenExpiresInSeconds });\n\n let refreshToken: string \| undefined;\n if (includeRefreshToken) {\n const jti = crypto.randomUUID();\n const refreshClaim: Jwt_RefreshToken_CreationParameter = {\n type: ExecutionContext_ExecutionType.USER_REQUEST,\n userId,\n authorizationVersion,\n jti,\n sessionId: sessionId,\n sessionType: stepUpClaims?.sessionType ?? SessionType.PERSISTENT,\n ...(lastAuthenticatedAt !== undefined ? { lastAuthenticatedAt } : {}),\n ...(resolvedActiveUserType ? { activeUserType: resolvedActiveUserType } : {}),\n ...(options?.refreshTokenExpiresAt ? { refreshTokenExpiresAt: Math.floor(options.refreshTokenExpiresAt.getTime() / 1000) } : {}),\n };\n\n refreshToken = await this.jwtService.createRefreshToken(\n refreshClaim,\n options?.refreshTokenExpiresAt\n ? { expiresInSeconds: Math.max(1, Math.floor((options.refreshTokenExpiresAt.getTime() - Date.now()) / 1000)) }\n : undefined,\n );\n\n if (!options?.skipSessionTracking) {\n await this._trackAndEnforceSessionLimit(userId, jti, resolvedActiveUserType);\n }\n\n this.logDebug('Refresh token issued', { userId, sessionType: stepUpClaims?.sessionType });\n }\n\n return {\n accessToken,\n refreshToken,\n expiresIn: accessTokenExpiresInSeconds,\n };\n }\n\n /*\n Refresh an access token using a valid refresh token.\n \n Flow:\n * 1. Verify the refresh token JWT signature + expiration\n * 2. Parse claims using JwtClaim_App_RefreshToken_Schema (discriminated union)\n * 3. Issue a fresh access token for the same user\n * 4. Optionally rotate the refresh token (always rotate for security)\n \n @param refreshToken - The JWT refresh token string\n * @returns Fresh access + refresh tokens\n * @throws AUTHENTICATION error if the refresh token is invalid/expired\n /\n public async refreshAccessToken(refreshToken: string): Promise<AuthTokens> {\n // Step 1: Verify the refresh token JWT (signature + expiry + audience=REFRESH_TOKEN)\n let decoded: unknown;\n try {\n decoded = await this.jwtService.verifyRefreshToken(refreshToken);\n } catch (error) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n },\n );\n }\n\n // Step 2: Parse claims using the discriminated union schema\n const parseResult = JwtClaim_App_RefreshToken_Schema.safeParse(decoded);\n if (!parseResult.success) {\n this.logger.warn('Refresh token claims failed validation', { issues: parseResult.error.issues });\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n },\n );\n }\n\n const claims = parseResult.data;\n\n // Step 2b: Read the live User and enforce the durable authorization fence\n // BEFORE the rotation-grace early return. A cached successor must not be\n // returned after userTypes/appRoles/status changed.\n const ec = await this.authEcFactory.createForAuthenticatedAuthOperation(\n claims.userId,\n this.authEcFactory.getUsersReadOperationPath(),\n );\n const currentUser =\n await this.servicesRegistryHandler.read<AuthorizationVersionedUser>(\n CoreResourceType.USERS,\n ec,\n { _id: claims.userId },\n );\n const currentAuthorizationVersion = getUserAuthorizationVersion(currentUser);\n if (!currentUser \|\| currentUser.status !== UserStatus.ACTIVE) {\n this.logger.warn('Refresh token for non-active user', {\n jti: claims.jti,\n userId: claims.userId,\n userStatus: currentUser?.status ?? 'NOT_FOUND',\n });\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n context: {\n userStatus: currentUser?.status ?? 'NOT_FOUND',\n source: 'token_refresh',\n },\n },\n );\n }\n if (\n currentAuthorizationVersion === null\n \|\| currentAuthorizationVersion !== claims.authorizationVersion\n ) {\n this.logger.warn(\n 'Refresh token authorization version no longer matches User',\n {\n jti: claims.jti,\n userId: claims.userId,\n tokenAuthorizationVersion: claims.authorizationVersion,\n currentAuthorizationVersion,\n },\n );\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { reason: 'user_authorization_version_changed' },\n },\n );\n }\n\n // Keep explicit all-session invalidation (password reset / theft\n // detection) ahead of rotation grace as well. AuthorizationVersion closes\n // database authorization races; this timestamp remains the independent\n // credential/session revocation mechanism.\n // GRACE-BOUNDARY (fixed here 2026-07-29, moved to the shared owner 2026-08-01). The fail-closed\n // `<=` — and the full rationale for why the same second must be rejected, and why raising timestamp\n // precision alone would NOT fix it — now lives in {@link evaluateUserTokenInvalidationFence}, which\n // every auth front shares. It was six hand-written copies of this comparison that let the fix land on\n // two of them while four kept the bypassing `<`. Refresh-specific note: this fence is checked BEFORE\n // rotation grace, so a stolen chain cannot ride the grace window past an invalidation.\n const { isRevoked, invalidBefore } = await evaluateUserTokenInvalidationFence(\n this.redisService, claims.userId, claims.iat,\n );\n if (isRevoked) {\n this.logger.warn('Refresh token issued before user-level invalidation', {\n jti: claims.jti,\n userId: claims.userId,\n tokenIat: claims.iat,\n invalidBefore,\n });\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n },\n );\n }\n\n // revocation-C: PER-SESSION fence. Distinct from the user-wide fence above — a single-session\n // terminate (OIDC end_session / per-device logout) evicts THIS session's refresh chain while the\n // user's other sessions stay live. Checked here so the terminated session cannot rotate a new\n // access token; the access guard checks the same fence so the current access token also dies.\n const sessionFence = await evaluateSessionInvalidationFence(\n this.redisService, claims.sessionId, claims.iat,\n );\n if (sessionFence.isRevoked) {\n this.logger.warn('Refresh token issued before per-session invalidation', {\n jti: claims.jti,\n userId: claims.userId,\n sessionId: claims.sessionId,\n tokenIat: claims.iat,\n invalidBefore: sessionFence.invalidBefore,\n });\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n },\n );\n }\n\n // Step 2c: Check JTI blacklist (revoked tokens) with reuse detection.\n const blacklistValue = await this.redisService.get<string>(`${AUTH_REDIS_KEYS.REFRESH_BLACKLIST}${claims.jti}`);\n if (blacklistValue) {\n if (blacklistValue === RefreshTokenBlacklistReason.ROTATED) {\n // IDEMPOTENT-ROTATION GRACE (checked BEFORE theft revocation): a token\n // re-presented within {@link REFRESH_TOKEN_ROTATION_GRACE_SECONDS} of\n // its rotation is almost always a benign race — a lost/retried refresh\n // response, or a second browsing context that read the shared\n // `__wildo_refresh` cookie a beat before the rotation replaced it. In\n // that case the original rotation cached its successor tokens; return\n // that SAME successor so the racing client converges on one token\n // family instead of being force-logged-out. Genuine theft re-presents\n // the token long after this window, by which time the grace key has\n // expired and control falls through to full revocation below.\n const graceSuccessor = await this.redisService.get<AuthTokens>(\n `${AUTH_REDIS_KEYS.REFRESH_GRACE_SUCCESSOR}${claims.jti}`,\n );\n if (graceSuccessor) {\n // Both durable authorizationVersion and explicit Redis invalidation\n // were checked above. Returning the exact cached successor therefore\n // grants nothing beyond the legitimate rotation winner and cannot\n // bypass an intervening User authorization mutation.\n this.logger.info('Refresh-token reuse within rotation grace window — returning cached successor (benign race, NOT revoking)', {\n jti: claims.jti,\n userId: claims.userId,\n type: claims.type,\n });\n return graceSuccessor;\n }\n\n // REUSE DETECTED outside the grace window: the old refresh token may\n // have been stolen — revoke ALL tokens for this user.\n this.logger.warn('REFRESH TOKEN REUSE DETECTED — possible token theft, revoking all tokens for user', {\n jti: claims.jti,\n userId : claims.userId,\n type: claims.type,\n });\n // F-24 (Slice 3.3): refresh-token TTL is required on the resolved\n // AppConfiguration and authoritatively sourced from operator-authored\n // `serviceAuth.refreshTokenExpirationDays`; no literal fallback.\n const refreshTokenDays = this.appConfigService.config.jwt.refreshTokenExpirationDays;\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.TOKEN_INVALID_BEFORE}${claims.userId}`,\n Math.floor(Date.now() / 1000),\n { ttl: refreshTokenDays 86400 },\n );\n // A-9: this issuer performed the family revoke but does NOT audit (TRAP 13 — see class JSDoc).\n // TAG the rejection with the reuse signal so the CALLER emits `USER_REFRESH_TOKEN_REUSE_DETECTED`\n // for this theft (the plain-revoked `else` below throws the UNtagged twin, so a routine revoked\n // token is not mis-audited as theft). Distinct throw here — never falls through to the shared one.\n // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — credential-theft detection + response.\n throw tagRefreshTokenReuseSignal(\n this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN },\n ) as object,\n {\n userId: claims.userId,\n reusedJti: claims.jti,\n sessionId: claims.sessionId,\n familyRevoked: true,\n },\n );\n } else {\n this.logger.warn('Refresh token has been revoked', { jti: claims.jti });\n }\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n },\n );\n }\n\n // Step 3: Issue new tokens — carry forward session-scoped claims, but\n // require the issuance read to observe this same authorization version.\n this.logDebug('Refresh token validated, issuing new tokens', { userId : claims.userId, jti: claims.jti });\n const refreshLastAuthAt = claims.lastAuthenticatedAt;\n const refreshActiveUserType = claims.activeUserType;\n const refreshSessionType = claims.sessionType;\n const refreshTokenExpiresAtClaim = claims.refreshTokenExpiresAt;\n\n const newTokens = await this._issueTokensForUser(\n claims.userId,\n claims.sessionId,\n true,\n {\n lastAuthenticatedAt: refreshLastAuthAt,\n activeUserType: refreshActiveUserType,\n sessionType: refreshSessionType ?? SessionType.PERSISTENT,\n },\n {\n ...(refreshSessionType === SessionType.ONE_OFF ? { skipSessionTracking: true } : {}),\n ...(refreshTokenExpiresAtClaim ? { refreshTokenExpiresAt: new Date(refreshTokenExpiresAtClaim * 1000) } : {}),\n expectedAuthorizationVersion: claims.authorizationVersion,\n },\n );\n\n // Step 4: Blacklist the consumed refresh token JTI as 'rotated'\n const nowSeconds = Math.floor(Date.now() / 1000);\n const ttl = claims.exp ? claims.exp - nowSeconds : 86400;\n if (ttl > 0 && claims.jti) {\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.REFRESH_BLACKLIST}${claims.jti}`,\n RefreshTokenBlacklistReason.ROTATED,\n { ttl },\n );\n this.logDebug('Old refresh token JTI blacklisted after rotation', { jti: claims.jti, ttl });\n\n // Cache the successor under the consumed JTI for the idempotent-rotation\n // grace window so a benign reuse race returns THIS exact successor (see\n // Step 2b) instead of being revoked. The TTL is the grace window clamped\n // to the consumed token's own remaining lifetime — the grace entry is\n // ALWAYS shorter-lived than the blacklist entry above, so once it expires\n // a re-presented token still trips full revocation (theft is preserved).\n //\n // AT-REST EXPOSURE (accepted, bounded): this is the ONLY place the auth\n // subsystem writes live token material to Redis — `REFRESH_BLACKLIST`\n // holds only reason strings, `TOKEN_INVALID_BEFORE` timestamps,\n // `ACTIVE_REFRESH_JTIS` only JTIs, and the session store holds session\n // state, never tokens. We store the FULL successor (incl. the refresh\n // token) because the idempotent guarantee requires returning the exact\n // same tokens — re-issuing would mint a divergent family, and an\n // access-token-only cache would break the lost-rotation-response client\n // (its cookie is still the now-blacklisted predecessor, so it needs the\n // successor refresh token re-sent via `Set-Cookie` to advance). An\n // attacker with Redis read access (snapshot/AOF dump, MONITOR, leaked\n // backup) could therefore harvest refresh tokens minted in the last\n // `graceTtl` seconds — but such an attacker already reads the session\n // store, so the marginal blast radius is one short window. If that window\n // ever needs hardening, encrypt this blob at rest (the read site already\n // fails closed to revocation on a parse miss). It is NOT logged.\n const graceTtl = Math.min(REFRESH_TOKEN_ROTATION_GRACE_SECONDS, ttl);\n if (graceTtl > 0) {\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.REFRESH_GRACE_SUCCESSOR}${claims.jti}`,\n newTokens,\n { ttl: graceTtl },\n );\n this.logDebug('Cached rotation successor for idempotent-grace window', { jti: claims.jti, graceTtl });\n }\n }\n\n return newTokens;\n }\n\n /*\n Revoke a refresh token by adding its JTI to the Redis blacklist.\n * TTL matches the token's remaining lifetime so the entry auto-expires.\n \n Called from the logout route handler.\n /\n public async revokeRefreshToken(refreshToken: string): Promise<void> {\n // Decode the token to extract JTI and exp. We verify the signature\n // so that arbitrary strings can't pollute the blacklist.\n let decoded: unknown;\n try {\n decoded = await this.jwtService.verifyRefreshToken(refreshToken);\n } catch {\n // Token is already invalid/expired — nothing to revoke\n this.logDebug('Refresh token revocation skipped — token is invalid or expired');\n return;\n }\n\n const parseResult = JwtClaim_App_RefreshToken_Schema.safeParse(decoded);\n if (!parseResult.success) {\n this.logDebug('Refresh token revocation skipped — claims are malformed');\n return;\n }\n\n const { jti, exp } = parseResult.data;\n if (!jti) {\n this.logDebug('Refresh token revocation skipped — no JTI');\n return;\n }\n\n // TTL = remaining seconds until token naturally expires\n const nowSeconds = Math.floor(Date.now() / 1000);\n const ttl = exp ? (exp as number) - nowSeconds : 86400; // fallback 24h\n if (ttl <= 0) {\n this.logDebug('Refresh token already expired — no blacklist needed', { jti });\n return;\n }\n\n await this.redisService.set(`${AUTH_REDIS_KEYS.REFRESH_BLACKLIST}${jti}`, RefreshTokenBlacklistReason.REVOKED, { ttl });\n\n // L3: Remove from active refresh tokens set\n const claims = parseResult.data;\n const userId = claims.userId;\n try {\n const setKey = this.redisService.buildKey(`${AUTH_REDIS_KEYS.ACTIVE_REFRESH_JTIS}${userId}`);\n await this.redisService.eval('redis.call(\"ZREM\", KEYS[1], ARGV[1]); return 1', [setKey], [jti]);\n } catch {\n // Non-fatal\n }\n\n this.logDebug('Refresh token revoked', { jti, ttlSeconds: ttl });\n }\n\n /\n Invalidate all refresh tokens for an user by setting a per-user\n * \"invalid before\" timestamp in Redis. All refresh tokens with `iat` before\n * this timestamp will be rejected on next use.\n \n Used on password change/reset (C4) and token reuse detection (H3).\n * TTL matches operator-authored `serviceAuth.refreshTokenExpirationDays`\n * (F-24, Slice 3.3); no literal fallback.\n /\n public async invalidateAllTokensForUser(userId: string): Promise<void> {\n const nowSeconds = Math.floor(Date.now() / 1000);\n const refreshTokenDays = this.appConfigService.config.jwt.refreshTokenExpirationDays;\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.TOKEN_INVALID_BEFORE}${userId}`,\n nowSeconds,\n { ttl: refreshTokenDays 86400 },\n );\n this.logDebug('All tokens invalidated for user', { userId, invalidBefore: nowSeconds });\n }\n\n /*\n revocation-C: invalidate a SINGLE login session by setting a per-session \"invalid before\"\n * timestamp in Redis. Every access/refresh token whose `sessionId` matches AND whose `iat` is at or\n * before this timestamp is rejected on next use — at every first-party auth front: the refresh exchange\n * ({@link refreshAccessToken}), the first-party access guard (`auth-jwt-guard.extractAuthenticatedUser`),\n * and the manual-controller / resource-API / socket-handshake fronts (`execution-context-creator`), all\n * via {@link evaluateSessionInvalidationFence}.\n \n This is the least-privilege sibling of {@link invalidateAllTokensForUser}: it terminates ONE\n * session (the OIDC `end_session_endpoint` / RP-Initiated Logout, and per-device logout), leaving the\n * user's other sessions live. TTL matches operator-authored `jwt.refreshTokenExpirationDays` — the\n * fence only needs to outlive the longest-lived token that could still carry this `sessionId`, after\n * which no such token can exist and the key is dead weight.\n /\n public async invalidateSession(sessionId: string): Promise<void> {\n const nowSeconds = Math.floor(Date.now() / 1000);\n const refreshTokenDays = this.appConfigService.config.jwt.refreshTokenExpirationDays;\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.SESSION_INVALID_BEFORE}${sessionId}`,\n nowSeconds,\n { ttl: refreshTokenDays 86400 },\n );\n this.logDebug('Session invalidated (per-session fence set)', { sessionId, invalidBefore: nowSeconds });\n }\n\n /*\n L3: Track an active refresh token JTI for an user and enforce the concurrent session limit.\n \n Uses a Redis sorted set per user where:\n * - Members = JTI strings\n * - Scores = issuedAt in MILLISECONDS (for FIFO eviction)\n \n When the set exceeds the max size (default 10), the oldest JTI(s) are evicted\n * and blacklisted so they can't be used anymore.\n \n The ordering, the score's unit, and the blacklist TTL all live in\n * `concurrent-session-eviction.backend.utils` — retiring the OLDEST chain is the security property\n * the cap exists to provide, so it is a named, separately-tested policy rather than a detail of\n * this method. See {@link buildSessionOrderingScore} for why whole-second scores silently made the\n * eviction arbitrary.\n /\n private async _trackAndEnforceSessionLimit(userId: string, newJti: string, activeUserType?: string): Promise<void> {\n const userTypeConfig = activeUserType\n ? this.appConfigService.config.userTypes?.[activeUserType]\n : undefined;\n const configuredMax = userTypeConfig?.auth?.maxConcurrentSessions;\n const maxSessions = (configuredMax && configuredMax > 0) ? configuredMax : DEFAULT_MAX_CONCURRENT_SESSIONS;\n // F-24 (Slice 3.3): operator-authored TTL; no literal fallback.\n const refreshTokenDays = this.appConfigService.config.jwt.refreshTokenExpirationDays;\n const setTtl = refreshTokenDays 86400;\n const nowMilliseconds = buildSessionOrderingScore();\n const setKey = this.redisService.buildKey(`${AUTH_REDIS_KEYS.ACTIVE_REFRESH_JTIS}${userId}`);\n\n try {\n const evictedPairs = await this.redisService.eval(\n CONCURRENT_SESSION_EVICTION_LUA,\n [setKey],\n [newJti, String(nowMilliseconds), String(maxSessions), String(setTtl)],\n ) as string[] \| null;\n\n if (evictedPairs && evictedPairs.length > 0) {\n // evictedPairs is [jti, score, jti, score, ...] — blacklist each with its actual remaining TTL\n for (let i = 0; i < evictedPairs.length; i += 2) {\n const jti = evictedPairs[i];\n const remainingTtl = resolveEvictedJtiBlacklistSeconds({\n rawScore: evictedPairs[i + 1],\n nowMilliseconds,\n refreshTokenTtlSeconds: setTtl,\n });\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.REFRESH_BLACKLIST}${jti}`,\n RefreshTokenBlacklistReason.EVICTED,\n { ttl: remainingTtl },\n );\n }\n this.logDebug('Concurrent session limit enforced — evicted oldest tokens', {\n userId,\n evictedCount: evictedPairs.length / 2,\n maxSessions,\n });\n this.recordEvictions({ userId, evictedPairs, maxSessions, nowMilliseconds });\n }\n } catch (error) {\n // Non-fatal: don't block token issuance if tracking fails\n this.logger.warn('Failed to track/enforce concurrent session limit', {\n userId,\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n /*\n Record each retired refresh chain in the audit trail.\n \n Until 2026-09-02 the only trace of an eviction was the debug line above — a security-relevant\n * token-lifecycle act with no durable record, which is exactly what `CLAUDE.md`'s\n * assurance-by-construction rule asks for by name. The cap exists to bound the blast radius of\n * undetected token theft, so a burst of evictions for one principal is among the more interesting\n * things the trail can carry, and it was not carrying it.\n \n `evictedIssuedAt` is what makes the record worth having: the cap's security property is that the\n * OLDEST chain goes, and a record naming only the victim would prove a session ended without\n * proving the right one did. An unreadable score yields ABSENCE rather than a synthesised instant —\n * a fabricated timestamp would make the first-in-first-out claim unfalsifiable.\n \n Feature-DETECTED rather than null-checked, for the reason recorded at the cross-tenant emitter:\n * adding a `log` method breaks partially-mocked doubles, the property is absent, and the CALL\n throws synchronously before any `.catch()` can make it fire-and-forget.\n \n assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — the bound's enforcement is\n * evidenced, naming WHICH chain was retired and when it was issued.\n /\n private recordEvictions(input: {\n userId: string;\n evictedPairs: string[];\n maxSessions: number;\n nowMilliseconds: number;\n }): void {\n const auditLogsService = this.auditLogsService;\n if (typeof auditLogsService?.logUserSessionEvicted !== 'function') return;\n\n for (let index = 0; index < input.evictedPairs.length; index += 2) {\n const evictedJti = input.evictedPairs[index];\n if (!evictedJti) continue;\n const issuedAtMilliseconds = readIssuedAtMilliseconds(input.evictedPairs[index + 1]);\n try {\n void auditLogsService.logUserSessionEvicted({\n userId: input.userId,\n evictedJti,\n ...(issuedAtMilliseconds === undefined ? {} : { evictedIssuedAt: new Date(issuedAtMilliseconds) }),\n configuredMaximum: input.maxSessions,\n retainedCount: input.maxSessions,\n }).catch(() => undefined);\n } catch {\n / An observer must never fail the issuance it observes. */\n }\n }\n }\n}\n"]}
1	+ {"version":3,"file":"auth-token-issuer.backend.service.js","sourceRoot":"","sources":["../../../../../src/security/authentications/services/auth-token-issuer.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAE3H,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAyB,8BAA8B,EAAE,WAAW,EAAE,SAAS,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACjL,OAAO,EACL,oCAAoC,EACpC,gCAAgC,GAEjC,MAAM,oFAAoF,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,oCAAoC,EAAE,MAAM,2EAA2E,CAAC;AAC/K,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,wBAAwB,EACxB,iCAAiC,GAClC,MAAM,sGAAsG,CAAC;AAC9G,OAAO,EAAE,kCAAkC,EAAE,MAAM,oEAAoE,CAAC;AACxH,OAAO,EAAE,gCAAgC,EAAE,MAAM,sEAAsE,CAAC;AACxH,OAAO,EACL,oBAAoB,EAEpB,oBAAoB,GACrB,MAAM,gFAAgF,CAAC;AACxF,OAAO,EACL,2BAA2B,GAE5B,MAAM,6FAA6F,CAAC;AAErG,0DAA0D;AAC1D,MAAM,+BAA+B,GAAG,EAAE,CAAC;AA6B3C;;;;;GAKG;AACH,MAAM,8BAA8B,GAAG,MAAM,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;AAExF;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAmB,KAAQ,EAAE,MAA+B;IACpG,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,8BAA8B,EAAE;QAC3D,KAAK,EAAE,MAAM;QACb,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,KAAK;QACf,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC3D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,8BAA8B,IAAI,KAAK,EAAE,CAAC;QAC3F,OAAQ,KAAgF,CAAC,8BAA8B,CAAC,CAAC;IAC3H,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AAEI,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAIc;IACU;IACC;IACE;IACP;IACkB;IACH;IAQxD;IASA;IA1BF,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACX,gBAAyC,EACxC,UAA6B,EAC3B,YAAwC,EAC/C,YAA0B,EACR,uBAA8D,EACjE,aAAwD,EAQhH,mBAAmD,IAAI,EASvD,cAAoD;QAvBjB,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QACxC,eAAU,GAAV,UAAU,CAAmB;QAC3B,iBAAY,GAAZ,YAAY,CAA4B;QAC/C,iBAAY,GAAZ,YAAY,CAAc;QACR,4BAAuB,GAAvB,uBAAuB,CAAuC;QACjE,kBAAa,GAAb,aAAa,CAA2C;QAQhH,qBAAgB,GAAhB,gBAAgB,CAAuC;QASvD,mBAAc,GAAd,cAAc,CAAsC;QAErE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,WAAW,CACtB,OAA8B,EAC9B,UAAoG,EAAE;QAEtG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAE9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;gBAC7F,OAAO,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,mBAAmB,IAAI,IAAI,EAAE;YAC9F,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,IAAI,SAAS;SAC9E,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,kBAAkB,CAC7B,MAAc,EACd,SAAkB,EAClB,YAIC,EACD,OAGC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IAClF,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,mBAAmB,CAC/B,MAAc,EACd,SAAkB,EAClB,sBAA+B,IAAI,EACnC,YAIC,EACD,OASC;QAED,IAAI,aAAkC,CAAC;QACvC,IAAI,sBAAsB,GAAG,YAAY,EAAE,cAAc,CAAC;QAE1D,0EAA0E;QAC1E,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mCAAmC,CAC1E,MAAM,EACN,IAAI,CAAC,aAAa,CAAC,yBAAyB,EAAE,CAC/C,CAAC;QACF,MAAM,IAAI,GACR,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACrC,gBAAgB,CAAC,KAAK,EACtB,OAAO,EACP,EAAE,GAAG,EAAE,MAAM,EAAE,CAChB,CAAC;QACJ,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,IAAI,oBAAoB,KAAK,IAAI,EAAE,CAAC;YAC3C,0FAA0F;YAC1F,0FAA0F;YAC1F,8FAA8F;YAC9F,8FAA8F;YAC9F,2EAA2E;YAC3E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,4BAA4B;gBAC1D,OAAO,EAAE;oBACP,MAAM,EAAE,IAAI;wBACV,CAAC,CAAC,uCAAuC;wBACzC,CAAC,CAAC,oCAAoC;oBACxC,MAAM;oBACN,qFAAqF;oBACrF,2CAA2C;oBAC3C,wBAAwB,EAAE,OAAQ,IAA0C,EAAE,QAAQ;oBACtF,UAAU,EAAE,IAAI,EAAE,MAAM;iBACzB;aACF,CACF,CAAC;QACJ,CAAC;QACD,IACE,OAAO,EAAE,4BAA4B,KAAK,SAAS;eAChD,oBAAoB,KAAK,OAAO,CAAC,4BAA4B,EAChE,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,4BAA4B;gBAC1D,OAAO,EAAE;oBACP,MAAM,EAAE,oDAAoD;oBAC5D,MAAM;iBACP;aACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YACtC,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,oBAAoB,EAAE,CAAC;YAC3D,aAAa,GAAG,KAAK,CAAC;QACxB,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,wCAAwC;QACxC,IAAI,sBAAsB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,sBAAsB,CAAC,EAC7E,CAAC;YACD,sBAAsB,GAAG,SAAS,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,sBAAsB,IAAI,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;YACtD,sBAAsB,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,mBAAmB,GAAG,YAAY,EAAE,mBAAmB,CAAC;QAE9D,MAAM,WAAW,GAAG,oCAAoC,CAAC,KAAK,CAAC;YAC7D,IAAI,EAAE,8BAA8B,CAAC,YAAY;YACjD,MAAM;YACN,oBAAoB;YACpB,WAAW,EAAE,YAAY,EAAE,WAAW,IAAI,WAAW,CAAC,UAAU;YAChE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,yGAAyG;YACzG,uGAAuG;YACvG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAC3E,+DAA+D;QAC/D,qEAAqE;QACrE,2EAA2E;QAC3E,6DAA6D;QAC7D,qEAAqE;QACrE,mEAAmE;QACnE,uEAAuE;QACvE,2CAA2C;QAC3C,MAAM,kBAAkB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC;QACzF,MAAM,2BAA2B,GAAG,kBAAkB,GAAG,EAAE,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAEzF,IAAI,YAAgC,CAAC;QACrC,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAChC,MAAM,YAAY,GAAuC;gBACvD,IAAI,EAAE,8BAA8B,CAAC,YAAY;gBACjD,MAAM;gBACN,oBAAoB;gBACpB,GAAG;gBACH,SAAS,EAAE,SAAS;gBACpB,WAAW,EAAE,YAAY,EAAE,WAAW,IAAI,WAAW,CAAC,UAAU;gBAChE,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,GAAG,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjI,CAAC;YAEF,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CACrD,YAAY,EACZ,OAAO,EAAE,qBAAqB;gBAC5B,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE;gBAC9G,CAAC,CAAC,SAAS,CACd,CAAC;YAEF,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;YAC/E,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,OAAO;YACL,WAAW;YACX,YAAY;YACZ,SAAS,EAAE,2BAA2B;SACvC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAClD,qFAAqF;QACrF,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CACF,CAAC;QACJ,CAAC;QAED,4DAA4D;QAC5D,MAAM,WAAW,GAAG,gCAAgC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACjG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC;QAEhC,0EAA0E;QAC1E,yEAAyE;QACzE,oDAAoD;QACpD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mCAAmC,CACrE,MAAM,CAAC,MAAM,EACb,IAAI,CAAC,aAAa,CAAC,yBAAyB,EAAE,CAC/C,CAAC;QACF,MAAM,WAAW,GACf,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACrC,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CACvB,CAAC;QACJ,MAAM,2BAA2B,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;QAC7E,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;gBACpD,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,WAAW;aAC/C,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,6BAA6B;gBAC3D,OAAO,EAAE;oBACP,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,WAAW;oBAC9C,MAAM,EAAE,eAAe;iBACxB;aACF,CACF,CAAC;QACJ,CAAC;QACD,IACE,2BAA2B,KAAK,IAAI;eACjC,2BAA2B,KAAK,MAAM,CAAC,oBAAoB,EAC9D,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4DAA4D,EAC5D;gBACE,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,yBAAyB,EAAE,MAAM,CAAC,oBAAoB;gBACtD,2BAA2B;aAC5B,CACF,CAAC;YACF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,4BAA4B;gBAC1D,OAAO,EAAE,EAAE,MAAM,EAAE,oCAAoC,EAAE;aAC1D,CACF,CAAC;QACJ,CAAC;QAED,iEAAiE;QACjE,0EAA0E;QAC1E,uEAAuE;QACvE,2CAA2C;QAC3C,gGAAgG;QAChG,oGAAoG;QACpG,oGAAoG;QACpG,sGAAsG;QACtG,qGAAqG;QACrG,uFAAuF;QACvF,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,MAAM,kCAAkC,CAC3E,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAC7C,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE;gBACtE,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,GAAG;gBACpB,aAAa;aACd,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,4BAA4B;aAC3D,CACF,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,iGAAiG;QACjG,8FAA8F;QAC9F,8FAA8F;QAC9F,MAAM,YAAY,GAAG,MAAM,gCAAgC,CACzD,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAChD,CAAC;QACF,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;gBACvE,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,MAAM,CAAC,GAAG;gBACpB,aAAa,EAAE,YAAY,CAAC,aAAa;aAC1C,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,4BAA4B;aAC3D,CACF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAS,GAAG,eAAe,CAAC,iBAAiB,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAChH,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,cAAc,KAAK,2BAA2B,CAAC,OAAO,EAAE,CAAC;gBAC3D,uEAAuE;gBACvE,sEAAsE;gBACtE,uEAAuE;gBACvE,8DAA8D;gBAC9D,sEAAsE;gBACtE,sEAAsE;gBACtE,kEAAkE;gBAClE,sEAAsE;gBACtE,oEAAoE;gBACpE,8DAA8D;gBAC9D,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAChD,GAAG,eAAe,CAAC,uBAAuB,GAAG,MAAM,CAAC,GAAG,EAAE,CAC1D,CAAC;gBACF,IAAI,cAAc,EAAE,CAAC;oBACnB,oEAAoE;oBACpE,qEAAqE;oBACrE,kEAAkE;oBAClE,qDAAqD;oBACrD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2GAA2G,EAAE;wBAC5H,GAAG,EAAE,MAAM,CAAC,GAAG;wBACf,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,IAAI,EAAE,MAAM,CAAC,IAAI;qBAClB,CAAC,CAAC;oBACH,OAAO,cAAc,CAAC;gBACxB,CAAC;gBAED,qEAAqE;gBACrE,sDAAsD;gBACtD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mFAAmF,EAAE;oBACpG,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,MAAM,EAAG,MAAM,CAAC,MAAM;oBACtB,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC,CAAC;gBACH,kEAAkE;gBAClE,sEAAsE;gBACtE,iEAAiE;gBACjE,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC;gBACrF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,EACzD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAC7B,EAAE,GAAG,EAAE,gBAAgB,GAAG,KAAK,EAAE,CAClC,CAAC;gBACF,+FAA+F;gBAC/F,kGAAkG;gBAClG,gGAAgG;gBAChG,mGAAmG;gBACnG,kGAAkG;gBAClG,MAAM,0BAA0B,CAC9B,IAAI,CAAC,YAAY,CAAC,UAAU,CAC1B,SAAS,CAAC,cAAc,EACxB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B,EAAE,CAC3E,EACX;oBACE,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,SAAS,EAAE,MAAM,CAAC,GAAG;oBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,aAAa,EAAE,IAAI;iBACpB,CACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CACF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,wEAAwE;QACxE,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE,EAAE,MAAM,EAAG,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1G,MAAM,iBAAiB,GAAG,MAAM,CAAC,mBAAmB,CAAC;QACrD,MAAM,qBAAqB,GAAG,MAAM,CAAC,cAAc,CAAC;QACpD,MAAM,kBAAkB,GAAG,MAAM,CAAC,WAAW,CAAC;QAC9C,MAAM,0BAA0B,GAAG,MAAM,CAAC,qBAAqB,CAAC;QAEhE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAC9C,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,SAAS,EAChB,IAAI,EACJ;YACE,mBAAmB,EAAE,iBAAiB;YACtC,cAAc,EAAE,qBAAqB;YACrC,WAAW,EAAE,kBAAkB,IAAI,WAAW,CAAC,UAAU;SAC1D,EACD;YACE,GAAG,CAAC,kBAAkB,KAAK,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,IAAI,CAAC,0BAA0B,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7G,4BAA4B,EAAE,MAAM,CAAC,oBAAoB;SAC1D,CACF,CAAC;QAEF,gEAAgE;QAChE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;QACzD,IAAI,GAAG,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,iBAAiB,GAAG,MAAM,CAAC,GAAG,EAAE,EACnD,2BAA2B,CAAC,OAAO,EACnC,EAAE,GAAG,EAAE,CACR,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,kDAAkD,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YAE5F,yEAAyE;YACzE,wEAAwE;YACxE,yEAAyE;YACzE,sEAAsE;YACtE,0EAA0E;YAC1E,yEAAyE;YACzE,EAAE;YACF,wEAAwE;YACxE,sEAAsE;YACtE,gEAAgE;YAChE,uEAAuE;YACvE,sEAAsE;YACtE,uEAAuE;YACvE,iEAAiE;YACjE,wEAAwE;YACxE,wEAAwE;YACxE,mEAAmE;YACnE,sEAAsE;YACtE,oEAAoE;YACpE,sEAAsE;YACtE,0EAA0E;YAC1E,yEAAyE;YACzE,iEAAiE;YACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;YACrE,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,uBAAuB,GAAG,MAAM,CAAC,GAAG,EAAE,EACzD,SAAS,EACT,EAAE,GAAG,EAAE,QAAQ,EAAE,CAClB,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,uDAAuD,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;YACxG,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAClD,mEAAmE;QACnE,yDAAyD;QACzD,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;YACvD,IAAI,CAAC,QAAQ,CAAC,gEAAgE,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,gCAAgC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,yDAAyD,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC;QACtC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,2CAA2C,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,wDAAwD;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAE,GAAc,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe;QACvE,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,qDAAqD,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,iBAAiB,GAAG,GAAG,EAAE,EAAE,2BAA2B,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAExH,4CAA4C;QAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,mBAAmB,GAAG,MAAM,EAAE,CAAC,CAAC;YAC7F,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gDAAgD,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAClG,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,0BAA0B,CAAC,MAAc;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACrF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,oBAAoB,GAAG,MAAM,EAAE,EAClD,UAAU,EACV,EAAE,GAAG,EAAE,gBAAgB,GAAG,KAAK,EAAE,CAClC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACrF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,sBAAsB,GAAG,SAAS,EAAE,EACvD,UAAU,EACV,EAAE,GAAG,EAAE,gBAAgB,GAAG,KAAK,EAAE,CAClC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;IACzG,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,4BAA4B,CAAC,MAAc,EAAE,MAAc,EAAE,cAAuB;QAChG,MAAM,cAAc,GAAG,cAAc;YACnC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,cAAc,CAAC;YAC1D,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,aAAa,GAAG,cAAc,EAAE,IAAI,EAAE,qBAAqB,CAAC;QAClE,MAAM,WAAW,GAAG,CAAC,aAAa,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,+BAA+B,CAAC;QAC3G,gEAAgE;QAChE,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACrF,MAAM,MAAM,GAAG,gBAAgB,GAAG,KAAK,CAAC;QACxC,MAAM,eAAe,GAAG,yBAAyB,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,mBAAmB,GAAG,MAAM,EAAE,CAAC,CAAC;QAE7F,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAC/C,+BAA+B,EAC/B,CAAC,MAAM,CAAC,EACR,CAAC,MAAM,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CACpD,CAAC;YAErB,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,+FAA+F;gBAC/F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChD,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC5B,MAAM,YAAY,GAAG,iCAAiC,CAAC;wBACrD,QAAQ,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC;wBAC7B,eAAe;wBACf,sBAAsB,EAAE,MAAM;qBAC/B,CAAC,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,iBAAiB,GAAG,GAAG,EAAE,EAC5C,2BAA2B,CAAC,OAAO,EACnC,EAAE,GAAG,EAAE,YAAY,EAAE,CACtB,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,2DAA2D,EAAE;oBACzE,MAAM;oBACN,YAAY,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC;oBACrC,WAAW;iBACZ,CAAC,CAAC;gBACH,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0DAA0D;YAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE;gBACnE,MAAM;gBACN,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACK,eAAe,CAAC,KAKvB;QACC,gGAAgG;QAChG,kGAAkG;QAClG,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,KAAK,UAAU;YAChF,CAAC,CAAC,IAAI,CAAC,gBAAgB;YACvB,CAAC,CAAC,SAAS,CAAC;QAEd,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAClE,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAC7C,8FAA8F;YAC9F,wBAAwB;YACxB,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC1B,MAAM,oBAAoB,GAAG,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;YACrF,oBAAoB,CAAC;gBACnB,WAAW,EAAE,oBAAoB,CAAC,oBAAoB;gBACtD,IAAI,EAAE,OAAO;oBACX,CAAC,CAAC,GAAY,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC;wBAC7C,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,UAAU;wBACV,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;wBAClG,iBAAiB,EAAE,KAAK,CAAC,WAAW;wBACpC,aAAa,EAAE,KAAK,CAAC,WAAW;qBACjC,CAAC;oBACF,CAAC,CAAC,SAAS;gBACb,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,2FAA2F;gBAC3F,yFAAyF;gBACzF,OAAO,EAAE;oBACP,cAAc,EAAE,KAAK,CAAC,MAAM;oBAC5B,kBAAkB,EAAE,UAAU;oBAC9B,yBAAyB,EAAE,KAAK,CAAC,WAAW;iBAC7C;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF,CAAA;AAhxBY,6BAA6B;IADzC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAC5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IAOtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;IASvD,WAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;qCAtBM,aAAa;QACO,uBAAuB;QAC5B,iBAAiB;QACb,0BAA0B;QACjC,YAAY,YAEI,yCAAyC;QAQ9F,uBAAuB;GAlBjD,6BAA6B,CAgxBzC","sourcesContent":["import 'reflect-metadata';\nimport crypto from 'crypto';\nimport { inject, injectable, optional } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport { AuthenticationSession, ExecutionContext_ExecutionType, SessionType, ErrorType, ErrorCustomMessageReference, CoreResourceType, UserStatus } from '@wildo-ai/saas-models';\nimport {\n JwtClaim_App_Auth_UserRequest_Schema,\n JwtClaim_App_RefreshToken_Schema,\n Jwt_RefreshToken_CreationParameter,\n} from '~wildo-backend-lib/security/authentications/models/authentications.backend.schemas';\nimport { AUTH_REDIS_KEYS, RefreshTokenBlacklistReason, REFRESH_TOKEN_ROTATION_GRACE_SECONDS } from '~wildo-backend-lib/security/authentications/models/auth-constants.backend';\nimport {\n buildSessionOrderingScore,\n CONCURRENT_SESSION_EVICTION_LUA,\n readIssuedAtMilliseconds,\n resolveEvictedJtiBlacklistSeconds,\n} from '~wildo-backend-lib/security/authentications/services/utils/concurrent-session-eviction.backend.utils';\nimport { evaluateUserTokenInvalidationFence } from '~wildo-backend-lib/security/token-invalidation-fence.backend.utils';\nimport { evaluateSessionInvalidationFence } from '~wildo-backend-lib/security/session-invalidation-fence.backend.utils';\nimport {\n AuditObservationKind,\n type AuditObservationLossMetricsRecorder,\n emitAuditObservation,\n} from '~wildo-backend-lib/monitoring/observability/audit-observation-emission.backend';\nimport {\n getUserAuthorizationVersion,\n type AuthorizationVersionedUser,\n} from '~wildo-backend-lib/security/authentications/models/user-authorization-version.backend.utils';\n\n/** L3: Default max concurrent refresh tokens per user. /\nconst DEFAULT_MAX_CONCURRENT_SESSIONS = 10;\n\n/\n Result of token issuance.\n /\nexport interface AuthTokens {\n accessToken: string;\n refreshToken?: string;\n expiresIn?: number;\n}\n\n/\n A-9 — the machine-readable signal a refresh-token REUSE rejection carries so a CALLER can audit the\n * theft. This issuer performs the family-wide revocation itself but deliberately does NOT audit\n * (see the class JSDoc — TRAP 13: callers decide what to audit); instead it TAGS its thrown rejection\n * with this signal, and each refresh caller reads it via {@link extractRefreshTokenReuseSignal} and\n * emits `USER_REFRESH_TOKEN_REUSE_DETECTED`. Never carries the raw token — only the reused `jti`.\n /\nexport interface RefreshTokenReuseSignal {\n /* The user whose whole token family was revoked (the victim). /\n userId: string;\n /* The reused refresh token's `jti` (the replayed credential id). /\n reusedJti: string;\n /* The session the reused token belonged to, when present on the claim. /\n sessionId?: string;\n /* Whether the `TOKEN_INVALID_BEFORE` family-revoke was written (the action the issuer took). /\n familyRevoked: boolean;\n}\n\n/\n Symbol-keyed so the signal rides the thrown rejection object WITHOUT ever appearing in a string-key\n * serialization or the error sanitizer (the reuse detail is internal, for the auditing caller only).\n * `Symbol.for` (the global registry, not a per-module `Symbol()`) so tag ⇄ extract still match if this\n * module is loaded under both ESM and CJS.\n /\nconst REFRESH_TOKEN_REUSE_SIGNAL_KEY = Symbol.for('wildo.auth.refreshTokenReuseSignal');\n\n/\n Tag a refresh-rejection error with the reuse signal (A-9). The issuer calls this after performing the\n * family revoke; the CALLER reads it back and emits the audit — preserving the issuer's no-audit boundary.\n /\nexport function tagRefreshTokenReuseSignal<E extends object>(error: E, signal: RefreshTokenReuseSignal): E {\n Object.defineProperty(error, REFRESH_TOKEN_REUSE_SIGNAL_KEY, {\n value: signal,\n enumerable: false,\n writable: false,\n configurable: false,\n });\n return error;\n}\n\n/\n Read the refresh-reuse signal off a caught error, or `null` when it is not a reuse rejection (a plain\n * revoked/expired/invalid refresh). A caller uses this to emit `USER_REFRESH_TOKEN_REUSE_DETECTED` for\n * the theft case ONLY, then map the error to its own rejection.\n /\nexport function extractRefreshTokenReuseSignal(error: unknown): RefreshTokenReuseSignal \| null {\n if (error !== null && typeof error === 'object' && REFRESH_TOKEN_REUSE_SIGNAL_KEY in error) {\n return (error as Record<typeof REFRESH_TOKEN_REUSE_SIGNAL_KEY, RefreshTokenReuseSignal>)[REFRESH_TOKEN_REUSE_SIGNAL_KEY];\n }\n return null;\n}\n\n/\n AuthTokenIssuerBackendService\n \n Responsibilities:\n * - Issue access tokens (delegates to JwtBackendService)\n * - Issue refresh tokens (delegates to JwtBackendService)\n \n This service does NOT:\n * - Manage sessions (that's AuthSessionStore)\n * - Verify credentials (that's AuthCredentialVerifier)\n * - Audit log (TRAP 13: callers decide what to audit based on full context)\n /\n@injectable()\nexport class AuthTokenIssuerBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.JwtBackendService) private readonly jwtService: JwtBackendService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,\n @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory) private readonly authEcFactory: AuthExecutionContextFactoryBackendService,\n /\n * The audit trail, `@optional()` and APPENDED LAST — the constructor-parameter discipline, and\n * optional for a second reason: this service sits on the token-issuance path, so a host that\n * binds no audit service must still be able to issue tokens. An observer may never be able to\n * fail the thing it observes.\n /\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) @optional()\n private readonly auditLogsService: AuditLogsBackendService \| null = null,\n /\n * The loss counter behind {@link recordEvictions}, `@optional()` and APPENDED after the audit\n * trail for the same two reasons: the constructor-parameter discipline, and that a host binding\n * no metrics service must still issue tokens. Its absence degrades a dropped eviction record to\n * the log channel — never to a refusal, which would put token issuance behind an observability\n * binding.\n /\n @inject(SAAS_SERVICE_TYPES.MetricsService) @optional()\n private readonly metricsService?: AuditObservationLossMetricsRecorder,\n ) {\n this.logDebug = this.logger.debugByType('AuthTokenIssuer');\n this.logger.setDebugTypeLogging('AuthTokenIssuer', false);\n }\n\n /\n Issue access + refresh tokens for a completed authentication session.\n /\n public async issueTokens(\n session: AuthenticationSession,\n options: { includeRefreshToken?: boolean; lastAuthenticatedAt?: number; activeUserType?: string } = {},\n ): Promise<AuthTokens> {\n const userId = session.userId;\n\n if (!userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_NOT_FOUND,\n context: { missingField: 'userId' },\n });\n }\n\n return this._issueTokensForUser(userId, session.sessionId, options.includeRefreshToken ?? true, {\n lastAuthenticatedAt: options.lastAuthenticatedAt,\n activeUserType: options.activeUserType ?? session.activeUserType ?? undefined,\n });\n }\n\n /\n Issue tokens for an user directly (without a full session).\n * Used by OAuth2/SAML/registration callback flows (TRAP 12) which bypass the session state machine.\n * `activeUserType` is resolved internally from the user record when not provided.\n /\n public async issueTokensForUser(\n userId: string,\n sessionId?: string,\n stepUpClaims?: {\n lastAuthenticatedAt?: number;\n activeUserType?: string;\n sessionType?: SessionType;\n },\n options?: {\n skipSessionTracking?: boolean;\n refreshTokenExpiresAt?: Date;\n },\n ): Promise<AuthTokens> {\n return this._issueTokensForUser(userId, sessionId, true, stepUpClaims, options);\n }\n\n /\n Internal implementation for token issuance.\n * Resolves `activeUserType` from the user DB record when not provided by the caller (N-2).\n /\n private async _issueTokensForUser(\n userId: string,\n sessionId?: string,\n includeRefreshToken: boolean = true,\n stepUpClaims?: {\n lastAuthenticatedAt?: number;\n activeUserType?: string;\n sessionType?: SessionType;\n },\n options?: {\n skipSessionTracking?: boolean;\n refreshTokenExpiresAt?: Date;\n /\n Refresh rotation passes the predecessor's durable authorization\n * version. Rechecking it on the issuance read closes the gap between the\n * refresh preflight read and successor signing.\n /\n expectedAuthorizationVersion?: number;\n },\n ): Promise<AuthTokens> {\n let emailVerified: boolean \| undefined;\n let resolvedActiveUserType = stepUpClaims?.activeUserType;\n\n // Token issuance is a security decision, so the User read and its durable\n // version are mandatory. A best-effort read here would mint an unfenced\n // token precisely when the database boundary is unavailable.\n const tokenEc = await this.authEcFactory.createForAuthenticatedAuthOperation(\n userId,\n this.authEcFactory.getUsersReadOperationPath(),\n );\n const user =\n await this.servicesRegistryHandler.read<AuthorizationVersionedUser>(\n CoreResourceType.USERS,\n tokenEc,\n { _id: userId },\n );\n const authorizationVersion = getUserAuthorizationVersion(user);\n if (!user \|\| authorizationVersion === null) {\n // Two very different faults, deliberately reported apart. Collapsing them into one reason\n // string sent a production investigation looking for a missing version field when the row\n // itself may simply not have been readable — the caller-facing answer is identical either way\n // (fail closed), but the operator-facing one is not: \"no such row\" points at the read's scope\n // or at write visibility, \"no version\" points at the persistence contract.\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: {\n reason: user\n ? 'user_authorization_version_unreadable'\n : 'user_row_not_readable_for_issuance',\n userId,\n // Only ever the SHAPE of what came back — never the value, which is an authorization\n // fence and does not belong in a log line.\n authorizationVersionType: typeof (user as AuthorizationVersionedUser \| null)?._version,\n userStatus: user?.status,\n },\n },\n );\n }\n if (\n options?.expectedAuthorizationVersion !== undefined\n && authorizationVersion !== options.expectedAuthorizationVersion\n ) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: {\n reason: 'user_authorization_version_changed_during_issuance',\n userId,\n },\n },\n );\n }\n\n if (user.status === UserStatus.ACTIVE) {\n emailVerified = true;\n } else if (user.status === UserStatus.PENDING_VERIFICATION) {\n emailVerified = false;\n }\n\n // A caller-carried active type is valid only while the live User still\n // owns it. This prevents direct issuance from preserving a removed auth\n // policy even outside refresh rotation.\n if (resolvedActiveUserType && !user.userTypes?.includes(resolvedActiveUserType)\n ) {\n resolvedActiveUserType = undefined;\n }\n if (!resolvedActiveUserType && user.userTypes?.length) {\n resolvedActiveUserType = user.userTypes[0];\n }\n\n const lastAuthenticatedAt = stepUpClaims?.lastAuthenticatedAt;\n\n const accessClaim = JwtClaim_App_Auth_UserRequest_Schema.parse({\n type: ExecutionContext_ExecutionType.USER_REQUEST,\n userId,\n authorizationVersion,\n sessionType: stepUpClaims?.sessionType ?? SessionType.PERSISTENT,\n ...(emailVerified !== undefined ? { emailVerified } : {}),\n ...(lastAuthenticatedAt !== undefined ? { lastAuthenticatedAt } : {}),\n ...(resolvedActiveUserType ? { activeUserType: resolvedActiveUserType } : {}),\n // revocation-C: carry the session id onto the ACCESS claim (it was already on the refresh claim), so the\n // access-token guard can enforce a per-session revocation fence and the OIDC id_token can carry `sid`.\n ...(sessionId ? { sessionId } : {}),\n });\n\n const accessToken = await this.jwtService.createJwtForAppAuth(accessClaim);\n // Resolved AppConfiguration always has this field (required on\n // `AppConfiguration_JWT_Schema`); operator-authored value flows from\n // `wildo.infra.<env>.config.ts` `serviceAuth.accessTokenExpirationMinutes`\n // through apps-manager bootstrap material and is overlaid by\n // `app-configuration-loader.backend.service.ts`. No literal fallback\n // here on purpose — F-24 (Slice 3.3) made `serviceAuth` the single\n // source of truth, so a missing value should fail the boot rather than\n // silently downgrade to a 15-minute floor.\n const accessTokenMinutes = this.appConfigService.config.jwt.accessTokenExpirationMinutes;\n const accessTokenExpiresInSeconds = accessTokenMinutes 60;\n this.logDebug('Access token issued', { userId, expiresIn: accessTokenExpiresInSeconds });\n\n let refreshToken: string \| undefined;\n if (includeRefreshToken) {\n const jti = crypto.randomUUID();\n const refreshClaim: Jwt_RefreshToken_CreationParameter = {\n type: ExecutionContext_ExecutionType.USER_REQUEST,\n userId,\n authorizationVersion,\n jti,\n sessionId: sessionId,\n sessionType: stepUpClaims?.sessionType ?? SessionType.PERSISTENT,\n ...(lastAuthenticatedAt !== undefined ? { lastAuthenticatedAt } : {}),\n ...(resolvedActiveUserType ? { activeUserType: resolvedActiveUserType } : {}),\n ...(options?.refreshTokenExpiresAt ? { refreshTokenExpiresAt: Math.floor(options.refreshTokenExpiresAt.getTime() / 1000) } : {}),\n };\n\n refreshToken = await this.jwtService.createRefreshToken(\n refreshClaim,\n options?.refreshTokenExpiresAt\n ? { expiresInSeconds: Math.max(1, Math.floor((options.refreshTokenExpiresAt.getTime() - Date.now()) / 1000)) }\n : undefined,\n );\n\n if (!options?.skipSessionTracking) {\n await this._trackAndEnforceSessionLimit(userId, jti, resolvedActiveUserType);\n }\n\n this.logDebug('Refresh token issued', { userId, sessionType: stepUpClaims?.sessionType });\n }\n\n return {\n accessToken,\n refreshToken,\n expiresIn: accessTokenExpiresInSeconds,\n };\n }\n\n /*\n Refresh an access token using a valid refresh token.\n \n Flow:\n * 1. Verify the refresh token JWT signature + expiration\n * 2. Parse claims using JwtClaim_App_RefreshToken_Schema (discriminated union)\n * 3. Issue a fresh access token for the same user\n * 4. Optionally rotate the refresh token (always rotate for security)\n \n @param refreshToken - The JWT refresh token string\n * @returns Fresh access + refresh tokens\n * @throws AUTHENTICATION error if the refresh token is invalid/expired\n /\n public async refreshAccessToken(refreshToken: string): Promise<AuthTokens> {\n // Step 1: Verify the refresh token JWT (signature + expiry + audience=REFRESH_TOKEN)\n let decoded: unknown;\n try {\n decoded = await this.jwtService.verifyRefreshToken(refreshToken);\n } catch (error) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n },\n );\n }\n\n // Step 2: Parse claims using the discriminated union schema\n const parseResult = JwtClaim_App_RefreshToken_Schema.safeParse(decoded);\n if (!parseResult.success) {\n this.logger.warn('Refresh token claims failed validation', { issues: parseResult.error.issues });\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n },\n );\n }\n\n const claims = parseResult.data;\n\n // Step 2b: Read the live User and enforce the durable authorization fence\n // BEFORE the rotation-grace early return. A cached successor must not be\n // returned after userTypes/appRoles/status changed.\n const ec = await this.authEcFactory.createForAuthenticatedAuthOperation(\n claims.userId,\n this.authEcFactory.getUsersReadOperationPath(),\n );\n const currentUser =\n await this.servicesRegistryHandler.read<AuthorizationVersionedUser>(\n CoreResourceType.USERS,\n ec,\n { _id: claims.userId },\n );\n const currentAuthorizationVersion = getUserAuthorizationVersion(currentUser);\n if (!currentUser \|\| currentUser.status !== UserStatus.ACTIVE) {\n this.logger.warn('Refresh token for non-active user', {\n jti: claims.jti,\n userId: claims.userId,\n userStatus: currentUser?.status ?? 'NOT_FOUND',\n });\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n context: {\n userStatus: currentUser?.status ?? 'NOT_FOUND',\n source: 'token_refresh',\n },\n },\n );\n }\n if (\n currentAuthorizationVersion === null\n \|\| currentAuthorizationVersion !== claims.authorizationVersion\n ) {\n this.logger.warn(\n 'Refresh token authorization version no longer matches User',\n {\n jti: claims.jti,\n userId: claims.userId,\n tokenAuthorizationVersion: claims.authorizationVersion,\n currentAuthorizationVersion,\n },\n );\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { reason: 'user_authorization_version_changed' },\n },\n );\n }\n\n // Keep explicit all-session invalidation (password reset / theft\n // detection) ahead of rotation grace as well. AuthorizationVersion closes\n // database authorization races; this timestamp remains the independent\n // credential/session revocation mechanism.\n // GRACE-BOUNDARY (fixed here 2026-07-29, moved to the shared owner 2026-08-01). The fail-closed\n // `<=` — and the full rationale for why the same second must be rejected, and why raising timestamp\n // precision alone would NOT fix it — now lives in {@link evaluateUserTokenInvalidationFence}, which\n // every auth front shares. It was six hand-written copies of this comparison that let the fix land on\n // two of them while four kept the bypassing `<`. Refresh-specific note: this fence is checked BEFORE\n // rotation grace, so a stolen chain cannot ride the grace window past an invalidation.\n const { isRevoked, invalidBefore } = await evaluateUserTokenInvalidationFence(\n this.redisService, claims.userId, claims.iat,\n );\n if (isRevoked) {\n this.logger.warn('Refresh token issued before user-level invalidation', {\n jti: claims.jti,\n userId: claims.userId,\n tokenIat: claims.iat,\n invalidBefore,\n });\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n },\n );\n }\n\n // revocation-C: PER-SESSION fence. Distinct from the user-wide fence above — a single-session\n // terminate (OIDC end_session / per-device logout) evicts THIS session's refresh chain while the\n // user's other sessions stay live. Checked here so the terminated session cannot rotate a new\n // access token; the access guard checks the same fence so the current access token also dies.\n const sessionFence = await evaluateSessionInvalidationFence(\n this.redisService, claims.sessionId, claims.iat,\n );\n if (sessionFence.isRevoked) {\n this.logger.warn('Refresh token issued before per-session invalidation', {\n jti: claims.jti,\n userId: claims.userId,\n sessionId: claims.sessionId,\n tokenIat: claims.iat,\n invalidBefore: sessionFence.invalidBefore,\n });\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n },\n );\n }\n\n // Step 2c: Check JTI blacklist (revoked tokens) with reuse detection.\n const blacklistValue = await this.redisService.get<string>(`${AUTH_REDIS_KEYS.REFRESH_BLACKLIST}${claims.jti}`);\n if (blacklistValue) {\n if (blacklistValue === RefreshTokenBlacklistReason.ROTATED) {\n // IDEMPOTENT-ROTATION GRACE (checked BEFORE theft revocation): a token\n // re-presented within {@link REFRESH_TOKEN_ROTATION_GRACE_SECONDS} of\n // its rotation is almost always a benign race — a lost/retried refresh\n // response, or a second browsing context that read the shared\n // `__wildo_refresh` cookie a beat before the rotation replaced it. In\n // that case the original rotation cached its successor tokens; return\n // that SAME successor so the racing client converges on one token\n // family instead of being force-logged-out. Genuine theft re-presents\n // the token long after this window, by which time the grace key has\n // expired and control falls through to full revocation below.\n const graceSuccessor = await this.redisService.get<AuthTokens>(\n `${AUTH_REDIS_KEYS.REFRESH_GRACE_SUCCESSOR}${claims.jti}`,\n );\n if (graceSuccessor) {\n // Both durable authorizationVersion and explicit Redis invalidation\n // were checked above. Returning the exact cached successor therefore\n // grants nothing beyond the legitimate rotation winner and cannot\n // bypass an intervening User authorization mutation.\n this.logger.info('Refresh-token reuse within rotation grace window — returning cached successor (benign race, NOT revoking)', {\n jti: claims.jti,\n userId: claims.userId,\n type: claims.type,\n });\n return graceSuccessor;\n }\n\n // REUSE DETECTED outside the grace window: the old refresh token may\n // have been stolen — revoke ALL tokens for this user.\n this.logger.warn('REFRESH TOKEN REUSE DETECTED — possible token theft, revoking all tokens for user', {\n jti: claims.jti,\n userId : claims.userId,\n type: claims.type,\n });\n // F-24 (Slice 3.3): refresh-token TTL is required on the resolved\n // AppConfiguration and authoritatively sourced from operator-authored\n // `serviceAuth.refreshTokenExpirationDays`; no literal fallback.\n const refreshTokenDays = this.appConfigService.config.jwt.refreshTokenExpirationDays;\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.TOKEN_INVALID_BEFORE}${claims.userId}`,\n Math.floor(Date.now() / 1000),\n { ttl: refreshTokenDays 86400 },\n );\n // A-9: this issuer performed the family revoke but does NOT audit (TRAP 13 — see class JSDoc).\n // TAG the rejection with the reuse signal so the CALLER emits `USER_REFRESH_TOKEN_REUSE_DETECTED`\n // for this theft (the plain-revoked `else` below throws the UNtagged twin, so a routine revoked\n // token is not mis-audited as theft). Distinct throw here — never falls through to the shared one.\n // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — credential-theft detection + response.\n throw tagRefreshTokenReuseSignal(\n this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN },\n ) as object,\n {\n userId: claims.userId,\n reusedJti: claims.jti,\n sessionId: claims.sessionId,\n familyRevoked: true,\n },\n );\n } else {\n this.logger.warn('Refresh token has been revoked', { jti: claims.jti });\n }\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n },\n );\n }\n\n // Step 3: Issue new tokens — carry forward session-scoped claims, but\n // require the issuance read to observe this same authorization version.\n this.logDebug('Refresh token validated, issuing new tokens', { userId : claims.userId, jti: claims.jti });\n const refreshLastAuthAt = claims.lastAuthenticatedAt;\n const refreshActiveUserType = claims.activeUserType;\n const refreshSessionType = claims.sessionType;\n const refreshTokenExpiresAtClaim = claims.refreshTokenExpiresAt;\n\n const newTokens = await this._issueTokensForUser(\n claims.userId,\n claims.sessionId,\n true,\n {\n lastAuthenticatedAt: refreshLastAuthAt,\n activeUserType: refreshActiveUserType,\n sessionType: refreshSessionType ?? SessionType.PERSISTENT,\n },\n {\n ...(refreshSessionType === SessionType.ONE_OFF ? { skipSessionTracking: true } : {}),\n ...(refreshTokenExpiresAtClaim ? { refreshTokenExpiresAt: new Date(refreshTokenExpiresAtClaim * 1000) } : {}),\n expectedAuthorizationVersion: claims.authorizationVersion,\n },\n );\n\n // Step 4: Blacklist the consumed refresh token JTI as 'rotated'\n const nowSeconds = Math.floor(Date.now() / 1000);\n const ttl = claims.exp ? claims.exp - nowSeconds : 86400;\n if (ttl > 0 && claims.jti) {\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.REFRESH_BLACKLIST}${claims.jti}`,\n RefreshTokenBlacklistReason.ROTATED,\n { ttl },\n );\n this.logDebug('Old refresh token JTI blacklisted after rotation', { jti: claims.jti, ttl });\n\n // Cache the successor under the consumed JTI for the idempotent-rotation\n // grace window so a benign reuse race returns THIS exact successor (see\n // Step 2b) instead of being revoked. The TTL is the grace window clamped\n // to the consumed token's own remaining lifetime — the grace entry is\n // ALWAYS shorter-lived than the blacklist entry above, so once it expires\n // a re-presented token still trips full revocation (theft is preserved).\n //\n // AT-REST EXPOSURE (accepted, bounded): this is the ONLY place the auth\n // subsystem writes live token material to Redis — `REFRESH_BLACKLIST`\n // holds only reason strings, `TOKEN_INVALID_BEFORE` timestamps,\n // `ACTIVE_REFRESH_JTIS` only JTIs, and the session store holds session\n // state, never tokens. We store the FULL successor (incl. the refresh\n // token) because the idempotent guarantee requires returning the exact\n // same tokens — re-issuing would mint a divergent family, and an\n // access-token-only cache would break the lost-rotation-response client\n // (its cookie is still the now-blacklisted predecessor, so it needs the\n // successor refresh token re-sent via `Set-Cookie` to advance). An\n // attacker with Redis read access (snapshot/AOF dump, MONITOR, leaked\n // backup) could therefore harvest refresh tokens minted in the last\n // `graceTtl` seconds — but such an attacker already reads the session\n // store, so the marginal blast radius is one short window. If that window\n // ever needs hardening, encrypt this blob at rest (the read site already\n // fails closed to revocation on a parse miss). It is NOT logged.\n const graceTtl = Math.min(REFRESH_TOKEN_ROTATION_GRACE_SECONDS, ttl);\n if (graceTtl > 0) {\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.REFRESH_GRACE_SUCCESSOR}${claims.jti}`,\n newTokens,\n { ttl: graceTtl },\n );\n this.logDebug('Cached rotation successor for idempotent-grace window', { jti: claims.jti, graceTtl });\n }\n }\n\n return newTokens;\n }\n\n /*\n Revoke a refresh token by adding its JTI to the Redis blacklist.\n * TTL matches the token's remaining lifetime so the entry auto-expires.\n \n Called from the logout route handler.\n /\n public async revokeRefreshToken(refreshToken: string): Promise<void> {\n // Decode the token to extract JTI and exp. We verify the signature\n // so that arbitrary strings can't pollute the blacklist.\n let decoded: unknown;\n try {\n decoded = await this.jwtService.verifyRefreshToken(refreshToken);\n } catch {\n // Token is already invalid/expired — nothing to revoke\n this.logDebug('Refresh token revocation skipped — token is invalid or expired');\n return;\n }\n\n const parseResult = JwtClaim_App_RefreshToken_Schema.safeParse(decoded);\n if (!parseResult.success) {\n this.logDebug('Refresh token revocation skipped — claims are malformed');\n return;\n }\n\n const { jti, exp } = parseResult.data;\n if (!jti) {\n this.logDebug('Refresh token revocation skipped — no JTI');\n return;\n }\n\n // TTL = remaining seconds until token naturally expires\n const nowSeconds = Math.floor(Date.now() / 1000);\n const ttl = exp ? (exp as number) - nowSeconds : 86400; // fallback 24h\n if (ttl <= 0) {\n this.logDebug('Refresh token already expired — no blacklist needed', { jti });\n return;\n }\n\n await this.redisService.set(`${AUTH_REDIS_KEYS.REFRESH_BLACKLIST}${jti}`, RefreshTokenBlacklistReason.REVOKED, { ttl });\n\n // L3: Remove from active refresh tokens set\n const claims = parseResult.data;\n const userId = claims.userId;\n try {\n const setKey = this.redisService.buildKey(`${AUTH_REDIS_KEYS.ACTIVE_REFRESH_JTIS}${userId}`);\n await this.redisService.eval('redis.call(\"ZREM\", KEYS[1], ARGV[1]); return 1', [setKey], [jti]);\n } catch {\n // Non-fatal\n }\n\n this.logDebug('Refresh token revoked', { jti, ttlSeconds: ttl });\n }\n\n /\n Invalidate all refresh tokens for an user by setting a per-user\n * \"invalid before\" timestamp in Redis. All refresh tokens with `iat` before\n * this timestamp will be rejected on next use.\n \n Used on password change/reset (C4) and token reuse detection (H3).\n * TTL matches operator-authored `serviceAuth.refreshTokenExpirationDays`\n * (F-24, Slice 3.3); no literal fallback.\n /\n public async invalidateAllTokensForUser(userId: string): Promise<void> {\n const nowSeconds = Math.floor(Date.now() / 1000);\n const refreshTokenDays = this.appConfigService.config.jwt.refreshTokenExpirationDays;\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.TOKEN_INVALID_BEFORE}${userId}`,\n nowSeconds,\n { ttl: refreshTokenDays 86400 },\n );\n this.logDebug('All tokens invalidated for user', { userId, invalidBefore: nowSeconds });\n }\n\n /*\n revocation-C: invalidate a SINGLE login session by setting a per-session \"invalid before\"\n * timestamp in Redis. Every access/refresh token whose `sessionId` matches AND whose `iat` is at or\n * before this timestamp is rejected on next use — at every first-party auth front: the refresh exchange\n * ({@link refreshAccessToken}), the first-party access guard (`auth-jwt-guard.extractAuthenticatedUser`),\n * and the manual-controller / resource-API / socket-handshake fronts (`execution-context-creator`), all\n * via {@link evaluateSessionInvalidationFence}.\n \n This is the least-privilege sibling of {@link invalidateAllTokensForUser}: it terminates ONE\n * session (the OIDC `end_session_endpoint` / RP-Initiated Logout, and per-device logout), leaving the\n * user's other sessions live. TTL matches operator-authored `jwt.refreshTokenExpirationDays` — the\n * fence only needs to outlive the longest-lived token that could still carry this `sessionId`, after\n * which no such token can exist and the key is dead weight.\n /\n public async invalidateSession(sessionId: string): Promise<void> {\n const nowSeconds = Math.floor(Date.now() / 1000);\n const refreshTokenDays = this.appConfigService.config.jwt.refreshTokenExpirationDays;\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.SESSION_INVALID_BEFORE}${sessionId}`,\n nowSeconds,\n { ttl: refreshTokenDays 86400 },\n );\n this.logDebug('Session invalidated (per-session fence set)', { sessionId, invalidBefore: nowSeconds });\n }\n\n /*\n L3: Track an active refresh token JTI for an user and enforce the concurrent session limit.\n \n Uses a Redis sorted set per user where:\n * - Members = JTI strings\n * - Scores = issuedAt in MILLISECONDS (for FIFO eviction)\n \n When the set exceeds the max size (default 10), the oldest JTI(s) are evicted\n * and blacklisted so they can't be used anymore.\n \n The ordering, the score's unit, and the blacklist TTL all live in\n * `concurrent-session-eviction.backend.utils` — retiring the OLDEST chain is the security property\n * the cap exists to provide, so it is a named, separately-tested policy rather than a detail of\n * this method. See {@link buildSessionOrderingScore} for why whole-second scores silently made the\n * eviction arbitrary.\n /\n private async _trackAndEnforceSessionLimit(userId: string, newJti: string, activeUserType?: string): Promise<void> {\n const userTypeConfig = activeUserType\n ? this.appConfigService.config.userTypes?.[activeUserType]\n : undefined;\n const configuredMax = userTypeConfig?.auth?.maxConcurrentSessions;\n const maxSessions = (configuredMax && configuredMax > 0) ? configuredMax : DEFAULT_MAX_CONCURRENT_SESSIONS;\n // F-24 (Slice 3.3): operator-authored TTL; no literal fallback.\n const refreshTokenDays = this.appConfigService.config.jwt.refreshTokenExpirationDays;\n const setTtl = refreshTokenDays 86400;\n const nowMilliseconds = buildSessionOrderingScore();\n const setKey = this.redisService.buildKey(`${AUTH_REDIS_KEYS.ACTIVE_REFRESH_JTIS}${userId}`);\n\n try {\n const evictedPairs = await this.redisService.eval(\n CONCURRENT_SESSION_EVICTION_LUA,\n [setKey],\n [newJti, String(nowMilliseconds), String(maxSessions), String(setTtl)],\n ) as string[] \| null;\n\n if (evictedPairs && evictedPairs.length > 0) {\n // evictedPairs is [jti, score, jti, score, ...] — blacklist each with its actual remaining TTL\n for (let i = 0; i < evictedPairs.length; i += 2) {\n const jti = evictedPairs[i];\n const remainingTtl = resolveEvictedJtiBlacklistSeconds({\n rawScore: evictedPairs[i + 1],\n nowMilliseconds,\n refreshTokenTtlSeconds: setTtl,\n });\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.REFRESH_BLACKLIST}${jti}`,\n RefreshTokenBlacklistReason.EVICTED,\n { ttl: remainingTtl },\n );\n }\n this.logDebug('Concurrent session limit enforced — evicted oldest tokens', {\n userId,\n evictedCount: evictedPairs.length / 2,\n maxSessions,\n });\n this.recordEvictions({ userId, evictedPairs, maxSessions, nowMilliseconds });\n }\n } catch (error) {\n // Non-fatal: don't block token issuance if tracking fails\n this.logger.warn('Failed to track/enforce concurrent session limit', {\n userId,\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n /*\n Record each retired refresh chain in the audit trail.\n \n Until 2026-09-02 the only trace of an eviction was the debug line above — a security-relevant\n * token-lifecycle act with no durable record, which is exactly what `CLAUDE.md`'s\n * assurance-by-construction rule asks for by name. The cap exists to bound the blast radius of\n * undetected token theft, so a burst of evictions for one principal is among the more interesting\n * things the trail can carry, and it was not carrying it.\n \n `evictedIssuedAt` is what makes the record worth having: the cap's security property is that the\n * OLDEST chain goes, and a record naming only the victim would prove a session ended without\n * proving the right one did. An unreadable score yields ABSENCE rather than a synthesised instant —\n * a fabricated timestamp would make the first-in-first-out claim unfalsifiable.\n \n Feature-DETECTED rather than null-checked, for the reason recorded at the cross-tenant emitter:\n * adding a `log` method breaks partially-mocked doubles, the property is absent, and the CALL\n throws synchronously before any `.catch()` can make it fire-and-forget.\n \n ## Why the detection decides an ARGUMENT rather than an early return\n \n Every emission goes through {@link emitAuditObservation}, which counts a lost one on\n * `audit_observation_dropped_total`. Handing the seam `undefined` is how this site reports\n * `SERVICE_UNAVAILABLE` — the loss shape that reaches no `_createAuditLog` and therefore used to\n * leave nothing behind at all. Returning early on an absent method would restore that silence,\n * which matters here more than it looks: an unbound audit service makes the eviction trail\n * PERMANENTLY empty, and an empty eviction trail reads as \"the cap never fired\".\n \n The count is per RETIRED CHAIN, not per enforcement — one lost row is one lost row, and a cap\n * that evicts four chains while the sink is down has lost four pieces of evidence. The\n * `!evictedJti` skip stays ABOVE the emission for the opposite reason: a pair with no jti is\n * nothing owed, and counting a deliberate skip would fire the loss signal on correct behaviour.\n \n assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — the bound's enforcement is\n * evidenced, naming WHICH chain was retired and when it was issued.\n */\n private recordEvictions(input: {\n userId: string;\n evictedPairs: string[];\n maxSessions: number;\n nowMilliseconds: number;\n }): void {\n // Narrowed to a VALUE rather than to a boolean flag: the emitting closure is created inside the\n // loop, and a captured `const` that is already non-nullish needs no narrowing to survive into it.\n const emitter = typeof this.auditLogsService?.logUserSessionEvicted === 'function'\n ? this.auditLogsService\n : undefined;\n\n for (let index = 0; index < input.evictedPairs.length; index += 2) {\n const evictedJti = input.evictedPairs[index];\n // Nothing was owed for this pair — a deliberate skip, kept above the emission so it can never\n // be counted as a loss.\n if (!evictedJti) continue;\n const issuedAtMilliseconds = readIssuedAtMilliseconds(input.evictedPairs[index + 1]);\n emitAuditObservation({\n observation: AuditObservationKind.USER_SESSION_EVICTED,\n emit: emitter\n ? (): unknown => emitter.logUserSessionEvicted({\n userId: input.userId,\n evictedJti,\n ...(issuedAtMilliseconds === undefined ? {} : { evictedIssuedAt: new Date(issuedAtMilliseconds) }),\n configuredMaximum: input.maxSessions,\n retainedCount: input.maxSessions,\n })\n : undefined,\n metricsService: this.metricsService,\n logger: this.logger,\n // Enough to reconstruct the lost row from the application log: WHOSE session, WHICH chain,\n // and under what bound. The jti is the identity the audit row itself would have carried.\n context: {\n observedUserId: input.userId,\n observedEvictedJti: evictedJti,\n observedConfiguredMaximum: input.maxSessions,\n },\n });\n }\n }\n}\n"]}

package/dist/esm/security/authentications/services/authentication-orchestrator.backend.service.d.ts CHANGED Viewed

@@ -5,6 +5,7 @@ import type { ServicesRegistryHandlerBackendService } from '../../../base-classe
 import type { SystemAccessBackendService } from '../../../base-classes/services/services/system-access.backend.service';
 import { ExecutionContext } from '../../../runtime/models/execution-context.backend.schemas';
 import { AuthIdentificationRequest, AvailableMethod, PasswordAuthRequest } from '@wildo-ai/saas-models';
+import { RepositoriesRegistryHandlerBackendService } from '../../../base-classes/services/repositories/repositories-registry-handler.backend.service';
 import { AuthIdentificationResponse, AuthenticationRequest, AuthenticationResponse, AuthenticationSession } from '@wildo-ai/saas-models';
 import { AuthSessionPurpose } from '@wildo-ai/saas-models';
 import type { EmailOTPAuthRequest, TOTPAuthRequest, PasskeyAuthRequest, SMSOTPAuthRequest, MagicLinkSendRequest, MagicLinkVerifyRequest, UserTypeAuthPolicy } from '@wildo-ai/saas-models';
@@ -90,6 +91,7 @@ export declare class AuthenticationOrchestratorBackendService {
     private readonly appConfigService;
     private readonly errorBuilder;
     private readonly servicesRegistryHandler;
+    private readonly repositoriesRegistry;
     private readonly auditLogsService;
     private readonly sessionStore;
     private readonly credentialVerifier;
@@ -133,7 +135,7 @@ export declare class AuthenticationOrchestratorBackendService {
      * the fleet (the always-on DB store still records every lock unconditionally).
      */
     private readonly _accountLockedAuditDedup;
-    constructor(logger: LoggerService, appConfigService: AppConfigurationService, errorBuilder: ErrorBuilderBackendService, servicesRegistryHandler: ServicesRegistryHandlerBackendService, auditLogsService: AuditLogsBackendService, sessionStore: AuthSessionStoreBackendService, credentialVerifier: AuthCredentialVerifierBackendService, tokenIssuer: AuthTokenIssuerBackendService, consumableTokenService: ConsumableTokenBackendService, redisService: RedisService, rateLimitService: RateLimitBackendService, domainToOrgLookup: DomainToOrgLookupBackendService, orgConfigService: AuthOrganizationConfigurationService, webAuthnService: WebAuthnBackendService, oauth2Resolver: OAuth2ConnectionResolverBackendService, userLookup: AuthUserLookupBackendService, credentialOps: AuthCredentialOpsBackendService, systemAccessService: SystemAccessBackendService, mongoDBService: MongoDBService, resourcePersistenceUnitOfWork: ResourcePersistenceUnitOfWorkBackendService, authMfaService: AuthMfaBackendService);
+    constructor(logger: LoggerService, appConfigService: AppConfigurationService, errorBuilder: ErrorBuilderBackendService, servicesRegistryHandler: ServicesRegistryHandlerBackendService, repositoriesRegistry: RepositoriesRegistryHandlerBackendService, auditLogsService: AuditLogsBackendService, sessionStore: AuthSessionStoreBackendService, credentialVerifier: AuthCredentialVerifierBackendService, tokenIssuer: AuthTokenIssuerBackendService, consumableTokenService: ConsumableTokenBackendService, redisService: RedisService, rateLimitService: RateLimitBackendService, domainToOrgLookup: DomainToOrgLookupBackendService, orgConfigService: AuthOrganizationConfigurationService, webAuthnService: WebAuthnBackendService, oauth2Resolver: OAuth2ConnectionResolverBackendService, userLookup: AuthUserLookupBackendService, credentialOps: AuthCredentialOpsBackendService, systemAccessService: SystemAccessBackendService, mongoDBService: MongoDBService, resourcePersistenceUnitOfWork: ResourcePersistenceUnitOfWorkBackendService, authMfaService: AuthMfaBackendService);
     /**
      * Global lockout policy for email-scoped rate limiting (pre-authentication, user type unknown).
      * Computed as the most-restrictive lockout across all configured user types:
@@ -380,9 +382,49 @@ export declare class AuthenticationOrchestratorBackendService {
      */
     private _shouldRequireMFA;
     /** Redis key prefix for SSO grace login counters — scope-aware format: sso_grace_logins:{scopeType}:{scopeId}:{userId} */
+    /**
+     * Read the tenant's branding for the sign-in screen (#410).
+     *
+     * NEVER throws. This runs on the pre-authentication identification path, so every failure mode —
+     * no profile row, a profile with no branding block, a store that is momentarily unavailable —
+     * resolves to `undefined` and the caller falls back to the application's brand. Letting a
+     * cosmetic read refuse an identification would turn a missing logo into an outage.
+     *
+     * `ORGANIZATION_PROFILES` had no backend reader at all before this; the audit note on
+     * `OrganizationBrandingSchema` records why, and why that reasoning was wrong.
+     *
+     * **Reads the REPOSITORY, not the service, and that is the difference between working and inert.**
+     * `ORGANIZATION_PROFILES`'s default READ variant requires `ORG_MEMBER`, and an identification
+     * request carries no roles at all — it is what happens BEFORE anyone is authenticated. Going
+     * through `servicesRegistryHandler.read` would therefore be refused by the operation pipeline,
+     * the refusal would be swallowed by the catch below, and the tenant's logo would silently never
+     * appear while every test stayed green. This is a SYSTEM read on the system's own behalf, to
+     * decorate a login screen; the repository is where a system read belongs. Same shape as the
+     * notifications dispatcher reading a recipient's preferences.
+     */
+    private readOrganizationBrandingForIdentification;
     /**
      * M14: Check if password login is allowed under SSO grace policy.
      * If the scope requires SSO and grace logins are exhausted, throws AUTHENTICATION error.
+     *
+     * ## Runs AFTER the credential is verified
+     *
+     * See the note at the `authenticatePassword` call site. Two consequences for anyone editing this:
+     * `email` is the address of a user whose password has been checked — never a caller-supplied
+     * claim — and every refusal here is one a caller could only reach by knowing that password.
+     *
+     * ## The break-glass exemption (#423)
+     *
+     * A named account in `emergencyAccess.breakGlassAccounts` is exempt from this refusal, including
+     * grace exhaustion, and from nothing else: same password, same lockout counters, same rate limits.
+     * Every use emits `EMERGENCY_ACCESS_USED` at CRITICAL, which is the control that makes a standing
+     * bypass acceptable at all — Microsoft Entra's emergency-access guidance asks for an alert on
+     * every sign-in of such an account and a post-mortem after each one, and the alert is the half a
+     * framework can provide.
+     *
+     * The emit is best-effort and never blocks the sign-in. That is deliberate and it is the same
+     * trade every audit emission on this path makes: refusing a break-glass sign-in because the audit
+     * store is unavailable would take the door away during exactly the outage it exists for.
      */
     private _checkSSOGraceLoginAllowed;
     /** 1 year in seconds — effectively permanent for grace counter, but avoids orphaned keys */

package/dist/esm/security/authentications/services/authentication-orchestrator.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authentication-orchestrator.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/security/authentications/services/authentication-orchestrator.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EACL,yBAAyB,EACzB,eAAe,EAOf,mBAAmB,EAGpB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAQL,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EAOtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAA4C,MAAM,uBAAuB,CAAC;AACrG,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAmB,oBAAoB,EAAE,sBAAsB,EAAE,kBAAkB,EAAmB,MAAM,uBAAuB,CAAC;AAQ7N,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAOzH,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,KAAK,EACV,2CAA2C,EAC5C,MAAM,yFAAyF,CAAC;AAGjG,OAAO,EAAE,8BAA8B,EAAE,MAAM,yFAAyF,CAAC;AACzI,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,6BAA6B,EAAmB,MAAM,wFAAwF,CAAC;AACxJ,OAAO,EAAE,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;~~AAGpI~~,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AAExG,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AACzJ,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wGAAwG,CAAC;AACpJ,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AAEjK,OAAO,EAAE,qBAAqB,EAAE,MAAM,4FAA4F,CAAC;AACnI,OAAO,EAAE,sCAAsC,EAAE,MAAM,8GAA8G,CAAC;AACtK,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;~~AAQjJ~~;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,2BAA2B,GAAG,sBAAsB,GAAG;IACjE;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,wCAAwC;IAgCd,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;~~IACtD~~,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEjC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAErB,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEhC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAEtB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEtD,OAAO,CAAC,QAAQ,CAAC,eAAe;IAEhB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAEzC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAExB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAGnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE1E,OAAO,CAAC,QAAQ,CAAC,6BAA6B;IAIH,OAAO,CAAC,QAAQ,CAAC,cAAc;~~IAjE5E~~,uHAAuH;IACvH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gCAAgC,CAAM;IAC9D,qHAAqH;IACrH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iCAAiC,CAAK;IAC9D,uEAAuE;IACvE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAK;IAEzD;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oCAAoC,CAAiB;IAC7E,2HAA2H;IAC3H,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mCAAmC,CAAU;IAErE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IAExF;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAA6B;gBAGhB,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACtC,YAAY,EAAE,0BAA0B,EAC7B,uBAAuB,EAAE,qCAAqC,~~EAC5E~~,gBAAgB,EAAE,uBAAuB,EAEzC,YAAY,EAAE,8BAA8B,EACtC,kBAAkB,EAAE,oCAAoC,EAC/D,WAAW,EAAE,6BAA6B,EAEnC,sBAAsB,EAAE,6BAA6B,EAC/D,YAAY,EAAE,YAAY,EACf,gBAAgB,EAAE,uBAAuB,EAExC,iBAAiB,EAAE,+BAA+B,EAEtC,gBAAgB,EAAE,oCAAoC,EAE3E,eAAe,EAAE,sBAAsB,EAEvB,cAAc,EAAE,sCAAsC,EAEhE,UAAU,EAAE,4BAA4B,EAErC,aAAa,EAAE,+BAA+B,EAGnD,mBAAmB,EAAE,0BAA0B,EACpD,cAAc,EAAE,cAAc,EAEzE,6BAA6B,EAC5C,2CAA2C,EAGe,cAAc,EAAE,qBAAqB;IAMnG;;;;OAIG;IACH,OAAO,KAAK,aAAa,GAYxB;IAED,OAAO,KAAK,SAAS,GAEpB;IAED,OAAO,KAAK,eAAe,GAE1B;IAUD;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAQ1B;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAqC1C;IAEF;;;;OAIG;YACW,kCAAkC;IAUhD;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAQhC;;OAEG;IACH,OAAO,CAAC,6BAA6B;IAIrC,OAAO,CAAC,iCAAiC;IAsBzC,OAAO,CAAC,qBAAqB;IAM7B;;OAEG;IACH,+FAA+F;IAC/F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gCAAgC,CAAgB;YAE1D,aAAa;IAqD3B;;OAEG;YACW,UAAU;IA+BxB,0FAA0F;IAC1F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAK;IAEtD;;;;;;OAMG;YACW,aAAa;IA4C3B;;OAEG;YACW,aAAa;IAK3B;;;OAGG;YACW,wBAAwB;IAyDtC;;;;;;;;;;;;;;;;;OAiBG;YACW,2BAA2B;IAyCzC;;;;;;;;;;;OAWG;YACW,oBAAoB;IAiBlC;;OAEG;YACW,6BAA6B;IAuB3C,OAAO,CAAC,kBAAkB;IAS1B;;;OAGG;YACW,iCAAiC;IA6GlC,QAAQ,CACnB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,qBAAqB,EAAE,yBAAyB,EAChD,cAAc,CAAC,EAAE,MAAM,EACvB,mBAAmB,CAAC,EAAE,MAAM,GAC3B,OAAO,CAAC,0BAA0B,CAAC;~~IA6LtC~~;;;;;;;;;;;OAWG;IACU,gCAAgC,CAC3C,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,UAAU,EAAE,kBAAkB,EAC9B,eAAe,CAAC,EAAE,qBAAqB,GAAG,IAAI,GAC7C,OAAO,CAAC,eAAe,EAAE,CAAC;YAIf,+BAA+B;YAY/B,gCAAgC;IAiB9C;;;OAGG;YACW,wBAAwB;IAsBzB,oBAAoB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,mBAAmB,EAAE,mBAAmB,GAAG,OAAO,CAAC,2BAA2B,CAAC;~~IA8W5I~~;;;;OAIG;IACU,yBAAyB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,kBAAkB,CAAC;QAC7B,UAAU,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACxD,cAAc,CAAC,EAAE,MAAM,CAAC;KACpB,GACL,OAAO,CAAC,qBAAqB,CAAC;IAajC;;;;;;OAMG;IACU,wBAAwB,CACnC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,cAAc,CAAC,EAAE,MAAM,EACvB,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EACvD,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,qBAAqB,CAAC;IAiBjC;;;OAGG;YACW,4BAA4B;IAsE1C;;;OAGG;YACW,4BAA4B;IAgB1C;;;;OAIG;IACU,iCAAiC,CAC5C,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAwCjC;;;OAGG;IACU,qBAAqB,CAChC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,qBAAqB,CAAC;IAyOpB,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAoL1H;;;;;OAKG;IACU,6BAA6B,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAa/H;;;;;;;;OAQG;IACU,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAC/E,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;IAiIF;;;;;OAKG;IACU,oBAAoB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IA2EhI;;;OAGG;YACW,eAAe;IAkD7B;;;;;;OAMG;IACU,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAsFxH;;;;;;OAMG;IACU,mBAAmB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,2BAA2B,CAAC;~~IA6G9H~~;;;;;;;;;;;;;;;;OAgBG;YACW,iBAAiB;IA2E/B,0HAA0H;IAE1H~~;;;OAGG~~;YACW,0BAA0B;~~IA2ExC~~,4FAA4F;IAC5F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAsB;IAEnE;;;;OAIG;YACW,uBAAuB;IAoDrC;;;;OAIG;IACU,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,yBAAyB,UAAQ,GAAG,OAAO,CAAC;QACxL,OAAO,EAAE,IAAI,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IA4FF;;;OAGG;IACU,eAAe,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;~~IAiWhN~~;;;;OAIG;IACU,UAAU,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAiM1J;;;;OAIG;IACU,kBAAkB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAkG5H;;;OAGG;YACW,aAAa;IA0C3B;;OAEG;IACH,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,yBAAyB;IA6BjC,OAAO,CAAC,iCAAiC;IAmBzC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,iCAAiC;IA0DzC,OAAO,CAAC,gCAAgC;YAqC1B,2BAA2B;CAwH1C"}
1	+ {"version":3,"file":"authentication-orchestrator.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/services/authentication-orchestrator.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EACL,yBAAyB,EACzB,eAAe,EAOf,mBAAmB,EAGpB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAEhK,OAAO,EAQL,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EAOtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAA4C,MAAM,uBAAuB,CAAC;AACrG,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAmB,oBAAoB,EAAE,sBAAsB,EAAE,kBAAkB,EAAmB,MAAM,uBAAuB,CAAC;AAQ7N,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAOzH,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,KAAK,EACV,2CAA2C,EAC5C,MAAM,yFAAyF,CAAC;AAGjG,OAAO,EAAE,8BAA8B,EAAE,MAAM,yFAAyF,CAAC;AACzI,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,6BAA6B,EAAmB,MAAM,wFAAwF,CAAC;AACxJ,OAAO,EAAE,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AAIpI,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AAExG,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AACzJ,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wGAAwG,CAAC;AACpJ,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AAEjK,OAAO,EAAE,qBAAqB,EAAE,MAAM,4FAA4F,CAAC;AACnI,OAAO,EAAE,sCAAsC,EAAE,MAAM,8GAA8G,CAAC;AACtK,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AASjJ;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,2BAA2B,GAAG,sBAAsB,GAAG;IACjE;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,wCAAwC;IAgCd,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACpC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEjC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAErB,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEhC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAEtB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEtD,OAAO,CAAC,QAAQ,CAAC,eAAe;IAEhB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAEzC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAExB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAGnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE1E,OAAO,CAAC,QAAQ,CAAC,6BAA6B;IAIH,OAAO,CAAC,QAAQ,CAAC,cAAc;IAlE5E,uHAAuH;IACvH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gCAAgC,CAAM;IAC9D,qHAAqH;IACrH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iCAAiC,CAAK;IAC9D,uEAAuE;IACvE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAK;IAEzD;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oCAAoC,CAAiB;IAC7E,2HAA2H;IAC3H,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mCAAmC,CAAU;IAErE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IAExF;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAA6B;gBAGhB,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACtC,YAAY,EAAE,0BAA0B,EAC7B,uBAAuB,EAAE,qCAAqC,EAC1D,oBAAoB,EAAE,yCAAyC,EACjF,gBAAgB,EAAE,uBAAuB,EAEzC,YAAY,EAAE,8BAA8B,EACtC,kBAAkB,EAAE,oCAAoC,EAC/D,WAAW,EAAE,6BAA6B,EAEnC,sBAAsB,EAAE,6BAA6B,EAC/D,YAAY,EAAE,YAAY,EACf,gBAAgB,EAAE,uBAAuB,EAExC,iBAAiB,EAAE,+BAA+B,EAEtC,gBAAgB,EAAE,oCAAoC,EAE3E,eAAe,EAAE,sBAAsB,EAEvB,cAAc,EAAE,sCAAsC,EAEhE,UAAU,EAAE,4BAA4B,EAErC,aAAa,EAAE,+BAA+B,EAGnD,mBAAmB,EAAE,0BAA0B,EACpD,cAAc,EAAE,cAAc,EAEzE,6BAA6B,EAC5C,2CAA2C,EAGe,cAAc,EAAE,qBAAqB;IAMnG;;;;OAIG;IACH,OAAO,KAAK,aAAa,GAYxB;IAED,OAAO,KAAK,SAAS,GAEpB;IAED,OAAO,KAAK,eAAe,GAE1B;IAUD;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAQ1B;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAqC1C;IAEF;;;;OAIG;YACW,kCAAkC;IAUhD;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAQhC;;OAEG;IACH,OAAO,CAAC,6BAA6B;IAIrC,OAAO,CAAC,iCAAiC;IAsBzC,OAAO,CAAC,qBAAqB;IAM7B;;OAEG;IACH,+FAA+F;IAC/F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gCAAgC,CAAgB;YAE1D,aAAa;IAqD3B;;OAEG;YACW,UAAU;IA+BxB,0FAA0F;IAC1F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAK;IAEtD;;;;;;OAMG;YACW,aAAa;IA4C3B;;OAEG;YACW,aAAa;IAK3B;;;OAGG;YACW,wBAAwB;IAyDtC;;;;;;;;;;;;;;;;;OAiBG;YACW,2BAA2B;IAyCzC;;;;;;;;;;;OAWG;YACW,oBAAoB;IAiBlC;;OAEG;YACW,6BAA6B;IAuB3C,OAAO,CAAC,kBAAkB;IAS1B;;;OAGG;YACW,iCAAiC;IA6GlC,QAAQ,CACnB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,qBAAqB,EAAE,yBAAyB,EAChD,cAAc,CAAC,EAAE,MAAM,EACvB,mBAAmB,CAAC,EAAE,MAAM,GAC3B,OAAO,CAAC,0BAA0B,CAAC;IAwMtC;;;;;;;;;;;OAWG;IACU,gCAAgC,CAC3C,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,UAAU,EAAE,kBAAkB,EAC9B,eAAe,CAAC,EAAE,qBAAqB,GAAG,IAAI,GAC7C,OAAO,CAAC,eAAe,EAAE,CAAC;YAIf,+BAA+B;YAY/B,gCAAgC;IAiB9C;;;OAGG;YACW,wBAAwB;IAsBzB,oBAAoB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,mBAAmB,EAAE,mBAAmB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAsY5I;;;;OAIG;IACU,yBAAyB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,kBAAkB,CAAC;QAC7B,UAAU,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACxD,cAAc,CAAC,EAAE,MAAM,CAAC;KACpB,GACL,OAAO,CAAC,qBAAqB,CAAC;IAajC;;;;;;OAMG;IACU,wBAAwB,CACnC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,cAAc,CAAC,EAAE,MAAM,EACvB,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EACvD,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,qBAAqB,CAAC;IAiBjC;;;OAGG;YACW,4BAA4B;IAsE1C;;;OAGG;YACW,4BAA4B;IAgB1C;;;;OAIG;IACU,iCAAiC,CAC5C,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAwCjC;;;OAGG;IACU,qBAAqB,CAChC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,qBAAqB,CAAC;IAyOpB,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAoL1H;;;;;OAKG;IACU,6BAA6B,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAa/H;;;;;;;;OAQG;IACU,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAC/E,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;IAiIF;;;;;OAKG;IACU,oBAAoB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IA2EhI;;;OAGG;YACW,eAAe;IAkD7B;;;;;;OAMG;IACU,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAsFxH;;;;;;OAMG;IACU,mBAAmB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAwI9H;;;;;;;;;;;;;;;;OAgBG;YACW,iBAAiB;IA2E/B,0HAA0H;IAE1H;;;;;;;;;;;;;;;;;;;OAmBG;YACW,yCAAyC;IAcvD;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,0BAA0B;IAuHxC,4FAA4F;IAC5F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAsB;IAEnE;;;;OAIG;YACW,uBAAuB;IAoDrC;;;;OAIG;IACU,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,yBAAyB,UAAQ,GAAG,OAAO,CAAC;QACxL,OAAO,EAAE,IAAI,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IA4FF;;;OAGG;IACU,eAAe,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAoYhN;;;;OAIG;IACU,UAAU,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAiM1J;;;;OAIG;IACU,kBAAkB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAkG5H;;;OAGG;YACW,aAAa;IA0C3B;;OAEG;IACH,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,yBAAyB;IA6BjC,OAAO,CAAC,iCAAiC;IAmBzC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,iCAAiC;IA0DzC,OAAO,CAAC,gCAAgC;YAqC1B,2BAA2B;CAwH1C"}