@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/security/authentications/services/custom-impls/sso-connection.custom-impl.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-connection.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/custom-impls/sso-connection.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,4BAA4B,EAC5B,wBAAwB,EACxB,4BAA4B,EAC5B,8BAA8B,EAC9B,sCAAsC,EACtC,yCAAyC,EACzC,SAAS,EACT,2BAA2B,EAC3B,mBAAmB,EACnB,aAAa,EACb,WAAW,EACX,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAKpH,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAEhJ,yEAAyE;AAEzE,MAAM,iCAAiC,GAAG;IACxC,gBAAgB,CAAC,4BAA4B;IAC7C,gBAAgB,CAAC,2BAA2B;CACpC,CAAC;AAEX,oEAAoE;AAEpE,MAAM,aAAa,GAAG;IACpB,QAAQ,EAAE,oDAAoD;IAC9D,IAAI,EAAE,gDAAgD;CAC9C,CAAC;AAEX,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,MAAM;AAEjD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;AAClE,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;AAEhE,MAAM,YAAY,GAAyC;IACzD,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,uBAAuB,EAAE;IACpD,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAChD,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE;IACtF,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE;IAC9E,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE;IACtF,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE;IAC9E,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE;IACtF,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE;CAC/E,CAAC;AAEF,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,UAAU,CAAC,6BAA6B,CAAC;QAAE,OAAO,OAAO,CAAC;IACtE,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,gCAAgC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC;AACvF,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAW;IAC5C,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,YAAY,EAAE,CAAC;QACzC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACrC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB;IACxC,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3D,CAAC;AAYD,SAAS,mBAAmB,CAAC,OAAe,EAAE,KAAa;IACzD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAChG,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,IAAI,SAAS,CAAC;QACpE,MAAM,SAAS,GAAG,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC;QACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;QAC/F,CAAC;aAAM,IAAI,aAAa,IAAI,EAAE,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,cAAc,aAAa,OAAO,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;IACxH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK;YACL,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,CAAC,CAAC;YACjB,SAAS,EAAE,SAAS;YACpB,WAAW,EAAE,EAAE;YACf,QAAQ,EAAE,CAAC,+BAA+B,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,GAAW,EAAE,YAAoB,IAAI;IACvE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;YACtC,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;gBACtC,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;YACH,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1D,CAAC;QAAC,OAAO,QAAQ,EAAE,CAAC;YAClB,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,KAAK,EAAE,mBAAmB,CAAC,QAAQ,CAAC;aACrC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,IAAI,mBAAmB,GAAG,KAAK,CAAC;AAChC,sIAAsI;AACtI,SAAS,gBAAgB;IACvB,iEAAiE;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,iEAAiE;QACjE,MAAM,SAAS,GAAG,OAAO,CAAC,wCAAwC,CAAC,CAAC;QACpE,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACnC,mBAAmB,GAAG,IAAI,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,6BAA6B,CAAC,UAA+B;IACpE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC/C,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;QAC7F,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qDAAqD,EAAE,CAAC;QAEnG,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC;QACrG,MAAM,OAAO,GAAG,UAAU,CAAC,cAAc,IAAI,UAAU,CAAC,aAAa,CAAC;QACtE,MAAM,QAAQ,GAAG,WAAW,SAAS,YAAY,SAAS,IAAI,OAAO,EAAE,CAAC;QACxE,MAAM,MAAM,GAAG,WAAW,SAAS,gBAAgB,CAAC;QAEpD,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC;YAC9B,QAAQ;YACR,mBAAmB,EAAE,IAAI;YACzB,oBAAoB,EAAE,IAAI;YAC1B,iBAAiB,EAAE,IAAI;YACvB,WAAW,EAAE,MAAM;YACnB,wBAAwB,EAAE;gBACxB,EAAE,OAAO,EAAE,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE;aAClD;SACF,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC3E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2DAA2D,EAAE,CAAC;IAC9F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACjG,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,UAA+B;IAC/D,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,4BAA4B;IAC5B,MAAM,kBAAkB,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACjD,CAAC;IAED,0BAA0B;IAC1B,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,YAAgC,CAAC;IACrC,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnE,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,6BAA6B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC3C,CAAC;IAED,2CAA2C;IAC3C,MAAM,YAAY,GAA4B,EAAE,CAAC;IACjD,MAAM,KAAK,GAAa,UAAU,EAAE,gBAAgB,IAAI,EAAE,CAAC;IAC3D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpD,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;aAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAClD,CAAC;IAED,0CAA0C;IAC1C,IAAI,eAAoC,CAAC;IACzC,IAAI,YAAgC,CAAC;IACrC,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnE,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,6BAA6B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,yCAAyC;IACzC,MAAM,UAAU,GAAG,6BAA6B,CAAC,UAAU,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,gBAAgB,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,oBAAoB;IACpB,IAAI,aAAa,GAAG,8BAA8B,CAAC,IAAI,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,aAAa,GAAG,8BAA8B,CAAC,IAAI,CAAC;SACtE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,aAAa,GAAG,8BAA8B,CAAC,OAAO,CAAC;IAErF,OAAO;QACL,kBAAkB;QAClB,eAAe;QACf,YAAY;QACZ,YAAY;QACZ,eAAe;QACf,YAAY;QACZ,eAAe,EAAE,UAAU,CAAC,KAAK;QACjC,aAAa;QACb,MAAM;QACN,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,sEAAsE;AACtE,SAAS,sBAAsB,CAAC,GAAW;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,KAAK,GAAG,+DAA+D,CAAC;IAC9E,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAyB,EACzB,MAA2D;IAE3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAE9C,KAAK,MAAM,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YACxD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;gBACjE,OAAQ,MAA+B,CAAC,QAAQ,CAAC;YACnD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,wBAAwB;AACxB,uEAAuE;AACvE,EAAE;AACF,0DAA0D;AAC1D,mFAAmF;AACnF,kFAAkF;AAClF,oFAAoF;AACpF,sFAAsF;AACtF,sFAAsF;AACtF,mFAAmF;AACnF,uFAAuF;AACvF,mFAAmF;AACnF,qBAAqB;AAErB,uEAAuE;AACvE,kCAAkC;AAClC,uEAAuE;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kCAAkC;IAChD,OAAO,iCAAiC,CAAC,GAAG,CAAC,CAAC,mBAAmB,EAAE,EAAE;QACnE,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,EAAE;YAC7E,OAAO,yCAAyC,CAAC;gBAC/C,aAAa,EAAE;oBACb,kBAAkB,EAAE,mBAAmB;oBACvC,mBAAmB,EAAE,qBAAqB,CAAC,MAAM;oBACjD,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,kBAAkB,EAAE,IAAI;iBACzB;gBACD,QAAQ,EAAE;oBACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE;wBACpF,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;wBAC/D,2DAA2D;wBAC3D,IAAI,MAAM,EAAE,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,oBAAoB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;4BAC3F,MAAM,GAAG,GAAI,MAAM,CAAC,IAAgC,CAAC,kBAAkB,CAAC;4BACxE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;gCAC1C,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;gCACzC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oCACrB,MAAM,CAAC,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAwB,CAAC;gCAClF,CAAC;4BACH,CAAC;4BACD,OAAQ,MAAM,CAAC,IAAgC,CAAC,kBAAkB,CAAC;wBACrE,CAAC;wBACD,OAAO,MAAM,CAAC;oBAChB,CAAC;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,kCAAkC;AAClC,uEAAuE;AAEvE,MAAM,UAAU,kCAAkC;IAChD,OAAO,iCAAiC,CAAC,GAAG,CAAC,CAAC,mBAAmB,EAAE,EAAE;QACnE,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,EAAE;YAC7E,OAAO,yCAAyC,CAAC;gBAC/C,aAAa,EAAE;oBACb,kBAAkB,EAAE,mBAAmB;oBACvC,mBAAmB,EAAE,qBAAqB,CAAC,MAAM;oBACjD,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,kBAAkB,EAAE,IAAI;iBACzB;gBACD,QAAQ,EAAE;oBACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;wBACnF,IAAI,MAAM,GAAG,KAAK,CAAC;wBACnB,mEAAmE;wBACnE,EAAE;wBACF,2EAA2E;wBAC3E,4EAA4E;wBAC5E,wEAAwE;wBACxE,wEAAwE;wBACxE,wEAAwE;wBACxE,4EAA4E;wBAC5E,2EAA2E;wBAC3E,0EAA0E;wBAC1E,yEAAyE;wBACzE,aAAa;wBACb,IAAI,KAAK,EAAE,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;4BAClD,MAAM,QAAQ,GAAI,KAAK,CAAC,IAAgC,CAAC,YAAY,CAAC;4BACtE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;gCACrF,MAAM,MAAM,GAAI,KAAK,CAAC,aAAqB,EAAE,IAAI,EAAE,YAAY,CAAC;gCAChE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oCACpD,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,CAAC;gCACvE,CAAC;4BACH,CAAC;wBACH,CAAC;wBACD,2DAA2D;wBAC3D,IAAI,MAAM,EAAE,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,oBAAoB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;4BAC3F,MAAM,GAAG,GAAI,MAAM,CAAC,IAAgC,CAAC,kBAAkB,CAAC;4BACxE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;gCAC1C,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;gCACzC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oCACrB,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAmB,CAAC;gCAC7F,CAAC;4BACH,CAAC;4BACD,MAAM,EAAE,kBAAkB,EAAE,CAAC,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,CAAC,IAA+B,CAAC;4BAC5F,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,cAAc,EAAmB,CAAC;wBAChE,CAAC;wBACD,OAAO,MAAM,CAAC;oBAChB,CAAC;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,kCAAkC;AAClC,uEAAuE;AAEvE;;;GAGG;AACH,KAAK,UAAU,sCAAsC,CACnD,YAAoB,EACpB,gBAAuD,EACvD,EAAyB;IAEzB,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAC7C,YAAY,EAAE,gBAAgB,EAAE,EAAE,EAClC,gBAAgB,CAAC,mBAAmB,EACpC,gBAAgB,CAAC,gBAAgB,EACjC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,EACnB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,EACnB,QAAQ,CACT,CAAC;IAEF,OAAO;QACL,iBAAiB,EAAE,UAAU,CAAC,QAAQ;QACtC,iBAAiB,EAAE,UAAU,CAAC,QAAQ;KACvC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,YAAoB,EACpB,gBAAuD,EACvD,EAAyB,EACzB,wBAAgC,EAChC,sBAA8B,EAC9B,WAAoC,EACpC,eAAwC,EACxC,aAAqB;IAErB,MAAM,iBAAiB,GAAG,MAAM,gBAAgB,CAAC,IAAI,CACnD,wBAA+B,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,EACrD,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CACrB,CAAC;IAEb,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAE3E,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAC3C,sBAA6B,EAAE,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAAE,EAClF,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CACrB,CAAC;IAEb,MAAM,8BAA8B,GAAG,IAAI,GAAG,EAAU,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,IAAW,CAAC;QACtB,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9D,8BAA8B,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,MAAM,wBAAwB,GAAG,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,8BAA8B,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACzG,IAAI,wBAAwB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAChD,wBAA+B,EAAE,EAAE,EAAE;QACnC,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,EAAE,wBAAwB,EAAE;QAClD,YAAY,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE;KACpC,EACD,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CACrB,CAAC;IACb,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAExE,MAAM,aAAa,GAAG,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACpG,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kCAAkC;IAChD,OAAO,iCAAiC,CAAC,GAAG,CAAC,CAAC,mBAAmB,EAAE,EAAE;QACnE,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,EAAE;YAC7E,OAAO,yCAAyC,CAAC;gBAC/C,aAAa,EAAE;oBACb,kBAAkB,EAAE,mBAAmB;oBACvC,mBAAmB,EAAE,qBAAqB,CAAC,MAAM;oBACjD,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,kBAAkB,EAAE,IAAI;iBACzB;gBACD,QAAQ,EAAE;oBACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;wBAClF,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;wBAC1C,MAAM,YAAY,GAAG,aAAa,EAAE,YAAY,IAAI,aAAa,EAAE,GAAG,CAAC;wBAEvE,IAAI,CAAC,YAAY,EAAE,CAAC;4BAClB,OAAO,KAAK,CAAC;wBACf,CAAC;wBAED,MAAM,KAAK,GAAI,KAAiC,EAAE,KAAK,KAAK,IAAI,CAAC;wBAEjE,IAAI,CAAC;4BACH,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,GAAG,MAAM,sCAAsC,CAC3F,YAAY,EACZ,KAAK,CAAC,gBAAgB,EACtB,gBAAgB,CACjB,CAAC;4BAEF,IAAI,iBAAiB,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gCACpC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;oCAC1E,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oCAC9D,OAAO,EAAE;wCACP,OAAO,EAAE,IAAI;wCACb,iBAAiB;wCACjB,iBAAiB;wCACjB,OAAO,EAAE,GAAG,iBAAiB,gGAAgG;wCAC7H,aAAa,EAAE,IAAI;qCACpB;iCACF,CAAC,CAAC;4BACL,CAAC;4BAED,IAAI,KAAK,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;gCACnC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE;oCAC7E,YAAY;oCACZ,iBAAiB;oCACjB,aAAa,EAAE,iBAAiB;iCACjC,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gCAAE,MAAM,KAAK,CAAC;4BAC5C,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;gCAClE,YAAY;gCACZ,GAAG,2BAA2B,CAAC,KAAK,CAAC;6BACtC,CAAC,CAAC;wBACL,CAAC;wBAED,OAAO,KAAK,CAAC;oBACf,CAAC;oBAED,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;wBACnF,MAAM,YAAY,GAAG,KAAK,CAAC,aAAa,EAAE,YAAY,IAAI,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC;wBACnF,IAAI,CAAC,YAAY;4BAAE,OAAO,KAAK,CAAC;wBAEhC,IAAI,CAAC;4BACH,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;4BAErI,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gCAC1B,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,2EAA2E,EAAE;oCAC7F,YAAY;oCACZ,gBAAgB,EAAE,UAAU,CAAC,MAAM;iCACpC,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,iFAAiF,EAAE;gCACnG,YAAY;gCACZ,GAAG,2BAA2B,CAAC,KAAK,CAAC;6BACtC,CAAC,CAAC;wBACL,CAAC;wBAED,OAAO,KAAK,CAAC;oBACf,CAAC;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,4CAA4C;AAC5C,uEAAuE;AAEvE,MAAM,UAAU,0CAA0C;IACxD,OAAO,iCAAiC,CAAC,GAAG,CAAC,CAAC,mBAAmB,EAAE,EAAE;QACnE,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,EAAE;YAC7E,OAAO,yCAAyC,CAAC;gBAC/C,aAAa,EAAE;oBACb,kBAAkB,EAAE,mBAAmB;oBACvC,mBAAmB,EAAE,wBAAwB,CAAC,eAAe;oBAC7D,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,kBAAkB,EAAE,IAAI;iBACzB;gBACD,gBAAgB,EAAE,sCAAsC;gBACxD,QAAQ,EAAE;oBACR,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;wBACrF,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;wBAE1C,IAAI,aAAa,EAAE,QAAQ,KAAK,WAAW,CAAC,IAAI,EAAE,CAAC;4BACjD,OAAO;gCACL,QAAQ,EAAE,WAAW,CAAC,IAAI;gCAC1B,SAAS,EAAE,IAAI;gCACf,GAAG,MAAM,kBAAkB,CAAC,aAAa,CAAC;6BAC3C,CAAC;wBACJ,CAAC;wBAED,OAAO;4BACL,QAAQ,EAAE,WAAW,CAAC,IAAI;4BAC1B,SAAS,EAAE,KAAK;4BAChB,OAAO,EAAE,kFAAkF;yBAC5F,CAAC;oBACJ,CAAC;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,+CAA+C;AAC/C,uEAAuE;AAEvE,MAAM,UAAU,6CAA6C;IAC3D,OAAO,iCAAiC,CAAC,GAAG,CAAC,CAAC,mBAAmB,EAAE,EAAE;QACnE,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,EAAE;YAC7E,OAAO,yCAAyC,CAAC;gBAC/C,aAAa,EAAE;oBACb,kBAAkB,EAAE,mBAAmB;oBACvC,mBAAmB,EAAE,wBAAwB,CAAC,kBAAkB;oBAChE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,kBAAkB,EAAE,IAAI;iBACzB;gBACD,gBAAgB,EAAE,yCAAyC;gBAC3D,QAAQ,EAAE;oBACR,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;wBACnF,MAAM,UAAU,GAAG,KAAiE,CAAC;wBAErF,oEAAoE;wBACpE,uEAAuE;wBACvE,IAAI,UAAU,EAAE,WAAW,EAAE,CAAC;4BAC5B,OAAO;gCACL,QAAQ,EAAE,WAAW,CAAC,IAAI;gCAC1B,SAAS,EAAE,IAAI;gCACf,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC;6BAChF,CAAC;wBACJ,CAAC;wBAED,OAAO;4BACL,QAAQ,EAAE,WAAW,CAAC,IAAI;4BAC1B,SAAS,EAAE,KAAK;4BAChB,OAAO,EAAE,8EAA8E;yBACxF,CAAC;oBACJ,CAAC;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AAExE,KAAK,UAAU,qBAAqB,CAClC,WAAmB,EACnB,gBAAuC,EACvC,KAGC;IAED,qBAAqB;IACrB,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;YACxC,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;YACnC,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBAC1E,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE,EAAE,OAAO,EAAE,8BAA8B,QAAQ,CAAC,MAAM,EAAE,EAAE;aACtE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7E,WAAW,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEpC,IAAI,WAAW,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;YAC3C,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBAC1E,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE,EAAE,OAAO,EAAE,6BAA6B,iBAAiB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE;aAC/F,CAAC,CAAC;QACL,CAAC;QAED,8DAA8D;QAC9D,MAAM,YAAY,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC;eAC3C,WAAW,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;eAC3C,WAAW,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBAC1E,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC5C,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;YAC1E,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;YAC7E,OAAO,EAAE,EAAE,OAAO,EAAE,iCAAiC,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE;SACpF,CAAC,CAAC;IACL,CAAC;IAED,kGAAkG;IAClG,oGAAoG;IACpG,6EAA6E;IAC7E,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC/B,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;YAC7E,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;YAC7E,OAAO,EAAE;gBACP,OAAO,EAAE,8HAA8H;aACxI;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,WAAW,CAMpE,CAAC;QACF,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,MAAM,EAAE,4BAA4B,CAAC,aAAa;SACnD,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC5C,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;YAC1E,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;YAC7E,OAAO,EAAE,EAAE,OAAO,EAAE,8BAA8B,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE;SACjF,CAAC,CAAC;IACL,CAAC;AACH,CAAC","sourcesContent":["/**\n * SSO Connection Custom Implementations\n *\n * Implements READ, CREATE, UPDATE, DELETE, TEST_CONNECTION, DISCOVER_ENDPOINTS\n * on SSO connection polymorphic variants (ORG + APP).\n *\n * Patterns:\n *   READ              → (no custom impl) — oidc.clientSecret masking is framework-driven\n *                                          via `.isWriteOnlySecret()` on the schema\n *   CREATE            → PREFIX_CORE_OPERATIONS  — generates connectionId via crypto.randomUUID()\n *   UPDATE            → PREFIX_CORE_OPERATIONS  — re-injects the stored oidc.clientSecret when\n *                                          the client round-trips the `••••••••` mask (nested\n *                                          field: whole-subdocument `$set` would otherwise drop it)\n *   DELETE            → PREFIX_CORE_OPERATIONS  — orphan validation (warns if users would lose their only auth method)\n *   TEST_CONNECTION   → REPLACE_CORE_OPERATIONS — SAML → validate config (certs, URLs, SP metadata), OIDC → explicit unsupported result\n *   DISCOVER_ENDPOINTS→ REPLACE_CORE_OPERATIONS — SAML → fetch + parse IdP metadata URL, OIDC → explicit unsupported result\n *\n * SAML helpers (cert validation, URL reachability, samlify init) are module-level\n * functions because the factory pattern does not support DI injection of arbitrary\n * services. Certificate validation uses Node.js crypto.X509Certificate directly.\n */\n\nimport crypto from 'node:crypto';\nimport {\n  CoreResourceOperation,\n  CoreResourceType,\n  ResourceOperationVariantType,\n  SsoConnection_Operations,\n  SsoConnectionDiscoverySource,\n  SsoConnectionTestOverallStatus,\n  SsoConnection_TestConnectionRequestDto,\n  SsoConnection_DiscoverEndpointsRequestDto,\n  ErrorType,\n  ErrorCustomMessageReference,\n  isWildoBackendError,\n  AuthScopeType,\n  SsoProtocol,\n  WRITE_ONLY_SECRET_MASK,\n} from '@wildo-ai/saas-models';\nimport { WildoHeaderKeys } from '@wildo-ai/saas-models';\nimport type { UserIdentityLink, UserCredentials } from '@wildo-ai/saas-models';\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\n\n// ── SSO connection polymorphic variant types ──────────────────────────\n\nconst AUTH_SSO_CONNECTION_VARIANT_TYPES = [\n  CoreResourceType.ORGANIZATION_SSO_CONNECTIONS,\n  CoreResourceType.APPLICATION_SSO_CONNECTIONS,\n] as const;\n\n// ── SAML Test / Discovery helpers ────────────────────────────────\n\nconst SAML_BINDINGS = {\n  REDIRECT: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',\n  POST: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',\n} as const;\n\nconst MAX_METADATA_SIZE = 2 * 1024 * 1024; // 2MB\n\nconst SHA1_RSA_OID = Buffer.from('06092a864886f70d010105', 'hex');\nconst ECDSA_SHA1_OID = Buffer.from('06072a8648ce3d0401', 'hex');\n\nconst SIG_ALG_OIDS: Array<{ oid: Buffer; name: string }> = [\n  { oid: SHA1_RSA_OID, name: 'sha1WithRSAEncryption' },\n  { oid: ECDSA_SHA1_OID, name: 'ecdsa-with-SHA1' },\n  { oid: Buffer.from('06092a864886f70d01010b', 'hex'), name: 'sha256WithRSAEncryption' },\n  { oid: Buffer.from('06082a8648ce3d040302', 'hex'), name: 'ecdsa-with-SHA256' },\n  { oid: Buffer.from('06092a864886f70d01010c', 'hex'), name: 'sha384WithRSAEncryption' },\n  { oid: Buffer.from('06082a8648ce3d040303', 'hex'), name: 'ecdsa-with-SHA384' },\n  { oid: Buffer.from('06092a864886f70d01010d', 'hex'), name: 'sha512WithRSAEncryption' },\n  { oid: Buffer.from('06082a8648ce3d040304', 'hex'), name: 'ecdsa-with-SHA512' },\n];\n\nfunction normalizePem(certPem: string): string {\n  const trimmed = certPem.trim();\n  if (trimmed.startsWith('-----BEGIN CERTIFICATE-----')) return trimmed;\n  const cleanBase64 = trimmed.replace(/\\s/g, '');\n  const lines: string[] = [];\n  for (let i = 0; i < cleanBase64.length; i += 64) {\n    lines.push(cleanBase64.substring(i, i + 64));\n  }\n  return `-----BEGIN CERTIFICATE-----\\n${lines.join('\\n')}\\n-----END CERTIFICATE-----`;\n}\n\nfunction getCertSignatureAlgorithm(der: Buffer): string {\n  for (const { oid, name } of SIG_ALG_OIDS) {\n    if (der.includes(oid)) return name;\n  }\n  return 'unknown';\n}\n\nfunction isSha1Algorithm(algorithm: string): boolean {\n  const lower = algorithm.toLowerCase();\n  return lower.includes('sha1') || lower.includes('sha-1');\n}\n\ninterface CertificateTestResult {\n  index: number;\n  valid: boolean;\n  expiresAt: string;\n  daysRemaining: number;\n  algorithm: string;\n  fingerprint: string;\n  warnings: string[];\n}\n\nfunction validateCertificate(certPem: string, index: number): CertificateTestResult {\n  try {\n    const normalized = normalizePem(certPem);\n    const x509 = new crypto.X509Certificate(normalized);\n    const expiresAt = new Date(x509.validTo);\n    const now = new Date();\n    const daysRemaining = Math.floor((expiresAt.getTime() - now.getTime()) / (1000 * 60 * 60 * 24));\n    const isValid = now >= new Date(x509.validFrom) && now <= expiresAt;\n    const algorithm = getCertSignatureAlgorithm(x509.raw);\n    const fingerprint = x509.fingerprint256;\n    const warnings: string[] = [];\n\n    if (!isValid) {\n      warnings.push(daysRemaining < 0 ? 'Certificate is expired' : 'Certificate is not yet valid');\n    } else if (daysRemaining <= 30) {\n      warnings.push(`Expires in ${daysRemaining} days`);\n    }\n    if (isSha1Algorithm(algorithm)) {\n      warnings.push('Uses SHA-1 signature algorithm (insecure)');\n    }\n\n    return { index, valid: isValid, expiresAt: expiresAt.toISOString(), daysRemaining, algorithm, fingerprint, warnings };\n  } catch (error) {\n    return {\n      index,\n      valid: false,\n      expiresAt: '',\n      daysRemaining: -1,\n      algorithm: 'unknown',\n      fingerprint: '',\n      warnings: [`Certificate parsing failed: ${describeCaughtError(error)}`],\n    };\n  }\n}\n\nasync function checkUrlReachability(url: string, timeoutMs: number = 5000): Promise<{ reachable: boolean; statusCode?: number; error?: string }> {\n  try {\n    const response = await fetch(url, {\n      method: 'HEAD',\n      signal: AbortSignal.timeout(timeoutMs),\n      redirect: 'follow',\n    });\n    return { reachable: true, statusCode: response.status };\n  } catch {\n    try {\n      const response = await fetch(url, {\n        method: 'GET',\n        signal: AbortSignal.timeout(timeoutMs),\n        redirect: 'follow',\n      });\n      return { reachable: true, statusCode: response.status };\n    } catch (getError) {\n      return {\n        reachable: false,\n        error: describeCaughtError(getError),\n      };\n    }\n  }\n}\n\nlet _samlifyInitialized = false;\n// Returns `any` to avoid `typeof import('samlify')` which forces tsc to resolve the CJS-only samlify package during declaration emit.\nfunction getSamlifyModule(): any {\n  // eslint-disable-next-line @typescript-eslint/no-require-imports\n  const saml = require('samlify');\n  if (!_samlifyInitialized) {\n    // eslint-disable-next-line @typescript-eslint/no-require-imports\n    const validator = require('@authenio/samlify-xsd-schema-validator');\n    saml.setSchemaValidator(validator);\n    _samlifyInitialized = true;\n  }\n  return saml;\n}\n\nfunction generateAndValidateSPMetadata(connection: Record<string, any>): { valid: boolean; error?: string } {\n  try {\n    const appDomain = process.env.APP_DOMAIN;\n    const spCert = process.env.SAML_SP_CERTIFICATE;\n    if (!appDomain) return { valid: false, error: 'APP_DOMAIN environment variable is not set' };\n    if (!spCert) return { valid: false, error: 'SAML_SP_CERTIFICATE environment variable is not set' };\n\n    const scopeType = connection.organizationId ? AuthScopeType.ORGANIZATION : AuthScopeType.APPLICATION;\n    const scopeId = connection.organizationId || connection.applicationId;\n    const entityID = `https://${appDomain}/saml/sp/${scopeType}/${scopeId}`;\n    const acsUrl = `https://${appDomain}/auth/saml/acs`;\n\n    const saml = getSamlifyModule();\n    const sp = saml.ServiceProvider({\n      entityID,\n      authnRequestsSigned: true,\n      wantAssertionsSigned: true,\n      wantMessageSigned: true,\n      signingCert: spCert,\n      assertionConsumerService: [\n        { Binding: SAML_BINDINGS.POST, Location: acsUrl },\n      ],\n    });\n\n    const metadata = sp.getMetadata();\n    if (typeof metadata === 'string' && metadata.includes('<EntityDescriptor')) {\n      return { valid: true };\n    }\n    return { valid: false, error: 'Generated SP metadata is missing EntityDescriptor element' };\n  } catch (error) {\n    return { valid: false, error: `SP metadata generation failed: ${describeCaughtError(error)}` };\n  }\n}\n\nasync function testSamlConnection(connection: Record<string, any>): Promise<Record<string, any>> {\n  const samlConfig = connection.saml;\n  const errors: string[] = [];\n  const warnings: string[] = [];\n\n  // 1. Validate IdP entity ID\n  const entityIdConfigured = !!(samlConfig?.entityId);\n  if (!entityIdConfigured) {\n    errors.push('IdP Entity ID is not configured');\n  }\n\n  // 2. SSO URL reachability\n  let ssoUrlReachable = false;\n  let ssoUrlStatus: number | undefined;\n  if (samlConfig?.ssoUrl) {\n    const result = await checkUrlReachability(samlConfig.ssoUrl, 5000);\n    ssoUrlReachable = result.reachable;\n    ssoUrlStatus = result.statusCode;\n    if (!result.reachable) errors.push(`SSO URL is not reachable: ${result.error}`);\n  } else {\n    errors.push('SSO URL is not configured');\n  }\n\n  // 3. Certificate validation (E8, E9, SC-1)\n  const certificates: CertificateTestResult[] = [];\n  const certs: string[] = samlConfig?.x509Certificates ?? [];\n  for (let i = 0; i < certs.length; i++) {\n    const certResult = validateCertificate(certs[i], i);\n    certificates.push(certResult);\n    if (!certResult.valid) {\n      errors.push(`Certificate ${i}: ${certResult.warnings.join(', ')}`);\n    } else if (certResult.warnings.length > 0) {\n      warnings.push(...certResult.warnings.map((w: string) => `Certificate ${i}: ${w}`));\n    }\n  }\n  if (certs.length === 0) {\n    errors.push('No X.509 certificates configured');\n  }\n\n  // 4. SLO URL reachability (if configured)\n  let sloUrlReachable: boolean | undefined;\n  let sloUrlStatus: number | undefined;\n  if (samlConfig?.sloUrl) {\n    const result = await checkUrlReachability(samlConfig.sloUrl, 5000);\n    sloUrlReachable = result.reachable;\n    sloUrlStatus = result.statusCode;\n    if (!result.reachable) warnings.push(`SLO URL is not reachable: ${result.error}`);\n  }\n\n  // 5. SP metadata generation + validation\n  const spMetadata = generateAndValidateSPMetadata(connection);\n  if (!spMetadata.valid) {\n    warnings.push(`SP metadata: ${spMetadata.error}`);\n  }\n\n  // 6. Overall status\n  let overallStatus = SsoConnectionTestOverallStatus.PASS;\n  if (errors.length > 0) overallStatus = SsoConnectionTestOverallStatus.FAIL;\n  else if (warnings.length > 0) overallStatus = SsoConnectionTestOverallStatus.WARNING;\n\n  return {\n    entityIdConfigured,\n    ssoUrlReachable,\n    ssoUrlStatus,\n    certificates,\n    sloUrlReachable,\n    sloUrlStatus,\n    spMetadataValid: spMetadata.valid,\n    overallStatus,\n    errors,\n    warnings,\n  };\n}\n\nfunction normalizeCertificates(certs: unknown): string[] {\n  if (!certs) return [];\n  if (typeof certs === 'string') {\n    return splitPemToCertificates(certs);\n  }\n  if (Array.isArray(certs)) {\n    return certs.flat().filter((c): c is string => typeof c === 'string' && c.length > 0);\n  }\n  return [];\n}\n\n/** Split multi-cert PEM string into array of individual cert PEMs. */\nfunction splitPemToCertificates(pem: string): string[] {\n  const trimmed = pem.trim();\n  if (!trimmed) return [];\n  const regex = /-----BEGIN CERTIFICATE-----[\\s\\S]*?-----END CERTIFICATE-----/g;\n  const matches = trimmed.match(regex);\n  if (!matches || matches.length === 0) return [trimmed];\n  return matches.map((m) => m.trim()).filter(Boolean);\n}\n\nfunction extractServiceUrl(\n  meta: Record<string, any>,\n  method: 'getSingleSignOnService' | 'getSingleLogoutService',\n): string | null {\n  const getter = meta[method];\n  if (typeof getter !== 'function') return null;\n\n  for (const binding of [SAML_BINDINGS.REDIRECT, SAML_BINDINGS.POST]) {\n    try {\n      const result = getter.call(meta, binding);\n      if (typeof result === 'string' && result) return result;\n      if (result && typeof result === 'object' && 'Location' in result) {\n        return (result as { Location: string }).Location;\n      }\n    } catch {\n      // Binding not available\n    }\n  }\n  return null;\n}\n\n// ════════════════════════════════════════════════════════════════════\n// READ — no custom impl\n// ════════════════════════════════════════════════════════════════════\n//\n// `oidc.clientSecret` carries `.isWriteOnlySecret()` (see\n// `sso-connection.shared.schemas.ts`). The framework masks it to `••••••••` at the\n// client-serialization boundary (`serializeOperationResultForResponse`) for every\n// client read (READ/CREATE/UPDATE responses) and strips the round-tripped mask from\n// write payloads centrally. The former READ postfix masking factory was redundant AND\n// masked the wrong tier: it ran at the service dispatch (before the client boundary),\n// so the internal `servicesRegistryHandler.read` used by the OAuth2 token exchange\n// received the mask too and could not authenticate at the IdP token endpoint. Removing\n// it restores the token exchange's real-value read; the decorator keeps the client\n// boundary redacted.\n\n// ════════════════════════════════════════════════════════════════════\n// CREATE — PREFIX_CORE_OPERATIONS\n// ════════════════════════════════════════════════════════════════════\n\n/**\n * SSO connection CREATE prefix — mints `connectionId` and normalizes the authored SAML\n * `x509CertificatePem` into the stored `x509Certificates` array.\n *\n * Registered on `INTERNAL_CALL`, matching the resource configuration. All three write\n * variants (CREATE / UPDATE / DELETE) were authored against `REPOSITORY_ONLY` and were\n * unreachable in both directions: `getServiceOperationPathDefault` — behind every\n * `*AsSystem` call — skips a REPOSITORY_ONLY-only op, and `doOperation` throws on that\n * variant, so the service tier where custom implementations execute was never entered.\n * Nothing else in the codebase mints `connectionId`, so a connection written past the\n * service tier had none at all.\n *\n * This mirrors the READ default, which had already been moved to `INTERNAL_CALL` for the\n * same resolver reason; the writes were simply left behind. `INTERNAL_CALL` adds no HTTP\n * surface — only API_CALL variants register routes.\n */\nexport function createSsoConnectionCreateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return AUTH_SSO_CONNECTION_VARIANT_TYPES.map((variantResourceType) => {\n    const factory = (_resourcesRegistryService: ResourcesRegistryBackendService) => {\n      return createResourceCustomServiceImplementation({\n        operationPath: {\n          resourceIdentifier: variantResourceType,\n          operationIdentifier: CoreResourceOperation.CREATE,\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isOperationDefault: true,\n        },\n        handlers: {\n          prefixCoreOperations: async (_id, input, _executionContext, _operationPath, _utils) => {\n            const result = { ...input, connectionId: crypto.randomUUID() };\n            // Transform x509CertificatePem → x509Certificates for SAML\n            if (result?.saml && typeof result.saml === 'object' && 'x509CertificatePem' in result.saml) {\n              const pem = (result.saml as Record<string, unknown>).x509CertificatePem;\n              if (typeof pem === 'string' && pem.trim()) {\n                const certs = normalizeCertificates(pem);\n                if (certs.length > 0) {\n                  result.saml = { ...result.saml, x509Certificates: certs } as typeof result.saml;\n                }\n              }\n              delete (result.saml as Record<string, unknown>).x509CertificatePem;\n            }\n            return result;\n          },\n        },\n      });\n    };\n\n    return factory as unknown as ResourceCustomServiceImplementationFactory;\n  });\n}\n\n// ════════════════════════════════════════════════════════════════════\n// UPDATE — PREFIX_CORE_OPERATIONS\n// ════════════════════════════════════════════════════════════════════\n\nexport function createSsoConnectionUpdateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return AUTH_SSO_CONNECTION_VARIANT_TYPES.map((variantResourceType) => {\n    const factory = (_resourcesRegistryService: ResourcesRegistryBackendService) => {\n      return createResourceCustomServiceImplementation({\n        operationPath: {\n          resourceIdentifier: variantResourceType,\n          operationIdentifier: CoreResourceOperation.UPDATE,\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isOperationDefault: true,\n        },\n        handlers: {\n          prefixCoreOperations: async (_id, input, _executionContext, _operationPath, utils) => {\n            let result = input;\n            // Write-only-secret preservation for the NESTED oidc.clientSecret.\n            //\n            // The field is `.isWriteOnlySecret()`, so a client that renders the masked\n            // read value and saves round-trips `••••••••` (or omits it). The repository\n            // UPDATE is a whole-subdocument `$set` with NO deep merge — writing the\n            // incoming `oidc` object would replace the stored one and drop the real\n            // secret. The framework's central sentinel-strip only rescues TOP-LEVEL\n            // write-only secrets (it deletes the key and relies on `$set` omitting it),\n            // which does not help a nested field. So re-inject the stored secret here,\n            // BEFORE the central strip runs, whenever the incoming value is the mask,\n            // empty, or absent. A genuinely rotated secret (any other value) is left\n            // untouched.\n            if (input?.oidc && typeof input.oidc === 'object') {\n              const incoming = (input.oidc as Record<string, unknown>).clientSecret;\n              if (incoming === undefined || incoming === '' || incoming === WRITE_ONLY_SECRET_MASK) {\n                const stored = (utils.currentObject as any)?.oidc?.clientSecret;\n                if (typeof stored === 'string' && stored.length > 0) {\n                  result = { ...input, oidc: { ...input.oidc, clientSecret: stored } };\n                }\n              }\n            }\n            // Transform x509CertificatePem → x509Certificates for SAML\n            if (result?.saml && typeof result.saml === 'object' && 'x509CertificatePem' in result.saml) {\n              const pem = (result.saml as Record<string, unknown>).x509CertificatePem;\n              if (typeof pem === 'string' && pem.trim()) {\n                const certs = normalizeCertificates(pem);\n                if (certs.length > 0) {\n                  result = { ...result, saml: { ...result.saml, x509Certificates: certs } } as typeof result;\n                }\n              }\n              const { x509CertificatePem: _, ...samlWithoutPem } = result.saml as Record<string, unknown>;\n              result = { ...result, saml: samlWithoutPem } as typeof result;\n            }\n            return result;\n          },\n        },\n      });\n    };\n\n    return factory as unknown as ResourceCustomServiceImplementationFactory;\n  });\n}\n\n// ════════════════════════════════════════════════════════════════════\n// DELETE — PREFIX_CORE_OPERATIONS\n// ════════════════════════════════════════════════════════════════════\n\n/**\n * Count users who would be left without any auth method if this SSO connection\n * is removed. Uses batch queries instead of per-user loads.\n */\nasync function countOrphanedUsersForConnectionRemoval(\n  connectionId: string,\n  servicesRegistry: ServicesRegistryHandlerBackendService,\n  ec: ExecutionContext<any>,\n): Promise<{ affectedUserCount: number; orphanedUserCount: number }> {\n  const userResult = await _countOrphanedEntities<UserIdentityLink, UserCredentials>(\n    connectionId, servicesRegistry, ec,\n    CoreResourceType.USER_IDENTITY_LINKS,\n    CoreResourceType.USER_CREDENTIALS,\n    link => link.userId,\n    cred => cred.userId,\n    'userId',\n  );\n\n  return {\n    affectedUserCount: userResult.affected,\n    orphanedUserCount: userResult.orphaned,\n  };\n}\n\nasync function _countOrphanedEntities<TLink, TCred>(\n  connectionId: string,\n  servicesRegistry: ServicesRegistryHandlerBackendService,\n  ec: ExecutionContext<any>,\n  identityLinkResourceType: string,\n  credentialResourceType: string,\n  getEntityId: (link: TLink) => string,\n  getCredEntityId: (cred: TCred) => string,\n  entityIdField: string,\n): Promise<{ affected: number; orphaned: number }> {\n  const affectedLinksList = await servicesRegistry.list<TLink>(\n    identityLinkResourceType as any, ec, { connectionId },\n    undefined, { paginated: false },\n  ) as TLink[];\n\n  if (affectedLinksList.length === 0) {\n    return { affected: 0, orphaned: 0 };\n  }\n\n  const affectedEntityIds = [...new Set(affectedLinksList.map(getEntityId))];\n\n  const credsList = await servicesRegistry.list<TCred>(\n    credentialResourceType as any, ec, { [entityIdField]: { $in: affectedEntityIds } },\n    undefined, { paginated: false },\n  ) as TCred[];\n\n  const entitiesWithCredentialFallback = new Set<string>();\n  for (const cred of credsList) {\n    const c = cred as any;\n    if (c.passwordHash || (c.passkeyCredentials?.length ?? 0) > 0) {\n      entitiesWithCredentialFallback.add(getCredEntityId(cred));\n    }\n  }\n\n  const entitiesNeedingLinkCheck = affectedEntityIds.filter(id => !entitiesWithCredentialFallback.has(id));\n  if (entitiesNeedingLinkCheck.length === 0) {\n    return { affected: affectedEntityIds.length, orphaned: 0 };\n  }\n\n  const otherLinksList = await servicesRegistry.list<TLink>(\n    identityLinkResourceType as any, ec, {\n      [entityIdField]: { $in: entitiesNeedingLinkCheck },\n      connectionId: { $ne: connectionId },\n    },\n    undefined, { paginated: false },\n  ) as TLink[];\n  const entitiesWithOtherLinks = new Set(otherLinksList.map(getEntityId));\n\n  const orphanedCount = entitiesNeedingLinkCheck.filter(id => !entitiesWithOtherLinks.has(id)).length;\n  return { affected: affectedEntityIds.length, orphaned: orphanedCount };\n}\n\n/**\n * SSO connection DELETE guards.\n *\n * Registered on `INTERNAL_CALL` — see the note on the CREATE factory for why the write\n * variants moved off `REPOSITORY_ONLY`.\n *\n * ⚠️ Reachable does NOT mean universal. The `onParentDelete` cascade (organization or\n * application deleted) still bypasses this prefix: it calls `childRepository.delete(...)`\n * directly after a `supportsOperation` check that matches on `operationIdentifier` +\n * `isOperationDefault` and ignores `variantType` entirely. That is intentional — the whole\n * owning scope is going away, so the \"last remaining connection\" and \"connection in use\"\n * guards below would be wrong there. These guards protect the targeted single-connection\n * delete, which now runs through the service tier.\n */\nexport function createSsoConnectionDeleteFactories(): ResourceCustomServiceImplementationFactory[] {\n  return AUTH_SSO_CONNECTION_VARIANT_TYPES.map((variantResourceType) => {\n    const factory = (_resourcesRegistryService: ResourcesRegistryBackendService) => {\n      return createResourceCustomServiceImplementation({\n        operationPath: {\n          resourceIdentifier: variantResourceType,\n          operationIdentifier: CoreResourceOperation.DELETE,\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isOperationDefault: true,\n        },\n        handlers: {\n          prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n            const currentObject = utils.currentObject;\n            const connectionId = currentObject?.connectionId || currentObject?._id;\n\n            if (!connectionId) {\n              return input;\n            }\n\n            const force = (input as Record<string, unknown>)?.force === true;\n\n            try {\n              const { affectedUserCount, orphanedUserCount } = await countOrphanedUsersForConnectionRemoval(\n                connectionId,\n                utils.servicesRegistry,\n                executionContext,\n              );\n\n              if (orphanedUserCount > 0 && !force) {\n                throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n                  customMessageReference: ErrorCustomMessageReference.VALIDATION,\n                  context: {\n                    warning: true,\n                    affectedUserCount,\n                    orphanedUserCount,\n                    message: `${orphanedUserCount} account(s) will lose their only authentication method. Re-submit with force: true to proceed.`,\n                    requiresForce: true,\n                  },\n                });\n              }\n\n              if (force && orphanedUserCount > 0) {\n                utils.logger.warn('SSO connection removal forced — accounts will be orphaned', {\n                  connectionId,\n                  orphanedUserCount,\n                  totalAffected: affectedUserCount,\n                });\n              }\n            } catch (error) {\n              if (isWildoBackendError(error)) throw error;\n              utils.logger.warn('SSO connection orphan check failed (non-fatal)', {\n                connectionId,\n                ...projectCaughtErrorLogFields(error),\n              });\n            }\n\n            return input;\n          },\n\n          postfixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n            const connectionId = utils.currentObject?.connectionId || utils.currentObject?._id;\n            if (!connectionId) return input;\n\n            try {\n              const deletedIds = await utils.servicesRegistry.deleteMany(CoreResourceType.USER_IDENTITY_LINKS, executionContext, { connectionId });\n\n              if (deletedIds.length > 0) {\n                utils.logger.info('AUTH-13: Cleaned up orphaned identity links after SSO connection deletion', {\n                  connectionId,\n                  deletedLinkCount: deletedIds.length,\n                });\n              }\n            } catch (error) {\n              utils.logger.warn('AUTH-13: Identity link cleanup failed (non-fatal) — orphaned links remain in DB', {\n                connectionId,\n                ...projectCaughtErrorLogFields(error),\n              });\n            }\n\n            return input;\n          },\n        },\n      });\n    };\n\n    return factory as unknown as ResourceCustomServiceImplementationFactory;\n  });\n}\n\n// ════════════════════════════════════════════════════════════════════\n// TEST_CONNECTION — REPLACE_CORE_OPERATIONS\n// ════════════════════════════════════════════════════════════════════\n\nexport function createSsoConnectionTestConnectionFactories(): ResourceCustomServiceImplementationFactory[] {\n  return AUTH_SSO_CONNECTION_VARIANT_TYPES.map((variantResourceType) => {\n    const factory = (_resourcesRegistryService: ResourcesRegistryBackendService) => {\n      return createResourceCustomServiceImplementation({\n        operationPath: {\n          resourceIdentifier: variantResourceType,\n          operationIdentifier: SsoConnection_Operations.TEST_CONNECTION,\n          variantType: ResourceOperationVariantType.API_CALL,\n          isOperationDefault: true,\n        },\n        requestDtoSchema: SsoConnection_TestConnectionRequestDto,\n        handlers: {\n          replaceCoreOperations: async (_id, _input, _executionContext, _operationPath, utils) => {\n            const currentObject = utils.currentObject;\n\n            if (currentObject?.protocol === SsoProtocol.SAML) {\n              return {\n                protocol: SsoProtocol.SAML,\n                supported: true,\n                ...await testSamlConnection(currentObject),\n              };\n            }\n\n            return {\n              protocol: SsoProtocol.OIDC,\n              supported: false,\n              message: 'OIDC connection testing is not implemented; no provider handshake was attempted.',\n            };\n          },\n        },\n      });\n    };\n\n    return factory as unknown as ResourceCustomServiceImplementationFactory;\n  });\n}\n\n// ════════════════════════════════════════════════════════════════════\n// DISCOVER_ENDPOINTS — REPLACE_CORE_OPERATIONS\n// ════════════════════════════════════════════════════════════════════\n\nexport function createSsoConnectionDiscoverEndpointsFactories(): ResourceCustomServiceImplementationFactory[] {\n  return AUTH_SSO_CONNECTION_VARIANT_TYPES.map((variantResourceType) => {\n    const factory = (_resourcesRegistryService: ResourcesRegistryBackendService) => {\n      return createResourceCustomServiceImplementation({\n        operationPath: {\n          resourceIdentifier: variantResourceType,\n          operationIdentifier: SsoConnection_Operations.DISCOVER_ENDPOINTS,\n          variantType: ResourceOperationVariantType.API_CALL,\n          isOperationDefault: true,\n        },\n        requestDtoSchema: SsoConnection_DiscoverEndpointsRequestDto,\n        handlers: {\n          replaceCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n            const typedInput = input as { issuerUrl?: string; metadataUrl?: string } | undefined;\n\n            // The request DTO enforces at least one source before this handler.\n            // When both are supplied, SAML metadata remains the explicit priority.\n            if (typedInput?.metadataUrl) {\n              return {\n                protocol: SsoProtocol.SAML,\n                supported: true,\n                ...await discoverSamlEndpoints(typedInput.metadataUrl, executionContext, utils),\n              };\n            }\n\n            return {\n              protocol: SsoProtocol.OIDC,\n              supported: false,\n              message: 'OIDC endpoint discovery is not implemented; issuer metadata was not fetched.',\n            };\n          },\n        },\n      });\n    };\n\n    return factory as unknown as ResourceCustomServiceImplementationFactory;\n  });\n}\n\n// ── SAML metadata discovery ──────────────────────────────────────────\n\nasync function discoverSamlEndpoints(\n  metadataUrl: string,\n  executionContext: ExecutionContext<any>,\n  utils: {\n    errorBuilder: ErrorBuilderBackendService;\n    samlMetadataService?: { parseIdPMetadata(metadataXml: string): unknown };\n  },\n): Promise<Record<string, any>> {\n  // Fetch metadata XML\n  let metadataXml: string;\n  try {\n    const response = await fetch(metadataUrl, {\n      method: 'GET',\n      signal: AbortSignal.timeout(10_000),\n      redirect: 'follow',\n    });\n\n    if (!response.ok) {\n      throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.SAML_METADATA_PARSE_ERROR,\n        context: { message: `Metadata URL returned HTTP ${response.status}` },\n      });\n    }\n\n    const contentType = response.headers.get(WildoHeaderKeys.CONTENT_TYPE) || '';\n    metadataXml = await response.text();\n\n    if (metadataXml.length > MAX_METADATA_SIZE) {\n      throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.SAML_METADATA_PARSE_ERROR,\n        context: { message: `Metadata response exceeds ${MAX_METADATA_SIZE / (1024 * 1024)}MB limit` },\n      });\n    }\n\n    // Validate XML content (Content-Type header or content sniff)\n    const looksLikeXml = contentType.includes('xml')\n      || metadataXml.trimStart().startsWith('<?xml')\n      || metadataXml.trimStart().startsWith('<');\n    if (!looksLikeXml) {\n      throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.SAML_METADATA_PARSE_ERROR,\n        context: { message: 'URL did not return XML metadata' },\n      });\n    }\n  } catch (error) {\n    if (isWildoBackendError(error)) throw error;\n    throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n      customMessageReference: ErrorCustomMessageReference.SAML_METADATA_PARSE_ERROR,\n      context: { message: `Could not reach metadata URL: ${describeCaughtError(error)}` },\n    });\n  }\n\n  // Parse metadata — requires SAMLMetadataBackendService via utils (production always provides it).\n  // No samlify fallback: samlify needs Java for XSD validation; when utils lacks samlMetadataService,\n  // fail fast with a clear error instead of attempting Java-dependent parsing.\n  if (!utils.samlMetadataService) {\n    throw utils.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {\n      customMessageReference: ErrorCustomMessageReference.SAML_METADATA_PARSE_ERROR,\n      context: {\n        message: 'SAML metadata parsing requires SAMLMetadataService. Ensure the service is registered and passed to DISCOVER_ENDPOINTS utils.',\n      },\n    });\n  }\n\n  try {\n    const parsed = utils.samlMetadataService.parseIdPMetadata(metadataXml) as {\n      entityId: string;\n      ssoUrl: string;\n      sloUrl?: string;\n      x509Certificates: string[];\n      nameIdFormat?: string;\n    };\n    return {\n      entityId: parsed.entityId,\n      ssoUrl: parsed.ssoUrl,\n      sloUrl: parsed.sloUrl,\n      x509Certificates: parsed.x509Certificates,\n      nameIdFormat: parsed.nameIdFormat,\n      source: SsoConnectionDiscoverySource.SAML_METADATA,\n    };\n  } catch (error) {\n    if (isWildoBackendError(error)) throw error;\n    throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n      customMessageReference: ErrorCustomMessageReference.SAML_METADATA_PARSE_ERROR,\n      context: { message: `Invalid SAML metadata XML: ${describeCaughtError(error)}` },\n    });\n  }\n}\n"]}
+{"version":3,"file":"sso-connection.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/custom-impls/sso-connection.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,4BAA4B,EAC5B,wBAAwB,EACxB,4BAA4B,EAC5B,8BAA8B,EAC9B,sCAAsC,EACtC,yCAAyC,EACzC,SAAS,EACT,2BAA2B,EAC3B,mBAAmB,EACnB,aAAa,EACb,WAAW,EACX,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAKpH,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAEhJ,yEAAyE;AAEzE,MAAM,iCAAiC,GAAG;IACxC,gBAAgB,CAAC,4BAA4B;IAC7C,gBAAgB,CAAC,2BAA2B;CACpC,CAAC;AAEX,oEAAoE;AAEpE,MAAM,aAAa,GAAG;IACpB,QAAQ,EAAE,oDAAoD;IAC9D,IAAI,EAAE,gDAAgD;CAC9C,CAAC;AAEX,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,MAAM;AAEjD;;;;;;;;GAQG;AACH,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAE9C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;AAClE,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;AAEhE,MAAM,YAAY,GAAyC;IACzD,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,uBAAuB,EAAE;IACpD,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAChD,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE;IACtF,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE;IAC9E,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE;IACtF,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE;IAC9E,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE;IACtF,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE;CAC/E,CAAC;AAEF,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,UAAU,CAAC,6BAA6B,CAAC;QAAE,OAAO,OAAO,CAAC;IACtE,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,gCAAgC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC;AACvF,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAW;IAC5C,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,YAAY,EAAE,CAAC;QACzC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACrC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB;IACxC,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3D,CAAC;AAYD,SAAS,mBAAmB,CAAC,OAAe,EAAE,KAAa;IACzD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAChG,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,IAAI,SAAS,CAAC;QACpE,MAAM,SAAS,GAAG,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC;QACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;QAC/F,CAAC;aAAM,IAAI,aAAa,IAAI,EAAE,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,cAAc,aAAa,OAAO,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;IACxH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK;YACL,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,CAAC,CAAC;YACjB,SAAS,EAAE,SAAS;YACpB,WAAW,EAAE,EAAE;YACf,QAAQ,EAAE,CAAC,+BAA+B,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,GAAW,EAAE,YAAoB,IAAI;IACvE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;YACtC,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;gBACtC,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;YACH,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1D,CAAC;QAAC,OAAO,QAAQ,EAAE,CAAC;YAClB,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,KAAK,EAAE,mBAAmB,CAAC,QAAQ,CAAC;aACrC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,IAAI,mBAAmB,GAAG,KAAK,CAAC;AAChC,sIAAsI;AACtI,SAAS,gBAAgB;IACvB,iEAAiE;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,iEAAiE;QACjE,MAAM,SAAS,GAAG,OAAO,CAAC,wCAAwC,CAAC,CAAC;QACpE,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACnC,mBAAmB,GAAG,IAAI,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,6BAA6B,CAAC,UAA+B;IACpE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC/C,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;QAC7F,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qDAAqD,EAAE,CAAC;QAEnG,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC;QACrG,MAAM,OAAO,GAAG,UAAU,CAAC,cAAc,IAAI,UAAU,CAAC,aAAa,CAAC;QACtE,MAAM,QAAQ,GAAG,WAAW,SAAS,YAAY,SAAS,IAAI,OAAO,EAAE,CAAC;QACxE,MAAM,MAAM,GAAG,WAAW,SAAS,gBAAgB,CAAC;QAEpD,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC;YAC9B,QAAQ;YACR,mBAAmB,EAAE,IAAI;YACzB,oBAAoB,EAAE,IAAI;YAC1B,iBAAiB,EAAE,IAAI;YACvB,WAAW,EAAE,MAAM;YACnB,wBAAwB,EAAE;gBACxB,EAAE,OAAO,EAAE,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE;aAClD;SACF,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC3E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2DAA2D,EAAE,CAAC;IAC9F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACjG,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,UAA+B;IAC/D,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,4BAA4B;IAC5B,MAAM,kBAAkB,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACjD,CAAC;IAED,0BAA0B;IAC1B,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,YAAgC,CAAC;IACrC,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnE,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,6BAA6B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC3C,CAAC;IAED,2CAA2C;IAC3C,MAAM,YAAY,GAA4B,EAAE,CAAC;IACjD,MAAM,KAAK,GAAa,UAAU,EAAE,gBAAgB,IAAI,EAAE,CAAC;IAC3D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpD,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;aAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAClD,CAAC;IAED,0CAA0C;IAC1C,IAAI,eAAoC,CAAC;IACzC,IAAI,YAAgC,CAAC;IACrC,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnE,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,6BAA6B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,yCAAyC;IACzC,MAAM,UAAU,GAAG,6BAA6B,CAAC,UAAU,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,gBAAgB,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,oBAAoB;IACpB,IAAI,aAAa,GAAG,8BAA8B,CAAC,IAAI,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,aAAa,GAAG,8BAA8B,CAAC,IAAI,CAAC;SACtE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,aAAa,GAAG,8BAA8B,CAAC,OAAO,CAAC;IAErF,OAAO;QACL,kBAAkB;QAClB,eAAe;QACf,YAAY;QACZ,YAAY;QACZ,eAAe;QACf,YAAY;QACZ,eAAe,EAAE,UAAU,CAAC,KAAK;QACjC,aAAa;QACb,MAAM;QACN,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,sEAAsE;AACtE,SAAS,sBAAsB,CAAC,GAAW;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,KAAK,GAAG,+DAA+D,CAAC;IAC9E,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAyB,EACzB,MAA2D;IAE3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAE9C,KAAK,MAAM,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YACxD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;gBACjE,OAAQ,MAA+B,CAAC,QAAQ,CAAC;YACnD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,wBAAwB;AACxB,uEAAuE;AACvE,EAAE;AACF,0DAA0D;AAC1D,mFAAmF;AACnF,kFAAkF;AAClF,oFAAoF;AACpF,sFAAsF;AACtF,sFAAsF;AACtF,mFAAmF;AACnF,uFAAuF;AACvF,mFAAmF;AACnF,qBAAqB;AAErB,uEAAuE;AACvE,kCAAkC;AAClC,uEAAuE;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kCAAkC;IAChD,OAAO,iCAAiC,CAAC,GAAG,CAAC,CAAC,mBAAmB,EAAE,EAAE;QACnE,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,EAAE;YAC7E,OAAO,yCAAyC,CAAC;gBAC/C,aAAa,EAAE;oBACb,kBAAkB,EAAE,mBAAmB;oBACvC,mBAAmB,EAAE,qBAAqB,CAAC,MAAM;oBACjD,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,kBAAkB,EAAE,IAAI;iBACzB;gBACD,QAAQ,EAAE;oBACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE;wBACpF,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;wBAC/D,2DAA2D;wBAC3D,IAAI,MAAM,EAAE,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,oBAAoB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;4BAC3F,MAAM,GAAG,GAAI,MAAM,CAAC,IAAgC,CAAC,kBAAkB,CAAC;4BACxE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;gCAC1C,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;gCACzC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oCACrB,MAAM,CAAC,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAwB,CAAC;gCAClF,CAAC;4BACH,CAAC;4BACD,OAAQ,MAAM,CAAC,IAAgC,CAAC,kBAAkB,CAAC;wBACrE,CAAC;wBACD,OAAO,MAAM,CAAC;oBAChB,CAAC;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,kCAAkC;AAClC,uEAAuE;AAEvE,MAAM,UAAU,kCAAkC;IAChD,OAAO,iCAAiC,CAAC,GAAG,CAAC,CAAC,mBAAmB,EAAE,EAAE;QACnE,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,EAAE;YAC7E,OAAO,yCAAyC,CAAC;gBAC/C,aAAa,EAAE;oBACb,kBAAkB,EAAE,mBAAmB;oBACvC,mBAAmB,EAAE,qBAAqB,CAAC,MAAM;oBACjD,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,kBAAkB,EAAE,IAAI;iBACzB;gBACD,QAAQ,EAAE;oBACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;wBACnF,IAAI,MAAM,GAAG,KAAK,CAAC;wBACnB,mEAAmE;wBACnE,EAAE;wBACF,2EAA2E;wBAC3E,4EAA4E;wBAC5E,wEAAwE;wBACxE,wEAAwE;wBACxE,wEAAwE;wBACxE,4EAA4E;wBAC5E,2EAA2E;wBAC3E,0EAA0E;wBAC1E,yEAAyE;wBACzE,aAAa;wBACb,IAAI,KAAK,EAAE,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;4BAClD,MAAM,QAAQ,GAAI,KAAK,CAAC,IAAgC,CAAC,YAAY,CAAC;4BACtE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;gCACrF,MAAM,MAAM,GAAI,KAAK,CAAC,aAAqB,EAAE,IAAI,EAAE,YAAY,CAAC;gCAChE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oCACpD,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,CAAC;gCACvE,CAAC;4BACH,CAAC;wBACH,CAAC;wBACD,2DAA2D;wBAC3D,IAAI,MAAM,EAAE,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,oBAAoB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;4BAC3F,MAAM,GAAG,GAAI,MAAM,CAAC,IAAgC,CAAC,kBAAkB,CAAC;4BACxE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;gCAC1C,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;gCACzC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oCACrB,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAmB,CAAC;gCAC7F,CAAC;4BACH,CAAC;4BACD,MAAM,EAAE,kBAAkB,EAAE,CAAC,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,CAAC,IAA+B,CAAC;4BAC5F,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,cAAc,EAAmB,CAAC;wBAChE,CAAC;wBACD,OAAO,MAAM,CAAC;oBAChB,CAAC;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,kCAAkC;AAClC,uEAAuE;AAEvE;;;GAGG;AACH,KAAK,UAAU,sCAAsC,CACnD,YAAoB,EACpB,gBAAuD,EACvD,EAAyB;IAEzB,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAC7C,YAAY,EAAE,gBAAgB,EAAE,EAAE,EAClC,gBAAgB,CAAC,mBAAmB,EACpC,gBAAgB,CAAC,gBAAgB,EACjC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,EACnB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,EACnB,QAAQ,CACT,CAAC;IAEF,OAAO;QACL,iBAAiB,EAAE,UAAU,CAAC,QAAQ;QACtC,iBAAiB,EAAE,UAAU,CAAC,QAAQ;KACvC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,YAAoB,EACpB,gBAAuD,EACvD,EAAyB,EACzB,wBAAgC,EAChC,sBAA8B,EAC9B,WAAoC,EACpC,eAAwC,EACxC,aAAqB;IAErB,MAAM,iBAAiB,GAAG,MAAM,gBAAgB,CAAC,IAAI,CACnD,wBAA+B,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,EACrD,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CACrB,CAAC;IAEb,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAE3E,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAC3C,sBAA6B,EAAE,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAAE,EAClF,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CACrB,CAAC;IAEb,MAAM,8BAA8B,GAAG,IAAI,GAAG,EAAU,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,IAAW,CAAC;QACtB,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9D,8BAA8B,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,MAAM,wBAAwB,GAAG,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,8BAA8B,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACzG,IAAI,wBAAwB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAChD,wBAA+B,EAAE,EAAE,EAAE;QACnC,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,EAAE,wBAAwB,EAAE;QAClD,YAAY,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE;KACpC,EACD,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CACrB,CAAC;IACb,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAExE,MAAM,aAAa,GAAG,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACpG,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kCAAkC;IAChD,OAAO,iCAAiC,CAAC,GAAG,CAAC,CAAC,mBAAmB,EAAE,EAAE;QACnE,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,EAAE;YAC7E,OAAO,yCAAyC,CAAC;gBAC/C,aAAa,EAAE;oBACb,kBAAkB,EAAE,mBAAmB;oBACvC,mBAAmB,EAAE,qBAAqB,CAAC,MAAM;oBACjD,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,kBAAkB,EAAE,IAAI;iBACzB;gBACD,QAAQ,EAAE;oBACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;wBAClF,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;wBAC1C,MAAM,YAAY,GAAG,aAAa,EAAE,YAAY,IAAI,aAAa,EAAE,GAAG,CAAC;wBAEvE,IAAI,CAAC,YAAY,EAAE,CAAC;4BAClB,OAAO,KAAK,CAAC;wBACf,CAAC;wBAED,MAAM,KAAK,GAAI,KAAiC,EAAE,KAAK,KAAK,IAAI,CAAC;wBAEjE,IAAI,CAAC;4BACH,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,GAAG,MAAM,sCAAsC,CAC3F,YAAY,EACZ,KAAK,CAAC,gBAAgB,EACtB,gBAAgB,CACjB,CAAC;4BAEF,IAAI,iBAAiB,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gCACpC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;oCAC1E,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oCAC9D,OAAO,EAAE;wCACP,OAAO,EAAE,IAAI;wCACb,iBAAiB;wCACjB,iBAAiB;wCACjB,OAAO,EAAE,GAAG,iBAAiB,gGAAgG;wCAC7H,aAAa,EAAE,IAAI;qCACpB;iCACF,CAAC,CAAC;4BACL,CAAC;4BAED,IAAI,KAAK,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;gCACnC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE;oCAC7E,YAAY;oCACZ,iBAAiB;oCACjB,aAAa,EAAE,iBAAiB;iCACjC,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gCAAE,MAAM,KAAK,CAAC;4BAC5C,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;gCAClE,YAAY;gCACZ,GAAG,2BAA2B,CAAC,KAAK,CAAC;6BACtC,CAAC,CAAC;wBACL,CAAC;wBAED,OAAO,KAAK,CAAC;oBACf,CAAC;oBAED,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;wBACnF,MAAM,YAAY,GAAG,KAAK,CAAC,aAAa,EAAE,YAAY,IAAI,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC;wBACnF,IAAI,CAAC,YAAY;4BAAE,OAAO,KAAK,CAAC;wBAEhC,IAAI,CAAC;4BACH,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;4BAErI,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gCAC1B,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,2EAA2E,EAAE;oCAC7F,YAAY;oCACZ,gBAAgB,EAAE,UAAU,CAAC,MAAM;iCACpC,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,iFAAiF,EAAE;gCACnG,YAAY;gCACZ,GAAG,2BAA2B,CAAC,KAAK,CAAC;6BACtC,CAAC,CAAC;wBACL,CAAC;wBAED,OAAO,KAAK,CAAC;oBACf,CAAC;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,4CAA4C;AAC5C,uEAAuE;AAEvE,MAAM,UAAU,0CAA0C;IACxD,OAAO,iCAAiC,CAAC,GAAG,CAAC,CAAC,mBAAmB,EAAE,EAAE;QACnE,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,EAAE;YAC7E,OAAO,yCAAyC,CAAC;gBAC/C,aAAa,EAAE;oBACb,kBAAkB,EAAE,mBAAmB;oBACvC,mBAAmB,EAAE,wBAAwB,CAAC,eAAe;oBAC7D,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,kBAAkB,EAAE,IAAI;iBACzB;gBACD,gBAAgB,EAAE,sCAAsC;gBACxD,QAAQ,EAAE;oBACR,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;wBACrF,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;wBAE1C,IAAI,aAAa,EAAE,QAAQ,KAAK,WAAW,CAAC,IAAI,EAAE,CAAC;4BACjD,OAAO;gCACL,QAAQ,EAAE,WAAW,CAAC,IAAI;gCAC1B,SAAS,EAAE,IAAI;gCACf,GAAG,MAAM,kBAAkB,CAAC,aAAa,CAAC;6BAC3C,CAAC;wBACJ,CAAC;wBAED,OAAO;4BACL,QAAQ,EAAE,WAAW,CAAC,IAAI;4BAC1B,SAAS,EAAE,KAAK;4BAChB,OAAO,EAAE,kFAAkF;yBAC5F,CAAC;oBACJ,CAAC;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,+CAA+C;AAC/C,uEAAuE;AAEvE,MAAM,UAAU,6CAA6C;IAC3D,OAAO,iCAAiC,CAAC,GAAG,CAAC,CAAC,mBAAmB,EAAE,EAAE;QACnE,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,EAAE;YAC7E,OAAO,yCAAyC,CAAC;gBAC/C,aAAa,EAAE;oBACb,kBAAkB,EAAE,mBAAmB;oBACvC,mBAAmB,EAAE,wBAAwB,CAAC,kBAAkB;oBAChE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,kBAAkB,EAAE,IAAI;iBACzB;gBACD,gBAAgB,EAAE,yCAAyC;gBAC3D,QAAQ,EAAE;oBACR,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;wBACnF,MAAM,UAAU,GAAG,KAAiE,CAAC;wBAErF,oEAAoE;wBACpE,uEAAuE;wBACvE,IAAI,UAAU,EAAE,WAAW,EAAE,CAAC;4BAC5B,OAAO;gCACL,QAAQ,EAAE,WAAW,CAAC,IAAI;gCAC1B,SAAS,EAAE,IAAI;gCACf,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC;6BAChF,CAAC;wBACJ,CAAC;wBAED,OAAO;4BACL,QAAQ,EAAE,WAAW,CAAC,IAAI;4BAC1B,SAAS,EAAE,KAAK;4BAChB,OAAO,EAAE,8EAA8E;yBACxF,CAAC;oBACJ,CAAC;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AAExE,KAAK,UAAU,qBAAqB,CAClC,WAAmB,EACnB,gBAAuC,EACvC,KAGC;IAED,qBAAqB;IACrB,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;YACxC,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,8BAA8B,CAAC;YAC3D,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBAC1E,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE,EAAE,OAAO,EAAE,8BAA8B,QAAQ,CAAC,MAAM,EAAE,EAAE;aACtE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7E,WAAW,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEpC,IAAI,WAAW,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;YAC3C,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBAC1E,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE,EAAE,OAAO,EAAE,6BAA6B,iBAAiB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE;aAC/F,CAAC,CAAC;QACL,CAAC;QAED,8DAA8D;QAC9D,MAAM,YAAY,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC;eAC3C,WAAW,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;eAC3C,WAAW,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBAC1E,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;gBAC7E,OAAO,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC5C,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;YAC1E,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;YAC7E,OAAO,EAAE,EAAE,OAAO,EAAE,iCAAiC,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE;SACpF,CAAC,CAAC;IACL,CAAC;IAED,kGAAkG;IAClG,oGAAoG;IACpG,6EAA6E;IAC7E,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC/B,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;YAC7E,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;YAC7E,OAAO,EAAE;gBACP,OAAO,EAAE,8HAA8H;aACxI;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,WAAW,CAMpE,CAAC;QACF,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,MAAM,EAAE,4BAA4B,CAAC,aAAa;SACnD,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC5C,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;YAC1E,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;YAC7E,OAAO,EAAE,EAAE,OAAO,EAAE,8BAA8B,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE;SACjF,CAAC,CAAC;IACL,CAAC;AACH,CAAC","sourcesContent":["/**\n * SSO Connection Custom Implementations\n *\n * Implements READ, CREATE, UPDATE, DELETE, TEST_CONNECTION, DISCOVER_ENDPOINTS\n * on SSO connection polymorphic variants (ORG + APP).\n *\n * Patterns:\n *   READ              → (no custom impl) — oidc.clientSecret masking is framework-driven\n *                                          via `.isWriteOnlySecret()` on the schema\n *   CREATE            → PREFIX_CORE_OPERATIONS  — generates connectionId via crypto.randomUUID()\n *   UPDATE            → PREFIX_CORE_OPERATIONS  — re-injects the stored oidc.clientSecret when\n *                                          the client round-trips the `••••••••` mask (nested\n *                                          field: whole-subdocument `$set` would otherwise drop it)\n *   DELETE            → PREFIX_CORE_OPERATIONS  — orphan validation (warns if users would lose their only auth method)\n *   TEST_CONNECTION   → REPLACE_CORE_OPERATIONS — SAML → validate config (certs, URLs, SP metadata), OIDC → explicit unsupported result\n *   DISCOVER_ENDPOINTS→ REPLACE_CORE_OPERATIONS — SAML → fetch + parse IdP metadata URL, OIDC → explicit unsupported result\n *\n * SAML helpers (cert validation, URL reachability, samlify init) are module-level\n * functions because the factory pattern does not support DI injection of arbitrary\n * services. Certificate validation uses Node.js crypto.X509Certificate directly.\n */\n\nimport crypto from 'node:crypto';\nimport {\n  CoreResourceOperation,\n  CoreResourceType,\n  ResourceOperationVariantType,\n  SsoConnection_Operations,\n  SsoConnectionDiscoverySource,\n  SsoConnectionTestOverallStatus,\n  SsoConnection_TestConnectionRequestDto,\n  SsoConnection_DiscoverEndpointsRequestDto,\n  ErrorType,\n  ErrorCustomMessageReference,\n  isWildoBackendError,\n  AuthScopeType,\n  SsoProtocol,\n  WRITE_ONLY_SECRET_MASK,\n} from '@wildo-ai/saas-models';\nimport { WildoHeaderKeys } from '@wildo-ai/saas-models';\nimport type { UserIdentityLink, UserCredentials } from '@wildo-ai/saas-models';\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\n\n// ── SSO connection polymorphic variant types ──────────────────────────\n\nconst AUTH_SSO_CONNECTION_VARIANT_TYPES = [\n  CoreResourceType.ORGANIZATION_SSO_CONNECTIONS,\n  CoreResourceType.APPLICATION_SSO_CONNECTIONS,\n] as const;\n\n// ── SAML Test / Discovery helpers ────────────────────────────────\n\nconst SAML_BINDINGS = {\n  REDIRECT: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',\n  POST: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',\n} as const;\n\nconst MAX_METADATA_SIZE = 2 * 1024 * 1024; // 2MB\n\n/**\n * Hard deadline for fetching an IdP's SAML metadata document.\n *\n * An administrator is watching: this runs while they configure an enterprise connection and press\n * save, so an unresponsive metadata host must produce an error they can act on rather than a form\n * that never returns. 10s — the document is XML capped by {@link MAX_METADATA_SIZE}, served by a\n * host the administrator has just typed, and erring generous here spends their whole wait on what\n * is most often a typo.\n */\nconst SAML_METADATA_FETCH_TIMEOUT_MS = 10_000;\n\nconst SHA1_RSA_OID = Buffer.from('06092a864886f70d010105', 'hex');\nconst ECDSA_SHA1_OID = Buffer.from('06072a8648ce3d0401', 'hex');\n\nconst SIG_ALG_OIDS: Array<{ oid: Buffer; name: string }> = [\n  { oid: SHA1_RSA_OID, name: 'sha1WithRSAEncryption' },\n  { oid: ECDSA_SHA1_OID, name: 'ecdsa-with-SHA1' },\n  { oid: Buffer.from('06092a864886f70d01010b', 'hex'), name: 'sha256WithRSAEncryption' },\n  { oid: Buffer.from('06082a8648ce3d040302', 'hex'), name: 'ecdsa-with-SHA256' },\n  { oid: Buffer.from('06092a864886f70d01010c', 'hex'), name: 'sha384WithRSAEncryption' },\n  { oid: Buffer.from('06082a8648ce3d040303', 'hex'), name: 'ecdsa-with-SHA384' },\n  { oid: Buffer.from('06092a864886f70d01010d', 'hex'), name: 'sha512WithRSAEncryption' },\n  { oid: Buffer.from('06082a8648ce3d040304', 'hex'), name: 'ecdsa-with-SHA512' },\n];\n\nfunction normalizePem(certPem: string): string {\n  const trimmed = certPem.trim();\n  if (trimmed.startsWith('-----BEGIN CERTIFICATE-----')) return trimmed;\n  const cleanBase64 = trimmed.replace(/\\s/g, '');\n  const lines: string[] = [];\n  for (let i = 0; i < cleanBase64.length; i += 64) {\n    lines.push(cleanBase64.substring(i, i + 64));\n  }\n  return `-----BEGIN CERTIFICATE-----\\n${lines.join('\\n')}\\n-----END CERTIFICATE-----`;\n}\n\nfunction getCertSignatureAlgorithm(der: Buffer): string {\n  for (const { oid, name } of SIG_ALG_OIDS) {\n    if (der.includes(oid)) return name;\n  }\n  return 'unknown';\n}\n\nfunction isSha1Algorithm(algorithm: string): boolean {\n  const lower = algorithm.toLowerCase();\n  return lower.includes('sha1') || lower.includes('sha-1');\n}\n\ninterface CertificateTestResult {\n  index: number;\n  valid: boolean;\n  expiresAt: string;\n  daysRemaining: number;\n  algorithm: string;\n  fingerprint: string;\n  warnings: string[];\n}\n\nfunction validateCertificate(certPem: string, index: number): CertificateTestResult {\n  try {\n    const normalized = normalizePem(certPem);\n    const x509 = new crypto.X509Certificate(normalized);\n    const expiresAt = new Date(x509.validTo);\n    const now = new Date();\n    const daysRemaining = Math.floor((expiresAt.getTime() - now.getTime()) / (1000 * 60 * 60 * 24));\n    const isValid = now >= new Date(x509.validFrom) && now <= expiresAt;\n    const algorithm = getCertSignatureAlgorithm(x509.raw);\n    const fingerprint = x509.fingerprint256;\n    const warnings: string[] = [];\n\n    if (!isValid) {\n      warnings.push(daysRemaining < 0 ? 'Certificate is expired' : 'Certificate is not yet valid');\n    } else if (daysRemaining <= 30) {\n      warnings.push(`Expires in ${daysRemaining} days`);\n    }\n    if (isSha1Algorithm(algorithm)) {\n      warnings.push('Uses SHA-1 signature algorithm (insecure)');\n    }\n\n    return { index, valid: isValid, expiresAt: expiresAt.toISOString(), daysRemaining, algorithm, fingerprint, warnings };\n  } catch (error) {\n    return {\n      index,\n      valid: false,\n      expiresAt: '',\n      daysRemaining: -1,\n      algorithm: 'unknown',\n      fingerprint: '',\n      warnings: [`Certificate parsing failed: ${describeCaughtError(error)}`],\n    };\n  }\n}\n\nasync function checkUrlReachability(url: string, timeoutMs: number = 5000): Promise<{ reachable: boolean; statusCode?: number; error?: string }> {\n  try {\n    const response = await fetch(url, {\n      method: 'HEAD',\n      signal: AbortSignal.timeout(timeoutMs),\n      redirect: 'follow',\n    });\n    return { reachable: true, statusCode: response.status };\n  } catch {\n    try {\n      const response = await fetch(url, {\n        method: 'GET',\n        signal: AbortSignal.timeout(timeoutMs),\n        redirect: 'follow',\n      });\n      return { reachable: true, statusCode: response.status };\n    } catch (getError) {\n      return {\n        reachable: false,\n        error: describeCaughtError(getError),\n      };\n    }\n  }\n}\n\nlet _samlifyInitialized = false;\n// Returns `any` to avoid `typeof import('samlify')` which forces tsc to resolve the CJS-only samlify package during declaration emit.\nfunction getSamlifyModule(): any {\n  // eslint-disable-next-line @typescript-eslint/no-require-imports\n  const saml = require('samlify');\n  if (!_samlifyInitialized) {\n    // eslint-disable-next-line @typescript-eslint/no-require-imports\n    const validator = require('@authenio/samlify-xsd-schema-validator');\n    saml.setSchemaValidator(validator);\n    _samlifyInitialized = true;\n  }\n  return saml;\n}\n\nfunction generateAndValidateSPMetadata(connection: Record<string, any>): { valid: boolean; error?: string } {\n  try {\n    const appDomain = process.env.APP_DOMAIN;\n    const spCert = process.env.SAML_SP_CERTIFICATE;\n    if (!appDomain) return { valid: false, error: 'APP_DOMAIN environment variable is not set' };\n    if (!spCert) return { valid: false, error: 'SAML_SP_CERTIFICATE environment variable is not set' };\n\n    const scopeType = connection.organizationId ? AuthScopeType.ORGANIZATION : AuthScopeType.APPLICATION;\n    const scopeId = connection.organizationId || connection.applicationId;\n    const entityID = `https://${appDomain}/saml/sp/${scopeType}/${scopeId}`;\n    const acsUrl = `https://${appDomain}/auth/saml/acs`;\n\n    const saml = getSamlifyModule();\n    const sp = saml.ServiceProvider({\n      entityID,\n      authnRequestsSigned: true,\n      wantAssertionsSigned: true,\n      wantMessageSigned: true,\n      signingCert: spCert,\n      assertionConsumerService: [\n        { Binding: SAML_BINDINGS.POST, Location: acsUrl },\n      ],\n    });\n\n    const metadata = sp.getMetadata();\n    if (typeof metadata === 'string' && metadata.includes('<EntityDescriptor')) {\n      return { valid: true };\n    }\n    return { valid: false, error: 'Generated SP metadata is missing EntityDescriptor element' };\n  } catch (error) {\n    return { valid: false, error: `SP metadata generation failed: ${describeCaughtError(error)}` };\n  }\n}\n\nasync function testSamlConnection(connection: Record<string, any>): Promise<Record<string, any>> {\n  const samlConfig = connection.saml;\n  const errors: string[] = [];\n  const warnings: string[] = [];\n\n  // 1. Validate IdP entity ID\n  const entityIdConfigured = !!(samlConfig?.entityId);\n  if (!entityIdConfigured) {\n    errors.push('IdP Entity ID is not configured');\n  }\n\n  // 2. SSO URL reachability\n  let ssoUrlReachable = false;\n  let ssoUrlStatus: number | undefined;\n  if (samlConfig?.ssoUrl) {\n    const result = await checkUrlReachability(samlConfig.ssoUrl, 5000);\n    ssoUrlReachable = result.reachable;\n    ssoUrlStatus = result.statusCode;\n    if (!result.reachable) errors.push(`SSO URL is not reachable: ${result.error}`);\n  } else {\n    errors.push('SSO URL is not configured');\n  }\n\n  // 3. Certificate validation (E8, E9, SC-1)\n  const certificates: CertificateTestResult[] = [];\n  const certs: string[] = samlConfig?.x509Certificates ?? [];\n  for (let i = 0; i < certs.length; i++) {\n    const certResult = validateCertificate(certs[i], i);\n    certificates.push(certResult);\n    if (!certResult.valid) {\n      errors.push(`Certificate ${i}: ${certResult.warnings.join(', ')}`);\n    } else if (certResult.warnings.length > 0) {\n      warnings.push(...certResult.warnings.map((w: string) => `Certificate ${i}: ${w}`));\n    }\n  }\n  if (certs.length === 0) {\n    errors.push('No X.509 certificates configured');\n  }\n\n  // 4. SLO URL reachability (if configured)\n  let sloUrlReachable: boolean | undefined;\n  let sloUrlStatus: number | undefined;\n  if (samlConfig?.sloUrl) {\n    const result = await checkUrlReachability(samlConfig.sloUrl, 5000);\n    sloUrlReachable = result.reachable;\n    sloUrlStatus = result.statusCode;\n    if (!result.reachable) warnings.push(`SLO URL is not reachable: ${result.error}`);\n  }\n\n  // 5. SP metadata generation + validation\n  const spMetadata = generateAndValidateSPMetadata(connection);\n  if (!spMetadata.valid) {\n    warnings.push(`SP metadata: ${spMetadata.error}`);\n  }\n\n  // 6. Overall status\n  let overallStatus = SsoConnectionTestOverallStatus.PASS;\n  if (errors.length > 0) overallStatus = SsoConnectionTestOverallStatus.FAIL;\n  else if (warnings.length > 0) overallStatus = SsoConnectionTestOverallStatus.WARNING;\n\n  return {\n    entityIdConfigured,\n    ssoUrlReachable,\n    ssoUrlStatus,\n    certificates,\n    sloUrlReachable,\n    sloUrlStatus,\n    spMetadataValid: spMetadata.valid,\n    overallStatus,\n    errors,\n    warnings,\n  };\n}\n\nfunction normalizeCertificates(certs: unknown): string[] {\n  if (!certs) return [];\n  if (typeof certs === 'string') {\n    return splitPemToCertificates(certs);\n  }\n  if (Array.isArray(certs)) {\n    return certs.flat().filter((c): c is string => typeof c === 'string' && c.length > 0);\n  }\n  return [];\n}\n\n/** Split multi-cert PEM string into array of individual cert PEMs. */\nfunction splitPemToCertificates(pem: string): string[] {\n  const trimmed = pem.trim();\n  if (!trimmed) return [];\n  const regex = /-----BEGIN CERTIFICATE-----[\\s\\S]*?-----END CERTIFICATE-----/g;\n  const matches = trimmed.match(regex);\n  if (!matches || matches.length === 0) return [trimmed];\n  return matches.map((m) => m.trim()).filter(Boolean);\n}\n\nfunction extractServiceUrl(\n  meta: Record<string, any>,\n  method: 'getSingleSignOnService' | 'getSingleLogoutService',\n): string | null {\n  const getter = meta[method];\n  if (typeof getter !== 'function') return null;\n\n  for (const binding of [SAML_BINDINGS.REDIRECT, SAML_BINDINGS.POST]) {\n    try {\n      const result = getter.call(meta, binding);\n      if (typeof result === 'string' && result) return result;\n      if (result && typeof result === 'object' && 'Location' in result) {\n        return (result as { Location: string }).Location;\n      }\n    } catch {\n      // Binding not available\n    }\n  }\n  return null;\n}\n\n// ════════════════════════════════════════════════════════════════════\n// READ — no custom impl\n// ════════════════════════════════════════════════════════════════════\n//\n// `oidc.clientSecret` carries `.isWriteOnlySecret()` (see\n// `sso-connection.shared.schemas.ts`). The framework masks it to `••••••••` at the\n// client-serialization boundary (`serializeOperationResultForResponse`) for every\n// client read (READ/CREATE/UPDATE responses) and strips the round-tripped mask from\n// write payloads centrally. The former READ postfix masking factory was redundant AND\n// masked the wrong tier: it ran at the service dispatch (before the client boundary),\n// so the internal `servicesRegistryHandler.read` used by the OAuth2 token exchange\n// received the mask too and could not authenticate at the IdP token endpoint. Removing\n// it restores the token exchange's real-value read; the decorator keeps the client\n// boundary redacted.\n\n// ════════════════════════════════════════════════════════════════════\n// CREATE — PREFIX_CORE_OPERATIONS\n// ════════════════════════════════════════════════════════════════════\n\n/**\n * SSO connection CREATE prefix — mints `connectionId` and normalizes the authored SAML\n * `x509CertificatePem` into the stored `x509Certificates` array.\n *\n * Registered on `INTERNAL_CALL`, matching the resource configuration. All three write\n * variants (CREATE / UPDATE / DELETE) were authored against `REPOSITORY_ONLY` and were\n * unreachable in both directions: `getServiceOperationPathDefault` — behind every\n * `*AsSystem` call — skips a REPOSITORY_ONLY-only op, and `doOperation` throws on that\n * variant, so the service tier where custom implementations execute was never entered.\n * Nothing else in the codebase mints `connectionId`, so a connection written past the\n * service tier had none at all.\n *\n * This mirrors the READ default, which had already been moved to `INTERNAL_CALL` for the\n * same resolver reason; the writes were simply left behind. `INTERNAL_CALL` adds no HTTP\n * surface — only API_CALL variants register routes.\n */\nexport function createSsoConnectionCreateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return AUTH_SSO_CONNECTION_VARIANT_TYPES.map((variantResourceType) => {\n    const factory = (_resourcesRegistryService: ResourcesRegistryBackendService) => {\n      return createResourceCustomServiceImplementation({\n        operationPath: {\n          resourceIdentifier: variantResourceType,\n          operationIdentifier: CoreResourceOperation.CREATE,\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isOperationDefault: true,\n        },\n        handlers: {\n          prefixCoreOperations: async (_id, input, _executionContext, _operationPath, _utils) => {\n            const result = { ...input, connectionId: crypto.randomUUID() };\n            // Transform x509CertificatePem → x509Certificates for SAML\n            if (result?.saml && typeof result.saml === 'object' && 'x509CertificatePem' in result.saml) {\n              const pem = (result.saml as Record<string, unknown>).x509CertificatePem;\n              if (typeof pem === 'string' && pem.trim()) {\n                const certs = normalizeCertificates(pem);\n                if (certs.length > 0) {\n                  result.saml = { ...result.saml, x509Certificates: certs } as typeof result.saml;\n                }\n              }\n              delete (result.saml as Record<string, unknown>).x509CertificatePem;\n            }\n            return result;\n          },\n        },\n      });\n    };\n\n    return factory as unknown as ResourceCustomServiceImplementationFactory;\n  });\n}\n\n// ════════════════════════════════════════════════════════════════════\n// UPDATE — PREFIX_CORE_OPERATIONS\n// ════════════════════════════════════════════════════════════════════\n\nexport function createSsoConnectionUpdateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return AUTH_SSO_CONNECTION_VARIANT_TYPES.map((variantResourceType) => {\n    const factory = (_resourcesRegistryService: ResourcesRegistryBackendService) => {\n      return createResourceCustomServiceImplementation({\n        operationPath: {\n          resourceIdentifier: variantResourceType,\n          operationIdentifier: CoreResourceOperation.UPDATE,\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isOperationDefault: true,\n        },\n        handlers: {\n          prefixCoreOperations: async (_id, input, _executionContext, _operationPath, utils) => {\n            let result = input;\n            // Write-only-secret preservation for the NESTED oidc.clientSecret.\n            //\n            // The field is `.isWriteOnlySecret()`, so a client that renders the masked\n            // read value and saves round-trips `••••••••` (or omits it). The repository\n            // UPDATE is a whole-subdocument `$set` with NO deep merge — writing the\n            // incoming `oidc` object would replace the stored one and drop the real\n            // secret. The framework's central sentinel-strip only rescues TOP-LEVEL\n            // write-only secrets (it deletes the key and relies on `$set` omitting it),\n            // which does not help a nested field. So re-inject the stored secret here,\n            // BEFORE the central strip runs, whenever the incoming value is the mask,\n            // empty, or absent. A genuinely rotated secret (any other value) is left\n            // untouched.\n            if (input?.oidc && typeof input.oidc === 'object') {\n              const incoming = (input.oidc as Record<string, unknown>).clientSecret;\n              if (incoming === undefined || incoming === '' || incoming === WRITE_ONLY_SECRET_MASK) {\n                const stored = (utils.currentObject as any)?.oidc?.clientSecret;\n                if (typeof stored === 'string' && stored.length > 0) {\n                  result = { ...input, oidc: { ...input.oidc, clientSecret: stored } };\n                }\n              }\n            }\n            // Transform x509CertificatePem → x509Certificates for SAML\n            if (result?.saml && typeof result.saml === 'object' && 'x509CertificatePem' in result.saml) {\n              const pem = (result.saml as Record<string, unknown>).x509CertificatePem;\n              if (typeof pem === 'string' && pem.trim()) {\n                const certs = normalizeCertificates(pem);\n                if (certs.length > 0) {\n                  result = { ...result, saml: { ...result.saml, x509Certificates: certs } } as typeof result;\n                }\n              }\n              const { x509CertificatePem: _, ...samlWithoutPem } = result.saml as Record<string, unknown>;\n              result = { ...result, saml: samlWithoutPem } as typeof result;\n            }\n            return result;\n          },\n        },\n      });\n    };\n\n    return factory as unknown as ResourceCustomServiceImplementationFactory;\n  });\n}\n\n// ════════════════════════════════════════════════════════════════════\n// DELETE — PREFIX_CORE_OPERATIONS\n// ════════════════════════════════════════════════════════════════════\n\n/**\n * Count users who would be left without any auth method if this SSO connection\n * is removed. Uses batch queries instead of per-user loads.\n */\nasync function countOrphanedUsersForConnectionRemoval(\n  connectionId: string,\n  servicesRegistry: ServicesRegistryHandlerBackendService,\n  ec: ExecutionContext<any>,\n): Promise<{ affectedUserCount: number; orphanedUserCount: number }> {\n  const userResult = await _countOrphanedEntities<UserIdentityLink, UserCredentials>(\n    connectionId, servicesRegistry, ec,\n    CoreResourceType.USER_IDENTITY_LINKS,\n    CoreResourceType.USER_CREDENTIALS,\n    link => link.userId,\n    cred => cred.userId,\n    'userId',\n  );\n\n  return {\n    affectedUserCount: userResult.affected,\n    orphanedUserCount: userResult.orphaned,\n  };\n}\n\nasync function _countOrphanedEntities<TLink, TCred>(\n  connectionId: string,\n  servicesRegistry: ServicesRegistryHandlerBackendService,\n  ec: ExecutionContext<any>,\n  identityLinkResourceType: string,\n  credentialResourceType: string,\n  getEntityId: (link: TLink) => string,\n  getCredEntityId: (cred: TCred) => string,\n  entityIdField: string,\n): Promise<{ affected: number; orphaned: number }> {\n  const affectedLinksList = await servicesRegistry.list<TLink>(\n    identityLinkResourceType as any, ec, { connectionId },\n    undefined, { paginated: false },\n  ) as TLink[];\n\n  if (affectedLinksList.length === 0) {\n    return { affected: 0, orphaned: 0 };\n  }\n\n  const affectedEntityIds = [...new Set(affectedLinksList.map(getEntityId))];\n\n  const credsList = await servicesRegistry.list<TCred>(\n    credentialResourceType as any, ec, { [entityIdField]: { $in: affectedEntityIds } },\n    undefined, { paginated: false },\n  ) as TCred[];\n\n  const entitiesWithCredentialFallback = new Set<string>();\n  for (const cred of credsList) {\n    const c = cred as any;\n    if (c.passwordHash || (c.passkeyCredentials?.length ?? 0) > 0) {\n      entitiesWithCredentialFallback.add(getCredEntityId(cred));\n    }\n  }\n\n  const entitiesNeedingLinkCheck = affectedEntityIds.filter(id => !entitiesWithCredentialFallback.has(id));\n  if (entitiesNeedingLinkCheck.length === 0) {\n    return { affected: affectedEntityIds.length, orphaned: 0 };\n  }\n\n  const otherLinksList = await servicesRegistry.list<TLink>(\n    identityLinkResourceType as any, ec, {\n      [entityIdField]: { $in: entitiesNeedingLinkCheck },\n      connectionId: { $ne: connectionId },\n    },\n    undefined, { paginated: false },\n  ) as TLink[];\n  const entitiesWithOtherLinks = new Set(otherLinksList.map(getEntityId));\n\n  const orphanedCount = entitiesNeedingLinkCheck.filter(id => !entitiesWithOtherLinks.has(id)).length;\n  return { affected: affectedEntityIds.length, orphaned: orphanedCount };\n}\n\n/**\n * SSO connection DELETE guards.\n *\n * Registered on `INTERNAL_CALL` — see the note on the CREATE factory for why the write\n * variants moved off `REPOSITORY_ONLY`.\n *\n * ⚠️ Reachable does NOT mean universal. The `onParentDelete` cascade (organization or\n * application deleted) still bypasses this prefix: it calls `childRepository.delete(...)`\n * directly after a `supportsOperation` check that matches on `operationIdentifier` +\n * `isOperationDefault` and ignores `variantType` entirely. That is intentional — the whole\n * owning scope is going away, so the \"last remaining connection\" and \"connection in use\"\n * guards below would be wrong there. These guards protect the targeted single-connection\n * delete, which now runs through the service tier.\n */\nexport function createSsoConnectionDeleteFactories(): ResourceCustomServiceImplementationFactory[] {\n  return AUTH_SSO_CONNECTION_VARIANT_TYPES.map((variantResourceType) => {\n    const factory = (_resourcesRegistryService: ResourcesRegistryBackendService) => {\n      return createResourceCustomServiceImplementation({\n        operationPath: {\n          resourceIdentifier: variantResourceType,\n          operationIdentifier: CoreResourceOperation.DELETE,\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isOperationDefault: true,\n        },\n        handlers: {\n          prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n            const currentObject = utils.currentObject;\n            const connectionId = currentObject?.connectionId || currentObject?._id;\n\n            if (!connectionId) {\n              return input;\n            }\n\n            const force = (input as Record<string, unknown>)?.force === true;\n\n            try {\n              const { affectedUserCount, orphanedUserCount } = await countOrphanedUsersForConnectionRemoval(\n                connectionId,\n                utils.servicesRegistry,\n                executionContext,\n              );\n\n              if (orphanedUserCount > 0 && !force) {\n                throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n                  customMessageReference: ErrorCustomMessageReference.VALIDATION,\n                  context: {\n                    warning: true,\n                    affectedUserCount,\n                    orphanedUserCount,\n                    message: `${orphanedUserCount} account(s) will lose their only authentication method. Re-submit with force: true to proceed.`,\n                    requiresForce: true,\n                  },\n                });\n              }\n\n              if (force && orphanedUserCount > 0) {\n                utils.logger.warn('SSO connection removal forced — accounts will be orphaned', {\n                  connectionId,\n                  orphanedUserCount,\n                  totalAffected: affectedUserCount,\n                });\n              }\n            } catch (error) {\n              if (isWildoBackendError(error)) throw error;\n              utils.logger.warn('SSO connection orphan check failed (non-fatal)', {\n                connectionId,\n                ...projectCaughtErrorLogFields(error),\n              });\n            }\n\n            return input;\n          },\n\n          postfixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n            const connectionId = utils.currentObject?.connectionId || utils.currentObject?._id;\n            if (!connectionId) return input;\n\n            try {\n              const deletedIds = await utils.servicesRegistry.deleteMany(CoreResourceType.USER_IDENTITY_LINKS, executionContext, { connectionId });\n\n              if (deletedIds.length > 0) {\n                utils.logger.info('AUTH-13: Cleaned up orphaned identity links after SSO connection deletion', {\n                  connectionId,\n                  deletedLinkCount: deletedIds.length,\n                });\n              }\n            } catch (error) {\n              utils.logger.warn('AUTH-13: Identity link cleanup failed (non-fatal) — orphaned links remain in DB', {\n                connectionId,\n                ...projectCaughtErrorLogFields(error),\n              });\n            }\n\n            return input;\n          },\n        },\n      });\n    };\n\n    return factory as unknown as ResourceCustomServiceImplementationFactory;\n  });\n}\n\n// ════════════════════════════════════════════════════════════════════\n// TEST_CONNECTION — REPLACE_CORE_OPERATIONS\n// ════════════════════════════════════════════════════════════════════\n\nexport function createSsoConnectionTestConnectionFactories(): ResourceCustomServiceImplementationFactory[] {\n  return AUTH_SSO_CONNECTION_VARIANT_TYPES.map((variantResourceType) => {\n    const factory = (_resourcesRegistryService: ResourcesRegistryBackendService) => {\n      return createResourceCustomServiceImplementation({\n        operationPath: {\n          resourceIdentifier: variantResourceType,\n          operationIdentifier: SsoConnection_Operations.TEST_CONNECTION,\n          variantType: ResourceOperationVariantType.API_CALL,\n          isOperationDefault: true,\n        },\n        requestDtoSchema: SsoConnection_TestConnectionRequestDto,\n        handlers: {\n          replaceCoreOperations: async (_id, _input, _executionContext, _operationPath, utils) => {\n            const currentObject = utils.currentObject;\n\n            if (currentObject?.protocol === SsoProtocol.SAML) {\n              return {\n                protocol: SsoProtocol.SAML,\n                supported: true,\n                ...await testSamlConnection(currentObject),\n              };\n            }\n\n            return {\n              protocol: SsoProtocol.OIDC,\n              supported: false,\n              message: 'OIDC connection testing is not implemented; no provider handshake was attempted.',\n            };\n          },\n        },\n      });\n    };\n\n    return factory as unknown as ResourceCustomServiceImplementationFactory;\n  });\n}\n\n// ════════════════════════════════════════════════════════════════════\n// DISCOVER_ENDPOINTS — REPLACE_CORE_OPERATIONS\n// ════════════════════════════════════════════════════════════════════\n\nexport function createSsoConnectionDiscoverEndpointsFactories(): ResourceCustomServiceImplementationFactory[] {\n  return AUTH_SSO_CONNECTION_VARIANT_TYPES.map((variantResourceType) => {\n    const factory = (_resourcesRegistryService: ResourcesRegistryBackendService) => {\n      return createResourceCustomServiceImplementation({\n        operationPath: {\n          resourceIdentifier: variantResourceType,\n          operationIdentifier: SsoConnection_Operations.DISCOVER_ENDPOINTS,\n          variantType: ResourceOperationVariantType.API_CALL,\n          isOperationDefault: true,\n        },\n        requestDtoSchema: SsoConnection_DiscoverEndpointsRequestDto,\n        handlers: {\n          replaceCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n            const typedInput = input as { issuerUrl?: string; metadataUrl?: string } | undefined;\n\n            // The request DTO enforces at least one source before this handler.\n            // When both are supplied, SAML metadata remains the explicit priority.\n            if (typedInput?.metadataUrl) {\n              return {\n                protocol: SsoProtocol.SAML,\n                supported: true,\n                ...await discoverSamlEndpoints(typedInput.metadataUrl, executionContext, utils),\n              };\n            }\n\n            return {\n              protocol: SsoProtocol.OIDC,\n              supported: false,\n              message: 'OIDC endpoint discovery is not implemented; issuer metadata was not fetched.',\n            };\n          },\n        },\n      });\n    };\n\n    return factory as unknown as ResourceCustomServiceImplementationFactory;\n  });\n}\n\n// ── SAML metadata discovery ──────────────────────────────────────────\n\nasync function discoverSamlEndpoints(\n  metadataUrl: string,\n  executionContext: ExecutionContext<any>,\n  utils: {\n    errorBuilder: ErrorBuilderBackendService;\n    samlMetadataService?: { parseIdPMetadata(metadataXml: string): unknown };\n  },\n): Promise<Record<string, any>> {\n  // Fetch metadata XML\n  let metadataXml: string;\n  try {\n    const response = await fetch(metadataUrl, {\n      method: 'GET',\n      signal: AbortSignal.timeout(SAML_METADATA_FETCH_TIMEOUT_MS),\n      redirect: 'follow',\n    });\n\n    if (!response.ok) {\n      throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.SAML_METADATA_PARSE_ERROR,\n        context: { message: `Metadata URL returned HTTP ${response.status}` },\n      });\n    }\n\n    const contentType = response.headers.get(WildoHeaderKeys.CONTENT_TYPE) || '';\n    metadataXml = await response.text();\n\n    if (metadataXml.length > MAX_METADATA_SIZE) {\n      throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.SAML_METADATA_PARSE_ERROR,\n        context: { message: `Metadata response exceeds ${MAX_METADATA_SIZE / (1024 * 1024)}MB limit` },\n      });\n    }\n\n    // Validate XML content (Content-Type header or content sniff)\n    const looksLikeXml = contentType.includes('xml')\n      || metadataXml.trimStart().startsWith('<?xml')\n      || metadataXml.trimStart().startsWith('<');\n    if (!looksLikeXml) {\n      throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n        customMessageReference: ErrorCustomMessageReference.SAML_METADATA_PARSE_ERROR,\n        context: { message: 'URL did not return XML metadata' },\n      });\n    }\n  } catch (error) {\n    if (isWildoBackendError(error)) throw error;\n    throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n      customMessageReference: ErrorCustomMessageReference.SAML_METADATA_PARSE_ERROR,\n      context: { message: `Could not reach metadata URL: ${describeCaughtError(error)}` },\n    });\n  }\n\n  // Parse metadata — requires SAMLMetadataBackendService via utils (production always provides it).\n  // No samlify fallback: samlify needs Java for XSD validation; when utils lacks samlMetadataService,\n  // fail fast with a clear error instead of attempting Java-dependent parsing.\n  if (!utils.samlMetadataService) {\n    throw utils.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {\n      customMessageReference: ErrorCustomMessageReference.SAML_METADATA_PARSE_ERROR,\n      context: {\n        message: 'SAML metadata parsing requires SAMLMetadataService. Ensure the service is registered and passed to DISCOVER_ENDPOINTS utils.',\n      },\n    });\n  }\n\n  try {\n    const parsed = utils.samlMetadataService.parseIdPMetadata(metadataXml) as {\n      entityId: string;\n      ssoUrl: string;\n      sloUrl?: string;\n      x509Certificates: string[];\n      nameIdFormat?: string;\n    };\n    return {\n      entityId: parsed.entityId,\n      ssoUrl: parsed.ssoUrl,\n      sloUrl: parsed.sloUrl,\n      x509Certificates: parsed.x509Certificates,\n      nameIdFormat: parsed.nameIdFormat,\n      source: SsoConnectionDiscoverySource.SAML_METADATA,\n    };\n  } catch (error) {\n    if (isWildoBackendError(error)) throw error;\n    throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n      customMessageReference: ErrorCustomMessageReference.SAML_METADATA_PARSE_ERROR,\n      context: { message: `Invalid SAML metadata XML: ${describeCaughtError(error)}` },\n    });\n  }\n}\n"]}

package/dist/esm/security/authentications/services/email-verification-initiator.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-verification-initiator.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/email-verification-initiator.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,kBAAkB,CAAC;AAa1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,mBAAmB,EAAE,MAAM,uEAAuE,CAAC;AAI5G,yFAAyF;AACzF,MAAM,WAAW,2BAA2B;IAC1C,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,qBACa,wCAAwC;IAId,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY;IANxE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACnC,sBAAsB,EAAE,6BAA6B,EAC/D,YAAY,EAAE,mBAAmB;IAM7F;;;;;;;OAOG;IACU,qBAAqB,CAAC,MAAM,EAAE,2BAA2B,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;CAqEpG"}
+{"version":3,"file":"email-verification-initiator.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/services/email-verification-initiator.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,kBAAkB,CAAC;AAa1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,mBAAmB,EAAE,MAAM,uEAAuE,CAAC;AAI5G,yFAAyF;AACzF,MAAM,WAAW,2BAA2B;IAC1C,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,qBACa,wCAAwC;IAId,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY;IANxE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACnC,sBAAsB,EAAE,6BAA6B,EAC/D,YAAY,EAAE,mBAAmB;IAM7F;;;;;;;OAOG;IACU,qBAAqB,CAAC,MAAM,EAAE,2BAA2B,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;CAqEpG"}

package/dist/esm/security/authentications/services/machine-token-issuer.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine-token-issuer.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/machine-token-issuer.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AAEjG,OAAO,EAAkC,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7F,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,gGAAgG;IAChG,SAAS,EAAE,oBAAoB,CAAC,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC;IACjF,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,KAAK,EAAE,KAAK,EAAE,CAAC;IACf;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,QAAQ,CAAC;IACpB,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,qBACa,gCAAgC;IAEN,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAFrB,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACxC,UAAU,EAAE,iBAAiB;IAGjF,sBAAsB,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,0BAA0B,CAAC;CAoC7G"}
+{"version":3,"file":"machine-token-issuer.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/services/machine-token-issuer.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AAEjG,OAAO,EAAkC,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7F,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,gGAAgG;IAChG,SAAS,EAAE,oBAAoB,CAAC,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC;IACjF,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,KAAK,EAAE,KAAK,EAAE,CAAC;IACf;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,QAAQ,CAAC;IACpB,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,qBACa,gCAAgC;IAEN,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAFrB,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACxC,UAAU,EAAE,iBAAiB;IAGjF,sBAAsB,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,0BAA0B,CAAC;CAoC7G"}

package/dist/esm/security/authentications/services/oauth-provider-token.backend.service.d.ts

@@ -136,6 +136,41 @@ export declare class OAuthProviderTokenBackendService {
      * throws for a bad token — only unexpected infra failures propagate.
      */
     revokeRefreshToken(refreshToken: string): Promise<void>;
+    /**
+     * F4 per-org SIEM routing for a provider event whose only trustworthy tenant anchor is the
+     * TOKEN-BOUND SUBJECT.
+     *
+     * Every emit on this service happens at a token MINT or ROTATION, where there is no authenticated
+     * request execution context — the caller has just presented a credential, and the token it is about
+     * to receive is not itself an authenticated request. So the routing org can never come from the
+     * request, and passing nothing left the provider's most sensitive events (a delegated grant, a
+     * detected credential theft) reaching the DB store and the app-level sinks but never a customer's
+     * own security sink.
+     *
+     * The subject is the answer, and only because of WHERE it comes from: each caller passes a user id
+     * the SERVER resolved — off the stored authorization code, off the stored refresh-token family, or
+     * off a token this process just minted and verified — never a value the caller wrote down.
+     * `resolveActiveMemberOrgIds` then reads the ORGANIZATION_MEMBERS junction as SYSTEM with a filter
+     * built entirely from that id plus a constant status, and brands the result `VerifiedOrgId[]`, so no
+     * caller input reaches the routing decision at any point in the chain. That provenance is the whole
+     * requirement — routing on an unverified org is the 2026-07-09 cross-tenant leak, and misrouting a
+     * delegated grant is strictly worse than not routing it.
+     *
+     * Resolved through the container rather than the constructor to match this service's lazy-dependency
+     * posture (the OAuth provider graph is reachable during startup; see the class JSDoc).
+     *
+     * NEVER-THROW, for a reason worth stating: each caller now resolves this BEFORE its emit, so a
+     * throw here would suppress the audit event entirely — turning a per-org DISPATCH failure into the
+     * loss of the authoritative record, which is the opposite of the fail-closed posture. Routing is
+     * best-effort; the DB store and the Layer-2 sink are not. `resolveActiveMemberOrgIds` is itself
+     * never-throw, so the only failure this adds is an unresolvable `SystemAccessService` binding.
+     *
+     * Returns `[]` when there is no subject to route on or when resolution failed. `[]` and `undefined`
+     * are equivalent at the sink boundary here because the request-EC argument is always `undefined` at
+     * these emit sites, so there is no EC org for `undefined` to fall back to; `[]` is passed because it
+     * states that the question WAS asked and the answer was empty.
+     */
+    private _resolveSubjectRoutingOrgIds;
     /**
      * Build a typed backend error carrying the precise OAuth 2.0 error code in `context.oauthError`
      * so the token-endpoint controller can render the RFC 6749 §5.2 error response body.

package/dist/esm/security/authentications/services/oauth-provider-token.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-provider-token.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/oauth-provider-token.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,gCAAgC,EAAE,MAAM,2FAA2F,CAAC;AA4C7I;;;;;GAKG;AACH,MAAM,WAAW,kCAAkC;IACjD,uDAAuD;IACvD,YAAY,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,6FAA6F;AAC7F,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,+FAA+F;AAC/F,MAAM,WAAW,wBAAyB,SAAQ,yBAAyB;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;GAcG;AACH,qBACa,gCAAgC;IAEH,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;gBAJ3B,SAAS,EAAE,SAAS,EACvB,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACtC,YAAY,EAAE,0BAA0B,EACzC,kBAAkB,EAAE,gCAAgC;IAGzG,2BAA2B,CAAC,OAAO,EAAE,kCAAkC,GAAG,OAAO,CAAC,yBAAyB,CAAC;IA+HzH;;;;;;;;OAQG;IACU,2BAA2B,CAAC,OAAO,EAAE;QAChD,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB;;;WAGG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;;WAKG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAiJrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACU,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAsFvL;;;;OAIG;IACU,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWpE;;;OAGG;IACH,OAAO,CAAC,WAAW;CAMpB"}
+{"version":3,"file":"oauth-provider-token.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/services/oauth-provider-token.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,gCAAgC,EAAE,MAAM,2FAA2F,CAAC;AA8C7I;;;;;GAKG;AACH,MAAM,WAAW,kCAAkC;IACjD,uDAAuD;IACvD,YAAY,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,6FAA6F;AAC7F,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,+FAA+F;AAC/F,MAAM,WAAW,wBAAyB,SAAQ,yBAAyB;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;GAcG;AACH,qBACa,gCAAgC;IAEH,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;gBAJ3B,SAAS,EAAE,SAAS,EACvB,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACtC,YAAY,EAAE,0BAA0B,EACzC,kBAAkB,EAAE,gCAAgC;IAGzG,2BAA2B,CAAC,OAAO,EAAE,kCAAkC,GAAG,OAAO,CAAC,yBAAyB,CAAC;IA+HzH;;;;;;;;OAQG;IACU,2BAA2B,CAAC,OAAO,EAAE;QAChD,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB;;;WAGG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;;WAKG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAmKrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACU,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA+GvL;;;;OAIG;IACU,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;YACW,4BAA4B;IAY1C;;;OAGG;IACH,OAAO,CAAC,WAAW;CAMpB"}

package/dist/esm/security/authentications/services/oauth-provider-token.backend.service.js

@@ -20,6 +20,7 @@ import { describeCaughtError, projectCaughtErrorLogFields } from '../../../error
 import { MachineTokenIssuerBackendService } from '../../../security/authentications/services/machine-token-issuer.backend.service.js';
 import { hashOAuthClientSecret } from '../../../security/oauth-clients/oauth-client-generation.backend.utils.js';
 import { extractRefreshTokenReuseSignal } from '../../../security/authentications/services/auth-token-issuer.backend.service.js';
+import { resolveActiveMemberOrgIds } from '../../../security/authentications/services/resolve-active-member-orgs.backend.utils.js';
 import { ApiKeyScope, CoreResourceOperation, CoreResourceType, DELEGATED_TOKEN_RESOURCE_SERVERS, MACHINE_TOKEN_RESOURCE_SERVERS, ErrorCustomMessageReference, ErrorType, ExecutionContext_ExecutionType, MachineAuthMethod, OAuthClientStatus, OAuthGrantType, ResourcePrimaryScope, UserStatus, } from '@wildo-ai/saas-models';
 import { JwtClaim_App_Auth_UserRequest_Schema } from '../../../security/authentications/models/authentications.backend.schemas.js';
 import { isRotationGraceWindowOpen, isCredentialExpired } from '../../../security/credential-rotation-grace.backend.utils.js';
@@ -276,17 +277,35 @@ let OAuthProviderTokenBackendService = class OAuthProviderTokenBackendService {
         // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — issuing a delegated token grants a
         // third-party client the ability to act AS the user (the most security-sensitive access grant the
         // provider makes). Emit the audit/SIEM record (subject, client/azp, audience, granted scopes, TTL).
-        // Fire-and-forget: auditing must never block or fail token issuance. No request EC / verified org at
-        // this mint (the token is not itself an authenticated request), so per-org SIEM dispatch is omitted —
-        // the DB store + Layer-2 immudb sink still record it.
+        // Fire-and-forget: auditing must never block or fail token issuance.
+        //
+        // SIEM-3 (F4 tenant-segregation routing) — the routing org comes from the SUBJECT, not the request.
+        // There is genuinely no authenticated request EC at a token MINT (the client has just redeemed a
+        // code; the token it is being handed is not itself an authenticated request), so the 2nd arg stays
+        // `undefined` and, without the 3rd, this — the provider's most sensitive grant — reached the DB
+        // store and the app-level sinks but NEVER the customer's own security sink. `grant.userId` is
+        // resolved by `exchangeAuthorizationCode` off the STORED authorization code, so it is token-bound
+        // and can never be a caller-supplied value; that is exactly the provenance the magic-link and
+        // first-party-refresh paths already route on, and `_resolveSubjectRoutingOrgIds` turns it into
+        // VERIFIED ACTIVE memberships read as SYSTEM. A delegated grant therefore reaches precisely the
+        // tenants whose data the minted token can act on, which is the F4 question.
+        //
+        // D3/H-20: the DELEGATING CLIENT's own org is deliberately NOT a routing target. The token carries
+        // the USER's authority and the client is only `azp`, so a client registered in org A completing the
+        // flow for a user of org B must not thereby publish that user's grant into org A's SIEM feed.
         const auditLogsForDelegated = this.container.get(SAAS_SERVICE_TYPES.AuditLogsService);
-        void auditLogsForDelegated.logOAuthDelegatedTokenIssued({
-            userId: grant.userId,
-            clientId: grant.clientId,
-            audience: requestedAudience,
-            scopes: grant.scope,
-            ttlSeconds: expiresIn,
-        }).catch((auditError) => this.logger.warn('OAUTH_DELEGATED_TOKEN_ISSUED audit emit failed (non-fatal)', {
+        void (async () => {
+            // Resolved INSIDE the fire-and-forget block: a membership read must never add latency to the
+            // mint, and its failure mode (fail-closed to `[]`) must never reach the token response.
+            const delegatedRoutingOrgIds = await this._resolveSubjectRoutingOrgIds(grant.userId);
+            await auditLogsForDelegated.logOAuthDelegatedTokenIssued({
+                userId: grant.userId,
+                clientId: grant.clientId,
+                audience: requestedAudience,
+                scopes: grant.scope,
+                ttlSeconds: expiresIn,
+            }, undefined, delegatedRoutingOrgIds);
+        })().catch((auditError) => this.logger.warn('OAUTH_DELEGATED_TOKEN_ISSUED audit emit failed (non-fatal)', {
             ...projectCaughtErrorLogFields(auditError),
         }));
         this.logger.debug('Issued authorization_code (user-delegated) token', {
@@ -364,15 +383,23 @@ let OAuthProviderTokenBackendService = class OAuthProviderTokenBackendService {
             // A routine expired/revoked/invalid refresh carries NO signal ⇒ no event (deliberate anti-flood: the
             // security-relevant refresh failure is theft, not routine session expiry). Fire-and-forget.
             // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — credential-theft detection + response.
+            // SIEM-3 (F4): routed to the VICTIM's verified member orgs, exactly as the first-party refresh
+            // endpoint already does (`authentication-controller.backend.service.ts` refreshToken). This is
+            // credential-THEFT detection — the single event a customer's SOC most needs in its own feed —
+            // and the two refresh surfaces share one issuer, so they must not disagree about who sees it.
+            // `reuseSignal.userId` is read off the STORED token family by the issuer, never off the request.
             const reuseSignal = extractRefreshTokenReuseSignal(refreshError);
             if (reuseSignal) {
                 const auditLogsForReuse = this.container.get(SAAS_SERVICE_TYPES.AuditLogsService);
-                void auditLogsForReuse.logUserRefreshTokenReuseDetected({
-                    userId: reuseSignal.userId,
-                    reusedJti: reuseSignal.reusedJti,
-                    sessionId: reuseSignal.sessionId,
-                    familyRevoked: reuseSignal.familyRevoked,
-                }).catch((auditError) => this.logger.warn('USER_REFRESH_TOKEN_REUSE_DETECTED audit emit failed (non-fatal)', {
+                void (async () => {
+                    const reuseRoutingOrgIds = await this._resolveSubjectRoutingOrgIds(reuseSignal.userId);
+                    await auditLogsForReuse.logUserRefreshTokenReuseDetected({
+                        userId: reuseSignal.userId,
+                        reusedJti: reuseSignal.reusedJti,
+                        sessionId: reuseSignal.sessionId,
+                        familyRevoked: reuseSignal.familyRevoked,
+                    }, undefined, reuseRoutingOrgIds);
+                })().catch((auditError) => this.logger.warn('USER_REFRESH_TOKEN_REUSE_DETECTED audit emit failed (non-fatal)', {
                     ...projectCaughtErrorLogFields(auditError),
                 }));
             }
@@ -406,13 +433,30 @@ let OAuthProviderTokenBackendService = class OAuthProviderTokenBackendService {
         // A-4: audit the SUCCESSFUL provider refresh grant. Low-detail INFO — the security-relevant refresh
         // failure (theft/reuse) is audited via A-9 above; routine failures are intentionally not audited.
         // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — token lifecycle (refresh). Fire-and-forget.
+        //
+        // SIEM-3 (F4): routed on `refreshedUserId`, which is read back from OUR OWN freshly-minted access
+        // token — server-minted, so token-bound rather than caller-claimed.
+        //
+        // NOT ROUTED on the FIRST-PARTY branch (no `clientId`+`clientSecret`), and that is a decision rather
+        // than an oversight. That branch deliberately performs no JWT verify (`AuthTokens` carries no
+        // subject, and the verify exists only to mint the OIDC §12.2 id_token), so the event has no subject
+        // at all — neither in `routingOrgIds` NOR in its own `userId` data field. Routing an org-anonymous
+        // "a token was refreshed" row into a tenant's SIEM would add noise carrying no attribution, so the
+        // honest ordering is: make the event ATTRIBUTABLE first (a verify inside this fire-and-forget block
+        // would do it, at the cost of retiring the "a first-party refresh performs no verify" pin), and
+        // route it in the same change. Until then the DB store + Layer-2 sinks remain its only record —
+        // and note the first-party refresh ENDPOINT (`/auth/refresh-token`) already audits with a subject
+        // and routes, so nothing is lost for the ordinary session-refresh journey.
         const clientAuthenticated = Boolean(clientId && clientSecret);
         const auditLogsForRefresh = this.container.get(SAAS_SERVICE_TYPES.AuditLogsService);
-        void auditLogsForRefresh.logOAuthTokenRefreshed({
-            userId: refreshedUserId,
-            clientId: clientAuthenticated ? clientId : undefined,
-            clientAuthenticated,
-        }).catch((auditError) => this.logger.warn('OAUTH_TOKEN_REFRESHED audit emit failed (non-fatal)', {
+        void (async () => {
+            const refreshRoutingOrgIds = await this._resolveSubjectRoutingOrgIds(refreshedUserId);
+            await auditLogsForRefresh.logOAuthTokenRefreshed({
+                userId: refreshedUserId,
+                clientId: clientAuthenticated ? clientId : undefined,
+                clientAuthenticated,
+            }, undefined, refreshRoutingOrgIds);
+        })().catch((auditError) => this.logger.warn('OAUTH_TOKEN_REFRESHED audit emit failed (non-fatal)', {
             ...projectCaughtErrorLogFields(auditError),
         }));
         return {
@@ -440,6 +484,52 @@ let OAuthProviderTokenBackendService = class OAuthProviderTokenBackendService {
             this.logger.debug('Token revocation on a non-revocable token treated as success (RFC 7009)', { reason: describeCaughtError(error) });
         }
     }
+    /**
+     * F4 per-org SIEM routing for a provider event whose only trustworthy tenant anchor is the
+     * TOKEN-BOUND SUBJECT.
+     *
+     * Every emit on this service happens at a token MINT or ROTATION, where there is no authenticated
+     * request execution context — the caller has just presented a credential, and the token it is about
+     * to receive is not itself an authenticated request. So the routing org can never come from the
+     * request, and passing nothing left the provider's most sensitive events (a delegated grant, a
+     * detected credential theft) reaching the DB store and the app-level sinks but never a customer's
+     * own security sink.
+     *
+     * The subject is the answer, and only because of WHERE it comes from: each caller passes a user id
+     * the SERVER resolved — off the stored authorization code, off the stored refresh-token family, or
+     * off a token this process just minted and verified — never a value the caller wrote down.
+     * `resolveActiveMemberOrgIds` then reads the ORGANIZATION_MEMBERS junction as SYSTEM with a filter
+     * built entirely from that id plus a constant status, and brands the result `VerifiedOrgId[]`, so no
+     * caller input reaches the routing decision at any point in the chain. That provenance is the whole
+     * requirement — routing on an unverified org is the 2026-07-09 cross-tenant leak, and misrouting a
+     * delegated grant is strictly worse than not routing it.
+     *
+     * Resolved through the container rather than the constructor to match this service's lazy-dependency
+     * posture (the OAuth provider graph is reachable during startup; see the class JSDoc).
+     *
+     * NEVER-THROW, for a reason worth stating: each caller now resolves this BEFORE its emit, so a
+     * throw here would suppress the audit event entirely — turning a per-org DISPATCH failure into the
+     * loss of the authoritative record, which is the opposite of the fail-closed posture. Routing is
+     * best-effort; the DB store and the Layer-2 sink are not. `resolveActiveMemberOrgIds` is itself
+     * never-throw, so the only failure this adds is an unresolvable `SystemAccessService` binding.
+     *
+     * Returns `[]` when there is no subject to route on or when resolution failed. `[]` and `undefined`
+     * are equivalent at the sink boundary here because the request-EC argument is always `undefined` at
+     * these emit sites, so there is no EC org for `undefined` to fall back to; `[]` is passed because it
+     * states that the question WAS asked and the answer was empty.
+     */
+    async _resolveSubjectRoutingOrgIds(userId) {
+        if (!userId) {
+            return [];
+        }
+        try {
+            const systemAccessService = this.container.get(SAAS_SERVICE_TYPES.SystemAccessService);
+            return await resolveActiveMemberOrgIds(systemAccessService, userId);
+        }
+        catch {
+            return [];
+        }
+    }
     /**
      * Build a typed backend error carrying the precise OAuth 2.0 error code in `context.oauthError`
      * so the token-endpoint controller can render the RFC 6749 §5.2 error response body.