npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.2 → 1.1.4 - Mend

@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1358) hide show

package/dist/esm/config/services/app-configuration-loader.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"app-configuration-loader.backend.service.js","sourceRoot":"","sources":["../../../../../src/config/services/app-configuration-loader.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,yCAAyC,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAClI,OAAO,EAAE,6BAA6B,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AACjH,OAAO,EAA2B,8BAA8B,EAAE,MAAM,qEAAqE,CAAC;AAC9I,OAAO,EAAE,cAAc,EAAE,MAAM,wEAAwE,CAAC;AAExG,OAAO,EAAE,wCAAwC,EAAE,uCAAuC,EAAE,mCAAmC,EAAE,MAAM,6DAA6D,CAAC;AACrM,OAAO,EAAE,8BAA8B,EAAE,eAAe,EAAE,MAAM,6DAA6D,CAAC;AAC9H,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,EAAE,2CAA2C,EAAE,MAAM,qEAAqE,CAAC;AAElI,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,iCAAiC,EAAE,MAAM,iEAAiE,CAAC;AACpH,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,KAAwB,MAAM,OAAO,CAAC;AAC7C,OAAO,EAAE,8BAA8B,EAAE,MAAM,kEAAkE,CAAC;AAElH,IAAK,oBAGJ;AAHD,WAAK,oBAAoB;IACvB,6EAAqD,CAAA;IACrD,+EAAuD,CAAA;AACzD,CAAC,EAHI,oBAAoB,KAApB,oBAAoB,QAGxB;AAED,IAAK,2BAEJ;AAFD,WAAK,2BAA2B;IAC9B,sDAAuB,CAAA;AACzB,CAAC,EAFI,2BAA2B,KAA3B,2BAA2B,QAE/B;AAED,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACnC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC;;;;;;;;;;;;;OAaG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,CACf,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;YACvB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SAC9C,CAAC,CAAC,QAAQ,EAAE;QACb,2EAA2E;QAC3E,wEAAwE;QACxE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QACtF,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE;QACvD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACvC,CAAC,CACH,CAAC,QAAQ,EAAE;IACZ,OAAO,EAAE,CAAC,CAAC,MAAM,CACf,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;YAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;SAC5B,CAAC;QACF,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACb,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;SAC1C,CAAC;QACF,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACrC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;YAClB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;SACrC,CAAC,CAAC,QAAQ,EAAE;QACb,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;YAChE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YAC7B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;SACnE,CAAC,CAAC,QAAQ,EAAE;KACd,CAAC,CACH,CAAC,QAAQ,EAAE;IACZ,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAC1B,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CACH,CAAC,QAAQ,EAAE;IACZ,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,2BAA2B,EAAE,CAAC,CAAC,OAAO,EAAE;QACxC,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE;KACrC,CAAC,CAAC,QAAQ,EAAE;IACb,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtG,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;QACZ,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3C,iBAAiB,EAAE,CAAC,CAAC,MAAM,CACzB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,2EAA2E;YAC3E,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;SACrC,CAAC,CAAC,CACJ,CAAC,QAAQ,EAAE;QACZ,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE;QACxC,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;KACvC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAGI,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;;IAcK;IACa;IAdhD,QAAQ,CAA+D;IACvE,oBAAoB,CAAuB;IAC3C,WAAW,CAAS;IACpB,aAAa,CAAgB;IACtB,iBAAiB,GAAW,QAAQ,GAAG,8BAA8B,CAAC,YAAY,CAAC,uBAAuB,EAAE,CAAC;IAC7G,gBAAgB,GAAW,QAAQ,GAAG,8BAA8B,CAAC,YAAY,CAAC,sBAAsB,EAAE,CAAC;IAEpH,MAAM,CAAU,wBAAwB,GAAG,uBAAuB,CAAC;IACnE,MAAM,CAAU,kBAAkB,GAAG,EAAE,CAAC;IACxC,MAAM,CAAU,iBAAiB,GAAG,IAAI,CAAC;IACzC,MAAM,CAAU,gBAAgB,GAAG,KAAK,CAAC;IAEjD,YAC6C,MAAqB,EACR,YAAwC;QADrD,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAEhG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,+BAA+B,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;IAC1E,CAAC;IAEM,KAAK,CAAC,UAAU;QAQrB,oBAAoB;QACpB,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,6BAA6B,EAAE,CAAC;QACjE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAE1D,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC;YAChC,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,yBAAyB;YAC5D,OAAO,EAAE;gBACP,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,kBAAkB;gBAClD,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,WAAW;gBAC9C,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,oBAAoB,CAAC,mCAAmC;gBAChG,CAAC,eAAe,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,oBAAoB,CAAC,cAAc;aAC3E;SACF,CAAC,CAAC;QAEH,uDAAuD;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAE5C,6EAA6E;QAC7E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAE3D,0EAA0E;QAC1E,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,oCAAoC,CAAC,SAAS,CAAC,CAAC;QAE/E,OAAO;YACL,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU;YACV,SAAS;YACT,aAAa,EAAE,IAAI,CAAC,oBAAoB,CAAC,cAAc;YACvD,OAAO;SACR,CAAC;IACJ,CAAC;IAES,6BAA6B;QACrC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACvE,IAAI,CAAC,QAAQ,CAAC,wDAAwD,CAAC,CAAC;YACxE,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oFAAoF;YACpF,oFAAoF;YACpF,sFAAsF;YACtF,qFAAqF;YACrF,sFAAsF;YACtF,mFAAmF;YACnF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,OAAO,EAAE,sDAAsD;oBAC/D,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;oBACxC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBAClC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACO,kBAAkB;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,CAAC;QACtC,MAAM,iBAAiB,GAAG,2CAA2C,CAAC;YACpE,cAAc,EAAE,GAAG,CAAC,yBAAyB;YAC7C,yBAAyB,EAAE,GAAG,CAAC,qCAAqC;YACpE,iBAAiB,EAAE,GAAG,CAAC,4BAA4B;SACpD,CAAC,CAAC;QACH,MAAM,2BAA2B,GAC/B,GAAG,CAAC,gCAAgC,CAAC,6BAA6B,CAAC,CAAC;QAEtE,MAAM,UAAU,GAAG,uCAAuC,CAAC;YACzD,gBAAgB,EAAE;gBAChB,GAAG,iBAAiB;gBACpB,GAAG,2BAA2B;aAC/B;YACD,QAAQ,EAAE;gBACR;;;;;;;;;;;mBAWG;gBACH,cAAc,EAAE,GAAG,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,IAAI,2BAA2B;gBAC1G;;;;;;;;;;;;;;mBAcG;gBACH,gBAAgB,EAAE,GAAG,CAAC,6BAA6B,CAAC,kBAAkB,CAAC,IAAI,gBAAgB,CAAC,SAAS;gBACrG;;;;;;;;;;;;;;;;;;mBAkBG;gBACH,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;oBACrB,OAAO,EAAE;wBACP,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,GAAG,CAAC,YAAY;wBACtB,QAAQ,EAAE,GAAG,CAAC,gBAAgB;wBAC9B,QAAQ,EAAE,GAAG,CAAC,gBAAgB,IAAI,eAAe,CAAC,OAAO;wBACzD,OAAO,EAAE;4BACP,WAAW,EAAE,IAAI;4BACjB,CAAC,EAAE,UAAU;4BACb,UAAU,EAAE,OAAO;4BACnB,GAAG,CAAC,GAAG,CAAC,yBAAyB,KAAK,SAAS;gCAC7C,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,yBAAyB,EAAE;gCACrD,CAAC,CAAC,EAAE,CAAC;yBACR;qBACF;iBACF,CAAC,CAAC,CAAC,EAAE,CAAC;gBACP;;;;;;;;mBAQG;gBACH,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;oBACvD,UAAU,EAAE;wBACV,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,GAAG,CAAC,6BAA6B,CAAC,eAAe,CAAC;wBACxD,IAAI,EAAE,GAAG,CAAC,6BAA6B,CAAC,eAAe,CAAC,IAAI,IAAI;wBAChE,YAAY,EAAE,GAAG,CAAC,6BAA6B,CAAC,mBAAmB,CAAC;wBACpE,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,mBAAmB,CAAC;4BACxD,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,6BAA6B,CAAC,mBAAmB,CAAC,EAAE;4BACrE,CAAC,CAAC,EAAE,CAAC;qBACR;iBACF,CAAC,CAAC,CAAC,EAAE,CAAC;gBACP,KAAK,EAAE;oBACL,IAAI,EAAE,GAAG,CAAC,UAAU;oBACpB,IAAI,EAAE,GAAG,CAAC,UAAU;oBACpB,EAAE,EAAE,CAAC;oBACL,0DAA0D;oBAC1D,6DAA6D;oBAC7D,iDAAiD;oBACjD,yDAAyD;oBACzD,sDAAsD;oBACtD,0DAA0D;oBAC1D,2DAA2D;oBAC3D,6DAA6D;oBAC7D,4DAA4D;oBAC5D,GAAG,CAAC,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnF;gBACD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;oBACtB,QAAQ,EAAE;wBACR,IAAI,EAAE,GAAG,CAAC,aAAa;wBACvB,IAAI,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI;wBAC/B,qEAAqE;wBACrE,mEAAmE;wBACnE,mEAAmE;wBACnE,iEAAiE;wBACjE,eAAe;wBACf,EAAE;wBACF,6EAA6E;wBAC7E,qEAAqE;wBACrE,qEAAqE;wBACrE,sEAAsE;wBACtE,kEAAkE;wBAClE,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC7D;iBACF,CAAC,CAAC,CAAC,EAAE,CAAC;aACR;YACD,GAAG,EAAE,EAAE;YACP,4EAA4E;YAC5E,6EAA6E;YAC7E,2EAA2E;YAC3E,8BAA8B;YAC9B,4DAA4D;YAC5D,EAAE;YACF,6EAA6E;YAC7E,uEAAuE;YACvE,2EAA2E;YAC3E,8EAA8E;YAC9E,uCAAuC;YACvC,OAAO,EAAE,mCAAmC,CAAC,GAAG,CAAC;YACjD,yEAAyE;YACzE,iEAAiE;YACjE,8CAA8C;YAC9C,GAAG,wCAAwC,CAAC,GAAG,CAAC;SACjD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,4DAA4D,EAAE;YAC1E,SAAS,EAAE,GAAG,CAAC,YAAY;YAC3B,qBAAqB,EAAE,GAAG,CAAC,yBAAyB;YACpD,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM;SAC7D,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;;;OAQG;IACO,KAAK,CAAC,oCAAoC,CAClD,SAA8D;QAE9D,MAAM,cAAc,GAAG,KAAK,IAAkC,EAAE;YAC9D,IAAI,CAAC,QAAQ,CAAC,sDAAsD,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAErE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,OAAO,EAAE,EAAE,OAAO,EAAE,6DAA6D,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;iBAC7G,CAAC,CAAC;YACL,CAAC;YAED,MAAM,EACJ,OAAO,EACP,WAAW,EACX,gBAAgB,EAChB,OAAO,EACP,OAAO,EACP,kBAAkB,EAClB,SAAS,EACT,KAAK,EACL,sBAAsB,EACtB,UAAU,EACV,iBAAiB,EACjB,4BAA4B,EAC5B,0BAA0B,GAC3B,GAAG,IAAI,CAAC,oCAAoC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAE7D,IAAI,WAAW,EAAE,CAAC;gBAChB,SAAS,CAAC,WAAW,GAAG,WAAW,CAAC;YACtC,CAAC;YAED,IAAI,gBAAgB,EAAE,CAAC;gBACrB,SAAS,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;YAChD,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBACZ,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC;YAC9B,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBACZ,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC;YAC9B,CAAC;YAED,IAAI,kBAAkB,EAAE,CAAC;gBACvB,SAAS,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;YACpD,CAAC;YAED,IAAI,SAAS,EAAE,CAAC;gBACd,SAAS,CAAC,SAAS,GAAG,SAAS,CAAC;YAClC,CAAC;YAED,IAAI,KAAK,EAAE,CAAC;gBACV,SAAS,CAAC,KAAK,GAAG;oBAChB,GAAG,SAAS,CAAC,KAAK;oBAClB,GAAG,KAAK;iBACT,CAAC;YACJ,CAAC;YAED,IAAI,sBAAsB,EAAE,CAAC;gBAC3B,SAAS,CAAC,sBAAsB,GAAG,sBAAsB,CAAC;YAC5D,CAAC;YAED,SAAS,CAAC,GAAG,GAAG;gBACd,GAAG,SAAS,CAAC,GAAG;gBAChB,SAAS,EAAE;oBACT,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS;oBAC1B,GAAG,UAAU;iBACd;gBACD,iBAAiB,EAAE;oBACjB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;oBAC1C,GAAG,iBAAiB;iBACrB;gBACD,kEAAkE;gBAClE,4DAA4D;gBAC5D,2DAA2D;gBAC3D,0CAA0C;gBAC1C,mEAAmE;gBACnE,+DAA+D;gBAC/D,+DAA+D;gBAC/D,uDAAuD;gBACvD,EAAE;gBACF,0DAA0D;gBAC1D,uEAAuE;gBACvE,6DAA6D;gBAC7D,wDAAwD;gBACxD,2DAA2D;gBAC3D,aAAa;gBACb,4BAA4B;gBAC5B,0BAA0B;aAC3B,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,oDAAoD,EAAE;gBAClE,OAAO;gBACP,cAAc,EAAE,CAAC,CAAC,WAAW;gBAC7B,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,MAAM;gBAChE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM;gBAC9C,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM;gBAC9C,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,MAAM;gBACnE,iBAAiB,EAAE,CAAC,CAAC,SAAS;gBAC9B,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,MAAM;gBAC5E,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM;aACzD,CAAC,CAAC;YAEH,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,2BAA2B,CAAC,cAAc,EAAE,sCAAsC,CAAC,CAAC;QACxG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,OAAO,EAAE,6DAA6D;oBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,cAAc,EAAE,IAAI,CAAC,oBAAoB,CAAC,eAAe;oBACzD,WAAW,EAAE,2BAA2B,CAAC,SAAS;oBAClD,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBAClC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAES,KAAK,CAAC,0BAA0B;QACxC,MAAM,oBAAoB,GAAG,KAAK,IAAsC,EAAE;YACxE,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;YACnF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAA0B,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAE/F,IAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChM,CAAC;YAED,MAAM,gBAAgB,GAAG,yCAAyC,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,CAAC;YAC1H,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACtD,IAAI,CAAC,QAAQ,CAAC,8CAA8C,CAAC,CAAC;YAE9D,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,2BAA2B,CAAC,oBAAoB,EAAE,4BAA4B,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,OAAO,EAAE,yCAAyC;oBAClD,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,cAAc,EAAE,IAAI,CAAC,oBAAoB,CAAC,eAAe;oBACzD,WAAW,EAAE,IAAI,CAAC,8BAA8B,CAAC,oBAAoB,CAAC,wBAAwB,CAAC;oBAC/F,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,SAAS;oBACjC,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,SAAS;oBAC3C,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBAClC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,oCAAoC,CAC1C,IAAa;QAoBb,MAAM,QAAQ,GAAG,wCAAwC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,OAAO,EAAE,iDAAiD;iBAC3D;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC;QAC9B,MAAM,UAAU,GAAG,QAAQ,EAAE,SAAS,CAAC;QACvC,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,OAAO,EAAE,+DAA+D;oBACxE,OAAO;iBACR;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,OAAO,EAAE,yDAAyD,cAAc,CAAC,sBAAsB,EAAE;oBACzG,OAAO;iBACR;aACF,CAAC,CAAC;QACL,CAAC;QACD,+DAA+D;QAC/D,mEAAmE;QACnE,+DAA+D;QAE/D,OAAO;YACL,OAAO;YACP,WAAW,EAAE,QAAQ,CAAC,WAA0D;YAChF,gBAAgB,EAAE,QAAQ,CAAC,gBAAoE;YAC/F,oDAAoD;YACpD,4CAA4C;YAC5C,6DAA6D;YAC7D,qEAAqE;YACrE,iEAAiE;YACjE,6DAA6D;YAC7D,kDAAkD;YAClD,OAAO,EAAE,QAAQ,CAAC,OAAkD;YACpE,OAAO,EAAE,QAAQ,CAAC,OAAkD;YACpE,kBAAkB,EAAE,QAAQ,CAAC,kBAAwE;YACrG,SAAS,EAAE,QAAQ,CAAC,SAAsD;YAC1E,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,sBAAsB,EAAE,QAAQ,CAAC,sBAAgF;YACjH,UAAU;YACV,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,IAAI,EAAE;YACnD,4BAA4B,EAAE,QAAQ,CAAC,4BAA4B;YACnE,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B;SAChE,CAAC;IACJ,CAAC;IAEO,8BAA8B,CACpC,SAA+B;QAE/B,QAAQ,SAAS,EAAE,CAAC;YAClB,KAAK,oBAAoB,CAAC,wBAAwB,CAAC;YACnD,KAAK,oBAAoB,CAAC,yBAAyB,CAAC;YACpD;gBACE,OAAO,2BAA2B,CAAC,SAAS,CAAC;QACjD,CAAC;IACH,CAAC;IAEO,4BAA4B;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,KAAK,+BAA6B,CAAC,wBAAwB,CAAC;QACjG,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,eAAe,KAAK,kBAAkB,CAAC,WAAW,CAAC;QACnG,OAAO,CAAC,YAAY,IAAI,aAAa,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,2BAA2B,CACvC,SAA2B,EAC3B,aAAqB;QAErB,IAAI,IAAI,CAAC,4BAA4B,EAAE,EAAE,CAAC;YACxC,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,SAA2B,EAC3B,aAAqB;QAErB,IAAI,SAAc,CAAC;QAEnB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,+BAA6B,CAAC,kBAAkB,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7F,IAAI,CAAC;gBACH,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;oBAChB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,+BAA6B,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,EAC1E,+BAA6B,CAAC,gBAAgB,CAC/C,CAAC;oBAEF,IAAI,CAAC,QAAQ,CAAC,YAAY,aAAa,cAAc,OAAO,IAAI,+BAA6B,CAAC,kBAAkB,UAAU,KAAK,UAAU,EAAE;wBACzI,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,OAAO;wBACP,KAAK;qBACN,CAAC,CAAC;oBAEH,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC1B,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,QAAQ,CAAC,uBAAuB,aAAa,wCAAwC,EAAE;wBAC1F,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,aAAa,EAAE,+BAA6B,CAAC,kBAAkB;qBAChE,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO,MAAM,SAAS,EAAE,CAAC;YAE3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,GAAG,KAAK,CAAC;gBAElB,IAAI,OAAO,GAAG,+BAA6B,CAAC,kBAAkB,EAAE,CAAC;oBAC/D,IAAI,CAAC,QAAQ,CAAC,WAAW,OAAO,eAAe,aAAa,cAAc,EAAE;wBAC1E,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,OAAO;wBACP,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;qBAClC,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,QAAQ,CAAC,OAAO,+BAA6B,CAAC,kBAAkB,wBAAwB,aAAa,EAAE,EAAE;wBAC5G,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;qBAClC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,SAAS,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,EAAU;QACtB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;;AArkBU,6BAA6B;IADzC,UAAU,EAAE;IAeR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCADI,aAAa;QACM,0BAA0B;GAfvF,6BAA6B,CAskBzC","sourcesContent":["/*\n Application Configuration Loader Service\n \n Loads application configuration through a layered chain (T5):\n * 1. Parse env vars (identity, database addresses, platform URLs)\n * 2. Build the minimal pre-override AppConfiguration skeleton\n * 3. Inject env-sourced database/runtime config into that skeleton\n * 4. Fetch reduced managed config metadata from apps-manager\n * 5. Merge managed app identity/frontend/engine-capability defaults plus JWT keys\n * 6. Return config for developer overrides (applied by AppConfigurationService)\n \n Secrets are still fully fetched from apps-manager (separate endpoint).\n /\n\nimport { injectable, inject } from 'inversify';\nimport { z } from 'zod';\nimport { ErrorType, ResourcesConfigOperationsDtosBuilderUtils, RuntimeEnvironment, WildoHeaderKeys } from '@wildo-ai/saas-models';\nimport { ApplicationBackendDataEnvKeys, ApplicationBackendRuntimeEnvKeys } from '@wildo-ai/platform-core-shared';\nimport { AppConfigurationSecrets, AppConfigurationSecrets_Schema } from '~wildo-backend-lib/config/models/app-config-secrets.backend.schemas';\nimport { JwtPrivateKeys } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport type { AppConfiguration, AppConfiguration_PreOverrideSeed } from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport { buildFileServicesTopologyFromEnvironment, buildMinimalPreOverrideAppConfiguration, buildStorageTopologyFromEnvironment } from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport { APP_CONFIGURATION_MINION_MODES, MongoDBProtocol } from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport { DEFAULT_PERSISTENCE_ADAPTER, ResourceIdFormat } from '@wildo-ai/saas-models';\nimport { buildPlatformRuntimeEndpointsFromBackendEnv } from '~wildo-backend-lib/config/models/runtime-topology.backend.contracts';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ApplicationEnvConfig } from '~wildo-backend-lib/config/models/app-env-config.backend.schemas';\nimport { ApplicationEnvConfigurationSchema } from '~wildo-backend-lib/config/models/app-env-config.backend.schemas';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport axios, { AxiosInstance } from 'axios';\nimport { API_ROUTES_BACKEND_DEFINITIONS } from '~wildo-backend-lib/requests/models/api-routes.backend.defintions';\n\nenum AppsManagerFetchKind {\n PLATFORM_MANAGED_SECRETS = 'platform_managed_secrets',\n BOOTSTRAP_CONFIG_METADATA = 'bootstrap_config_metadata',\n}\n\nenum AppsManagerFetchFailureMode {\n FAIL_FAST = 'fail_fast',\n}\n\nconst AppBootstrapConfigMetadataResponseSchema = z.object({\n appSlug: z.string().min(1),\n appIdentity: z.unknown().optional(),\n frontendServices: z.unknown().optional(),\n /\n Mirrors `AdminAppManagedMinionsSchema` from\n * `@wildo-ai/platform-config-lib` — it must carry EVERY field that schema\n * declares, not merely the ones a past regression happened to expose.\n * `mode` and `schedule` are the recorded case (the KD-12 cron-tick path);\n * `platformAccess` was added the same way and would have been stripped the\n * same way. Earlier\n * shape only declared `resourceAccess`, which silently stripped these\n * fields from the wire payload via Zod's default object semantics —\n * `extractMinionTickCronJobs()` then never observed `mode === 'cron'`\n * and the entire MINION_TICK CronJob registration was dead in\n * production. Adding either field on the apps-manager side without\n * mirroring it here will reintroduce the same silent regression.\n /\n minions: z.record(\n z.string(),\n z.object({\n resourceAccess: z.object({\n read: z.array(z.string().min(1)).default([]),\n write: z.array(z.string().min(1)).default([]),\n }).optional(),\n // Structural, mirroring `app-config.backend.schemas.ts` — see the boundary\n // note there for why this hop does not reference the config-lib schema.\n platformAccess: z.object({ scopes: z.array(z.string().min(1)).optional() }).optional(),\n mode: z.enum(APP_CONFIGURATION_MINION_MODES).optional(),\n schedule: z.string().min(1).optional(),\n }),\n ).optional(),\n workers: z.record(\n z.string(),\n z.object({\n name: z.string().min(1),\n displayName: z.string().min(1),\n description: z.string().optional(),\n runtime: z.object({\n type: z.string().min(1),\n language: z.string().min(1),\n }),\n http: z.object({\n port: z.number().int().positive(),\n healthPath: z.string().min(1),\n readyPath: z.string().min(1),\n metricsPath: z.string().min(1).optional(),\n }),\n auth: z.literal('wildo-jwt'),\n replicas: z.number().int().positive(),\n resources: z.object({\n cpu: z.string().min(1).optional(),\n memory: z.string().min(1).optional(),\n }).optional(),\n dataAccess: z.object({\n database: z.enum(['read-only', 'read-write', 'none']).optional(),\n cache: z.boolean().optional(),\n queue: z.enum(['consumer', 'producer', 'both', 'none']).optional(),\n }).optional(),\n }),\n ).optional(),\n engineCapabilities: z.record(\n z.string(),\n z.object({\n enabled: z.boolean(),\n required: z.boolean().optional(),\n }),\n ).optional(),\n providers: z.unknown().optional(),\n email: z.object({\n isTransactionalWildoManaged: z.boolean(),\n isMarketingWildoManaged: z.boolean(),\n }).optional(),\n providerConfigurations: z.record(z.string(), z.record(z.string(), z.unknown()).optional()).default({}),\n jwt: z.object({\n publicKey: z.record(z.string(), z.string()),\n rotatedPublicKeys: z.record(\n z.string(),\n z.array(z.object({\n kid: z.string().min(1),\n publicKey: z.string().min(1),\n /* Preserve platform-owned retirement bounds through bootstrap parsing. /\n notAfter: z.coerce.date().optional(),\n })),\n ).optional(),\n accessTokenExpirationMinutes: z.number(),\n refreshTokenExpirationDays: z.number(),\n }).optional(),\n});\n\n@injectable()\nexport class AppConfigurationLoaderService {\n protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n protected applicationEnvConfig: ApplicationEnvConfig;\n protected serviceName: string;\n protected axiosInstance: AxiosInstance;\n private readonly appsSecretUrlPath: string = \"api/v1\" + API_ROUTES_BACKEND_DEFINITIONS.APPS_MANAGER.GET_APPLICATION_SECRETS();\n private readonly appConfigUrlPath: string = \"api/v1\" + API_ROUTES_BACKEND_DEFINITIONS.APPS_MANAGER.GET_APPLICATION_CONFIG();\n\n private static readonly APP_MANAGER_SERVICE_NAME = \"platform_apps_manager\";\n private static readonly DEV_RETRY_ATTEMPTS = 10;\n private static readonly DEV_BASE_DELAY_MS = 1000;\n private static readonly DEV_MAX_DELAY_MS = 10000;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private errorBuilder: ErrorBuilderBackendService\n ) {\n this.logDebug = this.logger.debugByType('AppConfigurationLoaderService');\n this.logger.setDebugTypeLogging('AppConfigurationLoaderService', false);\n }\n\n public async initialize(): Promise<{\n applicationEnvConfig: ApplicationEnvConfig;\n serviceName: string;\n appSecrets: AppConfigurationSecrets;\n appConfig: AppConfiguration_PreOverrideSeed;\n applicationId: string;\n appSlug: string;\n }> {\n // 1. Parse env vars\n this.applicationEnvConfig = this.loadPlatformEnvironmentConfig();\n this.serviceName = this.applicationEnvConfig.SERVICE_NAME;\n\n this.axiosInstance = axios.create({\n baseURL: this.applicationEnvConfig.PLATFORM_APPS_MANAGER_URL,\n headers: {\n [WildoHeaderKeys.CONTENT_TYPE]: 'application/json',\n [WildoHeaderKeys.SERVICE_ID]: this.serviceName,\n [WildoHeaderKeys.PLATFORM_SECRET]: this.applicationEnvConfig.PLATFORM_APPLICATION_PRIMARY_SECRET,\n [WildoHeaderKeys.APPLICATION_ID]: this.applicationEnvConfig.APPLICATION_ID,\n },\n });\n\n // 2. Build base config from Zod defaults + env overlay\n const appConfig = this.buildConfigFromEnv();\n\n // 3. Fetch secrets (full payload — credentials are always from apps-manager)\n const appSecrets = await this.loadPlatformManagedSecrets();\n\n // 4. Fetch reduced managed config metadata from apps-manager and merge it\n const { appSlug } = await this.fetchAndMergeBootstrapConfigMetadata(appConfig);\n\n return {\n applicationEnvConfig: this.applicationEnvConfig,\n serviceName: this.serviceName,\n appSecrets,\n appConfig,\n applicationId: this.applicationEnvConfig.APPLICATION_ID,\n appSlug,\n };\n }\n\n protected loadPlatformEnvironmentConfig(): ApplicationEnvConfig {\n try {\n const envConfig = ApplicationEnvConfigurationSchema.parse(process.env);\n this.logDebug('Platform environment configuration loaded successfully');\n return envConfig;\n } catch (error) {\n // The caught error is the ONLY evidence of what actually failed here, and it is not\n // necessarily a Zod validation failure: anything thrown while evaluating the schema\n // (module-init/TDZ seams under native ESM) surfaces through the same catch. Reporting\n // only `processEnvKeys` produced a startup log that named a validation failure while\n // the env in fact parsed cleanly, which sent diagnosis down the wrong layer entirely.\n // Mirror the sibling catches in this service and always describe the caught error.\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: 'Platform environment configuration validation failed',\n processEnvKeys: Object.keys(process.env),\n error: describeCaughtError(error),\n },\n });\n }\n }\n\n /\n Build the minimal pre-override AppConfiguration skeleton, then inject\n * database and runtime config from environment variables.\n \n This replaces the old pattern of fetching the full config from apps-manager.\n * The loader only authors env/runtime material plus the narrow structural\n * placeholders required before developer overrides run.\n \n A minimal seed provides required top-level sections so the shared schema can\n * materialize nested defaults before developer overrides run. Developer\n * overrides still replace these placeholders with app-specific values.\n /\n protected buildConfigFromEnv(): AppConfiguration_PreOverrideSeed {\n const env = this.applicationEnvConfig;\n const platformEndpoints = buildPlatformRuntimeEndpointsFromBackendEnv({\n appsManagerUrl: env.PLATFORM_APPS_MANAGER_URL,\n crontabsBatchesManagerUrl: env.PLATFORM_CRONTABS_BATCHES_MANAGER_URL,\n moduleRegistryUrl: env.PLATFORM_MODULE_REGISTRY_URL,\n });\n const applicationRuntimeEndpoints =\n env[ApplicationBackendRuntimeEnvKeys.APPLICATION_RUNTIME_ENDPOINTS];\n\n const baseConfig = buildMinimalPreOverrideAppConfiguration({\n runtimeEndpoints: {\n ...platformEndpoints,\n ...applicationRuntimeEndpoints,\n },\n database: {\n /\n DECLARED by the environment, no longer hard-coded.\n \n This literal was `PersistenceAdapter.MONGODB`, which made the whole PostgreSQL adapter\n * unreachable through any supported boot path: no env var, secret or bootstrap value could\n * select it, so the only way to exercise it was a test reaching into the config object. That\n * is why no application had ever booted on PostgreSQL, and it is a much narrower gap than\n * \"PostgreSQL is unfinished\" — the adapter, planner, repository and (now) the DDL were all\n * ready; nothing could ASK for them.\n \n The env key defaults to MONGODB, so a deployment that does not author it is unchanged.\n /\n defaultAdapter: env[ApplicationBackendDataEnvKeys.DATABASE_DEFAULT_ADAPTER] ?? DEFAULT_PERSISTENCE_ADAPTER,\n /\n DECLARED by the environment, no longer hard-coded — and still NOT derived from the\n * adapter above.\n \n The literal that was here said \"declared, not derived\" while being neither: nothing could\n * state it, so the engine's own rule was true in the schema and unreachable in practice. An\n * application selecting PostgreSQL had no supported way to say which identity format it\n * mints, which is the second half of the same gap `DATABASE_DEFAULT_ADAPTER` closed.\n \n Deriving it from `defaultAdapter` remains rejected, and the schema's JSDoc records what\n * that cost: moving a resource between adapters silently changed the shape of every id it\n * minted, and made every id it had ALREADY minted fail `validateForResource`.\n \n The env key defaults to `OBJECT_ID`, so a deployment that does not author it is unchanged.\n /\n resourceIdFormat: env[ApplicationBackendDataEnvKeys.RESOURCE_ID_FORMAT] ?? ResourceIdFormat.OBJECT_ID,\n /\n Built ONLY when the environment supplies an address — the exact shape `postgresql` below\n * has always had, and for the reason its own JSDoc gives.\n \n Until 2026-08-28 this branch was UNCONDITIONAL, so `database.mongodb.enabled` was `true`\n * on every runtime that has ever existed, with `host` simply `undefined` when no mongod was\n * within reach. That left the flag unable to answer the only question anyone asks of it —\n * does this runtime have a MongoDB? — and reproduced exactly the defect the PostgreSQL\n * branch was written to avoid: it passes the registry's boot check and then fails at the\n * first connection, which is the wrong place to learn about it.\n \n Met on `wonder-crm` (PostgreSQL on both planes, no mongod declared): its readiness gate\n * probed a MongoDB it does not have, so `/health/ready` could never become ready.\n \n The compiler offers no protection here — this package builds with `strict: false`, so an\n * absent branch produces no access error at any reader. The readers were enumerated by hand\n * instead, and `MongoDBService.connect` now refuses with a named configuration error rather\n * than a bare TypeError.\n /\n ...(env.MONGODB_HOST ? {\n mongodb: {\n enabled: true,\n host: env.MONGODB_HOST,\n database: env.MONGODB_DATABASE,\n protocol: env.MONGODB_PROTOCOL ?? MongoDBProtocol.MONGODB,\n options: {\n retryWrites: true,\n w: 'majority',\n authSource: 'admin',\n ...(env.MONGODB_DIRECT_CONNECTION !== undefined\n ? { directConnection: env.MONGODB_DIRECT_CONNECTION }\n : {}),\n },\n },\n } : {}),\n /\n Built ONLY when the environment supplies an address.\n \n Absence is what keeps `postgresql.enabled` false — a branch with `enabled: true` and no\n * host would pass the registry's boot check (\"is the declared adapter enabled?\") and then\n * fail at the first connection, which is the wrong place to learn about it. Credentials are\n * NOT read here: `PostgreSQLDatabaseBackendService` takes them from\n * `secrets.database.postgresql`, matching how MongoDB splits address from credential.\n /\n ...(env[ApplicationBackendDataEnvKeys.POSTGRESQL_HOST] ? {\n postgresql: {\n enabled: true,\n host: env[ApplicationBackendDataEnvKeys.POSTGRESQL_HOST],\n port: env[ApplicationBackendDataEnvKeys.POSTGRESQL_PORT] ?? 5432,\n databaseName: env[ApplicationBackendDataEnvKeys.POSTGRESQL_DATABASE],\n ...(env[ApplicationBackendDataEnvKeys.POSTGRESQL_SSL_MODE]\n ? { sslMode: env[ApplicationBackendDataEnvKeys.POSTGRESQL_SSL_MODE] }\n : {}),\n },\n } : {}),\n redis: {\n host: env.REDIS_HOST,\n port: env.REDIS_PORT,\n db: 0,\n // Slice 3.6 + 2026-05-26 ACL-alignment fix — when the app\n // authored `wildo.saas.config.dataServices.redis.keyPrefix`,\n // the env var `REDIS_KEY_PREFIX` threads it into\n // `config.database.redis.keyPrefix`. When the env var is\n // unset, we deliberately leave the field undefined so\n // `RedisService.connect()` falls back to the slug-derived\n // default `<appSlug>:` — the only default that aligns with\n // the per-app ACL grant `~<appSlug>:`. The previous literal\n // schema default `'saas:'` was removed for the same reason.\n ...(env.REDIS_KEY_PREFIX !== undefined ? { keyPrefix: env.REDIS_KEY_PREFIX } : {}),\n },\n ...(env.RABBITMQ_HOST ? {\n rabbitmq: {\n host: env.RABBITMQ_HOST,\n port: env.RABBITMQ_PORT ?? 5672,\n // Slice 2.5c-3 — per-app vhost isolation. The field is threaded ONLY\n // when the operator authored `backingServices.rabbitmq.vhost`; the\n // key stays absent otherwise so the adapter applies its documented\n // default-vhost (`/`) fallback rather than receiving an explicit\n // `undefined`.\n //\n // The `database` branch is env-owned: `fetchAndMergeBootstrapConfigMetadata`\n // deliberately never re-authors it, so this seed is the ONLY path by\n // which an authored vhost can reach `RabbitMQAdapterBackendService`.\n // Dropping it here (as this mapping previously did) made the authored\n // vhost a silent no-op — see the matching note on the env schema.\n ...(env.RABBITMQ_VHOST ? { vhost: env.RABBITMQ_VHOST } : {}),\n },\n } : {}),\n },\n jwt: {},\n // Object-storage TOPOLOGY, injected here for the same reason `database` is:\n // this seed is the one place environment material becomes configuration, and\n // routing storage through it removes the last app-tier subsystem that read\n // `process.env` directly. See\n // `.claude/plans/application-runtime-topology-delivery.md`.\n //\n // Each block is emitted ONLY when its defining value is present, and that is\n // load-bearing rather than tidy: the storage provider treats a missing\n // connection as UNCONFIGURED, so seeding a plausible default would disable\n // the file feature silently instead of failing loudly — the failure mode this\n // subsystem has already produced once.\n storage: buildStorageTopologyFromEnvironment(env),\n // Same contract as `storage`, one derivation over: the scanning sidecars\n // are platform-injected topology, and this seed is the one place\n // environment material becomes configuration.\n ...buildFileServicesTopologyFromEnvironment(env),\n });\n\n this.logDebug('Built pre-override config seed from env/bootstrap material', {\n mongoHost: env.MONGODB_HOST,\n mongoDirectConnection: env.MONGODB_DIRECT_CONNECTION,\n platformEndpointCount: Object.keys(platformEndpoints).length,\n });\n\n return baseConfig;\n }\n\n /*\n Fetch reduced bootstrap metadata from apps-manager.\n * This keeps apps-manager authoritative for selected app-managed declaration\n * fields without letting it re-author env/bootstrap runtime branches.\n \n Policy:\n * - fail-fast after the retry window is exhausted\n * - development mode only changes retry behavior, not the final failure mode\n /\n protected async fetchAndMergeBootstrapConfigMetadata(\n appConfig: AppConfiguration \| AppConfiguration_PreOverrideSeed,\n ): Promise<{ appSlug: string }> {\n const fetchOperation = async (): Promise<{ appSlug: string }> => {\n this.logDebug('Fetching bootstrap config metadata from apps-manager');\n const response = await this.axiosInstance.get(this.appConfigUrlPath);\n\n if (response.status !== 200) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: { message: 'Failed to fetch bootstrap config metadata from apps-manager', status: response.status },\n });\n }\n\n const {\n appSlug,\n appIdentity,\n frontendServices,\n minions,\n workers,\n engineCapabilities,\n providers,\n email,\n providerConfigurations,\n publicKeys,\n rotatedPublicKeys,\n accessTokenExpirationMinutes,\n refreshTokenExpirationDays,\n } = this.parseBootstrapConfigMetadataResponse(response.data);\n\n if (appIdentity) {\n appConfig.appIdentity = appIdentity;\n }\n\n if (frontendServices) {\n appConfig.frontendServices = frontendServices;\n }\n\n if (minions) {\n appConfig.minions = minions;\n }\n\n if (workers) {\n appConfig.workers = workers;\n }\n\n if (engineCapabilities) {\n appConfig.engineCapabilities = engineCapabilities;\n }\n\n if (providers) {\n appConfig.providers = providers;\n }\n\n if (email) {\n appConfig.email = {\n ...appConfig.email,\n ...email,\n };\n }\n\n if (providerConfigurations) {\n appConfig.providerConfigurations = providerConfigurations;\n }\n\n appConfig.jwt = {\n ...appConfig.jwt,\n publicKey: {\n ...appConfig.jwt.publicKey,\n ...publicKeys,\n },\n rotatedPublicKeys: {\n ...(appConfig.jwt.rotatedPublicKeys ?? {}),\n ...rotatedPublicKeys,\n },\n // Slice 3.3 hardening (F-24, Slice 3 closeout): operator-authored\n // `serviceAuth` TTLs are AUTHORITATIVE — they overwrite any\n // locally authored values in `saas-config.backend.ts`. The\n // dogfood backend no longer hardcodes the\n // `jwt.{accessTokenExpirationMinutes, refreshTokenExpirationDays}`\n // block, and any future redeclaration is intentionally ignored\n // at sign time so that `wildo.infra.<env>.config.ts` stays the\n // single source of truth for the user-auth TTL policy.\n //\n // After Slice 3 closeout these fields are REQUIRED on the\n // bootstrap response (`AppBootstrapConfigMetadataResponseSchema.jwt`),\n // so the prior conditional-spread defensive pattern is gone.\n // The schema-level requirement is the gate; if an older\n // apps-manager violates the contract it fails parse(), not\n // sign-time.\n accessTokenExpirationMinutes,\n refreshTokenExpirationDays,\n };\n\n this.logDebug('Bootstrap config metadata merged from apps-manager', {\n appSlug,\n hasAppIdentity: !!appIdentity,\n frontendServiceCount: Object.keys(frontendServices ?? {}).length,\n minionCount: Object.keys(minions ?? {}).length,\n workerCount: Object.keys(workers ?? {}).length,\n engineCapabilityCount: Object.keys(engineCapabilities ?? {}).length,\n hasProviderScopes: !!providers,\n providerConfigurationCount: Object.keys(providerConfigurations ?? {}).length,\n jwtKeyCount: Object.keys(appConfig.jwt.publicKey).length,\n });\n\n return { appSlug };\n };\n\n try {\n return await this.executeWithRetryWhenEnabled(fetchOperation, 'fetchAndMergeBootstrapConfigMetadata');\n } catch (error) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: 'Failed to fetch bootstrap config metadata from apps-manager',\n serviceName: this.serviceName,\n applicationEnv: this.applicationEnvConfig.APPLICATION_ENV,\n failureMode: AppsManagerFetchFailureMode.FAIL_FAST,\n error: describeCaughtError(error),\n },\n });\n }\n }\n\n protected async loadPlatformManagedSecrets(): Promise<AppConfigurationSecrets> {\n const loadSecretsOperation = async (): Promise<AppConfigurationSecrets> => {\n this.logDebug('Loading platform managed secrets', { url: this.appsSecretUrlPath });\n const response = await this.axiosInstance.get<AppConfigurationSecrets>(this.appsSecretUrlPath);\n\n if(response.status !== 200) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, { context: { message: 'Failed to load platform managed secrets', response: response.data, status: response.status } });\n }\n\n const apiParsingSchema = ResourcesConfigOperationsDtosBuilderUtils.createApiParsingSchema(AppConfigurationSecrets_Schema);\n const secrets = apiParsingSchema.parse(response.data);\n this.logDebug('Platform managed secrets loaded successfully');\n\n return secrets;\n };\n\n try {\n return await this.executeWithRetryWhenEnabled(loadSecretsOperation, 'loadPlatformManagedSecrets');\n } catch (error) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: 'Failed to load platform managed secrets',\n serviceName: this.serviceName,\n applicationEnv: this.applicationEnvConfig.APPLICATION_ENV,\n failureMode: this.getAppsManagerFetchFailureMode(AppsManagerFetchKind.PLATFORM_MANAGED_SECRETS),\n status: error.status ?? undefined,\n response: error.response?.data ?? undefined,\n error: describeCaughtError(error)\n }\n });\n }\n }\n\n private parseBootstrapConfigMetadataResponse(\n data: unknown,\n ): {\n appSlug: string;\n appIdentity?: AppConfiguration['appIdentity'];\n frontendServices?: AppConfiguration['frontendServices'];\n minions?: AppConfiguration['minions'];\n workers?: AppConfiguration['workers'];\n engineCapabilities?: AppConfiguration['engineCapabilities'];\n providers?: AppConfiguration['providers'];\n email?: Pick<\n AppConfiguration['email'],\n 'isTransactionalWildoManaged' \| 'isMarketingWildoManaged'\n >;\n providerConfigurations?: AppConfiguration['providerConfigurations'];\n publicKeys: Record<string, string>;\n rotatedPublicKeys: Record<string, Array<{ kid: string; publicKey: string; notAfter?: Date }>>;\n /* Slice 3 closeout: required on the bootstrap response, never undefined here. /\n accessTokenExpirationMinutes: number;\n refreshTokenExpirationDays: number;\n } {\n const response = AppBootstrapConfigMetadataResponseSchema.parse(data);\n const appSlug = response.appSlug.trim();\n if (!appSlug) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: 'Apps-manager config response is missing appSlug',\n },\n });\n }\n\n const jwtBlock = response.jwt;\n const publicKeys = jwtBlock?.publicKey;\n if (!jwtBlock \|\| !publicKeys \|\| Object.keys(publicKeys).length === 0) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: 'Apps-manager config response is missing jwt.publicKey entries',\n appSlug,\n },\n });\n }\n if (!publicKeys[JwtPrivateKeys.APPLICATION_AUTH_TOKEN]?.trim()) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: `Apps-manager config response is missing jwt.publicKey.${JwtPrivateKeys.APPLICATION_AUTH_TOKEN}`,\n appSlug,\n },\n });\n }\n // Slice 3 closeout: when `jwt` is present (which the publicKey\n // guard above proves), the schema also guarantees both TTL fields.\n // The narrowing here lets the return value drop `\| undefined`.\n\n return {\n appSlug,\n appIdentity: response.appIdentity as AppConfiguration['appIdentity'] \| undefined,\n frontendServices: response.frontendServices as AppConfiguration['frontendServices'] \| undefined,\n // The cast here narrows our locally-parsed shape to\n // `AppConfiguration['minions']` (defined in\n // `app-config.backend.schemas.ts`). The two shapes MUST stay\n // aligned — when adding a field to `AppConfiguration_MinionsSchema`,\n // mirror it on the local response schema above so the wire field\n // survives Zod's \"strip unknown\" semantics. KD-12's `mode` /\n // `schedule` fields are the documented precedent.\n minions: response.minions as AppConfiguration['minions'] \| undefined,\n workers: response.workers as AppConfiguration['workers'] \| undefined,\n engineCapabilities: response.engineCapabilities as AppConfiguration['engineCapabilities'] \| undefined,\n providers: response.providers as AppConfiguration['providers'] \| undefined,\n email: response.email,\n providerConfigurations: response.providerConfigurations as AppConfiguration['providerConfigurations'] \| undefined,\n publicKeys,\n rotatedPublicKeys: jwtBlock.rotatedPublicKeys ?? {},\n accessTokenExpirationMinutes: jwtBlock.accessTokenExpirationMinutes,\n refreshTokenExpirationDays: jwtBlock.refreshTokenExpirationDays,\n };\n }\n\n private getAppsManagerFetchFailureMode(\n fetchKind: AppsManagerFetchKind,\n ): AppsManagerFetchFailureMode {\n switch (fetchKind) {\n case AppsManagerFetchKind.PLATFORM_MANAGED_SECRETS:\n case AppsManagerFetchKind.BOOTSTRAP_CONFIG_METADATA:\n default:\n return AppsManagerFetchFailureMode.FAIL_FAST;\n }\n }\n\n private shouldRetryInDevelopmentMode(): boolean {\n const isAppManager = this.serviceName === AppConfigurationLoaderService.APP_MANAGER_SERVICE_NAME;\n const isDevelopment = this.applicationEnvConfig.APPLICATION_ENV === RuntimeEnvironment.DEVELOPMENT;\n return !isAppManager && isDevelopment;\n }\n\n private async executeWithRetryWhenEnabled<T>(\n operation: () => Promise<T>,\n operationName: string,\n ): Promise<T> {\n if (this.shouldRetryInDevelopmentMode()) {\n return await this.executeWithRetry(operation, operationName);\n }\n\n return await operation();\n }\n\n private async executeWithRetry<T>(\n operation: () => Promise<T>,\n operationName: string\n ): Promise<T> {\n let lastError: any;\n\n for (let attempt = 1; attempt <= AppConfigurationLoaderService.DEV_RETRY_ATTEMPTS; attempt++) {\n try {\n if (attempt > 1) {\n const delay = Math.min(\n AppConfigurationLoaderService.DEV_BASE_DELAY_MS Math.pow(2, attempt - 2),\n AppConfigurationLoaderService.DEV_MAX_DELAY_MS\n );\n\n this.logDebug(`Retrying ${operationName} - attempt ${attempt}/${AppConfigurationLoaderService.DEV_RETRY_ATTEMPTS} after ${delay}ms delay`, {\n serviceName: this.serviceName,\n attempt,\n delay\n });\n\n await this.delay(delay);\n } else {\n this.logDebug(`Initial attempt for ${operationName} - non-app-manager service in dev mode`, {\n serviceName: this.serviceName,\n totalAttempts: AppConfigurationLoaderService.DEV_RETRY_ATTEMPTS\n });\n }\n\n return await operation();\n\n } catch (error) {\n lastError = error;\n\n if (attempt < AppConfigurationLoaderService.DEV_RETRY_ATTEMPTS) {\n this.logDebug(`Attempt ${attempt} failed for ${operationName}, will retry`, {\n serviceName: this.serviceName,\n attempt,\n error: describeCaughtError(error)\n });\n } else {\n this.logDebug(`All ${AppConfigurationLoaderService.DEV_RETRY_ATTEMPTS} attempts failed for ${operationName}`, {\n serviceName: this.serviceName,\n error: describeCaughtError(error)\n });\n }\n }\n }\n\n throw lastError;\n }\n\n private delay(ms: number): Promise<void> {\n return new Promise(resolve => setTimeout(resolve, ms));\n }\n}\n"]}
1	+ {"version":3,"file":"app-configuration-loader.backend.service.js","sourceRoot":"","sources":["../../../../src/config/services/app-configuration-loader.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,yCAAyC,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAClI,OAAO,EAAE,6BAA6B,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AACjH,OAAO,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC3G,OAAO,EAA2B,8BAA8B,EAAE,MAAM,qEAAqE,CAAC;AAC9I,OAAO,EAAE,cAAc,EAAE,MAAM,wEAAwE,CAAC;AAExG,OAAO,EAAE,wCAAwC,EAAE,uCAAuC,EAAE,mCAAmC,EAAE,MAAM,6DAA6D,CAAC;AACrM,OAAO,EAAE,eAAe,EAAE,MAAM,6DAA6D,CAAC;AAC9F,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,EAAE,2CAA2C,EAAE,MAAM,qEAAqE,CAAC;AAElI,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,iCAAiC,EAAE,MAAM,iEAAiE,CAAC;AACpH,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,KAAwB,MAAM,OAAO,CAAC;AAC7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,6EAA6E,CAAC;AAC9H,OAAO,EAAE,8BAA8B,EAAE,MAAM,kEAAkE,CAAC;AAElH;;;;;;;;;;;;GAYG;AACH,MAAM,+BAA+B,GAAG,WAAW,CAAC;AAEpD,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACnC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;IACH,OAAO,EAAE,4BAA4B,CAAC,QAAQ,EAAE;IAChD,OAAO,EAAE,4BAA4B,CAAC,QAAQ,EAAE;IAChD,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAC1B,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CACH,CAAC,QAAQ,EAAE;IACZ,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,2BAA2B,EAAE,CAAC,CAAC,OAAO,EAAE;QACxC,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE;KACrC,CAAC,CAAC,QAAQ,EAAE;IACb,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtG,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;QACZ,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3C,iBAAiB,EAAE,CAAC,CAAC,MAAM,CACzB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,2EAA2E;YAC3E,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;SACrC,CAAC,CAAC,CACJ,CAAC,QAAQ,EAAE;QACZ,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE;QACxC,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;KACvC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAGI,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;;IAcK;IACa;IAdhD,QAAQ,CAA+D;IACvE,oBAAoB,CAAuB;IAC3C,WAAW,CAAS;IACpB,aAAa,CAAgB;IACtB,iBAAiB,GAAW,QAAQ,GAAG,8BAA8B,CAAC,YAAY,CAAC,uBAAuB,EAAE,CAAC;IAC7G,gBAAgB,GAAW,QAAQ,GAAG,8BAA8B,CAAC,YAAY,CAAC,sBAAsB,EAAE,CAAC;IAEpH,MAAM,CAAU,wBAAwB,GAAG,uBAAuB,CAAC;IACnE,MAAM,CAAU,kBAAkB,GAAG,EAAE,CAAC;IACxC,MAAM,CAAU,iBAAiB,GAAG,IAAI,CAAC;IACzC,MAAM,CAAU,gBAAgB,GAAG,KAAK,CAAC;IAEjD,YAC6C,MAAqB,EACR,YAAwC;QADrD,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAEhG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,+BAA+B,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;IAC1E,CAAC;IAEM,KAAK,CAAC,UAAU;QAQrB,oBAAoB;QACpB,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,6BAA6B,EAAE,CAAC;QACjE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAE1D,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC;YAChC,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,yBAAyB;YAC5D,yFAAyF;YACzF,OAAO,EAAE,+BAA+B;YACxC,OAAO,EAAE;gBACP,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,kBAAkB;gBAClD,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,WAAW;gBAC9C,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,oBAAoB,CAAC,mCAAmC;gBAChG,CAAC,eAAe,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,oBAAoB,CAAC,cAAc;aAC3E;SACF,CAAC,CAAC;QAEH,uDAAuD;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAE5C,6EAA6E;QAC7E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAE3D,0EAA0E;QAC1E,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,oCAAoC,CAAC,SAAS,CAAC,CAAC;QAE/E,OAAO;YACL,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU;YACV,SAAS;YACT,aAAa,EAAE,IAAI,CAAC,oBAAoB,CAAC,cAAc;YACvD,OAAO;SACR,CAAC;IACJ,CAAC;IAES,6BAA6B;QACrC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACvE,IAAI,CAAC,QAAQ,CAAC,wDAAwD,CAAC,CAAC;YACxE,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oFAAoF;YACpF,oFAAoF;YACpF,sFAAsF;YACtF,qFAAqF;YACrF,sFAAsF;YACtF,mFAAmF;YACnF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,OAAO,EAAE,sDAAsD;oBAC/D,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;oBACxC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBAClC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACO,kBAAkB;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,CAAC;QACtC,MAAM,iBAAiB,GAAG,2CAA2C,CAAC;YACpE,cAAc,EAAE,GAAG,CAAC,yBAAyB;YAC7C,yBAAyB,EAAE,GAAG,CAAC,qCAAqC;YACpE,iBAAiB,EAAE,GAAG,CAAC,4BAA4B;SACpD,CAAC,CAAC;QACH,MAAM,2BAA2B,GAC/B,GAAG,CAAC,gCAAgC,CAAC,6BAA6B,CAAC,CAAC;QAEtE,MAAM,UAAU,GAAG,uCAAuC,CAAC;YACzD,gBAAgB,EAAE;gBAChB,GAAG,iBAAiB;gBACpB,GAAG,2BAA2B;aAC/B;YACD,QAAQ,EAAE;gBACR;;;;;;;;;;;mBAWG;gBACH,cAAc,EAAE,GAAG,CAAC,6BAA6B,CAAC,wBAAwB,CAAC,IAAI,2BAA2B;gBAC1G;;;;;;;;;;;;;;mBAcG;gBACH,gBAAgB,EAAE,GAAG,CAAC,6BAA6B,CAAC,kBAAkB,CAAC,IAAI,gBAAgB,CAAC,SAAS;gBACrG;;;;;;;;;;;;;;;;;;mBAkBG;gBACH,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;oBACrB,OAAO,EAAE;wBACP,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,GAAG,CAAC,YAAY;wBACtB,QAAQ,EAAE,GAAG,CAAC,gBAAgB;wBAC9B,QAAQ,EAAE,GAAG,CAAC,gBAAgB,IAAI,eAAe,CAAC,OAAO;wBACzD,OAAO,EAAE;4BACP,WAAW,EAAE,IAAI;4BACjB,CAAC,EAAE,UAAU;4BACb,UAAU,EAAE,OAAO;4BACnB,GAAG,CAAC,GAAG,CAAC,yBAAyB,KAAK,SAAS;gCAC7C,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,yBAAyB,EAAE;gCACrD,CAAC,CAAC,EAAE,CAAC;yBACR;qBACF;iBACF,CAAC,CAAC,CAAC,EAAE,CAAC;gBACP;;;;;;;;mBAQG;gBACH,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;oBACvD,UAAU,EAAE;wBACV,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,GAAG,CAAC,6BAA6B,CAAC,eAAe,CAAC;wBACxD,IAAI,EAAE,GAAG,CAAC,6BAA6B,CAAC,eAAe,CAAC,IAAI,IAAI;wBAChE,YAAY,EAAE,GAAG,CAAC,6BAA6B,CAAC,mBAAmB,CAAC;wBACpE,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,mBAAmB,CAAC;4BACxD,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,6BAA6B,CAAC,mBAAmB,CAAC,EAAE;4BACrE,CAAC,CAAC,EAAE,CAAC;qBACR;iBACF,CAAC,CAAC,CAAC,EAAE,CAAC;gBACP,KAAK,EAAE;oBACL,IAAI,EAAE,GAAG,CAAC,UAAU;oBACpB,IAAI,EAAE,GAAG,CAAC,UAAU;oBACpB,EAAE,EAAE,CAAC;oBACL,0DAA0D;oBAC1D,6DAA6D;oBAC7D,iDAAiD;oBACjD,yDAAyD;oBACzD,sDAAsD;oBACtD,0DAA0D;oBAC1D,2DAA2D;oBAC3D,6DAA6D;oBAC7D,4DAA4D;oBAC5D,GAAG,CAAC,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnF;gBACD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;oBACtB,QAAQ,EAAE;wBACR,IAAI,EAAE,GAAG,CAAC,aAAa;wBACvB,IAAI,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI;wBAC/B,qEAAqE;wBACrE,mEAAmE;wBACnE,mEAAmE;wBACnE,iEAAiE;wBACjE,eAAe;wBACf,EAAE;wBACF,6EAA6E;wBAC7E,qEAAqE;wBACrE,qEAAqE;wBACrE,sEAAsE;wBACtE,kEAAkE;wBAClE,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC7D;iBACF,CAAC,CAAC,CAAC,EAAE,CAAC;aACR;YACD,GAAG,EAAE,EAAE;YACP,4EAA4E;YAC5E,6EAA6E;YAC7E,2EAA2E;YAC3E,8BAA8B;YAC9B,4DAA4D;YAC5D,EAAE;YACF,6EAA6E;YAC7E,uEAAuE;YACvE,2EAA2E;YAC3E,8EAA8E;YAC9E,uCAAuC;YACvC,OAAO,EAAE,mCAAmC,CAAC,GAAG,CAAC;YACjD,yEAAyE;YACzE,iEAAiE;YACjE,8CAA8C;YAC9C,GAAG,wCAAwC,CAAC,GAAG,CAAC;SACjD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,4DAA4D,EAAE;YAC1E,SAAS,EAAE,GAAG,CAAC,YAAY;YAC3B,qBAAqB,EAAE,GAAG,CAAC,yBAAyB;YACpD,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM;SAC7D,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;;;OAQG;IACO,KAAK,CAAC,oCAAoC,CAClD,SAA8D;QAE9D,MAAM,cAAc,GAAG,KAAK,IAAkC,EAAE;YAC9D,IAAI,CAAC,QAAQ,CAAC,sDAAsD,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAErE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,OAAO,EAAE,EAAE,OAAO,EAAE,6DAA6D,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;iBAC7G,CAAC,CAAC;YACL,CAAC;YAED,MAAM,EACJ,OAAO,EACP,WAAW,EACX,gBAAgB,EAChB,OAAO,EACP,OAAO,EACP,kBAAkB,EAClB,SAAS,EACT,KAAK,EACL,sBAAsB,EACtB,UAAU,EACV,iBAAiB,EACjB,4BAA4B,EAC5B,0BAA0B,GAC3B,GAAG,IAAI,CAAC,oCAAoC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAE7D,IAAI,WAAW,EAAE,CAAC;gBAChB,SAAS,CAAC,WAAW,GAAG,WAAW,CAAC;YACtC,CAAC;YAED,IAAI,gBAAgB,EAAE,CAAC;gBACrB,SAAS,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;YAChD,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBACZ,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC;YAC9B,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBACZ,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC;YAC9B,CAAC;YAED,IAAI,kBAAkB,EAAE,CAAC;gBACvB,SAAS,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;YACpD,CAAC;YAED,IAAI,SAAS,EAAE,CAAC;gBACd,SAAS,CAAC,SAAS,GAAG,SAAS,CAAC;YAClC,CAAC;YAED,IAAI,KAAK,EAAE,CAAC;gBACV,SAAS,CAAC,KAAK,GAAG;oBAChB,GAAG,SAAS,CAAC,KAAK;oBAClB,GAAG,KAAK;iBACT,CAAC;YACJ,CAAC;YAED,IAAI,sBAAsB,EAAE,CAAC;gBAC3B,SAAS,CAAC,sBAAsB,GAAG,sBAAsB,CAAC;YAC5D,CAAC;YAED,SAAS,CAAC,GAAG,GAAG;gBACd,GAAG,SAAS,CAAC,GAAG;gBAChB,SAAS,EAAE;oBACT,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS;oBAC1B,GAAG,UAAU;iBACd;gBACD,iBAAiB,EAAE;oBACjB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;oBAC1C,GAAG,iBAAiB;iBACrB;gBACD,kEAAkE;gBAClE,4DAA4D;gBAC5D,2DAA2D;gBAC3D,0CAA0C;gBAC1C,mEAAmE;gBACnE,+DAA+D;gBAC/D,+DAA+D;gBAC/D,uDAAuD;gBACvD,EAAE;gBACF,0DAA0D;gBAC1D,uEAAuE;gBACvE,6DAA6D;gBAC7D,wDAAwD;gBACxD,2DAA2D;gBAC3D,aAAa;gBACb,4BAA4B;gBAC5B,0BAA0B;aAC3B,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,oDAAoD,EAAE;gBAClE,OAAO;gBACP,cAAc,EAAE,CAAC,CAAC,WAAW;gBAC7B,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,MAAM;gBAChE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM;gBAC9C,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM;gBAC9C,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,MAAM;gBACnE,iBAAiB,EAAE,CAAC,CAAC,SAAS;gBAC9B,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,MAAM;gBAC5E,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM;aACzD,CAAC,CAAC;YAEH,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,2BAA2B,CAAC,cAAc,EAAE,sCAAsC,CAAC,CAAC;QACxG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,OAAO,EAAE,6DAA6D;oBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,cAAc,EAAE,IAAI,CAAC,oBAAoB,CAAC,eAAe;oBACzD,WAAW,EAAE,+BAA+B;oBAC5C,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBAClC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAES,KAAK,CAAC,0BAA0B;QACxC,MAAM,oBAAoB,GAAG,KAAK,IAAsC,EAAE;YACxE,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;YACnF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAA0B,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAE/F,IAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChM,CAAC;YAED,MAAM,gBAAgB,GAAG,yCAAyC,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,CAAC;YAC1H,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACtD,IAAI,CAAC,QAAQ,CAAC,8CAA8C,CAAC,CAAC;YAE9D,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,2BAA2B,CAAC,oBAAoB,EAAE,4BAA4B,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,OAAO,EAAE,yCAAyC;oBAClD,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,cAAc,EAAE,IAAI,CAAC,oBAAoB,CAAC,eAAe;oBACzD,WAAW,EAAE,+BAA+B;oBAC5C,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,SAAS;oBACjC,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,SAAS;oBAC3C,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBAClC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,oCAAoC,CAC1C,IAAa;QAoBb,MAAM,QAAQ,GAAG,wCAAwC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,OAAO,EAAE,iDAAiD;iBAC3D;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC;QAC9B,MAAM,UAAU,GAAG,QAAQ,EAAE,SAAS,CAAC;QACvC,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,OAAO,EAAE,+DAA+D;oBACxE,OAAO;iBACR;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,OAAO,EAAE;oBACP,OAAO,EAAE,yDAAyD,cAAc,CAAC,sBAAsB,EAAE;oBACzG,OAAO;iBACR;aACF,CAAC,CAAC;QACL,CAAC;QACD,+DAA+D;QAC/D,mEAAmE;QACnE,+DAA+D;QAE/D,OAAO;YACL,OAAO;YACP,WAAW,EAAE,QAAQ,CAAC,WAA0D;YAChF,gBAAgB,EAAE,QAAQ,CAAC,gBAAoE;YAC/F,4EAA4E;YAC5E,4FAA4F;YAC5F,uFAAuF;YACvF,qFAAqF;YACrF,mFAAmF;YACnF,mFAAmF;YACnF,EAAE;YACF,6FAA6F;YAC7F,6FAA6F;YAC7F,oCAAoC;YACpC,8FAA8F;YAC9F,2EAA2E;YAC3E,OAAO,EAAE,QAAQ,CAAC,OAAkD;YACpE,OAAO,EAAE,QAAQ,CAAC,OAAkD;YACpE,kBAAkB,EAAE,QAAQ,CAAC,kBAAwE;YACrG,SAAS,EAAE,QAAQ,CAAC,SAAsD;YAC1E,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,sBAAsB,EAAE,QAAQ,CAAC,sBAAgF;YACjH,UAAU;YACV,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,IAAI,EAAE;YACnD,4BAA4B,EAAE,QAAQ,CAAC,4BAA4B;YACnE,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B;SAChE,CAAC;IACJ,CAAC;IAIO,4BAA4B;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,KAAK,+BAA6B,CAAC,wBAAwB,CAAC;QACjG,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,eAAe,KAAK,kBAAkB,CAAC,WAAW,CAAC;QACnG,OAAO,CAAC,YAAY,IAAI,aAAa,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,2BAA2B,CACvC,SAA2B,EAC3B,aAAqB;QAErB,IAAI,IAAI,CAAC,4BAA4B,EAAE,EAAE,CAAC;YACxC,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,SAA2B,EAC3B,aAAqB;QAErB,IAAI,SAAc,CAAC;QAEnB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,+BAA6B,CAAC,kBAAkB,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7F,IAAI,CAAC;gBACH,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;oBAChB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,+BAA6B,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,EAC1E,+BAA6B,CAAC,gBAAgB,CAC/C,CAAC;oBAEF,IAAI,CAAC,QAAQ,CAAC,YAAY,aAAa,cAAc,OAAO,IAAI,+BAA6B,CAAC,kBAAkB,UAAU,KAAK,UAAU,EAAE;wBACzI,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,OAAO;wBACP,KAAK;qBACN,CAAC,CAAC;oBAEH,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC1B,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,QAAQ,CAAC,uBAAuB,aAAa,wCAAwC,EAAE;wBAC1F,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,aAAa,EAAE,+BAA6B,CAAC,kBAAkB;qBAChE,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO,MAAM,SAAS,EAAE,CAAC;YAE3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,GAAG,KAAK,CAAC;gBAElB,IAAI,OAAO,GAAG,+BAA6B,CAAC,kBAAkB,EAAE,CAAC;oBAC/D,IAAI,CAAC,QAAQ,CAAC,WAAW,OAAO,eAAe,aAAa,cAAc,EAAE;wBAC1E,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,OAAO;wBACP,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;qBAClC,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,QAAQ,CAAC,OAAO,+BAA6B,CAAC,kBAAkB,wBAAwB,aAAa,EAAE,EAAE;wBAC5G,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;qBAClC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,SAAS,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,EAAU;QACtB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;;AAnkBU,6BAA6B;IADzC,UAAU,EAAE;IAeR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCADI,aAAa;QACM,0BAA0B;GAfvF,6BAA6B,CAokBzC","sourcesContent":["/*\n Application Configuration Loader Service\n \n Loads application configuration through a layered chain (T5):\n * 1. Parse env vars (identity, database addresses, platform URLs)\n * 2. Build the minimal pre-override AppConfiguration skeleton\n * 3. Inject env-sourced database/runtime config into that skeleton\n * 4. Fetch reduced managed config metadata from apps-manager\n * 5. Merge managed app identity/frontend/engine-capability defaults plus JWT keys\n * 6. Return config for developer overrides (applied by AppConfigurationService)\n \n Secrets are still fully fetched from apps-manager (separate endpoint).\n /\n\nimport { injectable, inject } from 'inversify';\nimport { z } from 'zod';\nimport { ErrorType, ResourcesConfigOperationsDtosBuilderUtils, RuntimeEnvironment, WildoHeaderKeys } from '@wildo-ai/saas-models';\nimport { ApplicationBackendDataEnvKeys, ApplicationBackendRuntimeEnvKeys } from '@wildo-ai/platform-core-shared';\nimport { AdminAppManagedMinionsSchema, AdminAppManagedWorkersSchema } from '@wildo-ai/platform-config-lib';\nimport { AppConfigurationSecrets, AppConfigurationSecrets_Schema } from '~wildo-backend-lib/config/models/app-config-secrets.backend.schemas';\nimport { JwtPrivateKeys } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport type { AppConfiguration, AppConfiguration_PreOverrideSeed } from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport { buildFileServicesTopologyFromEnvironment, buildMinimalPreOverrideAppConfiguration, buildStorageTopologyFromEnvironment } from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport { MongoDBProtocol } from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport { DEFAULT_PERSISTENCE_ADAPTER, ResourceIdFormat } from '@wildo-ai/saas-models';\nimport { buildPlatformRuntimeEndpointsFromBackendEnv } from '~wildo-backend-lib/config/models/runtime-topology.backend.contracts';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ApplicationEnvConfig } from '~wildo-backend-lib/config/models/app-env-config.backend.schemas';\nimport { ApplicationEnvConfigurationSchema } from '~wildo-backend-lib/config/models/app-env-config.backend.schemas';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport axios, { AxiosInstance } from 'axios';\nimport { APPS_MANAGER_REQUEST_TIMEOUT_MS } from '~wildo-backend-lib/config/models/apps-manager-transport.backend.definitions';\nimport { API_ROUTES_BACKEND_DEFINITIONS } from '~wildo-backend-lib/requests/models/api-routes.backend.defintions';\n\n/\n Every apps-manager fetch fails fast, and that is the whole policy (#502).\n \n This was an `AppsManagerFetchFailureMode` enum with one member and a resolver whose every switch\n * arm returned it — an abstraction expressing a choice that does not exist. Collapsed to a constant\n * because the value is still worth carrying in the error context: an operator reading a configuration\n * failure wants to know the loader gave up rather than degraded.\n \n If a second mode is ever wanted — a cached-config fallback, a degraded boot — it comes back as a\n * real decision about what an application may run WITHOUT, not as a vocabulary waiting for a second\n * member. Bootstrap configuration is the wrong place to be permissive: an application that boots on\n * stale or absent config is one whose behaviour nobody can reason about.\n /\nconst APPS_MANAGER_FETCH_FAILURE_MODE = 'fail_fast';\n\nconst AppBootstrapConfigMetadataResponseSchema = z.object({\n appSlug: z.string().min(1),\n appIdentity: z.unknown().optional(),\n frontendServices: z.unknown().optional(),\n /\n The managed runtime inventories are the PRODUCER's schemas, imported — never re-declared here.\n \n ## Why these two fields, alone in this object, come from `@wildo-ai/platform-config-lib`\n \n Until 2026-09-09 both blocks were written out by hand at this site, as a copy of\n * `AdminAppManagedMinionsSchema` / `AdminAppManagedWorkersSchema`, with a comment instructing the\n * next author to keep the copy in step. That instruction failed twice, in the only way this class\n * of defect ever fails: Zod strips what a schema does not declare, so a field added on the\n * platform side and not mirrored here was not rejected, it was DELETED from the payload between\n * the wire and the application.\n \n - `mode` / `schedule` (KD-12): the loader's copy declared only `resourceAccess`, so\n * `extractMinionTickCronJobs()` never observed `mode === 'cron'` and the entire MINION_TICK\n * CronJob registration was dead in production while apps-manager sent the data correctly.\n * - `platformAccess` (R4/R5): added on the platform side later, stripped here identically, until\n * someone noticed and widened the copy again.\n \n Neither incident produced an error, a failing test, or a log line — which is precisely why a\n * comment asking for vigilance was the wrong mechanism. The import removes the copy.\n \n ## Why importing is safe, and is not a new dependency\n \n `engine/saas-backend-lib` already declares `@wildo-ai/platform-config-lib` as a hard\n * `dependencies` edge (`package.json`), and `app-config.backend.schemas.ts` already imports\n * runtime VALUES from its package root. The module holding these schemas is re-exported by that\n * same root, so this import adds no module to any graph that was not already loaded.\n \n It also cannot tighten what the wire accepts, which is the risk worth naming. The PRODUCER —\n * `apps-to-manager.apps-manager.platform.controller.ts` — parses the payload it serves through\n * `AppBootstrapConfigMetadataResponseSchema`, which is built out of these very schemas. A\n * consumer parsing with the producer's own schema can reject nothing the producer can emit. The\n * differences all run the permissive way: `WorkerHttpSchema` DEFAULTS `port` / `healthPath` /\n * `readyPath` where the hand copy required them.\n \n The dev companion (`companion-platform-config.companion.ts`) has always parsed this response\n * with the platform's schema. This hop was the only consumer of the contract that did not.\n /\n minions: AdminAppManagedMinionsSchema.optional(),\n workers: AdminAppManagedWorkersSchema.optional(),\n engineCapabilities: z.record(\n z.string(),\n z.object({\n enabled: z.boolean(),\n required: z.boolean().optional(),\n }),\n ).optional(),\n providers: z.unknown().optional(),\n email: z.object({\n isTransactionalWildoManaged: z.boolean(),\n isMarketingWildoManaged: z.boolean(),\n }).optional(),\n providerConfigurations: z.record(z.string(), z.record(z.string(), z.unknown()).optional()).default({}),\n jwt: z.object({\n publicKey: z.record(z.string(), z.string()),\n rotatedPublicKeys: z.record(\n z.string(),\n z.array(z.object({\n kid: z.string().min(1),\n publicKey: z.string().min(1),\n /* Preserve platform-owned retirement bounds through bootstrap parsing. /\n notAfter: z.coerce.date().optional(),\n })),\n ).optional(),\n accessTokenExpirationMinutes: z.number(),\n refreshTokenExpirationDays: z.number(),\n }).optional(),\n});\n\n@injectable()\nexport class AppConfigurationLoaderService {\n protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n protected applicationEnvConfig: ApplicationEnvConfig;\n protected serviceName: string;\n protected axiosInstance: AxiosInstance;\n private readonly appsSecretUrlPath: string = \"api/v1\" + API_ROUTES_BACKEND_DEFINITIONS.APPS_MANAGER.GET_APPLICATION_SECRETS();\n private readonly appConfigUrlPath: string = \"api/v1\" + API_ROUTES_BACKEND_DEFINITIONS.APPS_MANAGER.GET_APPLICATION_CONFIG();\n\n private static readonly APP_MANAGER_SERVICE_NAME = \"platform_apps_manager\";\n private static readonly DEV_RETRY_ATTEMPTS = 10;\n private static readonly DEV_BASE_DELAY_MS = 1000;\n private static readonly DEV_MAX_DELAY_MS = 10000;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private errorBuilder: ErrorBuilderBackendService\n ) {\n this.logDebug = this.logger.debugByType('AppConfigurationLoaderService');\n this.logger.setDebugTypeLogging('AppConfigurationLoaderService', false);\n }\n\n public async initialize(): Promise<{\n applicationEnvConfig: ApplicationEnvConfig;\n serviceName: string;\n appSecrets: AppConfigurationSecrets;\n appConfig: AppConfiguration_PreOverrideSeed;\n applicationId: string;\n appSlug: string;\n }> {\n // 1. Parse env vars\n this.applicationEnvConfig = this.loadPlatformEnvironmentConfig();\n this.serviceName = this.applicationEnvConfig.SERVICE_NAME;\n\n this.axiosInstance = axios.create({\n baseURL: this.applicationEnvConfig.PLATFORM_APPS_MANAGER_URL,\n // `axios` defaults to `timeout: 0` — no deadline. Measured on axios@1.13.5, not assumed.\n timeout: APPS_MANAGER_REQUEST_TIMEOUT_MS,\n headers: {\n [WildoHeaderKeys.CONTENT_TYPE]: 'application/json',\n [WildoHeaderKeys.SERVICE_ID]: this.serviceName,\n [WildoHeaderKeys.PLATFORM_SECRET]: this.applicationEnvConfig.PLATFORM_APPLICATION_PRIMARY_SECRET,\n [WildoHeaderKeys.APPLICATION_ID]: this.applicationEnvConfig.APPLICATION_ID,\n },\n });\n\n // 2. Build base config from Zod defaults + env overlay\n const appConfig = this.buildConfigFromEnv();\n\n // 3. Fetch secrets (full payload — credentials are always from apps-manager)\n const appSecrets = await this.loadPlatformManagedSecrets();\n\n // 4. Fetch reduced managed config metadata from apps-manager and merge it\n const { appSlug } = await this.fetchAndMergeBootstrapConfigMetadata(appConfig);\n\n return {\n applicationEnvConfig: this.applicationEnvConfig,\n serviceName: this.serviceName,\n appSecrets,\n appConfig,\n applicationId: this.applicationEnvConfig.APPLICATION_ID,\n appSlug,\n };\n }\n\n protected loadPlatformEnvironmentConfig(): ApplicationEnvConfig {\n try {\n const envConfig = ApplicationEnvConfigurationSchema.parse(process.env);\n this.logDebug('Platform environment configuration loaded successfully');\n return envConfig;\n } catch (error) {\n // The caught error is the ONLY evidence of what actually failed here, and it is not\n // necessarily a Zod validation failure: anything thrown while evaluating the schema\n // (module-init/TDZ seams under native ESM) surfaces through the same catch. Reporting\n // only `processEnvKeys` produced a startup log that named a validation failure while\n // the env in fact parsed cleanly, which sent diagnosis down the wrong layer entirely.\n // Mirror the sibling catches in this service and always describe the caught error.\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: 'Platform environment configuration validation failed',\n processEnvKeys: Object.keys(process.env),\n error: describeCaughtError(error),\n },\n });\n }\n }\n\n /\n Build the minimal pre-override AppConfiguration skeleton, then inject\n * database and runtime config from environment variables.\n \n This replaces the old pattern of fetching the full config from apps-manager.\n * The loader only authors env/runtime material plus the narrow structural\n * placeholders required before developer overrides run.\n \n A minimal seed provides required top-level sections so the shared schema can\n * materialize nested defaults before developer overrides run. Developer\n * overrides still replace these placeholders with app-specific values.\n /\n protected buildConfigFromEnv(): AppConfiguration_PreOverrideSeed {\n const env = this.applicationEnvConfig;\n const platformEndpoints = buildPlatformRuntimeEndpointsFromBackendEnv({\n appsManagerUrl: env.PLATFORM_APPS_MANAGER_URL,\n crontabsBatchesManagerUrl: env.PLATFORM_CRONTABS_BATCHES_MANAGER_URL,\n moduleRegistryUrl: env.PLATFORM_MODULE_REGISTRY_URL,\n });\n const applicationRuntimeEndpoints =\n env[ApplicationBackendRuntimeEnvKeys.APPLICATION_RUNTIME_ENDPOINTS];\n\n const baseConfig = buildMinimalPreOverrideAppConfiguration({\n runtimeEndpoints: {\n ...platformEndpoints,\n ...applicationRuntimeEndpoints,\n },\n database: {\n /\n DECLARED by the environment, no longer hard-coded.\n \n This literal was `PersistenceAdapter.MONGODB`, which made the whole PostgreSQL adapter\n * unreachable through any supported boot path: no env var, secret or bootstrap value could\n * select it, so the only way to exercise it was a test reaching into the config object. That\n * is why no application had ever booted on PostgreSQL, and it is a much narrower gap than\n * \"PostgreSQL is unfinished\" — the adapter, planner, repository and (now) the DDL were all\n * ready; nothing could ASK for them.\n \n The env key defaults to MONGODB, so a deployment that does not author it is unchanged.\n /\n defaultAdapter: env[ApplicationBackendDataEnvKeys.DATABASE_DEFAULT_ADAPTER] ?? DEFAULT_PERSISTENCE_ADAPTER,\n /\n DECLARED by the environment, no longer hard-coded — and still NOT derived from the\n * adapter above.\n \n The literal that was here said \"declared, not derived\" while being neither: nothing could\n * state it, so the engine's own rule was true in the schema and unreachable in practice. An\n * application selecting PostgreSQL had no supported way to say which identity format it\n * mints, which is the second half of the same gap `DATABASE_DEFAULT_ADAPTER` closed.\n \n Deriving it from `defaultAdapter` remains rejected, and the schema's JSDoc records what\n * that cost: moving a resource between adapters silently changed the shape of every id it\n * minted, and made every id it had ALREADY minted fail `validateForResource`.\n \n The env key defaults to `OBJECT_ID`, so a deployment that does not author it is unchanged.\n /\n resourceIdFormat: env[ApplicationBackendDataEnvKeys.RESOURCE_ID_FORMAT] ?? ResourceIdFormat.OBJECT_ID,\n /\n Built ONLY when the environment supplies an address — the exact shape `postgresql` below\n * has always had, and for the reason its own JSDoc gives.\n \n Until 2026-08-28 this branch was UNCONDITIONAL, so `database.mongodb.enabled` was `true`\n * on every runtime that has ever existed, with `host` simply `undefined` when no mongod was\n * within reach. That left the flag unable to answer the only question anyone asks of it —\n * does this runtime have a MongoDB? — and reproduced exactly the defect the PostgreSQL\n * branch was written to avoid: it passes the registry's boot check and then fails at the\n * first connection, which is the wrong place to learn about it.\n \n Met on `wonder-crm` (PostgreSQL on both planes, no mongod declared): its readiness gate\n * probed a MongoDB it does not have, so `/health/ready` could never become ready.\n \n The compiler offers no protection here — this package builds with `strict: false`, so an\n * absent branch produces no access error at any reader. The readers were enumerated by hand\n * instead, and `MongoDBService.connect` now refuses with a named configuration error rather\n * than a bare TypeError.\n /\n ...(env.MONGODB_HOST ? {\n mongodb: {\n enabled: true,\n host: env.MONGODB_HOST,\n database: env.MONGODB_DATABASE,\n protocol: env.MONGODB_PROTOCOL ?? MongoDBProtocol.MONGODB,\n options: {\n retryWrites: true,\n w: 'majority',\n authSource: 'admin',\n ...(env.MONGODB_DIRECT_CONNECTION !== undefined\n ? { directConnection: env.MONGODB_DIRECT_CONNECTION }\n : {}),\n },\n },\n } : {}),\n /\n Built ONLY when the environment supplies an address.\n \n Absence is what keeps `postgresql.enabled` false — a branch with `enabled: true` and no\n * host would pass the registry's boot check (\"is the declared adapter enabled?\") and then\n * fail at the first connection, which is the wrong place to learn about it. Credentials are\n * NOT read here: `PostgreSQLDatabaseBackendService` takes them from\n * `secrets.database.postgresql`, matching how MongoDB splits address from credential.\n /\n ...(env[ApplicationBackendDataEnvKeys.POSTGRESQL_HOST] ? {\n postgresql: {\n enabled: true,\n host: env[ApplicationBackendDataEnvKeys.POSTGRESQL_HOST],\n port: env[ApplicationBackendDataEnvKeys.POSTGRESQL_PORT] ?? 5432,\n databaseName: env[ApplicationBackendDataEnvKeys.POSTGRESQL_DATABASE],\n ...(env[ApplicationBackendDataEnvKeys.POSTGRESQL_SSL_MODE]\n ? { sslMode: env[ApplicationBackendDataEnvKeys.POSTGRESQL_SSL_MODE] }\n : {}),\n },\n } : {}),\n redis: {\n host: env.REDIS_HOST,\n port: env.REDIS_PORT,\n db: 0,\n // Slice 3.6 + 2026-05-26 ACL-alignment fix — when the app\n // authored `wildo.saas.config.dataServices.redis.keyPrefix`,\n // the env var `REDIS_KEY_PREFIX` threads it into\n // `config.database.redis.keyPrefix`. When the env var is\n // unset, we deliberately leave the field undefined so\n // `RedisService.connect()` falls back to the slug-derived\n // default `<appSlug>:` — the only default that aligns with\n // the per-app ACL grant `~<appSlug>:`. The previous literal\n // schema default `'saas:'` was removed for the same reason.\n ...(env.REDIS_KEY_PREFIX !== undefined ? { keyPrefix: env.REDIS_KEY_PREFIX } : {}),\n },\n ...(env.RABBITMQ_HOST ? {\n rabbitmq: {\n host: env.RABBITMQ_HOST,\n port: env.RABBITMQ_PORT ?? 5672,\n // Slice 2.5c-3 — per-app vhost isolation. The field is threaded ONLY\n // when the operator authored `backingServices.rabbitmq.vhost`; the\n // key stays absent otherwise so the adapter applies its documented\n // default-vhost (`/`) fallback rather than receiving an explicit\n // `undefined`.\n //\n // The `database` branch is env-owned: `fetchAndMergeBootstrapConfigMetadata`\n // deliberately never re-authors it, so this seed is the ONLY path by\n // which an authored vhost can reach `RabbitMQAdapterBackendService`.\n // Dropping it here (as this mapping previously did) made the authored\n // vhost a silent no-op — see the matching note on the env schema.\n ...(env.RABBITMQ_VHOST ? { vhost: env.RABBITMQ_VHOST } : {}),\n },\n } : {}),\n },\n jwt: {},\n // Object-storage TOPOLOGY, injected here for the same reason `database` is:\n // this seed is the one place environment material becomes configuration, and\n // routing storage through it removes the last app-tier subsystem that read\n // `process.env` directly. See\n // `.claude/plans/application-runtime-topology-delivery.md`.\n //\n // Each block is emitted ONLY when its defining value is present, and that is\n // load-bearing rather than tidy: the storage provider treats a missing\n // connection as UNCONFIGURED, so seeding a plausible default would disable\n // the file feature silently instead of failing loudly — the failure mode this\n // subsystem has already produced once.\n storage: buildStorageTopologyFromEnvironment(env),\n // Same contract as `storage`, one derivation over: the scanning sidecars\n // are platform-injected topology, and this seed is the one place\n // environment material becomes configuration.\n ...buildFileServicesTopologyFromEnvironment(env),\n });\n\n this.logDebug('Built pre-override config seed from env/bootstrap material', {\n mongoHost: env.MONGODB_HOST,\n mongoDirectConnection: env.MONGODB_DIRECT_CONNECTION,\n platformEndpointCount: Object.keys(platformEndpoints).length,\n });\n\n return baseConfig;\n }\n\n /*\n Fetch reduced bootstrap metadata from apps-manager.\n * This keeps apps-manager authoritative for selected app-managed declaration\n * fields without letting it re-author env/bootstrap runtime branches.\n \n Policy:\n * - fail-fast after the retry window is exhausted\n * - development mode only changes retry behavior, not the final failure mode\n /\n protected async fetchAndMergeBootstrapConfigMetadata(\n appConfig: AppConfiguration \| AppConfiguration_PreOverrideSeed,\n ): Promise<{ appSlug: string }> {\n const fetchOperation = async (): Promise<{ appSlug: string }> => {\n this.logDebug('Fetching bootstrap config metadata from apps-manager');\n const response = await this.axiosInstance.get(this.appConfigUrlPath);\n\n if (response.status !== 200) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: { message: 'Failed to fetch bootstrap config metadata from apps-manager', status: response.status },\n });\n }\n\n const {\n appSlug,\n appIdentity,\n frontendServices,\n minions,\n workers,\n engineCapabilities,\n providers,\n email,\n providerConfigurations,\n publicKeys,\n rotatedPublicKeys,\n accessTokenExpirationMinutes,\n refreshTokenExpirationDays,\n } = this.parseBootstrapConfigMetadataResponse(response.data);\n\n if (appIdentity) {\n appConfig.appIdentity = appIdentity;\n }\n\n if (frontendServices) {\n appConfig.frontendServices = frontendServices;\n }\n\n if (minions) {\n appConfig.minions = minions;\n }\n\n if (workers) {\n appConfig.workers = workers;\n }\n\n if (engineCapabilities) {\n appConfig.engineCapabilities = engineCapabilities;\n }\n\n if (providers) {\n appConfig.providers = providers;\n }\n\n if (email) {\n appConfig.email = {\n ...appConfig.email,\n ...email,\n };\n }\n\n if (providerConfigurations) {\n appConfig.providerConfigurations = providerConfigurations;\n }\n\n appConfig.jwt = {\n ...appConfig.jwt,\n publicKey: {\n ...appConfig.jwt.publicKey,\n ...publicKeys,\n },\n rotatedPublicKeys: {\n ...(appConfig.jwt.rotatedPublicKeys ?? {}),\n ...rotatedPublicKeys,\n },\n // Slice 3.3 hardening (F-24, Slice 3 closeout): operator-authored\n // `serviceAuth` TTLs are AUTHORITATIVE — they overwrite any\n // locally authored values in `saas-config.backend.ts`. The\n // dogfood backend no longer hardcodes the\n // `jwt.{accessTokenExpirationMinutes, refreshTokenExpirationDays}`\n // block, and any future redeclaration is intentionally ignored\n // at sign time so that `wildo.infra.<env>.config.ts` stays the\n // single source of truth for the user-auth TTL policy.\n //\n // After Slice 3 closeout these fields are REQUIRED on the\n // bootstrap response (`AppBootstrapConfigMetadataResponseSchema.jwt`),\n // so the prior conditional-spread defensive pattern is gone.\n // The schema-level requirement is the gate; if an older\n // apps-manager violates the contract it fails parse(), not\n // sign-time.\n accessTokenExpirationMinutes,\n refreshTokenExpirationDays,\n };\n\n this.logDebug('Bootstrap config metadata merged from apps-manager', {\n appSlug,\n hasAppIdentity: !!appIdentity,\n frontendServiceCount: Object.keys(frontendServices ?? {}).length,\n minionCount: Object.keys(minions ?? {}).length,\n workerCount: Object.keys(workers ?? {}).length,\n engineCapabilityCount: Object.keys(engineCapabilities ?? {}).length,\n hasProviderScopes: !!providers,\n providerConfigurationCount: Object.keys(providerConfigurations ?? {}).length,\n jwtKeyCount: Object.keys(appConfig.jwt.publicKey).length,\n });\n\n return { appSlug };\n };\n\n try {\n return await this.executeWithRetryWhenEnabled(fetchOperation, 'fetchAndMergeBootstrapConfigMetadata');\n } catch (error) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: 'Failed to fetch bootstrap config metadata from apps-manager',\n serviceName: this.serviceName,\n applicationEnv: this.applicationEnvConfig.APPLICATION_ENV,\n failureMode: APPS_MANAGER_FETCH_FAILURE_MODE,\n error: describeCaughtError(error),\n },\n });\n }\n }\n\n protected async loadPlatformManagedSecrets(): Promise<AppConfigurationSecrets> {\n const loadSecretsOperation = async (): Promise<AppConfigurationSecrets> => {\n this.logDebug('Loading platform managed secrets', { url: this.appsSecretUrlPath });\n const response = await this.axiosInstance.get<AppConfigurationSecrets>(this.appsSecretUrlPath);\n\n if(response.status !== 200) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, { context: { message: 'Failed to load platform managed secrets', response: response.data, status: response.status } });\n }\n\n const apiParsingSchema = ResourcesConfigOperationsDtosBuilderUtils.createApiParsingSchema(AppConfigurationSecrets_Schema);\n const secrets = apiParsingSchema.parse(response.data);\n this.logDebug('Platform managed secrets loaded successfully');\n\n return secrets;\n };\n\n try {\n return await this.executeWithRetryWhenEnabled(loadSecretsOperation, 'loadPlatformManagedSecrets');\n } catch (error) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: 'Failed to load platform managed secrets',\n serviceName: this.serviceName,\n applicationEnv: this.applicationEnvConfig.APPLICATION_ENV,\n failureMode: APPS_MANAGER_FETCH_FAILURE_MODE,\n status: error.status ?? undefined,\n response: error.response?.data ?? undefined,\n error: describeCaughtError(error)\n }\n });\n }\n }\n\n private parseBootstrapConfigMetadataResponse(\n data: unknown,\n ): {\n appSlug: string;\n appIdentity?: AppConfiguration['appIdentity'];\n frontendServices?: AppConfiguration['frontendServices'];\n minions?: AppConfiguration['minions'];\n workers?: AppConfiguration['workers'];\n engineCapabilities?: AppConfiguration['engineCapabilities'];\n providers?: AppConfiguration['providers'];\n email?: Pick<\n AppConfiguration['email'],\n 'isTransactionalWildoManaged' \| 'isMarketingWildoManaged'\n >;\n providerConfigurations?: AppConfiguration['providerConfigurations'];\n publicKeys: Record<string, string>;\n rotatedPublicKeys: Record<string, Array<{ kid: string; publicKey: string; notAfter?: Date }>>;\n /* Slice 3 closeout: required on the bootstrap response, never undefined here. /\n accessTokenExpirationMinutes: number;\n refreshTokenExpirationDays: number;\n } {\n const response = AppBootstrapConfigMetadataResponseSchema.parse(data);\n const appSlug = response.appSlug.trim();\n if (!appSlug) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: 'Apps-manager config response is missing appSlug',\n },\n });\n }\n\n const jwtBlock = response.jwt;\n const publicKeys = jwtBlock?.publicKey;\n if (!jwtBlock \|\| !publicKeys \|\| Object.keys(publicKeys).length === 0) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: 'Apps-manager config response is missing jwt.publicKey entries',\n appSlug,\n },\n });\n }\n if (!publicKeys[JwtPrivateKeys.APPLICATION_AUTH_TOKEN]?.trim()) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: `Apps-manager config response is missing jwt.publicKey.${JwtPrivateKeys.APPLICATION_AUTH_TOKEN}`,\n appSlug,\n },\n });\n }\n // Slice 3 closeout: when `jwt` is present (which the publicKey\n // guard above proves), the schema also guarantees both TTL fields.\n // The narrowing here lets the return value drop `\| undefined`.\n\n return {\n appSlug,\n appIdentity: response.appIdentity as AppConfiguration['appIdentity'] \| undefined,\n frontendServices: response.frontendServices as AppConfiguration['frontendServices'] \| undefined,\n // The cast crosses the two schemas that describe this block: the platform's\n // `AdminAppManagedMinionsSchema` (what the wire carries, and what the response schema above\n // now parses with) and the engine's `AppConfiguration_MinionsSchema` (what the running\n // application holds). It is a cast rather than an assignment because the second is a\n // `strictObject` typed against a named interface for the TS7056 reason recorded on\n // `AppConfiguration_MinionEntry` — collapsing the two would put that ceiling back.\n //\n // What used to sit here was an instruction to hand-mirror a third copy at this site whenever\n // either schema grew, and that instruction failed twice in production. The two survivors are\n // now held in step MECHANICALLY, by\n // `config/__tests__/managed-runtime-inventory-parity.backend.test.ts`, which fails on a field\n // present in one and absent in the other. Do not restore a hand copy here.\n minions: response.minions as AppConfiguration['minions'] \| undefined,\n workers: response.workers as AppConfiguration['workers'] \| undefined,\n engineCapabilities: response.engineCapabilities as AppConfiguration['engineCapabilities'] \| undefined,\n providers: response.providers as AppConfiguration['providers'] \| undefined,\n email: response.email,\n providerConfigurations: response.providerConfigurations as AppConfiguration['providerConfigurations'] \| undefined,\n publicKeys,\n rotatedPublicKeys: jwtBlock.rotatedPublicKeys ?? {},\n accessTokenExpirationMinutes: jwtBlock.accessTokenExpirationMinutes,\n refreshTokenExpirationDays: jwtBlock.refreshTokenExpirationDays,\n };\n }\n\n\n\n private shouldRetryInDevelopmentMode(): boolean {\n const isAppManager = this.serviceName === AppConfigurationLoaderService.APP_MANAGER_SERVICE_NAME;\n const isDevelopment = this.applicationEnvConfig.APPLICATION_ENV === RuntimeEnvironment.DEVELOPMENT;\n return !isAppManager && isDevelopment;\n }\n\n private async executeWithRetryWhenEnabled<T>(\n operation: () => Promise<T>,\n operationName: string,\n ): Promise<T> {\n if (this.shouldRetryInDevelopmentMode()) {\n return await this.executeWithRetry(operation, operationName);\n }\n\n return await operation();\n }\n\n private async executeWithRetry<T>(\n operation: () => Promise<T>,\n operationName: string\n ): Promise<T> {\n let lastError: any;\n\n for (let attempt = 1; attempt <= AppConfigurationLoaderService.DEV_RETRY_ATTEMPTS; attempt++) {\n try {\n if (attempt > 1) {\n const delay = Math.min(\n AppConfigurationLoaderService.DEV_BASE_DELAY_MS Math.pow(2, attempt - 2),\n AppConfigurationLoaderService.DEV_MAX_DELAY_MS\n );\n\n this.logDebug(`Retrying ${operationName} - attempt ${attempt}/${AppConfigurationLoaderService.DEV_RETRY_ATTEMPTS} after ${delay}ms delay`, {\n serviceName: this.serviceName,\n attempt,\n delay\n });\n\n await this.delay(delay);\n } else {\n this.logDebug(`Initial attempt for ${operationName} - non-app-manager service in dev mode`, {\n serviceName: this.serviceName,\n totalAttempts: AppConfigurationLoaderService.DEV_RETRY_ATTEMPTS\n });\n }\n\n return await operation();\n\n } catch (error) {\n lastError = error;\n\n if (attempt < AppConfigurationLoaderService.DEV_RETRY_ATTEMPTS) {\n this.logDebug(`Attempt ${attempt} failed for ${operationName}, will retry`, {\n serviceName: this.serviceName,\n attempt,\n error: describeCaughtError(error)\n });\n } else {\n this.logDebug(`All ${AppConfigurationLoaderService.DEV_RETRY_ATTEMPTS} attempts failed for ${operationName}`, {\n serviceName: this.serviceName,\n error: describeCaughtError(error)\n });\n }\n }\n }\n\n throw lastError;\n }\n\n private delay(ms: number): Promise<void> {\n return new Promise(resolve => setTimeout(resolve, ms));\n }\n}\n"]}

package/dist/esm/config/services/app-configuration.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"app-configuration.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/config/services/app-configuration.backend.service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAEL,gBAAgB,EAChB,KAAK,gCAAgC,EAEtC,MAAM,6DAA6D,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,qEAAqE,CAAC;AAC9G,OAAO,EAAE,6BAA6B,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,EACL,KAAK,gCAAgC,EAGtC,MAAM,0EAA0E,CAAC;AAClF,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,uCAAuC,EAE7C,MAAM,4EAA4E,CAAC;AAGpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAIL,kBAAkB,EAIlB,kBAAkB,EAElB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAG9G;;;;;;;;;;;;GAYG;AACH,qBACa,uBAAuB;IAaG,OAAO,CAAC,MAAM;IACD,OAAO,CAAC,YAAY;IACjB,OAAO,CAAC,aAAa;IAd1E,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACjF,OAAO,CAAC,OAAO,CAAiC;IAChD,OAAO,CAAC,kBAAkB,CAAiD;IAC3E,OAAO,CAAC,2BAA2B,CAA8C;IACjF,OAAO,CAAC,wCAAwC,CAAwD;IACxG,OAAO,CAAC,QAAQ,CAAwC;IACxD,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,eAAe,CAAmC;IAC1D,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAuB;gBAGM,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACrC,aAAa,EAAE,6BAA6B;IAMzG;;OAEG;IACU,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBxC;;;;;;;;OAQG;IACI,4BAA4B,CAAC,OAAO,EAAE;QAC3C,MAAM,EAAE,gBAAgB,CAAC;QACzB,OAAO,EAAE,uBAAuB,CAAC;QACjC,aAAa,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE,kBAAkB,CAAC;QACnC,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,kBAAkB,CAAC,EAAE,gBAAgB,GAAG,gCAAgC,CAAC;QACzE,sBAAsB,CAAC,EAAE,OAAO,CAAC;KAClC,GAAG,IAAI;IA2ER;;;OAGG;IACI,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI;IAOzE;;;;OAIG;IACI,qCAAqC,CAAC,mBAAmB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;IAM7J;;;OAGG;IACI,kBAAkB,CAAC,mBAAmB,EAAE,MAAM,GAAG,OAAO;IAM/D;;;;OAIG;IACI,sCAAsC,CAAC,mBAAmB,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAWzF;;;;;;;;OAQG;IACI,sCAAsC,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAc9E;;;;;OAKG;IACI,iCAAiC,IAAI,MAAM,GAAG,IAAI;IAYzD,OAAO,CAAC,4BAA4B;IAiDpC,OAAO,CAAC,yBAAyB;IA2CjC,OAAO,CAAC,8BAA8B;IAsBtC,OAAO,CAAC,yBAAyB;IAejC;;;;;OAKG;IACI,aAAa,IAAI,OAAO;IAI/B;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,sCAAsC,CAAiD;IAE/F,IAAW,qCAAqC,IAAI,sBAAsB,GAAG,SAAS,CAErF;IAEM,0CAA0C,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI;IAIxF,IAAW,MAAM,IAAI,gBAAgB,CAMpC;IAED;;;;;;;;;;;;;OAaG;IACI,mBAAmB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;IAQtE;;;;;;;;;;;;;;OAcG;IACI,uBAAuB,IAAI,MAAM,GAAG,SAAS;IAepD;;;;;;;;;;;;OAYG;IACI,0BAA0B,IAAI,MAAM,GAAG,SAAS;IAKvD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACI,6BAA6B,CAAC,IAAI,EAAE,kBAAkB,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAgBxG;;;;;;;;;;;;;;;;;OAiBG;IACI,2BAA2B,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;IAiB9E,IAAW,OAAO,IAAI,uBAAuB,CAK5C;IAED,IAAW,aAAa,IAAI,MAAM,CAKjC;IAED,IAAW,cAAc,IAAI,kBAAkB,CAK9C;IAED,IAAW,WAAW,IAAI,MAAM,CAK/B;IAED;;;;;;;;;OASG;IACH,IAAW,OAAO,IAAI,MAAM,CAkB3B;IAED;;;OAGG;IACI,kBAAkB,CAAC,aAAa,EAAE,gCAAgC,GAAG,IAAI;IAkChF;;;;;;OAMG;IACI,oBAAoB,CAAC,eAAe,EAAE,uBAAuB,GAAG,IAAI;~~IAoCpE~~,4BAA4B,CAAC,mBAAmB,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS;IAIpG,yHAAyH;IAClH,0CAA0C,IAAI,uCAAuC,GAAG,IAAI;IAInG;;;OAGG;IACI,+BAA+B,IAAI,IAAI;IAoB9C,OAAO,CAAC,mBAAmB;IA0B3B;;OAEG;IACH,IAAW,SAAS,IAAI;QACtB,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,EAAE,uBAAuB,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAA;KACpD,CAKA;IAED,uEAAuE;IACvE,IAAW,wBAAwB,IAAI,OAAO,CAI7C;CAEF"}
1	+ {"version":3,"file":"app-configuration.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/config/services/app-configuration.backend.service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAEL,gBAAgB,EAChB,KAAK,gCAAgC,EAEtC,MAAM,6DAA6D,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,qEAAqE,CAAC;AAC9G,OAAO,EAAE,6BAA6B,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,EACL,KAAK,gCAAgC,EAGtC,MAAM,0EAA0E,CAAC;AAClF,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,uCAAuC,EAE7C,MAAM,4EAA4E,CAAC;AAGpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAIL,kBAAkB,EAIlB,kBAAkB,EAElB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAG9G;;;;;;;;;;;;GAYG;AACH,qBACa,uBAAuB;IAaG,OAAO,CAAC,MAAM;IACD,OAAO,CAAC,YAAY;IACjB,OAAO,CAAC,aAAa;IAd1E,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACjF,OAAO,CAAC,OAAO,CAAiC;IAChD,OAAO,CAAC,kBAAkB,CAAiD;IAC3E,OAAO,CAAC,2BAA2B,CAA8C;IACjF,OAAO,CAAC,wCAAwC,CAAwD;IACxG,OAAO,CAAC,QAAQ,CAAwC;IACxD,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,eAAe,CAAmC;IAC1D,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAuB;gBAGM,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACrC,aAAa,EAAE,6BAA6B;IAMzG;;OAEG;IACU,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBxC;;;;;;;;OAQG;IACI,4BAA4B,CAAC,OAAO,EAAE;QAC3C,MAAM,EAAE,gBAAgB,CAAC;QACzB,OAAO,EAAE,uBAAuB,CAAC;QACjC,aAAa,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE,kBAAkB,CAAC;QACnC,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,kBAAkB,CAAC,EAAE,gBAAgB,GAAG,gCAAgC,CAAC;QACzE,sBAAsB,CAAC,EAAE,OAAO,CAAC;KAClC,GAAG,IAAI;IA2ER;;;OAGG;IACI,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI;IAOzE;;;;OAIG;IACI,qCAAqC,CAAC,mBAAmB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;IAM7J;;;OAGG;IACI,kBAAkB,CAAC,mBAAmB,EAAE,MAAM,GAAG,OAAO;IAM/D;;;;OAIG;IACI,sCAAsC,CAAC,mBAAmB,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAWzF;;;;;;;;OAQG;IACI,sCAAsC,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAc9E;;;;;OAKG;IACI,iCAAiC,IAAI,MAAM,GAAG,IAAI;IAYzD,OAAO,CAAC,4BAA4B;IAiDpC,OAAO,CAAC,yBAAyB;IA2CjC,OAAO,CAAC,8BAA8B;IAsBtC,OAAO,CAAC,yBAAyB;IAejC;;;;;OAKG;IACI,aAAa,IAAI,OAAO;IAI/B;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,sCAAsC,CAAiD;IAE/F,IAAW,qCAAqC,IAAI,sBAAsB,GAAG,SAAS,CAErF;IAEM,0CAA0C,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI;IAIxF,IAAW,MAAM,IAAI,gBAAgB,CAMpC;IAED;;;;;;;;;;;;;OAaG;IACI,mBAAmB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;IAQtE;;;;;;;;;;;;;;OAcG;IACI,uBAAuB,IAAI,MAAM,GAAG,SAAS;IAepD;;;;;;;;;;;;OAYG;IACI,0BAA0B,IAAI,MAAM,GAAG,SAAS;IAKvD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACI,6BAA6B,CAAC,IAAI,EAAE,kBAAkB,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAgBxG;;;;;;;;;;;;;;;;;OAiBG;IACI,2BAA2B,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;IAiB9E,IAAW,OAAO,IAAI,uBAAuB,CAK5C;IAED,IAAW,aAAa,IAAI,MAAM,CAKjC;IAED,IAAW,cAAc,IAAI,kBAAkB,CAK9C;IAED,IAAW,WAAW,IAAI,MAAM,CAK/B;IAED;;;;;;;;;OASG;IACH,IAAW,OAAO,IAAI,MAAM,CAkB3B;IAED;;;OAGG;IACI,kBAAkB,CAAC,aAAa,EAAE,gCAAgC,GAAG,IAAI;IAkChF;;;;;;OAMG;IACI,oBAAoB,CAAC,eAAe,EAAE,uBAAuB,GAAG,IAAI;IA2DpE,4BAA4B,CAAC,mBAAmB,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS;IAIpG,yHAAyH;IAClH,0CAA0C,IAAI,uCAAuC,GAAG,IAAI;IAInG;;;OAGG;IACI,+BAA+B,IAAI,IAAI;IAoB9C,OAAO,CAAC,mBAAmB;IA0B3B;;OAEG;IACH,IAAW,SAAS,IAAI;QACtB,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,EAAE,uBAAuB,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAA;KACpD,CAKA;IAED,uEAAuE;IACvE,IAAW,wBAAwB,IAAI,OAAO,CAI7C;CAEF"}

package/dist/esm/config/services/app-configuration.backend.service.js CHANGED Viewed

@@ -625,7 +625,23 @@ let AppConfigurationService = class AppConfigurationService {
                 },
             });
         }
-        const artifact = ProviderRuntimeArtifactSchema.parse(providerRuntime);
+        const parsed = ProviderRuntimeArtifactSchema.safeParse(providerRuntime);
+        if (!parsed.success) {
+            // The artifact is GENERATED from the authored config by `wildo config sync`, so a parse
+            // failure here is almost always a stale artifact meeting a newer contract (#328 added the
+            // provider identity to every frontend entry). A raw Zod issue list reads as a logic defect
+            // in the backend; the remedy is regeneration, so name it (staleness-presents-as-a-logic-defect).
+            throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.CONFIGURATION,
+                context: {
+                    message: 'The generated provider runtime artifact does not satisfy the current contract — it was most likely '
+                        + 'generated before the contract changed. Regenerate it with `wildo config sync` and restart. '
+                        + `Issues: ${parsed.error.issues.map((issue) => `${issue.path.join('.')}: ${issue.message}`).join('; ')}`,
+                    issues: parsed.error.issues,
+                },
+            });
+        }
+        const artifact = parsed.data;
         this._frontendProviderBootstraps = artifact.frontendProviderBootstraps ?? {};
         this._providerRuntimeArtifactEvidenceMetadata = Object.freeze({
             sourceDigest: artifact.sourceDigest,
@@ -638,6 +654,12 @@ let AppConfigurationService = class AppConfigurationService {
                 scopes: {
                     backend: artifact.scope,
                 },
+                // Carried forward rather than defaulted, because this assignment REPLACES the whole providers
+                // block. The artifact supplies the backend's resolved scope and knows nothing about the
+                // application's connection policy, so rebuilding the block from it alone would silently drop
+                // a declared `providers.connections` — and the symptom would be a provider becoming
+                // connectable at scopes the application had deliberately switched off.
+                connections: baseConfig.providers?.connections ?? {},
             },
         };
         this.logDebug('Applied generated provider runtime module', {

package/dist/esm/config/services/app-configuration.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"app-configuration.backend.service.js","sourceRoot":"","sources":["../../../../../src/config/services/app-configuration.backend.service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EACL,2CAA2C,EAG3C,uBAAuB,EACxB,MAAM,6DAA6D,CAAC;AAErE,OAAO,EAAE,6BAA6B,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,EAEL,0BAA0B,EAC1B,wCAAwC,GACzC,MAAM,0EAA0E,CAAC;AAClF,OAAO,EAGL,6BAA6B,GAC9B,MAAM,4EAA4E,CAAC;AAEpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EACL,2BAA2B,EAC3B,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,2BAA2B,EAC3B,6BAA6B,EAC7B,iBAAiB,GAOlB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAG9G;;;;;;;;;;;;GAYG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAaW;IACa;IACG;IAdnD,QAAQ,CAA+D;IACzE,OAAO,GAA4B,IAAI,CAAC;IACxC,kBAAkB,GAA4C,IAAI,CAAC;IACnE,2BAA2B,GAA2C,EAAE,CAAC;IACzE,wCAAwC,GAAmD,IAAI,CAAC;IAChG,QAAQ,GAAmC,IAAI,CAAC;IAChD,cAAc,GAAkB,IAAI,CAAC;IACrC,eAAe,GAA8B,IAAI,CAAC;IAClD,YAAY,GAAkB,IAAI,CAAC;IACnC,QAAQ,GAAkB,IAAI,CAAC;IAEvC,YAC6C,MAAqB,EACR,YAAwC,EACrC,aAA4C;QAF5D,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QACrC,kBAAa,GAAb,aAAa,CAA+B;QAEvG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,UAAU;QACrB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,2CAA2C,CAAC,CAAC;YAC3D,IAAI,CAAC,2BAA2B,GAAG,EAAE,CAAC;YACtC,IAAI,CAAC,wCAAwC,GAAG,IAAI,CAAC;YACrD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,oBAAoB,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;YACnI,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC;YACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC;YAC3B,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;YACpC,IAAI,CAAC,eAAe,GAAG,oBAAoB,CAAC,eAAe,CAAC;YAC5D,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;YAChC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;YAExB,IAAI,CAAC,QAAQ,CAAC,oDAAoD,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACI,4BAA4B,CAAC,OAUnC;QACC,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,iEAAiE;oBAC1E,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,iGAAiG;wBACjG,uCAAuC;oBACzC,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;YACnE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,+FAA+F;wBAC/F,gEAAgE;oBAClE,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC/B,MAAM,kBAAkB,GAAG,wCAAwC,CACjE,OAAO,CAAC,kBAAkB,EAC1B,OAAO,CAAC,MAAM,CACf,CAAC;YACF,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACP,OAAO,EACL,oFAAoF,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;wBAC3H,WAAW,EAAE,OAAO,CAAC,WAAW;wBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;qBACrC;iBACF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7E,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4EAA4E,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACpH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC;QAChC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAE/B,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE;YACvC,MAAM,EAAE,UAAU;YAClB,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;SAC3C,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACI,qBAAqB,CAAC,QAAgB;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,SAAS;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC9C,OAAO,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACI,qCAAqC,CAAC,mBAA2B,EAAE,QAAgB;QACxF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAC9C,OAAO,SAAS,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,eAAe,EAAE,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC9F,CAAC;IAED;;;OAGG;IACI,kBAAkB,CAAC,mBAA2B;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,gBAAgB;YAAE,OAAO,KAAK,CAAC;QAC/C,OAAO,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACI,sCAAsC,CAAC,mBAA2B;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,qBAAqB,GAAG,SAAS,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;QAC9E,IAAI,CAAC,qBAAqB,EAAE,eAAe;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;QACtE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC9B,OAAO,CAAC,YAAY,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACnD,CAAC;IAED;;;;;;;;OAQG;IACI,sCAAsC,CAAC,QAAgB;QAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAE9C,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,KAAK,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtG,MAAM,KAAK,GAAG,qBAAqB,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,IAAI,KAAK,CAAC,SAAS;gBAAE,OAAO,mBAAmB,CAAC;YAChD,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ;gBAAE,QAAQ,GAAG,mBAAmB,CAAC;QAC9D,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACI,iCAAiC;QACtC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAE9C,KAAK,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtG,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC/F,IAAI,UAAU;gBAAE,OAAO,mBAAmB,CAAC;QAC7C,CAAC;QACD,MAAM,wBAAwB,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,OAAO,wBAAwB,IAAI,IAAI,CAAC;IAC1C,CAAC;IAEO,4BAA4B,CAAC,MAAwB;QAC3D,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC;QAClE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAErD,KAAK,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC5F,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC1E,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;wBACrE,OAAO,EAAE;4BACP,OAAO,EAAE,oBAAoB,mBAAmB,iDAAiD,QAAQ,KAAK;gCAC5G,0BAA0B,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;yBAC3D;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC5D,KAAK,MAAM,CAAC,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAC9D,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;oBAC3C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;4BACrE,OAAO,EAAE;gCACP,OAAO,EAAE,kDAAkD,QAAQ,KAAK;oCACtE,0BAA0B,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;6BAC3D;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YACD,KAAK,MAAM,CAAC,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxD,MAAM,QAAQ,GAAG,WAAW,CAAC,qBAAqB,EAAE,QAAQ,CAAC;gBAC7D,IAAI,QAAQ,EAAE,CAAC;oBACb,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;wBAC1B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;4BACzB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gCACrE,OAAO,EAAE;oCACP,OAAO,EAAE,+DAA+D,EAAE,KAAK;wCAC7E,kCAAkC,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iCAClE;6BACF,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,yBAAyB,CAAC,MAAwB;QACxD,IAAI,MAAM,CAAC,IAAI,EAAE,iBAAiB,KAAK,KAAK,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mJAAmJ,CACpJ,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC;YAC9B,IAAI,IAAI,EAAE,wBAAwB,KAAK,IAAI,EAAE,CAAC;gBAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qDAAqD,WAAW,4DAA4D,CAC7H,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,EAAE,oBAAoB,KAAK,IAAI,EAAE,CAAC;gBACxC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mDAAmD,WAAW,wDAAwD,CACvH,CAAC;YACJ,CAAC;YACD,IAAI,WAAW,CAAC,gBAAgB,IAAI,WAAW,CAAC,gBAAgB,KAAK,OAAO,EAAE,CAAC;gBAC7E,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4DAA4D,WAAW,CAAC,gBAAgB,8CAA8C,WAAW,IAAI,CACtJ,CAAC;YACJ,CAAC;YAED,IAAI,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;gBAC9B,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC;gBACpD,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAAC;gBACrD,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;oBACpD,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;oBAC3C,IAAI,WAAW,KAAK,SAAS;wBAAE,OAAO,KAAK,CAAC;oBAC5C,IAAI,OAAO,WAAW,KAAK,SAAS;wBAAE,OAAO,WAAW,CAAC;oBACzD,OAAO,WAAW,CAAC,OAAO,CAAC;gBAC7B,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gDAAgD,WAAW,8BAA8B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,iEAAiE,CACnL,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,8BAA8B,CAAC,MAAwB;QAC7D,MAAM,gBAAgB,GAAa,EAAE,CAAC;QAEtC,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,KAAK,2CAA2C,CAAC,OAAO,EAAE,CAAC;YACvF,gBAAgB,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,KAAK,2CAA2C,CAAC,OAAO,EAAE,CAAC;YACvF,gBAAgB,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,2CAA2C,CAAC,aAAa,EAAE,CAAC;YACnG,gBAAgB,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,2CAA2C,CAAC,WAAW,EAAE,CAAC;YAC/F,gBAAgB,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,2CAA2C,CAAC,SAAS,EAAE,CAAC;YAChF,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAEO,yBAAyB,CAAC,UAAmB;QACnD,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CACjC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAC;YACjC,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;YACrF,OAAO,EAAE;gBACP,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,aAAa,EAAE,IAAI,CAAC,cAAc;gBAClC,cAAc,EAAE,IAAI,CAAC,eAAe;gBACpC,OAAO,EAAE,mDAAmD,UAAU,IAAI,QAAQ,2BAA2B;aAC9G;SACF,CAEF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,aAAa;QAClB,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;IACzD,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,sCAAsC,GAAuC,SAAS,CAAC;IAE/F,IAAW,qCAAqC;QAC9C,OAAO,IAAI,CAAC,sCAAsC,CAAC;IACrD,CAAC;IAEM,0CAA0C,CAAC,OAA+B;QAC/E,IAAI,CAAC,sCAAsC,GAAG,OAAO,CAAC;IACxD,CAAC;IAED,IAAW,MAAM;QAEf,IAAI,CAAC,IAAI,CAAC,OAAO;YACf,MAAM,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAEjD,OAAO,IAAI,CAAC,OAAQ,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,mBAAmB,CAAC,KAAsB;QAC/C,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1E,OAAO,QAAQ,EAAE,GAAG,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACI,uBAAuB;QAC5B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,mBAAmB,GAAG,IAAI,CAAC,iCAAiC,EAAE,CAAC;QACrE,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,mBAAmB,CAAC,EAAE,SAAS,CAAC;QACpF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,0BAA0B;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,kBAAkB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACI,6BAA6B,CAAC,IAAwB,EAAE,WAAoB;QACjF,MAAM,WAAW,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACtD,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QACnC,kFAAkF;QAClF,IAAI,IAAI,KAAK,kBAAkB,CAAC,GAAG;YAAE,OAAO,WAAW,CAAC;QACxD,MAAM,IAAI,GAAG,GAAG,WAAW,GAAG,6BAA6B,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACjG,kGAAkG;QAClG,gGAAgG;QAChG,kGAAkG;QAClG,qGAAqG;QACrG,uEAAuE;QACvE,mGAAmG;QACnG,6DAA6D;QAC7D,OAAO,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACI,2BAA2B,CAAC,KAAsB;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,sEAAsE;QACtE,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;IAClE,CAAC;IAGD,IAAW,OAAO;QAChB,IAAI,CAAC,IAAI,CAAC,QAAQ;YAChB,MAAM,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC;QAElD,OAAO,IAAI,CAAC,QAAS,CAAC;IACxB,CAAC;IAED,IAAW,aAAa;QACtB,IAAI,CAAC,IAAI,CAAC,cAAc;YACtB,MAAM,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,CAAC;QAExD,OAAO,IAAI,CAAC,cAAe,CAAC;IAC9B,CAAC;IAED,IAAW,cAAc;QACvB,IAAI,CAAC,IAAI,CAAC,eAAe;YACvB,MAAM,IAAI,CAAC,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;QAEzD,OAAO,IAAI,CAAC,eAAgB,CAAC;IAC/B,CAAC;IAED,IAAW,WAAW;QACpB,IAAI,CAAC,IAAI,CAAC,YAAY;YACpB,MAAM,IAAI,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAC;QAEtD,OAAO,IAAI,CAAC,YAAa,CAAC;IAC5B,CAAC;IAED;;;;;;;;;OASG;IACH,IAAW,OAAO;QAChB,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,WAAW,EAAE,IAAI,CAAC,YAAY;oBAC9B,aAAa,EAAE,IAAI,CAAC,cAAc;oBAClC,cAAc,EAAE,IAAI,CAAC,eAAe;oBACpC,OAAO,EAAE,yDAAyD;iBACnE;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;OAGG;IACI,kBAAkB,CAAC,aAA+C;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,kBAAkB,CAAC;QAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,cAAc,GAAG,0BAA0B,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAC7E,MAAM,kBAAkB,GAAG,wCAAwC,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAChG,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,sEAAsE,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;oBAC7G,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,kBAAkB,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,iEAAiE,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACzG,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,cAAkC,EAAE;YAC3D,MAAM,EAAE,gBAAgB;YACxB,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EAAE;YACtC,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;SACrC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACI,oBAAoB,CAAC,eAAwC;QAClE,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,0FAA0F;iBACpG;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,6BAA6B,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACtE,IAAI,CAAC,2BAA2B,GAAG,QAAQ,CAAC,0BAA0B,IAAI,EAAE,CAAC;QAC7E,IAAI,CAAC,wCAAwC,GAAG,MAAM,CAAC,MAAM,CAAC;YAC5D,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,IAAI,IAAI;YACzD,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB,IAAI,IAAI;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,kBAAkB,GAAG;YACxB,GAAG,UAAU;YACb,SAAS,EAAE;gBACT,MAAM,EAAE;oBACN,OAAO,EAAE,QAAQ,CAAC,KAAK;iBACxB;aACF;SACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,2CAA2C,EAAE;YACzD,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CAAC,CAAC;IACL,CAAC;IAEM,4BAA4B,CAAC,mBAA2B;QAC7D,OAAO,IAAI,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,CAAC;IAC/D,CAAC;IAED,yHAAyH;IAClH,0CAA0C;QAC/C,OAAO,IAAI,CAAC,wCAAwC,CAAC;IACvD,CAAC;IAED;;;OAGG;IACI,+BAA+B;QACpC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,yBAAyB,CAAC,iCAAiC,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3E,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACP,OAAO,EACL,gFAAgF,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBAC/G,yFAAyF;aAC5F;SACF,CAAC,CAAC;IACL,CAAC;IAEO,mBAAmB,CACzB,MAAwB,EACxB,OAGC;QAED,MAAM,eAAe,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,eAAe,CAAC;QAC/B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAE/B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,CAAC,4BAA4B,CAAC,eAAe,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE;YAClD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,IAAI,CAAC,QAAQ;SACvB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,IAAW,SAAS;QAIlB,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG;SACnC,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,IAAW,wBAAwB;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC;QAC1C,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,wBAAwB,KAAK,IAAI,CAAC,CAAC;IACzF,CAAC;CAEF,CAAA;AA1vBY,uBAAuB;IADnC,UAAU,EAAE;IAcR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;qCAFC,aAAa;QACM,0BAA0B;QACtB,6BAA6B;GAf9F,uBAAuB,CA0vBnC","sourcesContent":["/*\n Application Configuration Service\n \n Service for managing application-level configuration\n /\n\nimport { injectable, inject } from 'inversify';\nimport {\n APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS,\n AppConfiguration,\n type AppConfiguration_PreOverrideSeed,\n AppConfiguration_Schema\n} from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport { AppConfigurationSecrets } from '~wildo-backend-lib/config/models/app-config-secrets.backend.schemas';\nimport { AppConfigurationLoaderService } from './app-configuration-loader.backend.service';\nimport {\n type AppConfiguration_BackendAuthored,\n applyBackendAuthoredConfig,\n inspectAppConfigurationBoundaryMutations,\n} from '~wildo-backend-lib/config/models/app-config.backend-authored.definitions';\nimport {\n type ProviderRuntimeArtifact,\n type ProviderRuntimeArtifactEvidenceMetadata,\n ProviderRuntimeArtifactSchema,\n} from '~wildo-backend-lib/config/models/provider-runtime-artifact.backend.schemas';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport {\n ErrorCustomMessageReference,\n ErrorType,\n MAIN_API_BASE_PATH,\n ResourceServerKind,\n RESOURCE_SERVER_MOUNT_ROUTE,\n MANUAL_CONTROLLER_ROUTES_URLS,\n resolveBrandAsset,\n RuntimeEnvironment,\n WildoError_Backend,\n type BrandAssetQuery,\n type FrontendProvidersBlock,\n type PersistenceAdapterType,\n type UserTypeAuthPolicy,\n} from '@wildo-ai/saas-models';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\n\n\n/\n Application Configuration Service\n \n Manages complete application configuration. After T5, the loading chain is:\n * 1. Env vars → database addresses, platform URLs\n * 2. Minimal pre-override skeleton → only the structural placeholders the\n * backend must provide before backendConfig is merged\n * 3. Apps-manager fetch → reduced managed metadata + JWT public keys + appSlug\n * 4. App-authored backendConfig → merged onto the runtime/bootstrap seed\n \n This service uses the loader service for steps 1-3, then provides\n * cached, type-safe access to all configuration sections.\n /\n@injectable()\nexport class AppConfigurationService {\n protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n private _config: AppConfiguration \| null = null;\n private _preOverrideConfig: AppConfiguration_PreOverrideSeed \| null = null;\n private _frontendProviderBootstraps: Record<string, FrontendProvidersBlock> = {};\n private _providerRuntimeArtifactEvidenceMetadata: ProviderRuntimeArtifactEvidenceMetadata \| null = null;\n private _secrets: AppConfigurationSecrets \| null = null;\n private _applicationId: string \| null = null;\n private _applicationEnv: RuntimeEnvironment \| null = null;\n private _serviceName: string \| null = null;\n private _appSlug: string \| null = null;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigLoaderService) private loaderService: AppConfigurationLoaderService\n ) {\n this.logDebug = this.logger.debugByType('AppConfigurationService');\n this.logger.setDebugTypeLogging('AppConfigurationService', false);\n }\n\n /\n Initialize the configuration service\n /\n public async initialize(): Promise<void> {\n if (!this._config \|\| !this._secrets) {\n this.logDebug('Initializing application configuration...');\n this._frontendProviderBootstraps = {};\n this._providerRuntimeArtifactEvidenceMetadata = null;\n const { appConfig, appSecrets, applicationId, applicationEnvConfig, serviceName, appSlug } = await this.loaderService.initialize();\n this._preOverrideConfig = appConfig;\n this._secrets = appSecrets;\n this._applicationId = applicationId;\n this._applicationEnv = applicationEnvConfig.APPLICATION_ENV;\n this._serviceName = serviceName;\n this._appSlug = appSlug;\n\n this.logDebug('Application configuration initialized successfully', { appSlug });\n }\n }\n\n /\n Hydrate the service from an already-resolved full configuration object.\n \n Platform startup paths use this when configuration was assembled by another\n * runtime-specific service. Callers must make the ownership decision explicit:\n * either provide a `boundaryBaseConfig` to run the Phase 4 mutation checks, or\n * set `skipBoundaryInspection` when hydrating a platform-owned config that does\n * not go through the tenant backendConfig authoring seam.\n /\n public hydrateResolvedConfiguration(options: {\n config: AppConfiguration;\n secrets: AppConfigurationSecrets;\n applicationId: string;\n applicationEnv: RuntimeEnvironment;\n serviceName: string;\n appSlug: string;\n emitWarnings?: boolean;\n boundaryBaseConfig?: AppConfiguration \| AppConfiguration_PreOverrideSeed;\n skipBoundaryInspection?: boolean;\n }): void {\n const resolvedAppSlug = options.appSlug.trim();\n if (!resolvedAppSlug) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'Resolved application configuration requires a non-empty appSlug',\n serviceName: options.serviceName,\n applicationId: options.applicationId,\n },\n });\n }\n\n if (options.boundaryBaseConfig && options.skipBoundaryInspection) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n 'hydrateResolvedConfiguration cannot accept both boundaryBaseConfig and skipBoundaryInspection. ' +\n 'Choose one ownership mode explicitly.',\n serviceName: options.serviceName,\n applicationId: options.applicationId,\n },\n });\n }\n\n if (!options.boundaryBaseConfig && !options.skipBoundaryInspection) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n 'hydrateResolvedConfiguration requires either boundaryBaseConfig for Phase 4 ownership checks ' +\n 'or skipBoundaryInspection for platform-owned hydrated configs.',\n serviceName: options.serviceName,\n applicationId: options.applicationId,\n },\n });\n }\n\n if (options.boundaryBaseConfig) {\n const boundaryInspection = inspectAppConfigurationBoundaryMutations(\n options.boundaryBaseConfig,\n options.config,\n );\n if (boundaryInspection.errors.length > 0) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Hydrated resolved config attempted to cross platform/runtime-managed boundaries: ${boundaryInspection.errors.join(' ')}`,\n serviceName: options.serviceName,\n applicationId: options.applicationId,\n },\n });\n }\n if ((options.emitWarnings ?? true) && boundaryInspection.warnings.length > 0) {\n this.logger.warn(\n `[Config] hydrated resolved config touched migration-seam runtime fields. ${boundaryInspection.warnings.join(' ')}`,\n );\n }\n }\n\n this._secrets = options.secrets;\n this._applicationId = options.applicationId;\n this._applicationEnv = options.applicationEnv;\n this._serviceName = options.serviceName;\n this._appSlug = resolvedAppSlug;\n this._preOverrideConfig = null;\n\n this.applyResolvedConfig(options.config, {\n reason: 'hydrated',\n emitWarnings: options.emitWarnings ?? true,\n });\n }\n\n /\n W3.1: Get auth policy for a specific user type.\n * Returns the complete per-user-type auth policy, or null if the user type doesn't exist in config.\n /\n public getUserTypeAuthPolicy(userType: string): UserTypeAuthPolicy \| null {\n const appConfig = this._config;\n if (!appConfig?.userTypes) return null;\n const typeDef = appConfig.userTypes[userType];\n return typeDef?.auth ?? null;\n }\n\n /\n Resolve a specific frontend-service user-management entry.\n * Used when runtime flows must enforce surface-level auth/register policy\n * for a known frontend service + user-type combination.\n /\n public getFrontendServiceUserManagementEntry(frontendServiceName: string, userType: string): { register: boolean; auth: boolean; isDefault?: boolean } \| null {\n const appConfig = this._config;\n if (!appConfig?.frontendServices) return null;\n return appConfig.frontendServices[frontendServiceName]?.usersManagement?.[userType] ?? null;\n }\n\n /\n Check whether a frontend service identity is declared in app-owned config.\n * This is the authoritative allow-list used for runtime/public frontend identity.\n /\n public hasFrontendService(frontendServiceName: string): boolean {\n const appConfig = this._config;\n if (!appConfig?.frontendServices) return false;\n return !!appConfig.frontendServices[frontendServiceName];\n }\n\n /\n Resolve user type from the active frontend service identity.\n * Reads `frontendServices[frontendServiceName].usersManagement` and returns\n * the default entry, or the first entry when no explicit default exists.\n /\n public resolveUserTypeFromFrontendServiceName(frontendServiceName: string): string \| null {\n const appConfig = this._config;\n if (!appConfig?.frontendServices) return null;\n const frontendServiceConfig = appConfig.frontendServices[frontendServiceName];\n if (!frontendServiceConfig?.usersManagement) return null;\n const entries = Object.entries(frontendServiceConfig.usersManagement);\n const defaultEntry = entries.find(([, v]) => v.isDefault);\n const firstEntry = entries[0];\n return (defaultEntry ?? firstEntry)?.[0] ?? null;\n }\n\n /\n Reverse lookup: given a user type, find the frontend service where that user type\n * has `isDefault: true` in usersManagement. Falls back to any app type that\n * references the user type (with `auth: true`) if no isDefault match exists.\n \n This is the mirror of `resolveUserTypeFromFrontendServiceName()`:\n * frontendServiceName → userType (forward)\n * userType → frontendServiceName (reverse)\n /\n public resolveFrontendServiceNameFromUserType(userType: string): string \| null {\n const appConfig = this._config;\n if (!appConfig?.frontendServices) return null;\n\n let fallback: string \| null = null;\n for (const [frontendServiceName, frontendServiceConfig] of Object.entries(appConfig.frontendServices)) {\n const entry = frontendServiceConfig.usersManagement[userType];\n if (!entry) continue;\n if (entry.isDefault) return frontendServiceName;\n if (entry.auth && !fallback) fallback = frontendServiceName;\n }\n return fallback;\n }\n\n /\n Find the default frontend service — the first frontend service that has any\n * user type entry with `isDefault: true`. Used as a last-resort fallback\n * when no specific user type context is available (e.g., SAML errors\n * before user identification).\n /\n public resolveDefaultFrontendServiceName(): string \| null {\n const appConfig = this._config;\n if (!appConfig?.frontendServices) return null;\n\n for (const [frontendServiceName, frontendServiceConfig] of Object.entries(appConfig.frontendServices)) {\n const hasDefault = Object.values(frontendServiceConfig.usersManagement).some(v => v.isDefault);\n if (hasDefault) return frontendServiceName;\n }\n const firstFrontendServiceName = Object.keys(appConfig.frontendServices)[0];\n return firstFrontendServiceName ?? null;\n }\n\n private validateEntityIdentityConfig(config: AppConfiguration): void {\n const { userTypes, frontendServices, organizationTypes } = config;\n const userTypeKeys = new Set(Object.keys(userTypes));\n\n for (const [frontendServiceName, frontendServiceConfig] of Object.entries(frontendServices)) {\n for (const userType of Object.keys(frontendServiceConfig.usersManagement)) {\n if (!userTypeKeys.has(userType)) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: `frontendServices.${frontendServiceName}.usersManagement references unknown userType \"${userType}\". ` +\n `userTypes must define: ${[...userTypeKeys].join(', ')}`,\n },\n });\n }\n }\n }\n\n if (organizationTypes) {\n const orgTypeKeys = new Set(Object.keys(organizationTypes));\n for (const [, orgConfig] of Object.entries(organizationTypes)) {\n for (const userType of orgConfig.userTypes) {\n if (!userTypeKeys.has(userType)) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: `organizationTypes references unknown userType \"${userType}\". ` +\n `userTypes must define: ${[...userTypeKeys].join(', ')}`,\n },\n });\n }\n }\n }\n for (const [, userTypeDef] of Object.entries(userTypes)) {\n const orgTypes = userTypeDef.requiresOrgMembership?.orgTypes;\n if (orgTypes) {\n for (const ot of orgTypes) {\n if (!orgTypeKeys.has(ot)) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: `requiresOrgMembership.orgTypes references unknown org type \"${ot}\". ` +\n `organizationTypes must define: ${[...orgTypeKeys].join(', ')}`,\n },\n });\n }\n }\n }\n }\n }\n }\n\n private emitDeferredFieldWarnings(config: AppConfiguration): void {\n if (config.auth?.crossOrgSSOAccess === false) {\n this.logger.info(\n `[Config] crossOrgSSOAccess is disabled — users with enterprise SSO links from one organization will be blocked from SSO into other organizations.`\n );\n }\n\n for (const [userTypeKey, userTypeDef] of Object.entries(config.userTypes)) {\n const auth = userTypeDef.auth;\n if (auth?.anonymousSessionsEnabled === true) {\n this.logger.info(\n `[Config] Anonymous sessions enabled for userType \"${userTypeKey}\" — isAnonymizable resources will support ANONYMOUS scope.`\n );\n }\n if (auth?.oneOffSessionAllowed === true) {\n this.logger.info(\n `[Config] One-off sessions enabled for userType \"${userTypeKey}\" — consumable token links can create scoped sessions.`\n );\n }\n if (userTypeDef.uniqueIdentifier && userTypeDef.uniqueIdentifier !== 'email') {\n this.logger.warn(\n `[Config] uniqueIdentifier only supports \"email\" — value \"${userTypeDef.uniqueIdentifier}\" will be treated as \"email\" for userType \"${userTypeKey}\".`\n );\n }\n\n if (auth?.stepUpAuth?.enabled) {\n const stepUpMethods = auth.stepUpAuth.methods ?? [];\n const enabledMethods = auth.authMethodsEnabled ?? {};\n const hasUsableMethod = stepUpMethods.some((method) => {\n const methodValue = enabledMethods[method];\n if (methodValue === undefined) return false;\n if (typeof methodValue === 'boolean') return methodValue;\n return methodValue.enabled;\n });\n if (!hasUsableMethod) {\n this.logger.warn(\n `[Config] stepUpAuth is enabled for userType \"${userTypeKey}\" but none of its methods [${stepUpMethods.join(', ')}] are enabled in authMethodsEnabled — step-up will always fail.`\n );\n }\n }\n }\n }\n\n private getPreOverridePlaceholderPaths(config: AppConfiguration): string[] {\n const placeholderPaths: string[] = [];\n\n if (config.appIdentity.appName === APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.appName) {\n placeholderPaths.push('appIdentity.appName');\n }\n if (config.appIdentity.version === APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.version) {\n placeholderPaths.push('appIdentity.version');\n }\n if (config.auth.passkeyConfig.rpName === APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.passkeyRpName) {\n placeholderPaths.push('auth.passkeyConfig.rpName');\n }\n if (config.auth.passkeyConfig.rpId === APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.passkeyRpId) {\n placeholderPaths.push('auth.passkeyConfig.rpId');\n }\n if (config.email.from === APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.emailFrom) {\n placeholderPaths.push('email.from');\n }\n\n return placeholderPaths;\n }\n\n private createNotInitializedError(getterName?: string): WildoError_Backend {\n return this.errorBuilder.buildError(\n ErrorType.CONFIGURATION, undefined,{\n customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n context: {\n serviceName: this._serviceName,\n applicationId: this._applicationId,\n applicationEnv: this._applicationEnv,\n message: `Application configuration not initialized : use ${getterName ?? 'getter'} before using the service`\n }\n }\n\n );\n }\n\n /\n Indicates whether the application configuration has been initialized.\n * Returns true only once the final resolved config is available through\n * `config`. A loader-only pre-override seed is not considered initialized for\n * downstream consumers because it still contains unresolved placeholders.\n /\n public isInitialized(): boolean {\n return this._config !== null && this._secrets !== null;\n }\n\n /\n PLATFORM-MODE construction-time default persistence adapter (Phase 5.2/5.3 + review R2).\n \n The one store for the answer \"what adapter does a resource without a declaration resolve\n * to?\" in platform mode, where this service is deliberately unhydrated while repositories are\n * constructed. It lives HERE — not on the repositories registry that historically owned it —\n * because THREE independent resolvers need it and only this service is injected into all of\n * them without a dependency cycle: the repositories-registry resolver (repository\n * construction, the boot door, the schema gate), the services-tier transaction router, and the\n * resource-id/unit-of-work resolver. When the value lived on the registry alone, the other two\n * read hydrated config and agreed with the constructed repositories only at a distance,\n * through the apps-manager env-truth overlay — nothing pinned the agreement.\n \n WRITE only through `RepositoriesRegistryHandlerBackendService.setPlatformModeDefaultPersistenceAdapter`,\n * which owns the conflict guard (a conflicting re-set refuses; a same-value re-set is a legal\n * retried startup phase). This adopt method is the dumb store half on purpose: keeping the\n * guard at the single sanctioned writer keeps it — and its pins — in one place.\n /\n private _platformModeDefaultPersistenceAdapter: PersistenceAdapterType \| undefined = undefined;\n\n public get platformModeDefaultPersistenceAdapter(): PersistenceAdapterType \| undefined {\n return this._platformModeDefaultPersistenceAdapter;\n }\n\n public adoptPlatformModeDefaultPersistenceAdapter(adapter: PersistenceAdapterType): void {\n this._platformModeDefaultPersistenceAdapter = adapter;\n }\n\n public get config(): AppConfiguration {\n\n if (!this._config)\n throw this.createNotInitializedError('config');\n\n return this._config!;\n }\n\n /\n Resolve a servable brand-logo URL for a `(composition[, theme, purpose])`\n * query against the resolved config's `brandAssets` (the CLI-generated,\n * backend-authored runtime projection).\n \n This is the single seam every backend logo consumer (auth-response\n * organization branding, email primary-scope context, ...) should call so\n * the composition/theme/purpose resolution stays consistent instead of each\n * consumer reading a free-form URL. Returns `undefined` when no matching\n * brand asset was generated.\n \n Safe before initialization: returns `undefined` rather than throwing so a\n * consumer building context on a not-yet-resolved config degrades gracefully.\n /\n public resolveBrandLogoUrl(query: BrandAssetQuery): string \| undefined {\n if (!this._config) {\n return undefined;\n }\n const resolved = resolveBrandAsset(this._config.brandAssets ?? [], query);\n return resolved?.url;\n }\n\n /\n Resolve the application's public base URL (`scheme://host[:port]`) used to\n * absolutize app-relative asset/link paths for OUT-OF-APP consumers — most\n * notably email, where a client cannot fetch a same-origin path like\n * `/brand/<ref>.png`.\n \n Source of truth: the DEFAULT frontend service's configured\n * `runtime.endPoints[<service>].publicUrl` (the app's primary frontend URL),\n * trailing slash stripped. This mirrors how notification dashboard/token\n * links resolve their base (`AuthControllerUtils.lookupFrontendPublicUrl`),\n * kept local here so the config layer does not depend on the auth module.\n \n Returns `undefined` pre-initialization, when no default frontend service is\n * resolvable, or when that service has no `publicUrl` configured.\n /\n public resolveAppPublicBaseUrl(): string \| undefined {\n if (!this._config) {\n return undefined;\n }\n const frontendServiceName = this.resolveDefaultFrontendServiceName();\n if (!frontendServiceName) {\n return undefined;\n }\n const publicUrl = this._config.runtime?.endPoints?.[frontendServiceName]?.publicUrl;\n if (!publicUrl) {\n return undefined;\n }\n return publicUrl.replace(/\\/+$/, '');\n }\n\n /\n Canonical audience (RFC 8707 resource indicator) of THIS app's generic API resource\n * server — the `aud` an exchanged machine (client-credentials) access token must carry\n * to be accepted at the resource-operation choke point (external-access D7).\n \n SINGLE SOURCE OF TRUTH: both the request-auth choke point (validation) and the\n * client-credentials token endpoint (minting) resolve the audience through THIS method,\n * so mint and validation cannot drift. Derivation = app public base URL + API mount path.\n * Returns `undefined` (→ fail-closed at the call site) when the public base is unresolvable.\n \n MCP and A2A resource servers carry their OWN canonical audiences (their endpoint URIs),\n * validated inside their own transports — not here.\n /\n public resolveApiResourceAudience(): string \| undefined {\n const base = this.resolveAppPublicBaseUrl();\n return base ? `${base}${MAIN_API_BASE_PATH}` : undefined;\n }\n\n /\n Canonical audience (RFC 8707 resource indicator) of one of this app's OAuth resource\n * servers ({@link ResourceServerKind} — `API` / `A2A` / `MCP`). This is the SINGLE SOURCE\n * OF TRUTH for both MINTING (`aud`) and VALIDATION (each server checks `aud === self`), so an\n * audience-bound token and the surface that consumes it cannot drift.\n \n Derivation: the API audience ({@link resolveApiResourceAudience}) is the base; A2A/MCP append\n * their mount path ({@link RESOURCE_SERVER_MOUNT_ROUTE}). The transports DELEGATE their verify-side\n * audience to THIS method — `A2ABackendService.resolveAgentAudience()` and the MCP controller's\n * `mcpResourceUri()` both return `resolveResourceServerAudience(A2A\|MCP)` — so mint and verify read\n * one function, not three parallel `${apiAudience}${route}` expressions. That is what makes \"cannot\n * drift\" a real guarantee rather than a coincidence. Returns `undefined` (→ fail-closed at the call\n * site) when the app public base URL is unresolvable.\n \n NB (documented follow-up): first-party USER login tokens still carry the legacy `'AUTH_TOKEN'`\n * sentinel audience rather than `resolveResourceServerAudience(API)`. That does NOT weaken the\n * A2A/MCP audience-binding here — a delegated token is `aud`-bound to A2A/MCP and is therefore\n * rejected by the main API (which accepts only `'AUTH_TOKEN'` user tokens or the API-audience\n * machine tokens).\n \n @param instanceRef - optional NAMED instance (multi-MCP / multi-A2A): appends `/<ref>` so each\n * server/agent instance carries its OWN audience. Omit for the DEFAULT (unnamed) surface, which\n * every app always has; `API` ignores it (a single, instance-less resource server).\n /\n public resolveResourceServerAudience(kind: ResourceServerKind, instanceRef?: string): string \| undefined {\n const apiAudience = this.resolveApiResourceAudience();\n if (!apiAudience) return undefined;\n // The API is a single, instance-less resource server — a ref never applies to it.\n if (kind === ResourceServerKind.API) return apiAudience;\n const base = `${apiAudience}${MANUAL_CONTROLLER_ROUTES_URLS[RESOURCE_SERVER_MOUNT_ROUTE[kind]]}`;\n // Multi-instance (multi-MCP / multi-A2A) audience contract: a NAMED server/agent instance appends\n // its ref as a path segment (`…/mcp/<ref>`, `…/a2a/<ref>`), so each instance carries a DISTINCT\n // RFC 8707 audience that its transport validates in isolation — the token-replay boundary between\n // instances. Live since R-2: `ResourceServerInstancesRegistryBackendService` declares the instances,\n // the MCP/A2A controllers resolve `:instanceRef` and pass it here, and\n // `listResourceServerAudiences` enumerates this function over every declared instance so the token\n // endpoint's mintable set and the servable set cannot drift.\n return instanceRef ? `${base}/${encodeURIComponent(instanceRef)}` : base;\n }\n\n /\n Absolute-URL variant of {@link resolveBrandLogoUrl} for out-of-app\n * consumers (email logos). Behaviour:\n \n - resolves the brand-logo URL via {@link resolveBrandLogoUrl}; if none, `undefined`.\n * - if that URL is already absolute (has a `scheme://` prefix or is\n * protocol-relative `//host/...`), it is returned unchanged.\n * - if it is app-relative (e.g. a generated brand-asset path\n * `/brand/<ref>.png`), the {@link resolveAppPublicBaseUrl} is prepended so\n * an email client can fetch it.\n * - if no public base URL is configured, the raw (still-relative) URL is\n * returned rather than dropping it — a relative hint degrades better than\n * nothing.\n \n Prefer this over `resolveBrandLogoUrl` anywhere the URL leaves the app\n * origin (email); same-origin surfaces (e.g. the auth login response) can\n * keep the relative form.\n /\n public resolveBrandLogoAbsoluteUrl(query: BrandAssetQuery): string \| undefined {\n const url = this.resolveBrandLogoUrl(query);\n if (!url) {\n return undefined;\n }\n // Already absolute: any `scheme://…` or protocol-relative `//host/…`.\n if (/^[a-z][a-z0-9+.-]:\\/\\//i.test(url) \|\| url.startsWith('//')) {\n return url;\n }\n const base = this.resolveAppPublicBaseUrl();\n if (!base) {\n return url;\n }\n return url.startsWith('/') ? `${base}${url}` : `${base}/${url}`;\n }\n\n\n public get secrets(): AppConfigurationSecrets {\n if (!this._secrets)\n throw this.createNotInitializedError('secrets');\n\n return this._secrets!;\n }\n\n public get applicationId(): string {\n if (!this._applicationId)\n throw this.createNotInitializedError('applicationId');\n\n return this._applicationId!;\n }\n\n public get applicationEnv(): RuntimeEnvironment {\n if (!this._applicationEnv)\n throw this.createNotInitializedError('applicationEnv');\n\n return this._applicationEnv!;\n }\n\n public get serviceName(): string {\n if (!this._serviceName)\n throw this.createNotInitializedError('serviceName');\n\n return this._serviceName!;\n }\n\n /*\n Application slug — the human-readable application label (e.g.,\n * 'wildo-ai-application'), carried as a secondary JWT claim alongside the\n * canonical `applicationId` and used for human-facing allow-lists.\n \n It is NOT the infrastructure identity: queue names, cron job IDs, and every\n * `wildo.queue.{appId}.` topology key are derived from `applicationId` (the\n Mongo `_id`), never from the slug — a slug is a mutable label and keying\n * infra on it orphans resources on rename. Not for display purposes.\n /\n public get appSlug(): string {\n if (this._appSlug === null) {\n throw this.createNotInitializedError('appSlug');\n }\n\n if (!this._appSlug) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n serviceName: this._serviceName,\n applicationId: this._applicationId,\n applicationEnv: this._applicationEnv,\n message: 'Application configuration is missing a resolved appSlug',\n },\n });\n }\n\n return this._appSlug;\n }\n\n /\n Apply declarative app-authored backend config after the runtime/bootstrap\n * seed has been loaded.\n /\n public applyBackendConfig(backendConfig: AppConfiguration_BackendAuthored): void {\n const baseConfig = this._config ?? this._preOverrideConfig;\n if (!baseConfig) {\n throw this.createNotInitializedError('applyBackendConfig');\n }\n\n const resolvedConfig = applyBackendAuthoredConfig(baseConfig, backendConfig);\n const boundaryInspection = inspectAppConfigurationBoundaryMutations(baseConfig, resolvedConfig);\n if (boundaryInspection.errors.length > 0) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `backendConfig attempted to mutate platform/runtime-managed fields: ${boundaryInspection.errors.join(' ')}`,\n sections: Object.keys(backendConfig),\n },\n });\n }\n if (boundaryInspection.warnings.length > 0) {\n this.logger.warn(\n `[Config] backendConfig touched migration-seam runtime fields. ${boundaryInspection.warnings.join(' ')}`,\n );\n }\n\n this.applyResolvedConfig(resolvedConfig as AppConfiguration, {\n reason: 'backend-config',\n emitWarnings: true,\n });\n this.logDebug('Applied backend config', {\n reason: 'backend-config',\n sections: Object.keys(backendConfig),\n });\n }\n\n /\n Merge generated, environment-independent backend provider topology.\n \n Provider secrets and per-env URLs stay in the regular env/secrets layers;\n * this only binds the backend process to the precomputed provider scope that\n * was generated into the application package before build/start.\n /\n public applyProviderRuntime(providerRuntime: ProviderRuntimeArtifact): void {\n const baseConfig = this._preOverrideConfig;\n if (!baseConfig) {\n throw this.createNotInitializedError('applyProviderRuntime');\n }\n if (this._config) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'applyProviderRuntime must run before backendConfig resolves the final application config',\n },\n });\n }\n\n const artifact = ProviderRuntimeArtifactSchema.parse(providerRuntime);\n this._frontendProviderBootstraps = artifact.frontendProviderBootstraps ?? {};\n this._providerRuntimeArtifactEvidenceMetadata = Object.freeze({\n sourceDigest: artifact.sourceDigest,\n providerGraphDigest: artifact.providerGraphDigest ?? null,\n lockfileSectionDigest: artifact.lockfileSectionDigest ?? null,\n });\n this._preOverrideConfig = {\n ...baseConfig,\n providers: {\n scopes: {\n backend: artifact.scope,\n },\n },\n };\n\n this.logDebug('Applied generated provider runtime module', {\n artifactKind: artifact.artifactKind,\n sourceDigest: artifact.sourceDigest,\n });\n }\n\n public getFrontendProviderBootstrap(frontendServiceName: string): FrontendProvidersBlock \| undefined {\n return this._frontendProviderBootstraps[frontendServiceName];\n }\n\n /* Exact sanitized identity of the generated provider-runtime artifact applied before backend authored configuration. /\n public getProviderRuntimeArtifactEvidenceMetadata(): ProviderRuntimeArtifactEvidenceMetadata \| null {\n return this._providerRuntimeArtifactEvidenceMetadata;\n }\n\n /\n Fail startup if a non-platform app still carries the explicit pre-override\n * placeholders after its backendConfig should have been applied.\n /\n public assertNoPreOverridePlaceholders(): void {\n if (!this._config) {\n throw this.createNotInitializedError('assertNoPreOverridePlaceholders');\n }\n\n const placeholderPaths = this.getPreOverridePlaceholderPaths(this._config);\n if (placeholderPaths.length === 0) {\n return;\n }\n\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Application configuration still contains pre-override placeholder values at: ${placeholderPaths.join(', ')}. ` +\n `Define those fields in backendConfig instead of relying on backend loader placeholders.`,\n },\n });\n }\n\n private applyResolvedConfig(\n config: AppConfiguration,\n options: {\n reason: 'initial-load' \| 'backend-config' \| 'hydrated';\n emitWarnings: boolean;\n },\n ): void {\n const validatedConfig = AppConfiguration_Schema.parse(config);\n this._config = validatedConfig;\n this._preOverrideConfig = null;\n\n if (this._appSlug !== null) {\n this.logger.reinitialize(validatedConfig, this._appSlug);\n }\n\n this.validateEntityIdentityConfig(validatedConfig);\n if (options.emitWarnings) {\n this.emitDeferredFieldWarnings(validatedConfig);\n }\n\n this.logDebug('Resolved application configuration', {\n reason: options.reason,\n appSlug: this._appSlug,\n });\n }\n\n /\n Get JWT configuration with secrets\n /\n public get jwtConfig(): {\n config: AppConfiguration['jwt'],\n secrets: AppConfigurationSecrets['security']['jwt']\n } {\n return {\n config: this.config.jwt,\n secrets: this.secrets.security.jwt\n };\n }\n\n /* W7.3a: Whether anonymous sessions are enabled for any user type. */\n public get anonymousSessionsEnabled(): boolean {\n const userTypes = this._config?.userTypes;\n if (!userTypes) return false;\n return Object.values(userTypes).some(ut => ut.auth?.anonymousSessionsEnabled === true);\n }\n\n}\n"]}
1	+ {"version":3,"file":"app-configuration.backend.service.js","sourceRoot":"","sources":["../../../../src/config/services/app-configuration.backend.service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EACL,2CAA2C,EAG3C,uBAAuB,EACxB,MAAM,6DAA6D,CAAC;AAErE,OAAO,EAAE,6BAA6B,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,EAEL,0BAA0B,EAC1B,wCAAwC,GACzC,MAAM,0EAA0E,CAAC;AAClF,OAAO,EAGL,6BAA6B,GAC9B,MAAM,4EAA4E,CAAC;AAEpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EACL,2BAA2B,EAC3B,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,2BAA2B,EAC3B,6BAA6B,EAC7B,iBAAiB,GAOlB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAG9G;;;;;;;;;;;;GAYG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAaW;IACa;IACG;IAdnD,QAAQ,CAA+D;IACzE,OAAO,GAA4B,IAAI,CAAC;IACxC,kBAAkB,GAA4C,IAAI,CAAC;IACnE,2BAA2B,GAA2C,EAAE,CAAC;IACzE,wCAAwC,GAAmD,IAAI,CAAC;IAChG,QAAQ,GAAmC,IAAI,CAAC;IAChD,cAAc,GAAkB,IAAI,CAAC;IACrC,eAAe,GAA8B,IAAI,CAAC;IAClD,YAAY,GAAkB,IAAI,CAAC;IACnC,QAAQ,GAAkB,IAAI,CAAC;IAEvC,YAC6C,MAAqB,EACR,YAAwC,EACrC,aAA4C;QAF5D,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QACrC,kBAAa,GAAb,aAAa,CAA+B;QAEvG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,UAAU;QACrB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,2CAA2C,CAAC,CAAC;YAC3D,IAAI,CAAC,2BAA2B,GAAG,EAAE,CAAC;YACtC,IAAI,CAAC,wCAAwC,GAAG,IAAI,CAAC;YACrD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,oBAAoB,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;YACnI,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC;YACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC;YAC3B,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;YACpC,IAAI,CAAC,eAAe,GAAG,oBAAoB,CAAC,eAAe,CAAC;YAC5D,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;YAChC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;YAExB,IAAI,CAAC,QAAQ,CAAC,oDAAoD,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACI,4BAA4B,CAAC,OAUnC;QACC,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,iEAAiE;oBAC1E,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,iGAAiG;wBACjG,uCAAuC;oBACzC,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;YACnE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,+FAA+F;wBAC/F,gEAAgE;oBAClE,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC/B,MAAM,kBAAkB,GAAG,wCAAwC,CACjE,OAAO,CAAC,kBAAkB,EAC1B,OAAO,CAAC,MAAM,CACf,CAAC;YACF,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACP,OAAO,EACL,oFAAoF,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;wBAC3H,WAAW,EAAE,OAAO,CAAC,WAAW;wBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;qBACrC;iBACF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7E,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4EAA4E,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACpH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC;QAChC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAE/B,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE;YACvC,MAAM,EAAE,UAAU;YAClB,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;SAC3C,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACI,qBAAqB,CAAC,QAAgB;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,SAAS;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC9C,OAAO,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACI,qCAAqC,CAAC,mBAA2B,EAAE,QAAgB;QACxF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAC9C,OAAO,SAAS,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,eAAe,EAAE,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC9F,CAAC;IAED;;;OAGG;IACI,kBAAkB,CAAC,mBAA2B;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,gBAAgB;YAAE,OAAO,KAAK,CAAC;QAC/C,OAAO,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACI,sCAAsC,CAAC,mBAA2B;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,qBAAqB,GAAG,SAAS,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;QAC9E,IAAI,CAAC,qBAAqB,EAAE,eAAe;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;QACtE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC9B,OAAO,CAAC,YAAY,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACnD,CAAC;IAED;;;;;;;;OAQG;IACI,sCAAsC,CAAC,QAAgB;QAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAE9C,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,KAAK,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtG,MAAM,KAAK,GAAG,qBAAqB,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,IAAI,KAAK,CAAC,SAAS;gBAAE,OAAO,mBAAmB,CAAC;YAChD,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ;gBAAE,QAAQ,GAAG,mBAAmB,CAAC;QAC9D,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACI,iCAAiC;QACtC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAE9C,KAAK,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtG,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC/F,IAAI,UAAU;gBAAE,OAAO,mBAAmB,CAAC;QAC7C,CAAC;QACD,MAAM,wBAAwB,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,OAAO,wBAAwB,IAAI,IAAI,CAAC;IAC1C,CAAC;IAEO,4BAA4B,CAAC,MAAwB;QAC3D,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC;QAClE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAErD,KAAK,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC5F,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC1E,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;wBACrE,OAAO,EAAE;4BACP,OAAO,EAAE,oBAAoB,mBAAmB,iDAAiD,QAAQ,KAAK;gCAC5G,0BAA0B,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;yBAC3D;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC5D,KAAK,MAAM,CAAC,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAC9D,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;oBAC3C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;4BACrE,OAAO,EAAE;gCACP,OAAO,EAAE,kDAAkD,QAAQ,KAAK;oCACtE,0BAA0B,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;6BAC3D;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YACD,KAAK,MAAM,CAAC,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxD,MAAM,QAAQ,GAAG,WAAW,CAAC,qBAAqB,EAAE,QAAQ,CAAC;gBAC7D,IAAI,QAAQ,EAAE,CAAC;oBACb,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;wBAC1B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;4BACzB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gCACrE,OAAO,EAAE;oCACP,OAAO,EAAE,+DAA+D,EAAE,KAAK;wCAC7E,kCAAkC,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iCAClE;6BACF,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,yBAAyB,CAAC,MAAwB;QACxD,IAAI,MAAM,CAAC,IAAI,EAAE,iBAAiB,KAAK,KAAK,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mJAAmJ,CACpJ,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC;YAC9B,IAAI,IAAI,EAAE,wBAAwB,KAAK,IAAI,EAAE,CAAC;gBAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qDAAqD,WAAW,4DAA4D,CAC7H,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,EAAE,oBAAoB,KAAK,IAAI,EAAE,CAAC;gBACxC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mDAAmD,WAAW,wDAAwD,CACvH,CAAC;YACJ,CAAC;YACD,IAAI,WAAW,CAAC,gBAAgB,IAAI,WAAW,CAAC,gBAAgB,KAAK,OAAO,EAAE,CAAC;gBAC7E,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4DAA4D,WAAW,CAAC,gBAAgB,8CAA8C,WAAW,IAAI,CACtJ,CAAC;YACJ,CAAC;YAED,IAAI,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;gBAC9B,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC;gBACpD,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAAC;gBACrD,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;oBACpD,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;oBAC3C,IAAI,WAAW,KAAK,SAAS;wBAAE,OAAO,KAAK,CAAC;oBAC5C,IAAI,OAAO,WAAW,KAAK,SAAS;wBAAE,OAAO,WAAW,CAAC;oBACzD,OAAO,WAAW,CAAC,OAAO,CAAC;gBAC7B,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gDAAgD,WAAW,8BAA8B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,iEAAiE,CACnL,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,8BAA8B,CAAC,MAAwB;QAC7D,MAAM,gBAAgB,GAAa,EAAE,CAAC;QAEtC,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,KAAK,2CAA2C,CAAC,OAAO,EAAE,CAAC;YACvF,gBAAgB,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,KAAK,2CAA2C,CAAC,OAAO,EAAE,CAAC;YACvF,gBAAgB,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,2CAA2C,CAAC,aAAa,EAAE,CAAC;YACnG,gBAAgB,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,2CAA2C,CAAC,WAAW,EAAE,CAAC;YAC/F,gBAAgB,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,2CAA2C,CAAC,SAAS,EAAE,CAAC;YAChF,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAEO,yBAAyB,CAAC,UAAmB;QACnD,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CACjC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAC;YACjC,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;YACrF,OAAO,EAAE;gBACP,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,aAAa,EAAE,IAAI,CAAC,cAAc;gBAClC,cAAc,EAAE,IAAI,CAAC,eAAe;gBACpC,OAAO,EAAE,mDAAmD,UAAU,IAAI,QAAQ,2BAA2B;aAC9G;SACF,CAEF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,aAAa;QAClB,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;IACzD,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,sCAAsC,GAAuC,SAAS,CAAC;IAE/F,IAAW,qCAAqC;QAC9C,OAAO,IAAI,CAAC,sCAAsC,CAAC;IACrD,CAAC;IAEM,0CAA0C,CAAC,OAA+B;QAC/E,IAAI,CAAC,sCAAsC,GAAG,OAAO,CAAC;IACxD,CAAC;IAED,IAAW,MAAM;QAEf,IAAI,CAAC,IAAI,CAAC,OAAO;YACf,MAAM,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAEjD,OAAO,IAAI,CAAC,OAAQ,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,mBAAmB,CAAC,KAAsB;QAC/C,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1E,OAAO,QAAQ,EAAE,GAAG,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACI,uBAAuB;QAC5B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,mBAAmB,GAAG,IAAI,CAAC,iCAAiC,EAAE,CAAC;QACrE,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,mBAAmB,CAAC,EAAE,SAAS,CAAC;QACpF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,0BAA0B;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,kBAAkB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACI,6BAA6B,CAAC,IAAwB,EAAE,WAAoB;QACjF,MAAM,WAAW,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACtD,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QACnC,kFAAkF;QAClF,IAAI,IAAI,KAAK,kBAAkB,CAAC,GAAG;YAAE,OAAO,WAAW,CAAC;QACxD,MAAM,IAAI,GAAG,GAAG,WAAW,GAAG,6BAA6B,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACjG,kGAAkG;QAClG,gGAAgG;QAChG,kGAAkG;QAClG,qGAAqG;QACrG,uEAAuE;QACvE,mGAAmG;QACnG,6DAA6D;QAC7D,OAAO,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACI,2BAA2B,CAAC,KAAsB;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,sEAAsE;QACtE,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;IAClE,CAAC;IAGD,IAAW,OAAO;QAChB,IAAI,CAAC,IAAI,CAAC,QAAQ;YAChB,MAAM,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC;QAElD,OAAO,IAAI,CAAC,QAAS,CAAC;IACxB,CAAC;IAED,IAAW,aAAa;QACtB,IAAI,CAAC,IAAI,CAAC,cAAc;YACtB,MAAM,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,CAAC;QAExD,OAAO,IAAI,CAAC,cAAe,CAAC;IAC9B,CAAC;IAED,IAAW,cAAc;QACvB,IAAI,CAAC,IAAI,CAAC,eAAe;YACvB,MAAM,IAAI,CAAC,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;QAEzD,OAAO,IAAI,CAAC,eAAgB,CAAC;IAC/B,CAAC;IAED,IAAW,WAAW;QACpB,IAAI,CAAC,IAAI,CAAC,YAAY;YACpB,MAAM,IAAI,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAC;QAEtD,OAAO,IAAI,CAAC,YAAa,CAAC;IAC5B,CAAC;IAED;;;;;;;;;OASG;IACH,IAAW,OAAO;QAChB,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,WAAW,EAAE,IAAI,CAAC,YAAY;oBAC9B,aAAa,EAAE,IAAI,CAAC,cAAc;oBAClC,cAAc,EAAE,IAAI,CAAC,eAAe;oBACpC,OAAO,EAAE,yDAAyD;iBACnE;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;OAGG;IACI,kBAAkB,CAAC,aAA+C;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,kBAAkB,CAAC;QAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,cAAc,GAAG,0BAA0B,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAC7E,MAAM,kBAAkB,GAAG,wCAAwC,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAChG,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,sEAAsE,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;oBAC7G,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,kBAAkB,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,iEAAiE,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACzG,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,cAAkC,EAAE;YAC3D,MAAM,EAAE,gBAAgB;YACxB,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EAAE;YACtC,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;SACrC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACI,oBAAoB,CAAC,eAAwC;QAClE,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,0FAA0F;iBACpG;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,wFAAwF;YACxF,0FAA0F;YAC1F,2FAA2F;YAC3F,iGAAiG;YACjG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,qGAAqG;0BACnG,6FAA6F;0BAC7F,WAAW,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBAC3G,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;iBAC5B;aACF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7B,IAAI,CAAC,2BAA2B,GAAG,QAAQ,CAAC,0BAA0B,IAAI,EAAE,CAAC;QAC7E,IAAI,CAAC,wCAAwC,GAAG,MAAM,CAAC,MAAM,CAAC;YAC5D,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,IAAI,IAAI;YACzD,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB,IAAI,IAAI;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,kBAAkB,GAAG;YACxB,GAAG,UAAU;YACb,SAAS,EAAE;gBACT,MAAM,EAAE;oBACN,OAAO,EAAE,QAAQ,CAAC,KAAK;iBACxB;gBACD,8FAA8F;gBAC9F,wFAAwF;gBACxF,6FAA6F;gBAC7F,oFAAoF;gBACpF,uEAAuE;gBACvE,WAAW,EAAE,UAAU,CAAC,SAAS,EAAE,WAAW,IAAI,EAAE;aACrD;SACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,2CAA2C,EAAE;YACzD,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CAAC,CAAC;IACL,CAAC;IAEM,4BAA4B,CAAC,mBAA2B;QAC7D,OAAO,IAAI,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,CAAC;IAC/D,CAAC;IAED,yHAAyH;IAClH,0CAA0C;QAC/C,OAAO,IAAI,CAAC,wCAAwC,CAAC;IACvD,CAAC;IAED;;;OAGG;IACI,+BAA+B;QACpC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,yBAAyB,CAAC,iCAAiC,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3E,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACP,OAAO,EACL,gFAAgF,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBAC/G,yFAAyF;aAC5F;SACF,CAAC,CAAC;IACL,CAAC;IAEO,mBAAmB,CACzB,MAAwB,EACxB,OAGC;QAED,MAAM,eAAe,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,eAAe,CAAC;QAC/B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAE/B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,CAAC,4BAA4B,CAAC,eAAe,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE;YAClD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,IAAI,CAAC,QAAQ;SACvB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,IAAW,SAAS;QAIlB,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG;SACnC,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,IAAW,wBAAwB;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC;QAC1C,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,wBAAwB,KAAK,IAAI,CAAC,CAAC;IACzF,CAAC;CAEF,CAAA;AAjxBY,uBAAuB;IADnC,UAAU,EAAE;IAcR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;qCAFC,aAAa;QACM,0BAA0B;QACtB,6BAA6B;GAf9F,uBAAuB,CAixBnC","sourcesContent":["/*\n Application Configuration Service\n \n Service for managing application-level configuration\n /\n\nimport { injectable, inject } from 'inversify';\nimport {\n APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS,\n AppConfiguration,\n type AppConfiguration_PreOverrideSeed,\n AppConfiguration_Schema\n} from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport { AppConfigurationSecrets } from '~wildo-backend-lib/config/models/app-config-secrets.backend.schemas';\nimport { AppConfigurationLoaderService } from './app-configuration-loader.backend.service';\nimport {\n type AppConfiguration_BackendAuthored,\n applyBackendAuthoredConfig,\n inspectAppConfigurationBoundaryMutations,\n} from '~wildo-backend-lib/config/models/app-config.backend-authored.definitions';\nimport {\n type ProviderRuntimeArtifact,\n type ProviderRuntimeArtifactEvidenceMetadata,\n ProviderRuntimeArtifactSchema,\n} from '~wildo-backend-lib/config/models/provider-runtime-artifact.backend.schemas';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport {\n ErrorCustomMessageReference,\n ErrorType,\n MAIN_API_BASE_PATH,\n ResourceServerKind,\n RESOURCE_SERVER_MOUNT_ROUTE,\n MANUAL_CONTROLLER_ROUTES_URLS,\n resolveBrandAsset,\n RuntimeEnvironment,\n WildoError_Backend,\n type BrandAssetQuery,\n type FrontendProvidersBlock,\n type PersistenceAdapterType,\n type UserTypeAuthPolicy,\n} from '@wildo-ai/saas-models';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\n\n\n/\n Application Configuration Service\n \n Manages complete application configuration. After T5, the loading chain is:\n * 1. Env vars → database addresses, platform URLs\n * 2. Minimal pre-override skeleton → only the structural placeholders the\n * backend must provide before backendConfig is merged\n * 3. Apps-manager fetch → reduced managed metadata + JWT public keys + appSlug\n * 4. App-authored backendConfig → merged onto the runtime/bootstrap seed\n \n This service uses the loader service for steps 1-3, then provides\n * cached, type-safe access to all configuration sections.\n /\n@injectable()\nexport class AppConfigurationService {\n protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n private _config: AppConfiguration \| null = null;\n private _preOverrideConfig: AppConfiguration_PreOverrideSeed \| null = null;\n private _frontendProviderBootstraps: Record<string, FrontendProvidersBlock> = {};\n private _providerRuntimeArtifactEvidenceMetadata: ProviderRuntimeArtifactEvidenceMetadata \| null = null;\n private _secrets: AppConfigurationSecrets \| null = null;\n private _applicationId: string \| null = null;\n private _applicationEnv: RuntimeEnvironment \| null = null;\n private _serviceName: string \| null = null;\n private _appSlug: string \| null = null;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigLoaderService) private loaderService: AppConfigurationLoaderService\n ) {\n this.logDebug = this.logger.debugByType('AppConfigurationService');\n this.logger.setDebugTypeLogging('AppConfigurationService', false);\n }\n\n /\n Initialize the configuration service\n /\n public async initialize(): Promise<void> {\n if (!this._config \|\| !this._secrets) {\n this.logDebug('Initializing application configuration...');\n this._frontendProviderBootstraps = {};\n this._providerRuntimeArtifactEvidenceMetadata = null;\n const { appConfig, appSecrets, applicationId, applicationEnvConfig, serviceName, appSlug } = await this.loaderService.initialize();\n this._preOverrideConfig = appConfig;\n this._secrets = appSecrets;\n this._applicationId = applicationId;\n this._applicationEnv = applicationEnvConfig.APPLICATION_ENV;\n this._serviceName = serviceName;\n this._appSlug = appSlug;\n\n this.logDebug('Application configuration initialized successfully', { appSlug });\n }\n }\n\n /\n Hydrate the service from an already-resolved full configuration object.\n \n Platform startup paths use this when configuration was assembled by another\n * runtime-specific service. Callers must make the ownership decision explicit:\n * either provide a `boundaryBaseConfig` to run the Phase 4 mutation checks, or\n * set `skipBoundaryInspection` when hydrating a platform-owned config that does\n * not go through the tenant backendConfig authoring seam.\n /\n public hydrateResolvedConfiguration(options: {\n config: AppConfiguration;\n secrets: AppConfigurationSecrets;\n applicationId: string;\n applicationEnv: RuntimeEnvironment;\n serviceName: string;\n appSlug: string;\n emitWarnings?: boolean;\n boundaryBaseConfig?: AppConfiguration \| AppConfiguration_PreOverrideSeed;\n skipBoundaryInspection?: boolean;\n }): void {\n const resolvedAppSlug = options.appSlug.trim();\n if (!resolvedAppSlug) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'Resolved application configuration requires a non-empty appSlug',\n serviceName: options.serviceName,\n applicationId: options.applicationId,\n },\n });\n }\n\n if (options.boundaryBaseConfig && options.skipBoundaryInspection) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n 'hydrateResolvedConfiguration cannot accept both boundaryBaseConfig and skipBoundaryInspection. ' +\n 'Choose one ownership mode explicitly.',\n serviceName: options.serviceName,\n applicationId: options.applicationId,\n },\n });\n }\n\n if (!options.boundaryBaseConfig && !options.skipBoundaryInspection) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n 'hydrateResolvedConfiguration requires either boundaryBaseConfig for Phase 4 ownership checks ' +\n 'or skipBoundaryInspection for platform-owned hydrated configs.',\n serviceName: options.serviceName,\n applicationId: options.applicationId,\n },\n });\n }\n\n if (options.boundaryBaseConfig) {\n const boundaryInspection = inspectAppConfigurationBoundaryMutations(\n options.boundaryBaseConfig,\n options.config,\n );\n if (boundaryInspection.errors.length > 0) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Hydrated resolved config attempted to cross platform/runtime-managed boundaries: ${boundaryInspection.errors.join(' ')}`,\n serviceName: options.serviceName,\n applicationId: options.applicationId,\n },\n });\n }\n if ((options.emitWarnings ?? true) && boundaryInspection.warnings.length > 0) {\n this.logger.warn(\n `[Config] hydrated resolved config touched migration-seam runtime fields. ${boundaryInspection.warnings.join(' ')}`,\n );\n }\n }\n\n this._secrets = options.secrets;\n this._applicationId = options.applicationId;\n this._applicationEnv = options.applicationEnv;\n this._serviceName = options.serviceName;\n this._appSlug = resolvedAppSlug;\n this._preOverrideConfig = null;\n\n this.applyResolvedConfig(options.config, {\n reason: 'hydrated',\n emitWarnings: options.emitWarnings ?? true,\n });\n }\n\n /\n W3.1: Get auth policy for a specific user type.\n * Returns the complete per-user-type auth policy, or null if the user type doesn't exist in config.\n /\n public getUserTypeAuthPolicy(userType: string): UserTypeAuthPolicy \| null {\n const appConfig = this._config;\n if (!appConfig?.userTypes) return null;\n const typeDef = appConfig.userTypes[userType];\n return typeDef?.auth ?? null;\n }\n\n /\n Resolve a specific frontend-service user-management entry.\n * Used when runtime flows must enforce surface-level auth/register policy\n * for a known frontend service + user-type combination.\n /\n public getFrontendServiceUserManagementEntry(frontendServiceName: string, userType: string): { register: boolean; auth: boolean; isDefault?: boolean } \| null {\n const appConfig = this._config;\n if (!appConfig?.frontendServices) return null;\n return appConfig.frontendServices[frontendServiceName]?.usersManagement?.[userType] ?? null;\n }\n\n /\n Check whether a frontend service identity is declared in app-owned config.\n * This is the authoritative allow-list used for runtime/public frontend identity.\n /\n public hasFrontendService(frontendServiceName: string): boolean {\n const appConfig = this._config;\n if (!appConfig?.frontendServices) return false;\n return !!appConfig.frontendServices[frontendServiceName];\n }\n\n /\n Resolve user type from the active frontend service identity.\n * Reads `frontendServices[frontendServiceName].usersManagement` and returns\n * the default entry, or the first entry when no explicit default exists.\n /\n public resolveUserTypeFromFrontendServiceName(frontendServiceName: string): string \| null {\n const appConfig = this._config;\n if (!appConfig?.frontendServices) return null;\n const frontendServiceConfig = appConfig.frontendServices[frontendServiceName];\n if (!frontendServiceConfig?.usersManagement) return null;\n const entries = Object.entries(frontendServiceConfig.usersManagement);\n const defaultEntry = entries.find(([, v]) => v.isDefault);\n const firstEntry = entries[0];\n return (defaultEntry ?? firstEntry)?.[0] ?? null;\n }\n\n /\n Reverse lookup: given a user type, find the frontend service where that user type\n * has `isDefault: true` in usersManagement. Falls back to any app type that\n * references the user type (with `auth: true`) if no isDefault match exists.\n \n This is the mirror of `resolveUserTypeFromFrontendServiceName()`:\n * frontendServiceName → userType (forward)\n * userType → frontendServiceName (reverse)\n /\n public resolveFrontendServiceNameFromUserType(userType: string): string \| null {\n const appConfig = this._config;\n if (!appConfig?.frontendServices) return null;\n\n let fallback: string \| null = null;\n for (const [frontendServiceName, frontendServiceConfig] of Object.entries(appConfig.frontendServices)) {\n const entry = frontendServiceConfig.usersManagement[userType];\n if (!entry) continue;\n if (entry.isDefault) return frontendServiceName;\n if (entry.auth && !fallback) fallback = frontendServiceName;\n }\n return fallback;\n }\n\n /\n Find the default frontend service — the first frontend service that has any\n * user type entry with `isDefault: true`. Used as a last-resort fallback\n * when no specific user type context is available (e.g., SAML errors\n * before user identification).\n /\n public resolveDefaultFrontendServiceName(): string \| null {\n const appConfig = this._config;\n if (!appConfig?.frontendServices) return null;\n\n for (const [frontendServiceName, frontendServiceConfig] of Object.entries(appConfig.frontendServices)) {\n const hasDefault = Object.values(frontendServiceConfig.usersManagement).some(v => v.isDefault);\n if (hasDefault) return frontendServiceName;\n }\n const firstFrontendServiceName = Object.keys(appConfig.frontendServices)[0];\n return firstFrontendServiceName ?? null;\n }\n\n private validateEntityIdentityConfig(config: AppConfiguration): void {\n const { userTypes, frontendServices, organizationTypes } = config;\n const userTypeKeys = new Set(Object.keys(userTypes));\n\n for (const [frontendServiceName, frontendServiceConfig] of Object.entries(frontendServices)) {\n for (const userType of Object.keys(frontendServiceConfig.usersManagement)) {\n if (!userTypeKeys.has(userType)) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: `frontendServices.${frontendServiceName}.usersManagement references unknown userType \"${userType}\". ` +\n `userTypes must define: ${[...userTypeKeys].join(', ')}`,\n },\n });\n }\n }\n }\n\n if (organizationTypes) {\n const orgTypeKeys = new Set(Object.keys(organizationTypes));\n for (const [, orgConfig] of Object.entries(organizationTypes)) {\n for (const userType of orgConfig.userTypes) {\n if (!userTypeKeys.has(userType)) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: `organizationTypes references unknown userType \"${userType}\". ` +\n `userTypes must define: ${[...userTypeKeys].join(', ')}`,\n },\n });\n }\n }\n }\n for (const [, userTypeDef] of Object.entries(userTypes)) {\n const orgTypes = userTypeDef.requiresOrgMembership?.orgTypes;\n if (orgTypes) {\n for (const ot of orgTypes) {\n if (!orgTypeKeys.has(ot)) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: `requiresOrgMembership.orgTypes references unknown org type \"${ot}\". ` +\n `organizationTypes must define: ${[...orgTypeKeys].join(', ')}`,\n },\n });\n }\n }\n }\n }\n }\n }\n\n private emitDeferredFieldWarnings(config: AppConfiguration): void {\n if (config.auth?.crossOrgSSOAccess === false) {\n this.logger.info(\n `[Config] crossOrgSSOAccess is disabled — users with enterprise SSO links from one organization will be blocked from SSO into other organizations.`\n );\n }\n\n for (const [userTypeKey, userTypeDef] of Object.entries(config.userTypes)) {\n const auth = userTypeDef.auth;\n if (auth?.anonymousSessionsEnabled === true) {\n this.logger.info(\n `[Config] Anonymous sessions enabled for userType \"${userTypeKey}\" — isAnonymizable resources will support ANONYMOUS scope.`\n );\n }\n if (auth?.oneOffSessionAllowed === true) {\n this.logger.info(\n `[Config] One-off sessions enabled for userType \"${userTypeKey}\" — consumable token links can create scoped sessions.`\n );\n }\n if (userTypeDef.uniqueIdentifier && userTypeDef.uniqueIdentifier !== 'email') {\n this.logger.warn(\n `[Config] uniqueIdentifier only supports \"email\" — value \"${userTypeDef.uniqueIdentifier}\" will be treated as \"email\" for userType \"${userTypeKey}\".`\n );\n }\n\n if (auth?.stepUpAuth?.enabled) {\n const stepUpMethods = auth.stepUpAuth.methods ?? [];\n const enabledMethods = auth.authMethodsEnabled ?? {};\n const hasUsableMethod = stepUpMethods.some((method) => {\n const methodValue = enabledMethods[method];\n if (methodValue === undefined) return false;\n if (typeof methodValue === 'boolean') return methodValue;\n return methodValue.enabled;\n });\n if (!hasUsableMethod) {\n this.logger.warn(\n `[Config] stepUpAuth is enabled for userType \"${userTypeKey}\" but none of its methods [${stepUpMethods.join(', ')}] are enabled in authMethodsEnabled — step-up will always fail.`\n );\n }\n }\n }\n }\n\n private getPreOverridePlaceholderPaths(config: AppConfiguration): string[] {\n const placeholderPaths: string[] = [];\n\n if (config.appIdentity.appName === APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.appName) {\n placeholderPaths.push('appIdentity.appName');\n }\n if (config.appIdentity.version === APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.version) {\n placeholderPaths.push('appIdentity.version');\n }\n if (config.auth.passkeyConfig.rpName === APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.passkeyRpName) {\n placeholderPaths.push('auth.passkeyConfig.rpName');\n }\n if (config.auth.passkeyConfig.rpId === APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.passkeyRpId) {\n placeholderPaths.push('auth.passkeyConfig.rpId');\n }\n if (config.email.from === APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.emailFrom) {\n placeholderPaths.push('email.from');\n }\n\n return placeholderPaths;\n }\n\n private createNotInitializedError(getterName?: string): WildoError_Backend {\n return this.errorBuilder.buildError(\n ErrorType.CONFIGURATION, undefined,{\n customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n context: {\n serviceName: this._serviceName,\n applicationId: this._applicationId,\n applicationEnv: this._applicationEnv,\n message: `Application configuration not initialized : use ${getterName ?? 'getter'} before using the service`\n }\n }\n\n );\n }\n\n /\n Indicates whether the application configuration has been initialized.\n * Returns true only once the final resolved config is available through\n * `config`. A loader-only pre-override seed is not considered initialized for\n * downstream consumers because it still contains unresolved placeholders.\n /\n public isInitialized(): boolean {\n return this._config !== null && this._secrets !== null;\n }\n\n /\n PLATFORM-MODE construction-time default persistence adapter (Phase 5.2/5.3 + review R2).\n \n The one store for the answer \"what adapter does a resource without a declaration resolve\n * to?\" in platform mode, where this service is deliberately unhydrated while repositories are\n * constructed. It lives HERE — not on the repositories registry that historically owned it —\n * because THREE independent resolvers need it and only this service is injected into all of\n * them without a dependency cycle: the repositories-registry resolver (repository\n * construction, the boot door, the schema gate), the services-tier transaction router, and the\n * resource-id/unit-of-work resolver. When the value lived on the registry alone, the other two\n * read hydrated config and agreed with the constructed repositories only at a distance,\n * through the apps-manager env-truth overlay — nothing pinned the agreement.\n \n WRITE only through `RepositoriesRegistryHandlerBackendService.setPlatformModeDefaultPersistenceAdapter`,\n * which owns the conflict guard (a conflicting re-set refuses; a same-value re-set is a legal\n * retried startup phase). This adopt method is the dumb store half on purpose: keeping the\n * guard at the single sanctioned writer keeps it — and its pins — in one place.\n /\n private _platformModeDefaultPersistenceAdapter: PersistenceAdapterType \| undefined = undefined;\n\n public get platformModeDefaultPersistenceAdapter(): PersistenceAdapterType \| undefined {\n return this._platformModeDefaultPersistenceAdapter;\n }\n\n public adoptPlatformModeDefaultPersistenceAdapter(adapter: PersistenceAdapterType): void {\n this._platformModeDefaultPersistenceAdapter = adapter;\n }\n\n public get config(): AppConfiguration {\n\n if (!this._config)\n throw this.createNotInitializedError('config');\n\n return this._config!;\n }\n\n /\n Resolve a servable brand-logo URL for a `(composition[, theme, purpose])`\n * query against the resolved config's `brandAssets` (the CLI-generated,\n * backend-authored runtime projection).\n \n This is the single seam every backend logo consumer (auth-response\n * organization branding, email primary-scope context, ...) should call so\n * the composition/theme/purpose resolution stays consistent instead of each\n * consumer reading a free-form URL. Returns `undefined` when no matching\n * brand asset was generated.\n \n Safe before initialization: returns `undefined` rather than throwing so a\n * consumer building context on a not-yet-resolved config degrades gracefully.\n /\n public resolveBrandLogoUrl(query: BrandAssetQuery): string \| undefined {\n if (!this._config) {\n return undefined;\n }\n const resolved = resolveBrandAsset(this._config.brandAssets ?? [], query);\n return resolved?.url;\n }\n\n /\n Resolve the application's public base URL (`scheme://host[:port]`) used to\n * absolutize app-relative asset/link paths for OUT-OF-APP consumers — most\n * notably email, where a client cannot fetch a same-origin path like\n * `/brand/<ref>.png`.\n \n Source of truth: the DEFAULT frontend service's configured\n * `runtime.endPoints[<service>].publicUrl` (the app's primary frontend URL),\n * trailing slash stripped. This mirrors how notification dashboard/token\n * links resolve their base (`AuthControllerUtils.lookupFrontendPublicUrl`),\n * kept local here so the config layer does not depend on the auth module.\n \n Returns `undefined` pre-initialization, when no default frontend service is\n * resolvable, or when that service has no `publicUrl` configured.\n /\n public resolveAppPublicBaseUrl(): string \| undefined {\n if (!this._config) {\n return undefined;\n }\n const frontendServiceName = this.resolveDefaultFrontendServiceName();\n if (!frontendServiceName) {\n return undefined;\n }\n const publicUrl = this._config.runtime?.endPoints?.[frontendServiceName]?.publicUrl;\n if (!publicUrl) {\n return undefined;\n }\n return publicUrl.replace(/\\/+$/, '');\n }\n\n /\n Canonical audience (RFC 8707 resource indicator) of THIS app's generic API resource\n * server — the `aud` an exchanged machine (client-credentials) access token must carry\n * to be accepted at the resource-operation choke point (external-access D7).\n \n SINGLE SOURCE OF TRUTH: both the request-auth choke point (validation) and the\n * client-credentials token endpoint (minting) resolve the audience through THIS method,\n * so mint and validation cannot drift. Derivation = app public base URL + API mount path.\n * Returns `undefined` (→ fail-closed at the call site) when the public base is unresolvable.\n \n MCP and A2A resource servers carry their OWN canonical audiences (their endpoint URIs),\n * validated inside their own transports — not here.\n /\n public resolveApiResourceAudience(): string \| undefined {\n const base = this.resolveAppPublicBaseUrl();\n return base ? `${base}${MAIN_API_BASE_PATH}` : undefined;\n }\n\n /\n Canonical audience (RFC 8707 resource indicator) of one of this app's OAuth resource\n * servers ({@link ResourceServerKind} — `API` / `A2A` / `MCP`). This is the SINGLE SOURCE\n * OF TRUTH for both MINTING (`aud`) and VALIDATION (each server checks `aud === self`), so an\n * audience-bound token and the surface that consumes it cannot drift.\n \n Derivation: the API audience ({@link resolveApiResourceAudience}) is the base; A2A/MCP append\n * their mount path ({@link RESOURCE_SERVER_MOUNT_ROUTE}). The transports DELEGATE their verify-side\n * audience to THIS method — `A2ABackendService.resolveAgentAudience()` and the MCP controller's\n * `mcpResourceUri()` both return `resolveResourceServerAudience(A2A\|MCP)` — so mint and verify read\n * one function, not three parallel `${apiAudience}${route}` expressions. That is what makes \"cannot\n * drift\" a real guarantee rather than a coincidence. Returns `undefined` (→ fail-closed at the call\n * site) when the app public base URL is unresolvable.\n \n NB (documented follow-up): first-party USER login tokens still carry the legacy `'AUTH_TOKEN'`\n * sentinel audience rather than `resolveResourceServerAudience(API)`. That does NOT weaken the\n * A2A/MCP audience-binding here — a delegated token is `aud`-bound to A2A/MCP and is therefore\n * rejected by the main API (which accepts only `'AUTH_TOKEN'` user tokens or the API-audience\n * machine tokens).\n \n @param instanceRef - optional NAMED instance (multi-MCP / multi-A2A): appends `/<ref>` so each\n * server/agent instance carries its OWN audience. Omit for the DEFAULT (unnamed) surface, which\n * every app always has; `API` ignores it (a single, instance-less resource server).\n /\n public resolveResourceServerAudience(kind: ResourceServerKind, instanceRef?: string): string \| undefined {\n const apiAudience = this.resolveApiResourceAudience();\n if (!apiAudience) return undefined;\n // The API is a single, instance-less resource server — a ref never applies to it.\n if (kind === ResourceServerKind.API) return apiAudience;\n const base = `${apiAudience}${MANUAL_CONTROLLER_ROUTES_URLS[RESOURCE_SERVER_MOUNT_ROUTE[kind]]}`;\n // Multi-instance (multi-MCP / multi-A2A) audience contract: a NAMED server/agent instance appends\n // its ref as a path segment (`…/mcp/<ref>`, `…/a2a/<ref>`), so each instance carries a DISTINCT\n // RFC 8707 audience that its transport validates in isolation — the token-replay boundary between\n // instances. Live since R-2: `ResourceServerInstancesRegistryBackendService` declares the instances,\n // the MCP/A2A controllers resolve `:instanceRef` and pass it here, and\n // `listResourceServerAudiences` enumerates this function over every declared instance so the token\n // endpoint's mintable set and the servable set cannot drift.\n return instanceRef ? `${base}/${encodeURIComponent(instanceRef)}` : base;\n }\n\n /\n Absolute-URL variant of {@link resolveBrandLogoUrl} for out-of-app\n * consumers (email logos). Behaviour:\n \n - resolves the brand-logo URL via {@link resolveBrandLogoUrl}; if none, `undefined`.\n * - if that URL is already absolute (has a `scheme://` prefix or is\n * protocol-relative `//host/...`), it is returned unchanged.\n * - if it is app-relative (e.g. a generated brand-asset path\n * `/brand/<ref>.png`), the {@link resolveAppPublicBaseUrl} is prepended so\n * an email client can fetch it.\n * - if no public base URL is configured, the raw (still-relative) URL is\n * returned rather than dropping it — a relative hint degrades better than\n * nothing.\n \n Prefer this over `resolveBrandLogoUrl` anywhere the URL leaves the app\n * origin (email); same-origin surfaces (e.g. the auth login response) can\n * keep the relative form.\n /\n public resolveBrandLogoAbsoluteUrl(query: BrandAssetQuery): string \| undefined {\n const url = this.resolveBrandLogoUrl(query);\n if (!url) {\n return undefined;\n }\n // Already absolute: any `scheme://…` or protocol-relative `//host/…`.\n if (/^[a-z][a-z0-9+.-]:\\/\\//i.test(url) \|\| url.startsWith('//')) {\n return url;\n }\n const base = this.resolveAppPublicBaseUrl();\n if (!base) {\n return url;\n }\n return url.startsWith('/') ? `${base}${url}` : `${base}/${url}`;\n }\n\n\n public get secrets(): AppConfigurationSecrets {\n if (!this._secrets)\n throw this.createNotInitializedError('secrets');\n\n return this._secrets!;\n }\n\n public get applicationId(): string {\n if (!this._applicationId)\n throw this.createNotInitializedError('applicationId');\n\n return this._applicationId!;\n }\n\n public get applicationEnv(): RuntimeEnvironment {\n if (!this._applicationEnv)\n throw this.createNotInitializedError('applicationEnv');\n\n return this._applicationEnv!;\n }\n\n public get serviceName(): string {\n if (!this._serviceName)\n throw this.createNotInitializedError('serviceName');\n\n return this._serviceName!;\n }\n\n /*\n Application slug — the human-readable application label (e.g.,\n * 'wildo-ai-application'), carried as a secondary JWT claim alongside the\n * canonical `applicationId` and used for human-facing allow-lists.\n \n It is NOT the infrastructure identity: queue names, cron job IDs, and every\n * `wildo.queue.{appId}.` topology key are derived from `applicationId` (the\n Mongo `_id`), never from the slug — a slug is a mutable label and keying\n * infra on it orphans resources on rename. Not for display purposes.\n /\n public get appSlug(): string {\n if (this._appSlug === null) {\n throw this.createNotInitializedError('appSlug');\n }\n\n if (!this._appSlug) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n serviceName: this._serviceName,\n applicationId: this._applicationId,\n applicationEnv: this._applicationEnv,\n message: 'Application configuration is missing a resolved appSlug',\n },\n });\n }\n\n return this._appSlug;\n }\n\n /\n Apply declarative app-authored backend config after the runtime/bootstrap\n * seed has been loaded.\n /\n public applyBackendConfig(backendConfig: AppConfiguration_BackendAuthored): void {\n const baseConfig = this._config ?? this._preOverrideConfig;\n if (!baseConfig) {\n throw this.createNotInitializedError('applyBackendConfig');\n }\n\n const resolvedConfig = applyBackendAuthoredConfig(baseConfig, backendConfig);\n const boundaryInspection = inspectAppConfigurationBoundaryMutations(baseConfig, resolvedConfig);\n if (boundaryInspection.errors.length > 0) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `backendConfig attempted to mutate platform/runtime-managed fields: ${boundaryInspection.errors.join(' ')}`,\n sections: Object.keys(backendConfig),\n },\n });\n }\n if (boundaryInspection.warnings.length > 0) {\n this.logger.warn(\n `[Config] backendConfig touched migration-seam runtime fields. ${boundaryInspection.warnings.join(' ')}`,\n );\n }\n\n this.applyResolvedConfig(resolvedConfig as AppConfiguration, {\n reason: 'backend-config',\n emitWarnings: true,\n });\n this.logDebug('Applied backend config', {\n reason: 'backend-config',\n sections: Object.keys(backendConfig),\n });\n }\n\n /\n Merge generated, environment-independent backend provider topology.\n \n Provider secrets and per-env URLs stay in the regular env/secrets layers;\n * this only binds the backend process to the precomputed provider scope that\n * was generated into the application package before build/start.\n /\n public applyProviderRuntime(providerRuntime: ProviderRuntimeArtifact): void {\n const baseConfig = this._preOverrideConfig;\n if (!baseConfig) {\n throw this.createNotInitializedError('applyProviderRuntime');\n }\n if (this._config) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'applyProviderRuntime must run before backendConfig resolves the final application config',\n },\n });\n }\n\n const parsed = ProviderRuntimeArtifactSchema.safeParse(providerRuntime);\n if (!parsed.success) {\n // The artifact is GENERATED from the authored config by `wildo config sync`, so a parse\n // failure here is almost always a stale artifact meeting a newer contract (#328 added the\n // provider identity to every frontend entry). A raw Zod issue list reads as a logic defect\n // in the backend; the remedy is regeneration, so name it (staleness-presents-as-a-logic-defect).\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n 'The generated provider runtime artifact does not satisfy the current contract — it was most likely '\n + 'generated before the contract changed. Regenerate it with `wildo config sync` and restart. '\n + `Issues: ${parsed.error.issues.map((issue) => `${issue.path.join('.')}: ${issue.message}`).join('; ')}`,\n issues: parsed.error.issues,\n },\n });\n }\n const artifact = parsed.data;\n this._frontendProviderBootstraps = artifact.frontendProviderBootstraps ?? {};\n this._providerRuntimeArtifactEvidenceMetadata = Object.freeze({\n sourceDigest: artifact.sourceDigest,\n providerGraphDigest: artifact.providerGraphDigest ?? null,\n lockfileSectionDigest: artifact.lockfileSectionDigest ?? null,\n });\n this._preOverrideConfig = {\n ...baseConfig,\n providers: {\n scopes: {\n backend: artifact.scope,\n },\n // Carried forward rather than defaulted, because this assignment REPLACES the whole providers\n // block. The artifact supplies the backend's resolved scope and knows nothing about the\n // application's connection policy, so rebuilding the block from it alone would silently drop\n // a declared `providers.connections` — and the symptom would be a provider becoming\n // connectable at scopes the application had deliberately switched off.\n connections: baseConfig.providers?.connections ?? {},\n },\n };\n\n this.logDebug('Applied generated provider runtime module', {\n artifactKind: artifact.artifactKind,\n sourceDigest: artifact.sourceDigest,\n });\n }\n\n public getFrontendProviderBootstrap(frontendServiceName: string): FrontendProvidersBlock \| undefined {\n return this._frontendProviderBootstraps[frontendServiceName];\n }\n\n /* Exact sanitized identity of the generated provider-runtime artifact applied before backend authored configuration. /\n public getProviderRuntimeArtifactEvidenceMetadata(): ProviderRuntimeArtifactEvidenceMetadata \| null {\n return this._providerRuntimeArtifactEvidenceMetadata;\n }\n\n /\n Fail startup if a non-platform app still carries the explicit pre-override\n * placeholders after its backendConfig should have been applied.\n /\n public assertNoPreOverridePlaceholders(): void {\n if (!this._config) {\n throw this.createNotInitializedError('assertNoPreOverridePlaceholders');\n }\n\n const placeholderPaths = this.getPreOverridePlaceholderPaths(this._config);\n if (placeholderPaths.length === 0) {\n return;\n }\n\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Application configuration still contains pre-override placeholder values at: ${placeholderPaths.join(', ')}. ` +\n `Define those fields in backendConfig instead of relying on backend loader placeholders.`,\n },\n });\n }\n\n private applyResolvedConfig(\n config: AppConfiguration,\n options: {\n reason: 'initial-load' \| 'backend-config' \| 'hydrated';\n emitWarnings: boolean;\n },\n ): void {\n const validatedConfig = AppConfiguration_Schema.parse(config);\n this._config = validatedConfig;\n this._preOverrideConfig = null;\n\n if (this._appSlug !== null) {\n this.logger.reinitialize(validatedConfig, this._appSlug);\n }\n\n this.validateEntityIdentityConfig(validatedConfig);\n if (options.emitWarnings) {\n this.emitDeferredFieldWarnings(validatedConfig);\n }\n\n this.logDebug('Resolved application configuration', {\n reason: options.reason,\n appSlug: this._appSlug,\n });\n }\n\n /\n Get JWT configuration with secrets\n /\n public get jwtConfig(): {\n config: AppConfiguration['jwt'],\n secrets: AppConfigurationSecrets['security']['jwt']\n } {\n return {\n config: this.config.jwt,\n secrets: this.secrets.security.jwt\n };\n }\n\n /* W7.3a: Whether anonymous sessions are enabled for any user type. */\n public get anonymousSessionsEnabled(): boolean {\n const userTypes = this._config?.userTypes;\n if (!userTypes) return false;\n return Object.values(userTypes).some(ut => ut.auth?.anonymousSessionsEnabled === true);\n }\n\n}\n"]}