npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.3 → 1.1.4 - Mend

@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1056) hide show

package/dist/esm/security/authentications/controllers/oauth-provider-controller.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-provider-controller.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/controllers/oauth-provider-controller.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAC5I,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AACvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,2FAA2F,CAAC;AAC7I,OAAO,EAAE,mCAAmC,EAAE,MAAM,8FAA8F,CAAC;AACnJ,OAAO,EAAE,4BAA4B,EAAE,8BAA8B,EAAE,gCAAgC,EAAE,MAAM,uFAAuF,CAAC;AACvM,OAAO,EAAE,eAAe,EAAE,MAAM,yEAAyE,CAAC;AAE1G,OAAO,EAAE,iCAAiC,EAAE,uCAAuC,EAAE,2BAA2B,EAAE,MAAM,iFAAiF,CAAC;AAE1M,OAAO,EAAE,gCAAgC,EAAE,MAAM,2FAA2F,CAAC;AAC7I,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,wEAAwE,CAAC;AACxG,OAAO,EAAE,mBAAmB,EAAE,MAAM,kFAAkF,CAAC;AAEvH,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAClG,OAAO,EAAE,kCAAkC,EAAE,wBAAwB,EAAE,MAAM,kGAAkG,CAAC;AAChL,OAAO,EAAE,wBAAwB,EAAE,MAAM,+EAA+E,CAAC;AACzH,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,8BAA8B,EAC9B,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,EAC7B,iBAAiB,EACjB,cAAc,EACd,4BAA4B,EAC5B,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAG/B;;;;;;;;;;;;;;GAcG;AAEI,IAAM,qCAAqC,GAA3C,MAAM,qCAAsC,SAAQ,gCAAgC;IAKvB;IACF;IACC;IACI;IACT;IACI;IACF;IACI;IACC;IAGJ;IAf/D,YACqC,MAAqB,EACR,YAAwC,EACxC,YAAiC,EACjB,YAA8C,EAChD,gBAAyC,EACxC,UAA6B,EACzB,eAAoD,EAC7D,YAA0B,EACtB,SAAkC,EACpC,iBAA+C,EAC3C,WAA6C,EAC5C,YAAwC,EAG5C,eAA8C;QAE3G,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,yBAAyB,CAAC,CAAC;QAbL,iBAAY,GAAZ,YAAY,CAAkC;QAChD,qBAAgB,GAAhB,gBAAgB,CAAyB;QACxC,eAAU,GAAV,UAAU,CAAmB;QACzB,oBAAe,GAAf,eAAe,CAAqC;QAC7D,iBAAY,GAAZ,YAAY,CAAc;QACtB,cAAS,GAAT,SAAS,CAAyB;QACpC,sBAAiB,GAAjB,iBAAiB,CAA8B;QAC3C,gBAAW,GAAX,WAAW,CAAkC;QAC5C,iBAAY,GAAZ,YAAY,CAA4B;QAG5C,oBAAe,GAAf,eAAe,CAA+B;IAG7G,CAAC;IAES,WAAW;QACnB,MAAM,QAAQ,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,CAAC;QAC9F,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,0DAA0D,CAAC,CAAC;QAExG,yFAAyF;QACzF,4FAA4F;QAC5F,6FAA6F;QAC7F,8FAA8F;QAC9F,+FAA+F;QAC/F,6FAA6F;QAC7F,2BAA2B;QAC3B,MAAM,kBAAkB,GAAG,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAEvF,MAAM,YAAY,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,CAAC;QACtG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,kBAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,6CAA6C,CAAC,CAAC;QAE9F,gGAAgG;QAChG,+DAA+D;QAC/D,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;QACzG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,kBAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,aAAa,EAAE,kEAAkE,CAAC,CAAC;QAEpH,MAAM,OAAO,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;QAC5F,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,iDAAiD,CAAC,CAAC;QAE7F,6FAA6F;QAC7F,gFAAgF;QAChF,MAAM,YAAY,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,CAAC;QACtG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,kDAAkD,CAAC,CAAC;QAEnG,+FAA+F;QAC/F,MAAM,UAAU,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,CAAC;QAClG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,4CAA4C,CAAC,CAAC;QAE5F,MAAM,WAAW,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;QACpG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC;QAExE,MAAM,SAAS,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,CAAC;QAChG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,uCAAuC,CAAC,CAAC;QAEtF,qGAAqG;QACrG,qGAAqG;QACrG,0FAA0F;QAC1F,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;QACzG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,aAAa,EAAE,iDAAiD,CAAC,CAAC;QAEnG,kGAAkG;QAClG,yFAAyF;QACzF,mFAAmF;QACnF,MAAM,oBAAoB,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,kCAAkC,CAAC,CAAC;QACxH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,EAAE,mDAAmD,CAAC,CAAC;QAE7G,MAAM,WAAW,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;QACpG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,4DAA4D,CAAC,CAAC;QAE7G,iGAAiG;QACjG,2EAA2E;QAC3E,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,CAAC;QACjH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1G,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,EAAE,4CAA4C,CAAC,CAAC;QAClG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,EAAE,8CAA8C,CAAC,CAAC;QACpG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,8CAA8C,CAAC,CAAC;IACzG,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,YAAY,CAAC,GAAY,EAAE,GAAa;QACpD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAuC,CAAC;QACpE,mGAAmG;QACnG,qFAAqF;QACrF,wFAAwF;QACxF,MAAM,oBAAoB,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;QACxH,IAAI,oBAAoB,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,QAAQ,oBAAoB,2CAA2C,CAAC,CAAC;YAC1H,OAAO;QACT,CAAC;QACD,4FAA4F;QAC5F,gGAAgG;QAChG,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5E,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,yDAAyD,CAAC,CAAC;gBAC5G,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,eAAe,CAAC,2BAA2B,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YACjF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/B,MAAM,OAAO,GAAI,KAAgE,CAAC,OAAO,CAAC;oBAC1F,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;wBACxB,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;wBAClH,OAAO;oBACT,CAAC;gBACH,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvD,+FAA+F;YAC/F,kGAAkG;YAClG,mGAAmG;YACnG,oGAAoG;YACpG,yFAAyF;YACzF,MAAM,yBAAyB,GAAG,OAAO,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAC;YACpE,KAAK,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC;gBACvC,QAAQ,EAAE,yBAAyB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAC1D,mBAAmB,EAAE,yBAAyB;gBAC9C,aAAa,EAAE,IAAI,CAAC,eAAe;gBACnC,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;aACvC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;gBAC7F,GAAG,2BAA2B,CAAC,UAAU,CAAC;aAC3C,CAAC,CAAC,CAAC;QACN,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACK,KAAK,CAAC,gBAAgB,CAAC,GAAY,EAAE,GAAa;QACxD,MAAM,CAAC,GAAG,GAAG,CAAC,KAA2C,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,eAAe,EAAE,0BAA0B,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QACnH,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,QAAQ,SAAS,2CAA2C,CAAC,CAAC;YAC/G,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,EAAE,uCAAuC,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,4FAA4F;QAC5F,kGAAkG;QAClG,qGAAqG;QACrG,sGAAsG;QACtG,wGAAwG;QACxG,MAAM,UAAU,GAAG,GAAG,OAAO,mBAAmB,CAAC;QAEjD,oGAAoG;QACpG,qGAAqG;QACrG,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,CAAC;QAElE,IAAI,MAA0B,CAAC;QAC/B,IAAI,SAA6B,CAAC;QAClC,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC,CAAC,aAAa,IAAI,MAAM,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,gCAAgC,CACpE,CAAC,CAAC,aAAa,EACf,cAAc,CAAC,sBAAsB,EACrC,EAAE,cAAc,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,CACzE,CAA+D,CAAC;gBACjE,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;gBACpB,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC;gBACvB,iGAAiG;gBACjG,8FAA8F;gBAC9F,QAAQ,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,gGAAgG;gBAChG,2FAA2F;YAC7F,CAAC;QACH,CAAC;QAED,oGAAoG;QACpG,+FAA+F;QAC/F,MAAM,gBAAgB,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC;QAEtF,kGAAkG;QAClG,IAAI,iBAAqC,CAAC;QAC1C,IAAI,6BAA6B,GAAG,KAAK,CAAC;QAC1C,IAAI,CAAC,CAAC,wBAAwB,EAAE,CAAC;YAC/B,MAAM,WAAW,GAAG,CAAC,gBAAgB;mBAChC,QAAQ,KAAK,SAAS;mBACtB,MAAM,IAAI,CAAC,eAAe,CAAC,iCAAiC,CAAC,QAAQ,EAAE,CAAC,CAAC,wBAAwB,CAAC,CAAC;YACxG,IAAI,WAAW,EAAE,CAAC;gBAChB,iBAAiB,GAAG,CAAC,CAAC,wBAAwB,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,6BAA6B,GAAG,IAAI,CAAC;YACvC,CAAC;QACH,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAErC,uGAAuG;QACvG,mGAAmG;QACnG,sGAAsG;QACtG,8FAA8F;QAC9F,IAAI,iBAAiB,EAAE,CAAC;YACtB,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC1D,CAAC;YACD,8FAA8F;YAC9F,gGAAgG;YAChG,yCAAyC;YACzC,mBAAmB,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;YAClF,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzI,IAAI,QAAa,CAAC;YAClB,IAAI,CAAC;gBACH,QAAQ,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,8FAA8F;gBAC9F,oGAAoG;gBACpG,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;gBAC9B,OAAO;YACT,CAAC;YACD,sGAAsG;YACtG,4EAA4E;YAC5E,IAAI,CAAC,CAAC,KAAK;gBAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACzD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QAED,sGAAsG;QACtG,mGAAmG;QACnG,8FAA8F;QAC9F,8FAA8F;QAC9F,8FAA8F;QAC9F,sGAAsG;QACtG,qGAAqG;QACrG,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;YACxB,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,wBAAwB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAClJ,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,OAAO,uBAAuB,CAAC,CAAC;YAC9D,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;YACxD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QAED,oGAAoG;QACpG,oGAAoG;QACpG,sGAAsG;QACtG,8BAA8B;QAC9B,mBAAmB,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAClF,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC5H,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACK,uBAAuB,CAC7B,GAAY,EACZ,MAAsI;QAEtI,KAAK,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC;YAC5C,GAAG,MAAM;YACT,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;SACvC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yDAAyD,EAAE;YACnG,GAAG,2BAA2B,CAAC,UAAU,CAAC;SAC3C,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACK,KAAK,CAAC,uBAAuB,CAAC,GAAY,EAAE,GAAa;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,EAAE,uCAAuC,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAwB,CAAC;QACrD,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,mCAAmC,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACjF,4FAA4F;QAC5F,IAAI,YAAY,EAAE,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACvE,CAAC;QACD,mBAAmB,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAClF,oGAAoG;QACpG,kGAAkG;QAClG,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,YAAY,EAAE,MAAM;YAC5B,SAAS,EAAE,YAAY,EAAE,SAAS;YAClC,QAAQ,EAAE,YAAY,EAAE,QAAQ;YAChC,iBAAiB,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC;YACnD,6BAA6B,EAAE,YAAY,EAAE,6BAA6B,IAAI,KAAK;SACpF,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,OAAO,mBAAmB,EAAE,CAAC,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,eAAe,CAAC,IAAa,EAAE,GAAa;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,EAAE,8BAA8B,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,qGAAqG;QACrG,wFAAwF;QACxF,kGAAkG;QAClG,8EAA8E;QAC9E,oGAAoG;QACpG,2GAA2G;QAC3G,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,EAAE,uCAAuC,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,0FAA0F;QAC1F,6FAA6F;QAC7F,8FAA8F;QAC9F,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iHAAiH,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAClJ,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QACjD,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;YACpB,MAAM;YACN,sBAAsB,EAAE,GAAG,OAAO,gBAAgB;YAClD,cAAc,EAAE,GAAG,MAAM,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;YAC1G,QAAQ,EAAE,GAAG,MAAM,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;YACnG,iBAAiB,EAAE,GAAG,MAAM,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE;YAChH,mBAAmB,EAAE,GAAG,MAAM,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE;YAChH,sGAAsG;YACtG,qGAAqG;YACrG,kFAAkF;YAClF,+FAA+F;YAC/F,qCAAqC;YACrC,oBAAoB,EAAE,GAAG,MAAM,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;YACtH,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,eAAe,CAAC;YACpF,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,wBAAwB,EAAE,CAAC,OAAO,CAAC;YACnC,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,4FAA4F;YAC5F,gGAAgG;YAChG,+FAA+F;YAC/F,8FAA8F;YAC9F,+FAA+F;YAC/F,yBAAyB;YACzB,gFAAgF;YAChF,8CAA8C,EAAE,IAAI;YACpD,0FAA0F;YAC1F,+FAA+F;YAC/F,+FAA+F;YAC/F,4FAA4F;YAC5F,qCAAqC,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,oBAAoB,CAAC;YAC5F,yFAAyF;YACzF,gGAAgG;YAChG,2FAA2F;YAC3F,6BAA6B,EAAE,IAAI;YACnC;;;;;;;;;;;;;eAaG;YACH,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,uBAAuB,EAAE,CAAC,MAAM,KAAK,eAAe,CAAC,QAAQ;gBAChF,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC;YACpD;;;;;;;;;;eAUG;YACH,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,CAAC,OAAO;gBACjD,CAAC,CAAC,EAAE,qBAAqB,EAAE,GAAG,MAAM,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,EAAE;gBAC1H,CAAC,CAAC,EAAE,CAAC;YACP,uBAAuB,EAAE,CAAC,QAAQ,CAAC;YACnC,qCAAqC,EAAE,CAAC,OAAO,CAAC;YAChD,oGAAoG;YACpG,iGAAiG;YACjG,sGAAsG;YACtG,wGAAwG;YACxG,oGAAoG;YACpG,iGAAiG;YACjG,kGAAkG;YAClG,4EAA4E;YAC5E,gBAAgB,EAAE,CAAC,GAAG,8BAA8B,CAAC;YACrD,gBAAgB,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,gCAAgC,CAAC;SAC3G,EAAE,GAAG,CAAC,CAAC;IACV,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,GAAa;QACnD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QACjD,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,WAAW,CAAC,GAAY,EAAE,GAAa;QACnD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAuC,CAAC;QACpE,gGAAgG;QAChG,gGAAgG;QAChG,yFAAyF;QACzF,MAAM,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QACxL,IAAI,mBAAmB,EAAE,CAAC;YACxB,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,QAAQ,mBAAmB,2CAA2C,CAAC,CAAC;YACzH,OAAO;QACT,CAAC;QACD,iGAAiG;QACjG,+FAA+F;QAC/F,8GAA8G;QAC9G,6GAA6G;QAC7G,6GAA6G;QAC7G,oGAAoG;QACpG,yGAAyG;QACzG,8FAA8F;QAC9F,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAE7C,IAAI,CAAC;YACH,IAAI,KAAc,CAAC;YACnB,IAAI,IAAI,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;gBAC7C,+EAA+E;gBAC/E,yFAAyF;gBACzF,MAAM,kCAAkC,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;gBAC5I,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC5E,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,4BAA4B,CAAC,CAAC;oBAC9E,OAAO;gBACT,CAAC;gBACD,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,2BAA2B,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnH,CAAC;iBAAM,IAAI,IAAI,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;gBACpD,8FAA8F;gBAC9F,2FAA2F;gBAC3F,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC5E,MAAM,iBAAiB,GAAG,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC;gBACrD,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;oBAClF,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,8DAA8D,CAAC,CAAC;oBACjH,OAAO;gBACT,CAAC;gBACD,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,2BAA2B,CAAC;oBAC1D,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,iBAAiB;oBAC3B,WAAW,EAAE,IAAI,CAAC,YAAY;oBAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;oBAChC,4FAA4F;oBAC5F,4DAA4D;oBAC5D,YAAY;oBACZ,wFAAwF;oBACxF,oFAAoF;oBACpF,uDAAuD;oBACvD,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,IAAI,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;gBAC/C,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;oBACxB,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;oBAC9E,OAAO;gBACT,CAAC;gBACD,6FAA6F;gBAC7F,uFAAuF;gBACvF,4FAA4F;gBAC5F,gEAAgE;gBAChE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC5E,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;YACrG,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,EAAE,eAAe,IAAI,CAAC,UAAU,IAAI,EAAE,oBAAoB,CAAC,CAAC;gBAClH,OAAO;YACT,CAAC;YAED,qDAAqD;YACrD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YACrC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC9B,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,OAAO,GAAI,KAAgE,CAAC,OAAO,CAAC;gBAC1F,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;oBACxB,sFAAsF;oBACtF,yFAAyF;oBACzF,yFAAyF;oBACzF,uFAAuF;oBACvF,4FAA4F;oBAC5F,sFAAsF;oBACtF,IAAI,OAAO,CAAC,UAAU,KAAK,gBAAgB,IAAI,IAAI,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;wBACxF,MAAM,wBAAwB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;wBACzE,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,CAAC;wBAC3C,MAAM,gBAAgB,GAAG,eAAe,EAAE,UAAU,CAAC,SAAS,CAAC;4BAC7D,CAAC,CAAC,SAAS;4BACX,CAAC,CAAC,eAAe,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;wBACnE,KAAK,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC;4BACvC,cAAc,EAAE,cAAc;4BAC9B,gBAAgB;4BAChB,MAAM,EAAE,gBAAgB;4BACxB,SAAS,EAAE,QAAQ;yBACpB,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;4BAC7F,GAAG,2BAA2B,CAAC,UAAU,CAAC;yBAC3C,CAAC,CAAC,CAAC;oBACN,CAAC;oBACD,+EAA+E;oBAC/E,iFAAiF;oBACjF,yFAAyF;oBACzF,wFAAwF;oBACxF,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,KAAK,yBAAyB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;oBAC3K,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC,CAAC,gDAAgD;QAC/D,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,wEAAwE;IAChE,gCAAgC;QACtC,MAAM,QAAQ,GAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAoF,EAAE,yBAAyB,CAAC;QAChK,OAAO;YACL,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,KAAK;YACnC,4BAA4B,EAAE,QAAQ,EAAE,4BAA4B,IAAI,EAAE;SAC3E,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACK,KAAK,CAAC,yBAAyB,CAAC,GAAY,EAAE,GAAa;QACjE,MAAM,aAAa,GAAG,IAAI,CAAC,gCAAgC,EAAE,CAAC;QAC9D,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3B,0FAA0F;YAC1F,yFAAyF;YACzF,qDAAqD;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC7C,gGAAgG;QAChG,yEAAyE;QACzE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACrF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,gDAAgD,EAAE,CAAC,CAAC;YAChI,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAEzD,6FAA6F;QAC7F,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;YACtI,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,sBAAsB,EAAE,oDAAoD,CAAC,CAAC;YAC9G,OAAO;QACT,CAAC;QACD,0FAA0F;QAC1F,qFAAqF;QACrF,8FAA8F;QAC9F,2EAA2E;QAC3E,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,sBAAsB,EAAE,kCAAkC,MAAM,EAAE,CAAC,CAAC;YACpG,OAAO;QACT,CAAC;QAED,wGAAwG;QACxG,wGAAwG;QACxG,kGAAkG;QAClG,yGAAyG;QACzG,4EAA4E;QAC5E,IAAI,sBAAsB,GAAa,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,yBAAyB,KAAK,SAAS,EAAE,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAC7I,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,uDAAuD,CAAC,CAAC;gBACpH,OAAO;YACT,CAAC;YACD,MAAM,gBAAgB,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;YACpG,IAAI,gBAAgB,EAAE,CAAC;gBACrB,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,8CAA8C,gBAAgB,EAAE,CAAC,CAAC;gBAC7H,OAAO;YACT,CAAC;YACD,sBAAsB,GAAG,IAAI,CAAC,yBAAyB,CAAC;QAC1D,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAC3F,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACvC,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,yBAAyB,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QAED,2FAA2F;QAC3F,0FAA0F;QAC1F,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,mDAAmD,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QACD,sFAAsF;QACtF,MAAM,eAAe,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,MAAM,cAAc,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,8BAA8B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1G,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,8DAA8D,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACtJ,OAAO;QACT,CAAC;QACD,2CAA2C;QAC3C,EAAE;QACF,gGAAgG;QAChG,6FAA6F;QAC7F,6FAA6F;QAC7F,4FAA4F;QAC5F,8FAA8F;QAC9F,6FAA6F;QAC7F,iFAAiF;QACjF,EAAE;QACF,iGAAiG;QACjG,+FAA+F;QAC/F,iGAAiG;QACjG,6FAA6F;QAC7F,+FAA+F;QAC/F,QAAQ;QACR,EAAE;QACF,gGAAgG;QAChG,mFAAmF;QACnF,6FAA6F;QAC7F,+FAA+F;QAC/F,8EAA8E;QAC9E,EAAE;QACF,6DAA6D;QAC7D,oFAAoF;QACpF,6DAA6D;QAC7D,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;QACjH,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,cAAc,CAAC,kBAAkB,IAAI,KAAK,KAAK,cAAc,CAAC,aAAa,CAAC,CAAC;QAC9I,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,gEAAgE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YACrJ,OAAO;QACT,CAAC;QACD,+FAA+F;QAC/F,MAAM,mBAAmB,GAAG,IAAI,CAAC,0BAA0B,CAAC;QAC5D,IAAI,mBAAmB,KAAK,SAAS,IAAI,mBAAmB,KAAK,4BAA4B,CAAC,IAAI,EAAE,CAAC;YACnG,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,sFAAsF,CAAC,CAAC;YACnJ,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,iCAAiC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAClF,kGAAkG;QAClG,kGAAkG;QAClG,kGAAkG;QAClG,sEAAsE;QACtE,MAAM,yBAAyB,GAAG,uCAAuC,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,gBAAgB,CAAC,yBAAyB,EAAE;YACjG,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,WAAW,CAAC,WAAW;YAC9B,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,aAAa;YAClD,2FAA2F;YAC3F,KAAK,EAAE,EAAE;YACT,aAAa,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,8BAA8B,CAAC;YACjG,aAAa,EAAE,CAAC,cAAc,CAAC,kBAAkB,CAAC;YAClD,YAAY;YACZ,sBAAsB;YACtB,uBAAuB,EAAE,4BAA4B,CAAC,IAAI;YAC1D,6FAA6F;YAC7F,6FAA6F;YAC7F,eAAe,EAAE,IAAI;YACrB,kBAAkB,EAAE,6BAA6B,CAAC,OAAO;YACzD,YAAY,EAAE,cAAc,CAAC,YAAY;YACzC,YAAY,EAAE,cAAc,CAAC,YAAY;YACzC,2BAA2B,EAAE,yBAAyB,CAAC,2BAA2B;YAClF,6BAA6B,EAAE,yBAAyB,CAAC,6BAA6B;SACvF,EAAE;YACD,oEAAoE;YACpE,2FAA2F;YAC3F,4EAA4E;YAC5E,4BAA4B,EAAE;gBAC5B,oBAAoB,EAAE,cAAc,EAAE,cAAc;gBACpD,0FAA0F;gBAC1F,yFAAyF;gBACzF,4FAA4F;gBAC5F,0CAA0C;gBAC1C,6BAA6B,EAAE,+BAA+B;aAC/D;SACF,CAAoB,CAAC;QAEtB,6FAA6F;QAC7F,gGAAgG;QAChG,2CAA2C;QAC3C,KAAK,IAAI,CAAC,SAAS,CAAC,0BAA0B,CAAC;YAC7C,QAAQ,EAAE,OAAO,CAAC,GAAG;YACrB,UAAU;YACV,YAAY;YACZ,sBAAsB;YACtB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yDAAyD,EAAE;YACnG,GAAG,2BAA2B,CAAC,UAAU,CAAC;SAC3C,CAAC,CAAC,CAAC;QAEJ,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,+FAA+F;QAC/F,8FAA8F;QAC9F,0EAA0E;QAC1E,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;YACpB,SAAS,EAAE,OAAO,CAAC,GAAG;YACtB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAClD,WAAW,EAAE,UAAU;YACvB,aAAa,EAAE,YAAY;YAC3B,yBAAyB,EAAE,sBAAsB;YACjD,WAAW,EAAE,CAAC,cAAc,CAAC,kBAAkB,CAAC;YAChD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,4BAA4B,CAAC,IAAI;YAC7D,KAAK,EAAE,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,8BAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACrG,6FAA6F;YAC7F,uCAAuC;YACvC,yBAAyB,EAAE,yBAAyB,CAAC,UAAU;YAC/D,uBAAuB,EAAE,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC;SACjE,EAAE,GAAG,CAAC,CAAC;IACV,CAAC;IAED;;;;;OAKG;IACK,qBAAqB,CAAC,QAAgB;QAC5C,MAAM,QAAQ,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,CAAC;QACxG,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,CAAC;QAClE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;IACnF,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACK,yBAAyB,CAAC,GAAa,EAAE,QAAa;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,EAAE,8BAA8B,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;IAED,yFAAyF;IACzF;;kFAE8E;IAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACK,KAAK,CAAC,+BAA+B,CAC3C,GAAY,EACZ,GAAa;QAEb,IAAI,CAAC,IAAI,CAAC,gCAAgC,EAAE,CAAC,OAAO,EAAE,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;YAC1E,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;YACvC,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,mCAAmC,CAAC,GAAG,EAAE,yCAAyC,CAAC,CAAC;YACzF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,mCAAmC,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CACjD,gBAAgB,CAAC,yBAAyB,EAC1C,QAAQ,CACT,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,mCAAmC,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,MAAM,CAAC,kBAAkB,KAAK,6BAA6B,CAAC,OAAO,EAAE,CAAC;YACxE,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,yDAAyD,EAAE,CAAC,CAAC;YAC/H,OAAO,IAAI,CAAC;QACd,CAAC;QAED;;;;;;;;;;WAUG;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;YAC/C,IAAI,CAAC,mCAAmC,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;YACnF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,2BAA2B,CAAC;QACtD,6FAA6F;QAC7F,8FAA8F;QAC9F,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,mCAAmC,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;YACnF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACK,wBAAwB,CAAC,SAAiB,EAAE,UAAkB;QACpE,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;QACnF,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,eAAe,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACjG,OAAO,eAAe,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IACxD,CAAC;IAED;;;;;OAKG;IACK,mCAAmC,CAAC,GAAa,EAAE,WAAmB;QAC5E,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,8BAA8B,CAAC,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;;;OASG;IACK,yBAAyB,CAAC,QAAgB,EAAE,MAA8B;QAChF,OAAO;YACL,SAAS,EAAE,QAAQ;YACnB,WAAW,EAAE,MAAM,CAAC,IAAI;YACxB,aAAa,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YACxC,yBAAyB,EAAE,MAAM,CAAC,sBAAsB,IAAI,EAAE;YAC9D,WAAW,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;YACvC,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;YAC1D,KAAK,EAAE,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7C,uBAAuB,EAAE,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC;SAC9D,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,6BAA6B,CAAC,GAAY,EAAE,GAAa;QACrE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3E,IAAI,CAAC,aAAa;YAAE,OAAO;QAE3B,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,yBAAyB,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3G,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,+BAA+B,CAAC,GAAY,EAAE,GAAa;QACvE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3E,IAAI,CAAC,aAAa;YAAE,OAAO;QAC3B,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC;QAE3C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAEzD,gGAAgG;QAChG,0FAA0F;QAC1F,0FAA0F;QAC1F,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,mEAAmE,CAAC,CAAC;YAChI,OAAO;QACT,CAAC;QAED,gGAAgG;QAChG,2FAA2F;QAC3F,gGAAgG;QAChG,gGAAgG;QAChG,MAAM,SAAS,GAAG,CAAC,2BAA2B,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,qBAAqB,CAAC;aAC1H,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC;QAC9C,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,GAAG,SAAS,4CAA4C,CAAC,CAAC;YACrH,OAAO;QACT,CAAC;QAED,iGAAiG;QACjG,8FAA8F;QAC9F,6FAA6F;QAC7F,+FAA+F;QAC/F,mFAAmF;QACnF,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,6CAA6C,CAAC,CAAC;YAC1G,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;YACtI,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,sBAAsB,EAAE,oDAAoD,CAAC,CAAC;YAC9G,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,sBAAsB,EAAE,kCAAkC,MAAM,EAAE,CAAC,CAAC;YACpG,OAAO;QACT,CAAC;QAED,qFAAqF;QACrF,IAAI,sBAAsB,GAAa,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,yBAAyB,KAAK,SAAS,EAAE,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAC7I,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,uDAAuD,CAAC,CAAC;gBACpH,OAAO;YACT,CAAC;YACD,MAAM,gBAAgB,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;YACpG,IAAI,gBAAgB,EAAE,CAAC;gBACrB,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,8CAA8C,gBAAgB,EAAE,CAAC,CAAC;gBAC7H,OAAO;YACT,CAAC;YACD,sBAAsB,GAAG,IAAI,CAAC,yBAAyB,CAAC;QAC1D,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAC3F,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACvC,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,yBAAyB,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QAED,8FAA8F;QAC9F,uFAAuF;QACvF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,mDAAmD,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QACD,MAAM,eAAe,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,MAAM,cAAc,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,8BAA8B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1G,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,8DAA8D,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACtJ,OAAO;QACT,CAAC;QACD,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;QACjH,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,cAAc,CAAC,kBAAkB,IAAI,KAAK,KAAK,cAAc,CAAC,aAAa,CAAC,CAAC;QAC9I,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,gEAAgE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YACrJ,OAAO;QACT,CAAC;QACD,MAAM,mBAAmB,GAAG,IAAI,CAAC,0BAA0B,CAAC;QAC5D,IAAI,mBAAmB,KAAK,SAAS,IAAI,mBAAmB,KAAK,4BAA4B,CAAC,IAAI,EAAE,CAAC;YACnG,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,sFAAsF,CAAC,CAAC;YACnJ,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CACpD,gBAAgB,CAAC,yBAAyB,EAC1C,QAAQ,EACR;YACE,IAAI,EAAE,UAAU;YAChB,YAAY;YACZ,sBAAsB;YACtB,aAAa,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,8BAA8B,CAAC;SAClG,CACF,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,mCAAmC,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,iGAAiG;QACjG,6FAA6F;QAC7F,kGAAkG;QAClG,6CAA6C;QAC7C,KAAK,IAAI,CAAC,SAAS,CAAC,0BAA0B,CAAC;YAC7C,QAAQ;YACR,UAAU;YACV,YAAY;YACZ,sBAAsB;YACtB,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;SACvC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mEAAmE,EAAE;YAC7G,GAAG,2BAA2B,CAAC,UAAU,CAAC;SAC3C,CAAC,CAAC,CAAC;QAEJ,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAClG,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACK,KAAK,CAAC,+BAA+B,CAAC,GAAY,EAAE,GAAa;QACvE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3E,IAAI,CAAC,aAAa;YAAE,OAAO;QAC3B,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC;QAEnC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAC1D,gBAAgB,CAAC,yBAAyB,EAC1C,QAAQ,EACR,EAAE,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE,CACvC,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,mCAAmC,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAEO,qBAAqB,CAAC,GAAa,EAAE,KAAa,EAAE,WAAmB;QAC7E,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,6BAA6B,CAAC,QAA4B,EAAE,aAA8C;QACtH,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,8BAA8B,QAAQ,IAAI,SAAS,EAAE,CAAC;YAClE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACpE,OAAO,KAAK,IAAI,aAAa,CAAC,4BAA4B,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gEAAgE,EAAE;gBACjF,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa;QACvD,MAAM,CAAC,GAAG,GAAG,CAAC,KAA2C,CAAC;QAE1D,8FAA8F;QAC9F,iGAAiG;QACjG,4EAA4E;QAC5E,MAAM,uBAAuB,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9L,IAAI,uBAAuB,EAAE,CAAC;YAC5B,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,QAAQ,uBAAuB,2CAA2C,CAAC,CAAC;YAC7H,OAAO;QACT,CAAC;QAED,IAAI,CAAC,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YAC/B,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,2BAA2B,EAAE,sCAAsC,CAAC,CAAC;YACnG,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;YACpC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;YAC5F,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,qBAAqB,KAAK,MAAM,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC;YACtF,qGAAqG;YACrG,uGAAuG;YACvG,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,wCAAwC,CAAC,CAAC;YAC3F,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,2FAA2F;YAC3F,8FAA8F;YAC9F,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,+DAA+D,CAAC,CAAC;YACjH,OAAO;QACT,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC;QAE5C,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,6FAA6F;YAC7F,kFAAkF;YAClF,4FAA4F;YAC5F,uFAAuF;YACvF,+FAA+F;YAC/F,2FAA2F;YAC3F,oGAAoG;YACpG,gGAAgG;YAChG,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,iCAAiC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACzH,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,cAAc,CAAC;YACvD,kGAAkG;YAClG,oGAAoG;YACpG,qGAAqG;YACrG,0GAA0G;YAC1G,MAAM,YAAY,GAAG,eAAe;mBAC/B,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YACnG,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC;oBACvE,MAAM;oBACN,QAAQ,EAAE,CAAC,CAAC,SAAS;oBACrB,WAAW,EAAE,CAAC,CAAC,YAAY;oBAC3B,KAAK;oBACL,aAAa,EAAE,CAAC,CAAC,cAAc;oBAC/B,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,KAAK,EAAE,CAAC,CAAC,KAAK;iBACf,CAAC,CAAC;gBACH,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBACrC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;oBACpB,gBAAgB,EAAE,IAAI;oBACtB,aAAa,EAAE,YAAY;oBAC3B,MAAM,EAAE;wBACN,EAAE,EAAE,CAAC,CAAC,SAAS;wBACf,IAAI,EAAE,UAAU;wBAChB;;;;;;;;;;;;;;;2BAeG;wBACH,MAAM,EAAE,cAAc,CAAC,MAAM;wBAC7B,qBAAqB,EAAE,cAAc,CAAC,mBAAmB;wBACzD,uBAAuB,EAAE,cAAc,CAAC,0BAA0B;qBACnE;oBACD,MAAM,EAAE,KAAK;oBACb,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;iBAC7B,EAAE,GAAG,CAAC,CAAC;gBACR,OAAO;YACT,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,sBAAsB,CAAC;gBACjE,MAAM;gBACN,QAAQ,EAAE,CAAC,CAAC,SAAS;gBACrB,WAAW,EAAE,CAAC,CAAC,YAAY;gBAC3B,KAAK;gBACL,aAAa,EAAE,CAAC,CAAC,cAAc;gBAC/B,mBAAmB,EAAE,MAAM;gBAC3B,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,0FAA0F;gBAC1F,+FAA+F;gBAC/F,0FAA0F;gBAC1F,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,6FAA6F;gBAC7F,8FAA8F;gBAC9F,SAAS;aACV,CAAC,CAAC;YACH,gGAAgG;YAChG,qGAAqG;YACrG,qGAAqG;YACrG,8FAA8F;YAC9F,IAAI,QAAa,CAAC;YAClB,IAAI,CAAC;gBACH,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,2DAA2D,CAAC,CAAC;gBAC9G,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxC,IAAI,CAAC,CAAC,KAAK;gBAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACzD,oGAAoG;YACpG,+FAA+F;YAC/F,kGAAkG;YAClG,2FAA2F;YAC3F,IAAI,CAAC,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,GAAG,GAAI,KAAgE,CAAC,OAAO,CAAC;gBACtF,IAAI,GAAG,EAAE,UAAU,EAAE,CAAC;oBACpB,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;oBACtG,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,qBAAqB,CAAC,GAAY,EAAE,GAAa;QAC7D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAuC,CAAC;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,eAAe,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5F,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,QAAQ,SAAS,2CAA2C,CAAC,CAAC;YAC/G,OAAO;QACT,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,8DAA8D,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;YAC5F,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACrF,+FAA+F;YAC/F,8FAA8F;YAC9F,oEAAoE;YACpE,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,wGAAwG;gBACxG,0FAA0F;gBAC1F,gGAAgG;gBAChG,6FAA6F;gBAC7F,sGAAsG;gBACtG,KAAK,IAAI,CAAC,SAAS,CAAC,+BAA+B,CAAC;oBAClD,mBAAmB,EAAE,MAAM;oBAC3B,WAAW,EAAE,OAAO,CAAC,MAAM;oBAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;iBACvC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+DAA+D,EAAE;oBACzG,GAAG,2BAA2B,CAAC,UAAU,CAAC;iBAC3C,CAAC,CAAC,CAAC;gBACJ,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,+DAA+D,CAAC,CAAC;gBAChH,OAAO;YACT,CAAC;YACD,uGAAuG;YACvG,0GAA0G;YAC1G,iGAAiG;YACjG,mFAAmF;YACnF,IAAI,QAAa,CAAC;YAClB,IAAI,CAAC;gBACH,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,mEAAmE,CAAC,CAAC;gBACtH,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,KAAK;gBAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACrE,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAErC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAChC,iEAAiE;gBACjE,6GAA6G;gBAC7G,wFAAwF;gBACxF,KAAK,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC;oBACxC,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,MAAM,EAAE,OAAO,CAAC,KAAK;oBACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;iBACvC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE;oBAC9F,GAAG,2BAA2B,CAAC,UAAU,CAAC;iBAC3C,CAAC,CAAC,CAAC;gBACJ,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;gBACpD,6FAA6F;gBAC7F,qEAAqE;gBACrE,IAAI,CAAC,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,sBAAsB,CAAC;gBACjE,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,mBAAmB,EAAE,MAAM;gBAC3B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,2FAA2F;gBAC3F,+FAA+F;gBAC/F,2FAA2F;gBAC3F,0EAA0E;gBAC1E,SAAS;aACV,CAAC,CAAC;YACH,4GAA4G;YAC5G,sGAAsG;YACtG,uGAAuG;YACvG,kFAAkF;YAClF,KAAK,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC;gBACzC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,KAAK;gBACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,UAAU,EAAE,IAAI,CAAC,QAAQ,KAAK,MAAM;gBACpC,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;aACvC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE;gBAC/F,GAAG,2BAA2B,CAAC,UAAU,CAAC;aAC3C,CAAC,CAAC,CAAC;YACJ,kGAAkG;YAClG,iGAAiG;YACjG,uEAAuE;YACvE,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBAC7B,MAAM,IAAI,CAAC,eAAe;qBACvB,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;qBACrF,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE,EAAE,GAAG,2BAA2B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAChI,CAAC;YACD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxC,IAAI,CAAC,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,GAAG,GAAI,KAAgE,CAAC,OAAO,CAAC;gBACtF,IAAI,GAAG,EAAE,UAAU,EAAE,CAAC;oBACpB,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;oBACtG,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,cAAc,CAAC,GAAY,EAAE,GAAa;QACtD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,mCAAmC,EAAE,QAAQ,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QACD,IAAI,KAAyE,CAAC;QAC9E,IAAI,CAAC;YACH,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAiB,CAAC;QACpG,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,iCAAiC,EAAE,QAAQ,CAAC,CAAC;YAC5F,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC;QACtC,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,8BAA8B,CAAC,YAAY,EAAE,CAAC;YACvE,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE,uCAAuC,EAAE,QAAQ,CAAC,CAAC;YACvG,OAAO;QACT,CAAC;QACD,8FAA8F;QAC9F,8FAA8F;QAC9F,4FAA4F;QAC5F,gCAAgC;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACtF,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,wBAAwB,CAAC,GAAY;QACjD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAA2D,CAAC;YAClJ,IAAI,KAAK,CAAC,IAAI,KAAK,8BAA8B,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAClG,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,wBAAwB,CAAC,GAAY,EAAE,IAAwC;QACrF,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjG,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,OAAO;oBACL,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,SAAS;oBAC5C,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,SAAS;iBAClD,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,SAAS,EAAE,CAAC;IAClG,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,mBAAmB,CAAC,MAA+B,EAAE,IAAc;QACzE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;IACpF,CAAC;IAEO,cAAc,CAAC,GAAa,EAAE,MAAc,EAAE,KAAa,EAAE,WAAoB,EAAE,eAAoC;QAC7H,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,2FAA2F;QAC3F,0DAA0D;QAC1D,MAAM,MAAM,GAAG,eAAe,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACzE,IAAI,MAAM;YAAE,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;CACF,CAAA;AA1pDY,qCAAqC;IADjD,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;IAC7C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAC5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAChD,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IACzC,YAAA,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;IAC7C,YAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAG9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;qCAdA,aAAa;QACM,0BAA0B;QAC1B,mBAAmB;QACH,gCAAgC;QAC9B,uBAAuB;QAC5B,iBAAiB;QACR,mCAAmC;QAC/C,YAAY;QACX,uBAAuB;QACjB,4BAA4B;QAC9B,gCAAgC;GAZpG,qCAAqC,CA0pDjD","sourcesContent":["import 'reflect-metadata';\nimport { timingSafeEqual } from 'node:crypto';\nimport { inject, injectable } from 'inversify';\nimport type { Request, Response } from 'express';\nimport cors from 'cors';\nimport { AbstractControllerBackendService } from '~wildo-backend-lib/base-classes/services/controllers/abstract-controller.backend.service';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ErrorHandlerService } from '~wildo-backend-lib/errors/services/error-handler.backend.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { OAuthProviderTokenBackendService } from '~wildo-backend-lib/security/authentications/services/oauth-provider-token.backend.service';\nimport { OidcAuthorizationCodeBackendService } from '~wildo-backend-lib/security/authentications/services/oidc-authorization-code.backend.service';\nimport { OidcUserClaimsBackendService, OIDC_SUPPORTED_IDENTITY_SCOPES, OIDC_SCOPE_GATED_IDENTITY_CLAIMS } from '~wildo-backend-lib/security/authentications/services/oidc-user-claims.backend.service';\nimport { CimdTrustPolicy } from '~wildo-backend-lib/security/authentications/models/cimd.backend.schemas';\nimport type { DynamicClientRegistrationConfig } from '~wildo-backend-lib/security/authentications/models/cimd.backend.schemas';\nimport { generateOAuthClientSecretMaterial, generateRegistrationAccessTokenMaterial, hashRegistrationAccessToken } from '~wildo-backend-lib/security/oauth-clients/oauth-client-generation.backend.utils';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport { CimdClientMetadataBackendService } from '~wildo-backend-lib/security/authentications/services/cimd-client-metadata.backend.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport { JwtPrivateKeys } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport { AuthControllerUtils } from '~wildo-backend-lib/security/authentications/services/utils/auth-controller.utils';\nimport type { AuthTokenIssuerBackendService } from '~wildo-backend-lib/security/authentications/services/auth-token-issuer.backend.service';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { getClientIpFromRequest } from '~wildo-backend-lib/runtime/utils/request-client-ip.utils';\nimport { assertMachineAuthAttemptWithinRate, recordMachineAuthFailure } from '~wildo-backend-lib/security/authentications/services/utils/machine-auth-rate-limit.backend.utils';\nimport { isValidS256CodeChallenge } from '~wildo-backend-lib/security/authentications/services/utils/pkce.backend.utils';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport {\n ApiKeyScope,\n CoreResourceType,\n ExecutionContext_ExecutionType,\n MANUAL_CONTROLLER_ROUTES_URLS,\n ManualControllerRouteKey,\n OAuthClientRegistrationOrigin,\n OAuthClientStatus,\n OAuthGrantType,\n OAuthTokenEndpointAuthMethod,\n isSafeOAuthRedirectUri,\n isWildoBackendError,\n} from '@wildo-ai/saas-models';\nimport type { OAuthClientApplication } from '@wildo-ai/saas-models';\n\n/*\n OAuth 2.0 Authorization Server endpoints (Wildo-AS-PROVIDER). A THIN transport wrapper\n * over {@link OAuthProviderTokenBackendService} — it parses the request per RFC 6749 and\n * renders the §5.1 success / §5.2 error body; all verification + issuance logic lives in\n * the (unit-tested) service.\n \n Deliberately SEPARATE from the RP-side `AuthenticationControllerBackendService`\n * (Wildo-as-client) per the framework's semantic-distinction rule. The OIDC branch adds\n * `/.well-known/openid-configuration`, `/jwks`, `authorize`, and `userinfo` alongside this\n * token endpoint here.\n \n NOTE: `setupRoutes()` runs inside the `super()` constructor (before this subclass's field\n * initializers), so it only BINDS handlers — `this.tokenService` is read at REQUEST time,\n * by which point the field is set. This is the standard manual-controller pattern.\n /\n@injectable()\nexport class OAuthProviderControllerBackendService extends AbstractControllerBackendService {\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ErrorHandlerService) errorHandler: ErrorHandlerService,\n @inject(SAAS_SERVICE_TYPES.OAuthProviderToken) private readonly tokenService: OAuthProviderTokenBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.JwtBackendService) private readonly jwtService: JwtBackendService,\n @inject(SAAS_SERVICE_TYPES.OidcAuthorizationCode) private readonly authCodeService: OidcAuthorizationCodeBackendService,\n @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) private readonly auditLogs: AuditLogsBackendService,\n @inject(SAAS_SERVICE_TYPES.OidcUserClaims) private readonly userClaimsService: OidcUserClaimsBackendService,\n @inject(SAAS_SERVICE_TYPES.CimdClientMetadata) private readonly cimdService: CimdClientMetadataBackendService,\n @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccess: SystemAccessBackendService,\n // revocation-C: the per-session revocation writer the `/oauth/end-session` handler calls to terminate\n // the OP session named by an id_token's `sid`. Appended LAST so the existing positional DI is untouched.\n @inject(SAAS_SERVICE_TYPES.AuthTokenIssuer) private readonly authTokenIssuer: AuthTokenIssuerBackendService,\n ) {\n super(logger, errorBuilder, errorHandler, 'OAuthProviderController');\n }\n\n protected setupRoutes(): void {\n const tokenUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_TOKEN];\n this.router.post(tokenUrl, this.asyncHandler(this.handleToken.bind(this)));\n this.logRouteRegistration('POST', tokenUrl, 'OAuth 2.0 token endpoint (grant_type=client_credentials)');\n\n // OIDC discovery + JWKS are PUBLIC, non-credentialed metadata that clients (incl. future\n // browser SPAs doing authorization_code) fetch cross-origin. Per OIDC/OAuth convention they\n // must be readable from ANY origin, so they get their own permissive-GET CORS that overrides\n // the app-global frontend-origin allowlist. `origin:''` is safe here BECAUSE these responses\n // carry NO credentials and NO secrets (public keys + public metadata only). The token endpoint\n // is deliberately NOT included — it is a server-side credential endpoint and stays under the\n // restrictive global CORS.\n const publicMetadataCors = cors({ origin: '', methods: ['GET'], credentials: false });\n\n const discoveryUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_DISCOVERY];\n this.router.get(discoveryUrl, publicMetadataCors, this.asyncHandler(this.handleDiscovery.bind(this)));\n this.logRouteRegistration('GET', discoveryUrl, 'OIDC discovery document (public, CORS-open)');\n\n // RFC 8414 alias: many OAuth/MCP clients probe `/.well-known/oauth-authorization-server` FIRST.\n // Serve the SAME discovery document there (public, CORS-open).\n const asMetadataUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_AS_METADATA];\n this.router.get(asMetadataUrl, publicMetadataCors, this.asyncHandler(this.handleDiscovery.bind(this)));\n this.logRouteRegistration('GET', asMetadataUrl, 'RFC 8414 authorization-server metadata alias (public, CORS-open)');\n\n const jwksUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_JWKS];\n this.router.get(jwksUrl, publicMetadataCors, this.asyncHandler(this.handleJwks.bind(this)));\n this.logRouteRegistration('GET', jwksUrl, 'JSON Web Key Set (jwks_uri) (public, CORS-open)');\n\n // authorize is a browser-redirect endpoint (no CORS). userinfo is bearer-credentialed, so it\n // stays under the restrictive global CORS (NOT the public-metadata origin:'').\n const authorizeUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_AUTHORIZE];\n this.router.get(authorizeUrl, this.asyncHandler(this.handleAuthorize.bind(this)));\n this.logRouteRegistration('GET', authorizeUrl, 'OIDC authorization endpoint (authorization_code)');\n\n // S1: interactive-consent decision endpoint — the approve/deny for a `requiresConsent` client.\n const consentUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_CONSENT];\n this.router.post(consentUrl, this.asyncHandler(this.handleConsentDecision.bind(this)));\n this.logRouteRegistration('POST', consentUrl, 'OIDC interactive-consent decision endpoint');\n\n const userInfoUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_USERINFO];\n this.router.get(userInfoUrl, this.asyncHandler(this.handleUserInfo.bind(this)));\n this.logRouteRegistration('GET', userInfoUrl, 'OIDC UserInfo endpoint');\n\n const revokeUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_REVOKE];\n this.router.post(revokeUrl, this.asyncHandler(this.handleRevoke.bind(this)));\n this.logRouteRegistration('POST', revokeUrl, 'OAuth 2.0 token revocation (RFC 7009)');\n\n // OIDC RP-Initiated Logout (revocation-C). A GET browser-redirect endpoint like `authorize` — the RP\n // navigates the user's browser here, so it takes NO CORS (a top-level navigation, not an XHR) and no\n // Bearer middleware (the `id_token_hint` IS the credential, verified inside the handler).\n const endSessionUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION];\n this.router.get(endSessionUrl, this.asyncHandler(this.handleEndSession.bind(this)));\n this.logRouteRegistration('GET', endSessionUrl, 'OIDC RP-Initiated Logout (end_session_endpoint)');\n\n // §6 logout-confirmation decision — the POST the frontend `/oauth/logout-confirm` prompt calls to\n // actually terminate the session. Token-authorized (no Bearer / no CORS); the single-use\n // `OIDC_LOGOUT_CONFIRMATION` token minted by `handleEndSession` is the credential.\n const endSessionConfirmUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION_CONFIRM];\n this.router.post(endSessionConfirmUrl, this.asyncHandler(this.handleEndSessionConfirm.bind(this)));\n this.logRouteRegistration('POST', endSessionConfirmUrl, 'OIDC RP-Initiated Logout §6 confirmation decision');\n\n const registerUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER];\n this.router.post(registerUrl, this.asyncHandler(this.handleDynamicRegistration.bind(this)));\n this.logRouteRegistration('POST', registerUrl, 'RFC 7591 dynamic client registration (404 unless opted in)');\n\n // RFC 7592 §2: ONE client configuration endpoint, three methods. Registered unconditionally like\n // `/oauth/register` above and gated by the same opt-in inside the handler.\n const registerClientUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER_CLIENT];\n this.router.get(registerClientUrl, this.asyncHandler(this.handleClientConfigurationRead.bind(this)));\n this.router.put(registerClientUrl, this.asyncHandler(this.handleClientConfigurationUpdate.bind(this)));\n this.router.delete(registerClientUrl, this.asyncHandler(this.handleClientConfigurationDelete.bind(this)));\n this.logRouteRegistration('GET', registerClientUrl, 'RFC 7592 client read (404 unless opted in)');\n this.logRouteRegistration('PUT', registerClientUrl, 'RFC 7592 client update (404 unless opted in)');\n this.logRouteRegistration('DELETE', registerClientUrl, 'RFC 7592 client delete (404 unless opted in)');\n }\n\n /*\n `POST /oauth/revoke` — RFC 7009 token revocation. Revokes the presented `token` (a user\n * refresh token). Per §2.2 the endpoint returns 200 even for an unknown/invalid token (no\n * token-status oracle).\n \n F-OIDC-6 (RFC 7009 §2.1 client authentication): when the request carries client credentials\n * (`client_secret_basic` via the Authorization header, or `client_secret_post` in the body), the\n * client is authenticated FIRST — a bad secret is `invalid_client` (401) and NO revocation happens.\n * An UNauthenticated revoke stays allowed: §2.1 permits it for a public client, and Wildo's refresh\n * tokens are first-party session tokens that no OAuth client owns, so there is no client↔token\n * binding to additionally enforce. A `client_secret` presented WITHOUT a `client_id` is\n * `invalid_request` (400) — an unnamed client cannot be authenticated.\n /\n private async handleRevoke(req: Request, res: Response): Promise<void> {\n const body = (req.body ?? {}) as Record<string, string \| undefined>;\n // A repeated body param (Express parses `k=a&k=b` into a string[] despite the cast) is a malformed\n // request. Reject cleanly (400) so an array never reaches `hashOAuthClientSecret` or\n // `revokeRefreshToken` (which would 500), consistent with the token/authorize handlers.\n const malformedRevokeParam = this.firstMalformedParam(body, ['token', 'token_type_hint', 'client_id', 'client_secret']);\n if (malformedRevokeParam) {\n this.sendOAuthError(res, 400, 'invalid_request', `the '${malformedRevokeParam}' parameter must be a single string value`);\n return;\n }\n // `extractClientCredentials` already resolves the client id from Basic-header-or-body, so a\n // present `clientSecret` with an absent `clientId` means a secret was posted with no id at all.\n const { clientId, clientSecret } = this.extractClientCredentials(req, body);\n if (clientSecret) {\n if (!clientId) {\n this.sendOAuthError(res, 400, 'invalid_request', 'client_id is required when a client_secret is presented');\n return;\n }\n try {\n await this.authCodeService.verifyPresentedClientSecret(clientId, clientSecret);\n } catch (error) {\n if (isWildoBackendError(error)) {\n const context = (error as { context?: { oauthError?: string; detail?: string } }).context;\n if (context?.oauthError) {\n this.sendOAuthError(res, context.oauthError === 'invalid_client' ? 401 : 400, context.oauthError, context.detail);\n return;\n }\n }\n throw error;\n }\n }\n if (body.token) {\n await this.tokenService.revokeRefreshToken(body.token);\n // A-5: audit the revocation ATTEMPT. RFC 7009 is a no-oracle (200 for unknown tokens), so this\n // records the presented client (if a confidential client authenticated above) + hint, never whose\n // token it was or whether it existed. Reaching here with a `clientSecret` means it verified (a bad\n // secret returned early above). Fire-and-forget — auditing must never affect the RFC 7009 response.\n // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — token lifecycle (revocation).\n const revokeClientAuthenticated = Boolean(clientId && clientSecret);\n void this.auditLogs.logOAuthTokenRevoked({\n clientId: revokeClientAuthenticated ? clientId : undefined,\n clientAuthenticated: revokeClientAuthenticated,\n tokenTypeHint: body.token_type_hint,\n ipAddress: getClientIpFromRequest(req),\n }).catch((auditError) => this.logger.warn('OAUTH_TOKEN_REVOKED audit emit failed (non-fatal)', {\n ...projectCaughtErrorLogFields(auditError),\n }));\n }\n res.set('Cache-Control', 'no-store');\n res.status(200).json({});\n }\n\n /\n `GET /oauth/end-session` — OIDC RP-Initiated Logout 1.0 (revocation-C). A relying party redirects the\n * End-User's browser here to terminate their Wildo OP login session. This is a top-level BROWSER\n * navigation (not an XHR), so it answers with a real 302 redirect — unlike `authorize`/`decision`, which\n * return JSON to a Bearer SPA.\n \n Flow:\n * 1. Verify the `id_token_hint` — a token WE minted (signature + our public issuer), TOLERATING expiry\n * (§2: the hint may be a previously issued, possibly-expired ID token) and audience (its `aud` is the\n * RP, validated by the allowlist below, not the first-party `AUTH_TOKEN`).\n * 2. Extract `sub` (user), `sid` (the session), `azp` (the relying party); validate a presented\n * `post_logout_redirect_uri` against the RP's registered allowlist (EXACT match, `client_id`/`azp` agree).\n * 3. Branch on trust — the §6 logout-confirmation posture (Keycloak-style: skip the prompt for a trusted RP):\n * a. TRUSTED RP (valid hint + exact-match registered redirect) → terminate THAT session inline\n * (`invalidateSession(sid)`, per-session — its access + refresh die on the next request across every\n * front, other sessions live), clear the refresh cookie, and 302 to the RP echoing `state` (§3). No\n * prompt: a known RP presenting an id_token we signed is trusted to log the user out directly.\n * b. NON-trusted but a real session was identified (a valid hint whose redirect is absent / unregistered /\n * mismatched) → do NOT terminate; mint a single-use `OIDC_LOGOUT_CONFIRMATION` token naming the session\n * and 302 to the frontend `/oauth/logout-confirm` §6 prompt. Termination happens at\n * `POST /oauth/end-session/confirm` on the End-User's explicit confirm — this closes the BROWSER-based\n * logout-CSRF vector §6 targets (a cross-origin page cannot read the token to complete the confirm; see\n * `handleEndSessionConfirm` for the full threat model, incl. what it deliberately does NOT defend).\n * c. Nothing to terminate (no / unverifiable / forged hint) → clear the cookie and land on the OP's\n * signed-out page (`/oauth/logged-out`, §5). No prompt — there is nothing to confirm.\n * 4. Audit the logout (`OAUTH_RP_INITIATED_LOGOUT`) at each terminal disposition — for the prompt path (b)\n * that is the confirm endpoint, when the session actually ends.\n \n The signed-out landing (`/oauth/logged-out`) is UNIFORM across the confirm result of (b) and case (c), so\n * the response is not an oracle for whether a session existed. RP-Initiated Logout forbids acting on an\n * invalid hint; RP token revocation is out of scope (RFC 7009); delegated tokens are left to expire.\n * spec-cite: OpenID Connect RP-Initiated Logout 1.0 §2 (the OP terminates the End-User's session; the\n * `id_token_hint` need not be current — \"even when the exp time has passed\"; `post_logout_redirect_uri`\n * MUST have been registered) and §3 (the OP MUST NOT redirect unless the value EXACTLY matches a\n * registered `post_logout_redirect_uri`).\n * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — per-session revocation (RP-Initiated Logout).\n /\n private async handleEndSession(req: Request, res: Response): Promise<void> {\n const q = req.query as Record<string, string \| undefined>;\n const malformed = this.firstMalformedParam(q, ['id_token_hint', 'post_logout_redirect_uri', 'client_id', 'state']);\n if (malformed) {\n this.sendOAuthError(res, 400, 'invalid_request', `the '${malformed}' parameter must be a single string value`);\n return;\n }\n const appBase = this.appConfigService.resolveAppPublicBaseUrl();\n if (!appBase) {\n this.sendOAuthError(res, 503, 'temporarily_unavailable', 'app public base URL is not resolvable');\n return;\n }\n // The OP's own logged-out destination when there is no validated RP redirect: the dedicated\n // \"you have been signed out\" page (`PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT`, route `/oauth/logged-out`),\n // per RP-Initiated Logout 1.0 §5 (the OP displays a logout confirmation rather than redirecting back\n // to the RP). Reached by the no-session branch (c) — where NOTHING is terminated — and by the confirm\n // endpoint after it terminates; the landing is UNIFORM across both so it is not a session-state oracle.\n const landingUrl = `${appBase}/oauth/logged-out`;\n\n // The public issuer id_tokens are minted with (`createJwtForIdToken` sets `iss` to this). Needed to\n // verify the hint against the RIGHT issuer — `getVerifyOptions` otherwise forces the appSlug issuer.\n const issuer = this.appConfigService.resolveApiResourceAudience();\n\n let userId: string \| undefined;\n let sessionId: string \| undefined;\n let clientId: string \| undefined;\n if (q.id_token_hint && issuer) {\n try {\n const claims = (await this.jwtService.verifyWithoutBackendErrorActions(\n q.id_token_hint,\n JwtPrivateKeys.APPLICATION_AUTH_TOKEN,\n { ignoreAudience: true, ignoreExpiration: true, issuerOverride: issuer },\n )) as { sub?: string; sid?: string; azp?: string; aud?: string };\n userId = claims.sub;\n sessionId = claims.sid;\n // The relying party the hint was issued to: `azp` (OIDC authorized party), falling back to `aud`\n // (the id_token audience = the client). Scopes the post_logout_redirect_uri allowlist lookup.\n clientId = claims.azp ?? claims.aud;\n } catch {\n // An invalid / forged hint identifies nothing. Terminate nothing; land the user on the OP page.\n // Deliberately NOT an error — §2 tolerates a stale hint; we simply cannot act on this one.\n }\n }\n\n // RP-Initiated Logout §2: a `client_id` parameter, when present, MUST agree with the hint's client.\n // A mismatch means the request cannot be trusted to name the RP, so no RP redirect is honored.\n const clientIdMismatch = Boolean(q.client_id && clientId && q.client_id !== clientId);\n\n // Validate the post_logout_redirect_uri BEFORE terminating, so the audit records the disposition.\n let validatedRedirect: string \| undefined;\n let postLogoutRedirectUriRejected = false;\n if (q.post_logout_redirect_uri) {\n const canRedirect = !clientIdMismatch\n && clientId !== undefined\n && await this.authCodeService.isRegisteredPostLogoutRedirectUri(clientId, q.post_logout_redirect_uri);\n if (canRedirect) {\n validatedRedirect = q.post_logout_redirect_uri;\n } else {\n postLogoutRedirectUriRejected = true;\n }\n }\n\n res.set('Cache-Control', 'no-store');\n\n // ── Trusted RP logout (the Keycloak-style §6-prompt skip): a valid `id_token_hint` AND an exact-match\n // registered `post_logout_redirect_uri`. The request names a known, allow-listed relying party and\n // carries an id_token WE signed, so it is trusted to terminate the session and return the End-User to\n // the RP WITHOUT an interstitial — the current, unchanged behaviour (RP-Initiated Logout §3).\n if (validatedRedirect) {\n if (sessionId) {\n await this.authTokenIssuer.invalidateSession(sessionId);\n }\n // Best-effort browser hygiene: clear the first-party refresh cookie. The helper sets the same\n // `Path=/api/v1/auth` the cookie was issued with, so the deletion takes effect even though this\n // endpoint lives under a different path.\n AuthControllerUtils.clearRefreshCookie(res, this.appConfigService.applicationEnv);\n this._auditRpInitiatedLogout(req, { userId, sessionId, clientId, sessionTerminated: Boolean(sessionId), postLogoutRedirectUriRejected });\n let redirect: URL;\n try {\n redirect = new URL(validatedRedirect);\n } catch {\n // The allowlist entry passed `isSafeOAuthRedirectUri` at registration, so this is unreachable\n // through the front door; fall back to the landing rather than 500 if a malformed entry slipped in.\n res.redirect(302, landingUrl);\n return;\n }\n // RP-Initiated Logout §2: echo `state` on the post-logout redirect when the RP supplied it (§2 states\n // the OP passes `state` back to the RP; §3 governs the redirection itself).\n if (q.state) redirect.searchParams.set('state', q.state);\n res.redirect(302, redirect.toString());\n return;\n }\n\n // ── §6 confirmation prompt: a NON-trusted logout that still names a real session (a valid hint whose\n // `post_logout_redirect_uri` is absent / unregistered / client-mismatched). Do NOT terminate yet —\n // mint a single-use confirmation token naming the session and 302 the browser to the frontend\n // `/oauth/logout-confirm` prompt. Termination happens only on the End-User's explicit confirm\n // (`POST /oauth/end-session/confirm`), which closes the BROWSER-based logout-CSRF vector (see\n // `handleEndSessionConfirm` for the exact threat model). No audit here — nothing has been terminated;\n // the confirm endpoint audits the actual logout with the clientId/redirect disposition stashed here.\n if (sessionId && userId) {\n const { confirmationToken } = await this.authCodeService.createLogoutConfirmation({ userId, sessionId, clientId, postLogoutRedirectUriRejected });\n const confirmUrl = new URL(`${appBase}/oauth/logout-confirm`);\n confirmUrl.searchParams.set('token', confirmationToken);\n res.redirect(302, confirmUrl.toString());\n return;\n }\n\n // ── Nothing to terminate (no / unverifiable / forged hint): no session was identified, so there is\n // nothing to confirm. Clear the cookie for hygiene and land on the signed-out page — the UNIFORM §5\n // landing, identical to a completed logout, so the response is not an oracle for whether the hint was\n // valid or a session existed.\n AuthControllerUtils.clearRefreshCookie(res, this.appConfigService.applicationEnv);\n this._auditRpInitiatedLogout(req, { userId, sessionId, clientId, sessionTerminated: false, postLogoutRedirectUriRejected });\n res.redirect(302, landingUrl);\n }\n\n /\n Fire-and-forget audit for an RP-Initiated Logout disposition (`OAUTH_RP_INITIATED_LOGOUT`). Auditing\n * must never affect the logout the End-User already performed, so a failure is swallowed at WARN.\n * Called at each terminal disposition: the trusted-RP redirect, the no-session landing, and the §6\n * confirm endpoint (the prompt path audits there, when the session actually ends).\n /\n private _auditRpInitiatedLogout(\n req: Request,\n fields: { userId?: string; sessionId?: string; clientId?: string; sessionTerminated: boolean; postLogoutRedirectUriRejected: boolean },\n ): void {\n void this.auditLogs.logOAuthRpInitiatedLogout({\n ...fields,\n ipAddress: getClientIpFromRequest(req),\n }).catch((auditError) => this.logger.warn('OAUTH_RP_INITIATED_LOGOUT audit emit failed (non-fatal)', {\n ...projectCaughtErrorLogFields(auditError),\n }));\n }\n\n /\n `POST /oauth/end-session/confirm` — the OIDC RP-Initiated Logout §6 confirmation decision\n * (revocation-C). The frontend `/oauth/logout-confirm` prompt calls this with the single-use\n * `OIDC_LOGOUT_CONFIRMATION` token minted by `handleEndSession` when the End-User clicks \"Sign out\".\n * Token-authorized (no Bearer — the End-User may be unauthenticated in the SPA, having arrived via an\n * RP redirect), single-use, short-TTL.\n \n THREAT MODEL — read before strengthening or relaxing this. The prompt+token defends against\n * BROWSER-based logout CSRF: the token is minted into the VICTIM'S browser URL by the GET's 302, and a\n * cross-origin page (an `<img>`/auto-navigation forcing the GET) cannot READ that URL, so it cannot\n * complete the confirm — the classic \"silent logout via a crafted link\" is closed. It does NOT, and by\n * the endpoint's nature cannot, stop a party that HOLDS a valid `id_token` from scripting\n * GET→read-token→POST-confirm headlessly; but that party can already log the user out through the\n * trusted-RP path, because letting an authorized RP end the End-User's session is exactly what\n * RP-Initiated Logout is FOR. So the residual is a bounded session-logout by an id_token holder, not a\n * new capability. Binding the confirm to the victim's OP session (Keycloak's mechanism) is deliberately\n * NOT done: this OP is token-based and the `__wildo_refresh` cookie is scoped to `/api/v1/auth`, so it\n * never reaches `/oauth/`, and the design intentionally allows an unauthenticated SPA to confirm.\n \n * Consumes the token → terminates the named session (`invalidateSession(sid)`) → clears the refresh\n * cookie → audits → returns `{ redirect_to: /oauth/logged-out }` as JSON (the SPA navigates there,\n * mirroring `/oauth/authorize/decision`). A stale / invalid / already-used token is NOT an error: the\n * End-User confirmed a logout, so it lands them on the signed-out page WITHOUT terminating (the session\n * is most likely already gone, and revealing whether the token was live would be a session-state oracle).\n /\n private async handleEndSessionConfirm(req: Request, res: Response): Promise<void> {\n const appBase = this.appConfigService.resolveAppPublicBaseUrl();\n if (!appBase) {\n this.sendOAuthError(res, 503, 'temporarily_unavailable', 'app public base URL is not resolvable');\n return;\n }\n const body = (req.body ?? {}) as { token?: unknown };\n const token = typeof body.token === 'string' ? body.token : '';\n if (!token) {\n this.sendOAuthError(res, 400, 'invalid_request', \"the 'token' parameter is required\");\n return;\n }\n\n res.set('Cache-Control', 'no-store');\n const confirmation = await this.authCodeService.consumeLogoutConfirmation(token);\n // A stale / wrong-type token yields null → land on the signed-out page without terminating.\n if (confirmation?.sessionId) {\n await this.authTokenIssuer.invalidateSession(confirmation.sessionId);\n }\n AuthControllerUtils.clearRefreshCookie(res, this.appConfigService.applicationEnv);\n // Full attribution: the RP the hint named and the redirect disposition were stashed in the token at\n // mint time, so the confirm audit matches what the trusted-RP and no-session paths record inline.\n this._auditRpInitiatedLogout(req, {\n userId: confirmation?.userId,\n sessionId: confirmation?.sessionId,\n clientId: confirmation?.clientId,\n sessionTerminated: Boolean(confirmation?.sessionId),\n postLogoutRedirectUriRejected: confirmation?.postLogoutRedirectUriRejected ?? false,\n });\n res.status(200).json({ redirect_to: `${appBase}/oauth/logged-out` });\n }\n\n /\n `GET /.well-known/openid-configuration` — OIDC discovery metadata. `issuer` is the app's\n * API base URL (matching the `iss` in issued tokens); endpoint URLs are absolute so a client\n * that fetched this doc can reach them directly. The `authorization_endpoint` is the BROWSER-FACING\n * frontend consent/authorize page; the other endpoints are the backend API routes.\n /\n private async handleDiscovery(_req: Request, res: Response): Promise<void> {\n const issuer = this.appConfigService.resolveApiResourceAudience();\n if (!issuer) {\n this.sendOAuthError(res, 503, 'temporarily_unavailable', 'issuer URL is not resolvable');\n return;\n }\n // The `authorization_endpoint` is a BROWSER-FACING page, not the backend API endpoint: a third-party\n // client redirects the user's browser THERE, the SPA establishes the session and (for a\n // `requiresConsent` client) renders the consent screen, then calls the backend `/oauth/authorize`\n // with the user's Bearer. So it points at the frontend consent route (matches\n // `CommonRoutePaths.oauthConsent` in saas-frontend-lib) under the app's public base URL — NOT under\n // the `/api/v1` API mount. The path is a frontend-route literal (route paths are not a closed vocabulary).\n const appBase = this.appConfigService.resolveAppPublicBaseUrl();\n if (!appBase) {\n this.sendOAuthError(res, 503, 'temporarily_unavailable', 'app public base URL is not resolvable');\n return;\n }\n // Deployment guard: a non-https issuer (outside localhost) is a misconfigured public base\n // URL — OIDC relying parties reject a non-https issuer. Surface it loudly rather than let it\n // fail opaquely at the client. (The fix is operator-side: set the external https public URL.)\n if (issuer.startsWith('http://') && !/\\/\\/(localhost\|127\\.0\\.0\\.1)/.test(issuer)) {\n this.logger.warn('OIDC issuer is not https — relying parties will reject it. Set the app public URL to the external https origin.', { issuer });\n }\n res.set('Cache-Control', 'public, max-age=3600');\n this.jsonSuccess(res, {\n issuer,\n authorization_endpoint: `${appBase}/oauth/consent`,\n token_endpoint: `${issuer}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_TOKEN]}`,\n jwks_uri: `${issuer}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_JWKS]}`,\n userinfo_endpoint: `${issuer}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_USERINFO]}`,\n revocation_endpoint: `${issuer}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_REVOKE]}`,\n // OIDC RP-Initiated Logout 1.0 (revocation-C): the `end_session_endpoint` an RP redirects the browser\n // to in order to terminate the End-User's OP session. A backend API route (like revocation), not the\n // browser-facing frontend page — the handler does the termination then redirects.\n // spec-cite: OpenID Connect RP-Initiated Logout 1.0 §2.1 (OpenID Provider Discovery Metadata —\n // `end_session_endpoint: REQUIRED`).\n end_session_endpoint: `${issuer}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION]}`,\n grant_types_supported: ['client_credentials', 'authorization_code', 'refresh_token'],\n response_types_supported: ['code'],\n response_modes_supported: ['query'],\n code_challenge_methods_supported: ['S256'],\n // RFC 9207. This is a CLAIM, not a preference: a client reading `true` here MUST reject any\n // authorization response from this server that arrives without `iss`. It is therefore only safe\n // while `sendAuthorizationRedirect` remains the sole way an authorization response leaves this\n // controller — it is what makes the claim true on the code path, the consent-approve path and\n // the consent-deny path alike. Do not set this to `true` for a server that emits `iss` on only\n // some of its responses.\n // spec-cite: RFC 9207 § 2.3 — `authorization_response_iss_parameter_supported`.\n authorization_response_iss_parameter_supported: true,\n // `none` = PUBLIC client (PKCE, no client secret) — the authorization_code token exchange\n // accepts `client_id` from the body and relies on PKCE (S256) instead of a secret, so a public\n // agent/SPA client is supported. Confidential clients use `client_secret_basic\|post`. Omitting\n // `none` here would (mis)signal confidential-only and block a spec-compliant public client.\n token_endpoint_auth_methods_supported: ['none', 'client_secret_basic', 'client_secret_post'],\n // RFC 8707: this provider honors the `resource` indicator (REQUIRED for a user-delegated\n // authorization_code token — it binds the token `aud` to the A2A/MCP endpoint; the per-endpoint\n // resource value is discovered from the A2A agent card `url` / the MCP RFC 9728 metadata).\n resource_indicators_supported: true,\n /\n CIMD advertisement — DERIVED from the deployment's own posture, never hard-coded true.\n \n \"Authorization servers advertise that they support clients using Client ID Metadata Documents\n * by including the following property in their OAuth Authorization Server metadata:\n * `client_id_metadata_document_supported: true`\"\n * spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Documents → Discovery\n \n The client's documented reaction to this flag is to CHOOSE CIMD over its other options —\n * \"Use Client ID Metadata Documents if the Authorization Server indicates it supports it\" —\n * so advertising it while the policy is `DISABLED` would steer every conformant client into a\n * mechanism this deployment refuses, and its fallback order would already have been spent.\n * Advertising the truth is what lets a client pick DCR or pre-registration instead.\n /\n ...(this.cimdService.deploymentConfiguration().policy === CimdTrustPolicy.DISABLED\n ? {}\n : { client_id_metadata_document_supported: true }),\n /\n `registration_endpoint` — advertised ONLY when the application opted in, for the same\n * reason as the CIMD flag and with the same consequence if it lies.\n \n A client's documented fallback order is \"pre-registered → CIMD → Dynamic Client\n * Registration → prompt the user\", so advertising an endpoint that answers 404 would consume\n * the third rung and push a conformant client straight to prompting a human.\n * spec-cite: MCP 2025-11-25 — Authorization § Client Registration Approaches: \"Use Dynamic\n * Client Registration as a fallback if the Authorization Server supports it (via\n * `registration_endpoint` in OAuth Authorization Server Metadata)\".\n /\n ...(this.dynamicRegistrationConfiguration().enabled\n ? { registration_endpoint: `${issuer}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER]}` }\n : {}),\n subject_types_supported: ['public'],\n id_token_signing_alg_values_supported: ['ES256'],\n // OIDC Discovery RECOMMENDED metadata — DERIVED from the userinfo/ID-token resolver's single-source\n // vocabulary so discovery can never drift from what the ID token actually carries (the OIDC §5.4\n // consistency contract). `openid` is the baseline identity scope; `email`/`profile` gate the identity\n // claims. Scopes are IDENTITY only — authorization is roles-only (scope-based authorization was deleted\n // 2026-07-21). `claims_supported` = the always-present protocol claims + the resolver's scope-gated\n // identity claims; `auth_time` is deliberately NOT advertised (the authorization_code flow never\n // populates it, so advertising it would promise a claim we never deliver). The authorize endpoint\n // redirects the code as query params, so the only response mode is `query`.\n scopes_supported: [...OIDC_SUPPORTED_IDENTITY_SCOPES],\n claims_supported: ['sub', 'iss', 'aud', 'exp', 'iat', 'nonce', 'azp', ...OIDC_SCOPE_GATED_IDENTITY_CLAIMS],\n }, 200);\n }\n\n /\n `GET /oauth/jwks` — the JWKS a relying party uses to verify Wildo-issued tokens. Each JWK's\n * `kid` is the RFC 7638 thumbprint embedded in the token header. Public keys only.\n /\n private async handleJwks(_req: Request, res: Response): Promise<void> {\n res.set('Cache-Control', 'public, max-age=3600');\n this.jsonSuccess(res, this.jwtService.getPublicJwks(), 200);\n }\n\n /\n `POST /oauth/token` — RFC 6749 token endpoint. Serves `grant_type=client_credentials`\n * (the OIDC branch adds `authorization_code`). Accepts `client_secret_basic` (Authorization:\n * Basic) or `client_secret_post` (form body) client authentication.\n /\n private async handleToken(req: Request, res: Response): Promise<void> {\n const body = (req.body ?? {}) as Record<string, string \| undefined>;\n // These OAuth params are single-valued; a REPEATED body key (which Express parses to `string[]`\n // despite the cast) is a malformed request. Reject it cleanly (400) so an array never reaches a\n // `.split`/`.includes` (500) or silently slips through the RFC 8707 audience comparison.\n const malformedTokenParam = this.firstMalformedParam(body, ['grant_type', 'code', 'redirect_uri', 'code_verifier', 'client_id', 'client_secret', 'refresh_token', 'resource', 'scope']);\n if (malformedTokenParam) {\n this.sendOAuthError(res, 400, 'invalid_request', `the '${malformedTokenParam}' parameter must be a single string value`);\n return;\n }\n // Source IP for the per-IP machine-auth failure lockout (see the machine-auth-rate-limit utils).\n // Cheap header parse; only the `client_credentials` grant actually asserts/records against it.\n // security-decision (accepted-low — D11, see .claude/plans/oidc-provider-test-coverage.md § \"ACCEPTED RISK\"):\n // the per-IP brute-force limiter (`assertMachineAuthAttemptWithinRate`) fires ONLY on the client_credentials\n // branch below; the authorization_code + refresh_token secret fronts (and the unauthenticated /oauth/revoke)\n // are DELIBERATELY not per-endpoint rate-limited. 256-bit high-entropy secrets make online guessing\n // infeasible and the global ~1000/min/IP HTTP limiter caps the DoS surface; those fronts are now audited\n // (A-7), so a per-endpoint lockout counter is cheap to add IF the decision is ever revisited.\n const clientIp = getClientIpFromRequest(req);\n\n try {\n let token: unknown;\n if (body.grant_type === 'client_credentials') {\n // Brute-force / DB-read-exhaustion guard: reject a saturated source before the\n // `hashOAuthClientSecret` lookup; the catch below records a failure on `invalid_client`.\n await assertMachineAuthAttemptWithinRate(this.redisService, this.errorBuilder, this.logger, clientIp, this.appConfigService.applicationEnv);\n const { clientId, clientSecret } = this.extractClientCredentials(req, body);\n if (!clientSecret) {\n this.sendOAuthError(res, 401, 'invalid_client', 'missing client credentials');\n return;\n }\n token = await this.tokenService.issueClientCredentialsToken({ clientSecret, clientId, resource: body.resource });\n } else if (body.grant_type === 'authorization_code') {\n // client_id comes from the body (public client) or client auth (confidential); a confidential\n // client ALSO presents client_secret here (client_secret_basic/post), enforced downstream.\n const { clientId, clientSecret } = this.extractClientCredentials(req, body);\n const effectiveClientId = clientId ?? body.client_id;\n if (!effectiveClientId \|\| !body.code \|\| !body.redirect_uri \|\| !body.code_verifier) {\n this.sendOAuthError(res, 400, 'invalid_request', 'code, redirect_uri, code_verifier and client_id are required');\n return;\n }\n token = await this.tokenService.issueAuthorizationCodeToken({\n code: body.code,\n clientId: effectiveClientId,\n redirectUri: body.redirect_uri,\n codeVerifier: body.code_verifier,\n // Presented client secret (if any). REQUIRED for a confidential client, verified during the\n // code exchange; a public (PKCE-only) client presents none.\n clientSecret,\n // RFC 8707 §2.2: a client MAY echo `resource` on the token request. The authorize-bound\n // resource is authoritative; when the token request also names one it MUST match (a\n // confused-deputy cross-check), else `invalid_target`.\n resource: body.resource,\n });\n } else if (body.grant_type === 'refresh_token') {\n if (!body.refresh_token) {\n this.sendOAuthError(res, 400, 'invalid_request', 'refresh_token is required');\n return;\n }\n // Item 5 (OIDC §12.2): pass the presented client credentials so an AUTHENTICATED OIDC client\n // ALSO gets a fresh id_token. The token service authenticates the secret (bad secret ⇒\n // `invalid_client` → 401 via the catch below) before minting; a first-party session refresh\n // presents no credentials → access + refresh only, no id_token.\n const { clientId, clientSecret } = this.extractClientCredentials(req, body);\n token = await this.tokenService.issueRefreshTokenGrant(body.refresh_token, clientId, clientSecret);\n } else {\n this.sendOAuthError(res, 400, 'unsupported_grant_type', `grant_type '${body.grant_type ?? ''}' is not supported`);\n return;\n }\n\n // RFC 6749 §5.1: token responses MUST NOT be cached.\n res.set('Cache-Control', 'no-store');\n res.set('Pragma', 'no-cache');\n this.jsonSuccess(res, token, 200);\n } catch (error) {\n if (isWildoBackendError(error)) {\n const context = (error as { context?: { oauthError?: string; detail?: string } }).context;\n if (context?.oauthError) {\n // Feed the per-IP machine-auth failure lockout AND emit the MACHINE_AUTH_FAILED audit\n // event when a client presented a bad secret to the client-credentials exchange (a guess\n // attempt) — scoped to that grant so authorization_code client-auth failures don't share\n // the machine-front bucket. `invalid_client` = authentication failed (bad secret); the\n // other OAuth errors (unauthorized_client / invalid_scope / invalid_target) are authorized-\n // client request errors, not auth failures, so they neither lock nor emit this event.\n if (context.oauthError === 'invalid_client' && body.grant_type === 'client_credentials') {\n await recordMachineAuthFailure(this.redisService, this.logger, clientIp);\n const presentedSecret = body.client_secret;\n const credentialPrefix = presentedSecret?.startsWith('oc_org_')\n ? 'oc_org_'\n : presentedSecret?.startsWith('oc_app_') ? 'oc_app_' : undefined;\n void this.auditLogs.logMachineAuthFailed({\n credentialKind: 'oauth_client',\n credentialPrefix,\n reason: 'invalid_client',\n ipAddress: clientIp,\n }).catch((auditError) => this.logger.warn('MACHINE_AUTH_FAILED audit emit failed (non-fatal)', {\n ...projectCaughtErrorLogFields(auditError),\n }));\n }\n // RFC 6749 §5.2: `invalid_client` → 401 (with WWW-Authenticate); others → 400.\n // RFC 6749 §5.2 status: invalid_client→401; temporarily_unavailable (server-side\n // misconfig, e.g. an unresolvable issuer/audience)→503; everything else→400. Without the\n // 503 case a server misconfiguration is mislabelled to the client as a 400 bad request.\n this.sendOAuthError(res, context.oauthError === 'invalid_client' ? 401 : context.oauthError === 'temporarily_unavailable' ? 503 : 400, context.oauthError, context.detail);\n return;\n }\n }\n throw error; // unexpected → unified error-handler middleware\n }\n }\n\n /\n `GET /oauth/authorize` — OIDC authorization endpoint (authorization_code + PKCE). Called by the\n * BROWSER-FACING frontend consent page (the discovery `authorization_endpoint`), NOT hit directly by a\n * raw third-party browser: the SPA establishes the user session first and calls this with the user's\n * Bearer. Validates the request + resolves the user, then either:\n * - `requiresConsent` client → returns `{ consent_required, consent_token, client, scopes, resource }`\n * JSON (the SPA renders the consent screen, then POSTs the decision to `/oauth/authorize/decision`); or\n * - trusted client (`requiresConsent` false) → mints the code and returns `{ redirect_to }` JSON.\n * BOTH the trusted code path and the consent-decision path return `redirect_to` as JSON (NOT an HTTP\n * 302): the caller is a Bearer-authenticated XHR that auto-follows a 302 but cannot read a cross-origin\n * `Location`, so the SPA completes the OAuth redirect with `window.location.assign(redirect_to)`.\n \n Errors are returned DIRECTLY (never redirected) — safe against open-redirect; redirecting\n * OAuth errors for a pre-validated `redirect_uri` (RFC 6749 §4.1.2.1) is a follow-up.\n /\n /* The deployment's dynamic-registration posture. Absent ⇒ disabled. /\n private dynamicRegistrationConfiguration(): DynamicClientRegistrationConfig {\n const authored = (this.appConfigService.config?.auth as { dynamicClientRegistration?: DynamicClientRegistrationConfig } \| undefined)?.dynamicClientRegistration;\n return {\n enabled: authored?.enabled ?? false,\n maxRegistrationsPerHourPerIp: authored?.maxRegistrationsPerHourPerIp ?? 10,\n };\n }\n\n /\n `POST /oauth/register` — RFC 7591 dynamic client registration.\n \n ## What this endpoint is, stated plainly\n \n An UNAUTHENTICATED write primitive. Anyone who can reach it creates a durable row in this\n * application's database. That is not a flaw in the design — it is the design, and it is why the\n * endpoint is off by default, rate-limited per source IP, and why everything it creates is\n * confined to the weakest posture the framework can express.\n \n ## The four confinements, and why each one is not optional\n \n 1. No roles, ever. Roles are this framework's single authorization axis. A caller who\n * could name its own roles at an anonymous endpoint would have found a total privilege\n * escalation — the exact bypass `buildOAuthClientMintHandlers`' role-ceiling gate exists to\n * prevent for AUTHENTICATED callers. A request that ASKS for roles is REFUSED rather than\n * quietly downgraded: a client that believes it holds authority it does not have will fail\n * later in a way neither side can diagnose.\n * 2. Identity scopes only (`openid`/`profile`/`email`), for the same reason CIMD is capped\n * there: the ceiling would otherwise be authored by the party it constrains.\n * 3. `registrationOrigin: DYNAMIC`, which `adaptRegisteredClient` maps to\n * `UNAFFILIATED` — so the row lands on the APPLICATION collection for want of an\n * organization WITHOUT inheriting the platform-operator first-party posture that\n * `scope: APPLICATION` normally carries. This is the whole reason the field exists.\n * 4. `authorization_code` only. `client_credentials` is the machine front, where a client\n * acts as ITSELF with its own roles. A self-registered client acting on its own behalf is a\n * principal nobody vouched for; it may only ever act FOR A USER who consented.\n \n ## What is deliberately NOT issued\n \n No `client_secret`. The client is public (`token_endpoint_auth_method: none`) and authenticates\n * with PKCE, which is what MCP's own worked example registers. A row still persists inert secret\n * material because `hashedSecret` is required by the client schema; the REJECTED alternative was\n * making that field optional, which is a reshape across every OAuth-client surface for the sake of\n * one caller. Nothing can present the inert secret — it is never returned and never regenerated.\n \n spec-cite: RFC 7591 § 3.1 — client registration request; § 3.2.1 — client information response.\n * spec-cite: MCP 2025-11-25 — Authorization § Dynamic Client Registration (\"included for\n * backwards compatibility with earlier versions of the MCP authorization spec\"), which is why\n * this ships OFF by default while CIMD is the recommended path.\n /\n private async handleDynamicRegistration(req: Request, res: Response): Promise<void> {\n const configuration = this.dynamicRegistrationConfiguration();\n if (!configuration.enabled) {\n // 404, not 403: an application that has not opted in should be indistinguishable from one\n // whose framework never had the endpoint. A 403 would advertise a capability that is one\n // config flag away, and invite probing for the flag.\n res.status(404).json({ error: 'not_found' });\n return;\n }\n\n const clientIp = getClientIpFromRequest(req);\n // The ONLY thing between an unauthenticated endpoint and unbounded row creation. Applied before\n // any parsing so a malformed flood costs no more than a well-formed one.\n const withinRate = await this.withinDynamicRegistrationRate(clientIp, configuration);\n if (!withinRate) {\n res.status(429).json({ error: 'temporarily_unavailable', error_description: 'too many client registrations from this source' });\n return;\n }\n\n const body = (req.body ?? {}) as Record<string, unknown>;\n\n // RFC 7591 § 2: `redirect_uris` is REQUIRED for a client using the authorization_code grant.\n const redirectUris = body.redirect_uris;\n if (!Array.isArray(redirectUris) \|\| redirectUris.length === 0 \|\| !redirectUris.every((uri): uri is string => typeof uri === 'string')) {\n this.sendRegistrationError(res, 'invalid_redirect_uri', 'redirect_uris must be a non-empty array of strings');\n return;\n }\n // Each URI must independently pass the SAME safety refine every registered client faces —\n // https anywhere, http loopback only, no javascript:/data:, no fragment, no embedded\n // credentials. Checked HERE as well as by the schema so the refusal names the offending value\n // rather than surfacing as a generic validation failure on a system write.\n const unsafe = redirectUris.find((uri) => !isSafeOAuthRedirectUri(uri));\n if (unsafe) {\n this.sendRegistrationError(res, 'invalid_redirect_uri', `redirect_uri is not permitted: ${unsafe}`);\n return;\n }\n\n // revocation-C: `post_logout_redirect_uris` — OPTIONAL OIDC RP-Initiated Logout client metadata (unlike\n // `redirect_uris`, which RFC 7591 requires for authorization_code). When present it must be an array of\n // strings, each held to the SAME `isSafeOAuthRedirectUri` gate as a redirect URI (so a registered\n // post-logout target can never become an open-redirect / off-origin navigation). Absent ⇒ [] (the client\n // simply cannot pass a `post_logout_redirect_uri` to `/oauth/end-session`).\n let postLogoutRedirectUris: string[] = [];\n if (body.post_logout_redirect_uris !== undefined) {\n if (!Array.isArray(body.post_logout_redirect_uris) \|\| !body.post_logout_redirect_uris.every((uri): uri is string => typeof uri === 'string')) {\n this.sendRegistrationError(res, 'invalid_client_metadata', 'post_logout_redirect_uris must be an array of strings');\n return;\n }\n const unsafePostLogout = body.post_logout_redirect_uris.find((uri) => !isSafeOAuthRedirectUri(uri));\n if (unsafePostLogout) {\n this.sendRegistrationError(res, 'invalid_client_metadata', `post_logout_redirect_uri is not permitted: ${unsafePostLogout}`);\n return;\n }\n postLogoutRedirectUris = body.post_logout_redirect_uris;\n }\n\n const clientName = typeof body.client_name === 'string' && body.client_name.trim().length > 0\n ? body.client_name.trim().slice(0, 100)\n : undefined;\n if (!clientName) {\n this.sendRegistrationError(res, 'invalid_client_metadata', 'client_name is required');\n return;\n }\n\n // CONFINEMENT 1 — refuse, never downgrade. `roles` is not an RFC 7591 field at all, so its\n // presence is either a probe or a client that fundamentally misunderstands this endpoint.\n if (body.roles !== undefined) {\n this.sendRegistrationError(res, 'invalid_client_metadata', 'roles cannot be requested at dynamic registration');\n return;\n }\n // CONFINEMENT 2 — a scope request wider than identity is refused for the same reason.\n const requestedScopes = typeof body.scope === 'string' ? body.scope.split(/\\s+/).filter(Boolean) : [];\n const beyondIdentity = requestedScopes.filter((scope) => !OIDC_SUPPORTED_IDENTITY_SCOPES.includes(scope));\n if (beyondIdentity.length > 0) {\n this.sendRegistrationError(res, 'invalid_client_metadata', `scope(s) not available to a dynamically registered client: ${beyondIdentity.join(', ')}`);\n return;\n }\n // CONFINEMENT 4 — authorization_code only.\n //\n // `refresh_token` is TOLERATED here and then NOT granted, and the asymmetry with confinements 1\n // and 2 (which refuse rather than downgrade) is deliberate — do not \"fix\" it into a refusal.\n // A conformant MCP client is TOLD to ask: clients that desire refresh tokens \"SHOULD include\n // `refresh_token` in their `grant_types` client metadata\", and in the same breath \"MUST NOT\n // assume refresh tokens will be issued; the AS retains discretion\". Refusing the registration\n // would therefore reject well-behaved clients for following their own specification, whereas\n // roles and wide scopes are things no client is ever instructed to request here.\n //\n // Substituting instead of refusing is the sanctioned shape: the AS \"MAY reject or replace any of\n // the client's requested metadata values submitted during the registration and substitute them\n // with suitable values\", and MUST \"return all registered metadata about this client\" — which the\n // 201 echo below does, so `grant_types: [\"authorization_code\"]` IS the notification that the\n // request was narrowed. There is no second signal, and per the discretion clause above none is\n // owed.\n //\n // OPEN DESIGN QUESTION, recorded rather than silently settled: whether a dynamically registered\n // PUBLIC client should be granted refresh at all. Granting it extends an anonymous\n // self-registered client's reach without a fresh consent; withholding it means such a client\n // re-consents when its access token expires. Today it is withheld. That is a security posture,\n // not an oversight, and changing it is a deliberate decision — not a bug fix.\n //\n // spec-cite: MCP 2026-07-28 — Authorization § Refresh Tokens\n // (<https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization>).\n // spec-cite: RFC 7591 § 3.2.1 — Client Information Response.\n const requestedGrants = Array.isArray(body.grant_types) ? body.grant_types : [OAuthGrantType.AUTHORIZATION_CODE];\n const forbiddenGrant = requestedGrants.find((grant) => grant !== OAuthGrantType.AUTHORIZATION_CODE && grant !== OAuthGrantType.REFRESH_TOKEN);\n if (forbiddenGrant) {\n this.sendRegistrationError(res, 'invalid_client_metadata', `grant_type not available to a dynamically registered client: ${String(forbiddenGrant)}`);\n return;\n }\n // A confidential auth method would require a secret this endpoint deliberately does not issue.\n const requestedAuthMethod = body.token_endpoint_auth_method;\n if (requestedAuthMethod !== undefined && requestedAuthMethod !== OAuthTokenEndpointAuthMethod.NONE) {\n this.sendRegistrationError(res, 'invalid_client_metadata', 'only token_endpoint_auth_method=none is available to a dynamically registered client');\n return;\n }\n\n const secretMaterial = generateOAuthClientSecretMaterial(ApiKeyScope.APPLICATION);\n // RFC 7592 §3: the registration response carries a `registration_access_token` the client uses at\n // the client configuration endpoint, and a `registration_client_uri` naming that endpoint. Minted\n // here and returned exactly once — there is no way to recover it afterwards, which is why §5 says\n // it \"SHOULD NOT expire while a client is still actively registered\".\n const registrationTokenMaterial = generateRegistrationAccessTokenMaterial();\n const created = await this.systemAccess.createAsSystem(CoreResourceType.OAUTH_CLIENTS_APPLICATION, {\n name: clientName,\n scope: ApiKeyScope.APPLICATION,\n applicationId: this.appConfigService.applicationId,\n // Every confinement, as DATA on the row — so a later read does not have to re-derive them.\n roles: [],\n allowedScopes: requestedScopes.length > 0 ? requestedScopes : [...OIDC_SUPPORTED_IDENTITY_SCOPES],\n allowedGrants: [OAuthGrantType.AUTHORIZATION_CODE],\n redirectUris,\n postLogoutRedirectUris,\n tokenEndpointAuthMethod: OAuthTokenEndpointAuthMethod.NONE,\n // Belt to `adaptRegisteredClient`'s braces: the resolver forces consent for a DYNAMIC client\n // regardless, but a row that also SAYS so cannot mislead an operator reading the collection.\n requiresConsent: true,\n registrationOrigin: OAuthClientRegistrationOrigin.DYNAMIC,\n hashedSecret: secretMaterial.hashedSecret,\n secretPrefix: secretMaterial.secretPrefix,\n registrationAccessTokenHash: registrationTokenMaterial.registrationAccessTokenHash,\n registrationAccessTokenPrefix: registrationTokenMaterial.registrationAccessTokenPrefix,\n }, {\n // `registrationOrigin`, `hashedSecret` and `secretPrefix` all carry\n // `.excludeFromCreate()` — they are server-managed precisely so no caller can author them.\n // This endpoint IS the server-side door, so it re-attaches them explicitly.\n preserveServerInjectedFields: [\n 'registrationOrigin', 'hashedSecret', 'secretPrefix',\n // Same reason as the two above: server-managed, so `.excludeFromCreate()` strips them and\n // this endpoint — the server-side door — re-attaches them explicitly. Omitting them here\n // would persist a client with NO registration access token, and every management call would\n // then fail 401 with nothing to diagnose.\n 'registrationAccessTokenHash', 'registrationAccessTokenPrefix',\n ],\n }) as { _id: string };\n\n // assurance-control: WILDO.IDENTITY.CLIENT_IDENTITY_ASSERTION — an anonymous party created a\n // client identity in this application. Fire-and-forget; auditing must never fail the request it\n // observes, and the row exists either way.\n void this.auditLogs.logDynamicClientRegistered({\n clientId: created._id,\n clientName,\n redirectUris,\n postLogoutRedirectUris,\n ipAddress: clientIp,\n }).catch((auditError) => this.logger.warn('DYNAMIC_CLIENT_REGISTERED audit emit failed (non-fatal)', {\n ...projectCaughtErrorLogFields(auditError),\n }));\n\n res.set('Cache-Control', 'no-store');\n // RFC 7591 § 3.2.1: 201 Created, and the response echoes the registered metadata so the client\n // can see exactly what was accepted — including the fields we NARROWED, which is how a client\n // learns it is confined rather than discovering it at the token endpoint.\n this.jsonSuccess(res, {\n client_id: created._id,\n client_id_issued_at: Math.floor(Date.now() / 1000),\n client_name: clientName,\n redirect_uris: redirectUris,\n post_logout_redirect_uris: postLogoutRedirectUris,\n grant_types: [OAuthGrantType.AUTHORIZATION_CODE],\n response_types: ['code'],\n token_endpoint_auth_method: OAuthTokenEndpointAuthMethod.NONE,\n scope: (requestedScopes.length > 0 ? requestedScopes : [...OIDC_SUPPORTED_IDENTITY_SCOPES]).join(' '),\n // RFC 7592 §3 — both REQUIRED in a registration response that supports management. The token\n // appears here and NOWHERE else, ever.\n registration_access_token: registrationTokenMaterial.plainToken,\n registration_client_uri: this.registrationClientUri(created._id),\n }, 201);\n }\n\n /\n The client configuration endpoint URL for one client — RFC 7592 §3's `registration_client_uri`.\n \n Built from the same issuer the discovery document advertises, so a client that resolved this\n * server through discovery reaches the same origin here.\n /\n private registrationClientUri(clientId: string): string {\n const template = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER_CLIENT];\n const issuer = this.appConfigService.resolveApiResourceAudience();\n return `${issuer}${template.replace(':clientId', encodeURIComponent(clientId))}`;\n }\n\n /\n The SINGLE seam through which every OAuth authorization RESPONSE leaves this server.\n \n It exists to make one invariant unbypassable rather than hand-applied: every authorization\n * response carries the RFC 9207 `iss` parameter. There are three responses today — the trusted-client\n * code path, the consent APPROVE path, and the consent DENY path — and the specification requires the\n * parameter on all of them, \"including error responses\". A fourth response added later cannot forget,\n * because emitting one means calling this.\n * spec-cite: MCP 2026-07-28 — Authorization § Authorization Response Validation.\n \n `iss` is the mix-up defence: it lets a client that talks to more than one authorization server\n * verify that the response came from the one it started the flow with, before it hands the code to a\n * token endpoint. Without it, a client with several configured servers can be induced to redeem a code\n * at the wrong one.\n \n Fails closed when the issuer is unresolvable, and that is the point. A conformant client MUST\n * REJECT a response whose `iss` is missing when the server advertises\n * `authorization_response_iss_parameter_supported: true` — so silently omitting the parameter would\n * turn a local misconfiguration into a response the client is obliged to throw away, with no\n * diagnosis. Refusing here names the cause instead. `503` rather than `400` because an unresolvable\n * issuer is this deployment's fault, never the caller's — matching `handleDiscovery`, which already\n * refuses on the same condition.\n \n spec-cite: MCP 2026-07-28 — Authorization § Authorization Response Validation (the SHOULD to\n * include `iss`, the MUST to advertise it, and the client action table whose `true` + absent row is\n * \"Reject the response\").\n * spec-cite: RFC 9207 § 2 — `iss` in the authorization response; § 2.3 — metadata advertisement.\n /\n private sendAuthorizationRedirect(res: Response, redirect: URL): void {\n const issuer = this.appConfigService.resolveApiResourceAudience();\n if (!issuer) {\n this.sendOAuthError(res, 503, 'temporarily_unavailable', 'issuer URL is not resolvable');\n return;\n }\n redirect.searchParams.set('iss', issuer);\n res.set('Cache-Control', 'no-store');\n this.jsonSuccess(res, { redirect_to: redirect.toString() }, 200);\n }\n\n /* RFC 7591 § 3.2.2 registration-error response: 400 + `error` / `error_description`. /\n / ───────────────────────────────────────────────────────────────────────────\n * RFC 7592 — client configuration endpoint\n * ──────────────────────────────────────────────────────────────────────── /\n\n /\n Authenticate a call to the client configuration endpoint, or answer and return null.\n \n Every RFC 7592 verb shares this, so the refusal ladder cannot drift between them — which is the\n * whole reason it is a helper rather than three copies. The ladder, and why each rung is the code\n * it is:\n \n - 404 when the application has not opted in. Identical to `/oauth/register`: an application\n * without dynamic registration should be indistinguishable from one whose framework never had\n * the endpoint, so a 403 would advertise a capability one config flag away.\n * - 401 with `WWW-Authenticate` when the Bearer token is absent or malformed. \"The client MUST\n * use its registration access token in all calls to this endpoint as an OAuth 2.0 Bearer Token.\"\n * spec-cite: RFC 7592 §2.\n * - 401 when the client does not exist. \"If the client does not exist on this server, the\n * server MUST respond with HTTP 401 Unauthorized and the registration access token used to make\n * this request SHOULD be immediately revoked.\" spec-cite: RFC 7592 §2.1. The SHOULD is moot for\n * us: a token for a client that does not exist has no row to revoke, so there is nothing to do.\n * - 403 when the client exists but was not dynamically registered. \"If the client does not have\n * permission to read its record, the server MUST return an HTTP 403 Forbidden.\" spec-cite: RFC\n * 7592 §2.1. An operator- or organization-registered client is administered through the ordinary\n * authenticated resource surface; it holds no registration access token and must not be\n * reachable here even if one were somehow presented.\n * - 401 when the presented token does not match.\n \n Note the deliberate asymmetry: an unknown client is 401 and a known-but-ineligible one is 403,\n * which is what the specification asks for even though it leaks that a client id exists. That\n * disclosure is bounded — the caller already had to supply the id — and diverging from the\n * specification here would break a conformant client's error handling.\n /\n private async authenticateClientConfiguration(\n req: Request,\n res: Response,\n ): Promise<{ clientId: string; record: OAuthClientApplication } \| null> {\n if (!this.dynamicRegistrationConfiguration().enabled) {\n res.status(404).json({ error: 'not_found' });\n return null;\n }\n\n const header = req.headers.authorization;\n const presented = typeof header === 'string' && header.startsWith('Bearer ')\n ? header.slice('Bearer '.length).trim()\n : undefined;\n if (!presented) {\n this.sendClientConfigurationUnauthorized(res, 'a registration access token is required');\n return null;\n }\n\n const clientId = String(req.params.clientId ?? '');\n if (!clientId) {\n this.sendClientConfigurationUnauthorized(res, 'unknown client');\n return null;\n }\n\n const record = await this.systemAccess.readAsSystem<OAuthClientApplication>(\n CoreResourceType.OAUTH_CLIENTS_APPLICATION,\n clientId,\n ).catch(() => null);\n if (!record) {\n this.sendClientConfigurationUnauthorized(res, 'unknown client');\n return null;\n }\n\n if (record.registrationOrigin !== OAuthClientRegistrationOrigin.DYNAMIC) {\n res.set('Cache-Control', 'no-store');\n res.status(403).json({ error: 'access_denied', error_description: 'this client is not managed through dynamic registration' });\n return null;\n }\n\n /\n * A DEPROVISIONED client is not manageable, and this rung is what makes its registration access\n * token invalid.\n \n \"If a client is deprovisioned from a server, any outstanding registration access token for\n * that client MUST be invalidated at the same time.\" spec-cite: RFC 7592 §5. A token that\n * authenticates at no endpoint is invalidated in the only sense that matters — so `DELETE` marks\n * the client `INACTIVE` and this refuses every later call, rather than clearing the stored hash\n * and losing the record of which token the client held, which an operator investigating a\n * deleted client wants.\n /\n if (record.status !== OAuthClientStatus.ACTIVE) {\n this.sendClientConfigurationUnauthorized(res, 'invalid registration access token');\n return null;\n }\n\n const storedHash = record.registrationAccessTokenHash;\n // Compared through `timingSafeEqual` over the two DIGESTS: both are fixed-length hex, so the\n // buffers can never differ in length and the comparison cannot leak a prefix match by timing.\n if (!storedHash \|\| !this.registrationTokenMatches(presented, storedHash)) {\n this.sendClientConfigurationUnauthorized(res, 'invalid registration access token');\n return null;\n }\n\n return { clientId, record };\n }\n\n /\n Constant-time comparison of a presented registration access token against the stored digest.\n \n Both sides are SHA-256 hex, so they are always the same length and `timingSafeEqual` cannot\n * throw — which is why the digests are compared rather than the raw values.\n /\n private registrationTokenMatches(presented: string, storedHash: string): boolean {\n const presentedDigest = Buffer.from(hashRegistrationAccessToken(presented), 'hex');\n const storedDigest = Buffer.from(storedHash, 'hex');\n if (presentedDigest.length !== storedDigest.length \|\| presentedDigest.length === 0) return false;\n return timingSafeEqual(presentedDigest, storedDigest);\n }\n\n /\n RFC 6750 §3 shape for every unauthenticated refusal at this endpoint.\n \n One description for a missing token and a wrong one, on purpose: distinguishing them tells an\n * unauthenticated caller which half of its guess was right.\n /\n private sendClientConfigurationUnauthorized(res: Response, description: string): void {\n res.set('Cache-Control', 'no-store');\n res.set('WWW-Authenticate', 'Bearer error=\"invalid_token\"');\n res.status(401).json({ error: 'invalid_token', error_description: description });\n }\n\n /\n The client information response body — RFC 7592 §3, minus the two members §2.2 forbids a client\n * to send back.\n \n `registration_access_token` is NOT echoed on read or update. It is returned once, at\n * registration, and we do not rotate it: §5 permits rotation on a read or update (\"MAY\"), and\n * taking that option means a client that loses the response has silently lost management access\n * for good. The specification's own preference — \"SHOULD NOT expire while a client is still\n * actively registered\" — points the same way.\n /\n private clientInformationResponse(clientId: string, record: OAuthClientApplication): Record<string, unknown> {\n return {\n client_id: clientId,\n client_name: record.name,\n redirect_uris: record.redirectUris ?? [],\n post_logout_redirect_uris: record.postLogoutRedirectUris ?? [],\n grant_types: record.allowedGrants ?? [],\n response_types: ['code'],\n token_endpoint_auth_method: record.tokenEndpointAuthMethod,\n scope: (record.allowedScopes ?? []).join(' '),\n registration_client_uri: this.registrationClientUri(clientId),\n };\n }\n\n /\n `GET /oauth/register/:clientId` — RFC 7592 §2.1 Client Read Request.\n \n \"the authorization server responds with an HTTP 200 OK with content type of `application/json`\".\n * spec-cite: RFC 7592 §2.1.\n /\n private async handleClientConfigurationRead(req: Request, res: Response): Promise<void> {\n const authenticated = await this.authenticateClientConfiguration(req, res);\n if (!authenticated) return;\n\n res.set('Cache-Control', 'no-store');\n this.jsonSuccess(res, this.clientInformationResponse(authenticated.clientId, authenticated.record), 200);\n }\n\n /\n `PUT /oauth/register/:clientId` — RFC 7592 §2.2 Client Update Request.\n \n Full replacement, not a patch, and that is the specification's choice rather than ours: \"This\n * request MUST include all client metadata fields as returned to the client from a previous\n * registration, read, or update operation\" and \"Omitted fields MUST be treated as null or empty\n * values by the server, indicating the client's request to delete them from the client's\n * registration.\" spec-cite: RFC 7592 §2.2.\n \n So a client that sends only the field it wants to change DELETES everything else. That is\n * surprising, it is what the specification requires, and it is why `redirect_uris` is re-validated\n * on every update rather than assumed still present.\n \n Every confinement the registration endpoint applies is re-applied here, in the same order. A\n * client that could widen its scopes, add a grant or change its auth method through an update\n * would have found a way around the registration confinements by taking one extra step.\n /\n private async handleClientConfigurationUpdate(req: Request, res: Response): Promise<void> {\n const authenticated = await this.authenticateClientConfiguration(req, res);\n if (!authenticated) return;\n const { clientId, record } = authenticated;\n\n const body = (req.body ?? {}) as Record<string, unknown>;\n\n // \"The client MUST include its `client_id` field in the request, and it MUST be the same as its\n // currently issued client identifier.\" spec-cite: RFC 7592 §2.2. A mismatch is the client\n // addressing one registration and describing another, which is a client bug worth naming.\n if (body.client_id !== clientId) {\n this.sendRegistrationError(res, 'invalid_client_metadata', 'client_id must be present and must match the client being updated');\n return;\n }\n\n // \"The updated client metadata fields request MUST NOT include the `registration_access_token`,\n // `registration_client_uri`, `client_secret_expires_at`, or `client_id_issued_at` fields.\"\n // spec-cite: RFC 7592 §2.2. Refused rather than ignored: a client sending one has misunderstood\n // the contract, and silently dropping it would leave it believing it had rotated its own token.\n const forbidden = ['registration_access_token', 'registration_client_uri', 'client_secret_expires_at', 'client_id_issued_at']\n .find((field) => body[field] !== undefined);\n if (forbidden) {\n this.sendRegistrationError(res, 'invalid_client_metadata', `${forbidden} must not be included in an update request`);\n return;\n }\n\n // \"If the client includes the `client_secret` field in the request, the value of this field MUST\n // match the currently issued client secret for that client. The client MUST NOT be allowed to\n // overwrite its existing client secret with its own chosen value.\" spec-cite: RFC 7592 §2.2.\n // A dynamically registered client is PUBLIC and never received a secret, so any value it sends\n // cannot match one — refuse rather than compare against a secret it does not have.\n if (body.client_secret !== undefined) {\n this.sendRegistrationError(res, 'invalid_client_metadata', 'this client has no client secret to confirm');\n return;\n }\n\n const redirectUris = body.redirect_uris;\n if (!Array.isArray(redirectUris) \|\| redirectUris.length === 0 \|\| !redirectUris.every((uri): uri is string => typeof uri === 'string')) {\n this.sendRegistrationError(res, 'invalid_redirect_uri', 'redirect_uris must be a non-empty array of strings');\n return;\n }\n const unsafe = redirectUris.find((uri) => !isSafeOAuthRedirectUri(uri));\n if (unsafe) {\n this.sendRegistrationError(res, 'invalid_redirect_uri', `redirect_uri is not permitted: ${unsafe}`);\n return;\n }\n\n // Omitted ⇒ emptied, per §2.2. That is the whole reason this reads as a replacement.\n let postLogoutRedirectUris: string[] = [];\n if (body.post_logout_redirect_uris !== undefined) {\n if (!Array.isArray(body.post_logout_redirect_uris) \|\| !body.post_logout_redirect_uris.every((uri): uri is string => typeof uri === 'string')) {\n this.sendRegistrationError(res, 'invalid_client_metadata', 'post_logout_redirect_uris must be an array of strings');\n return;\n }\n const unsafePostLogout = body.post_logout_redirect_uris.find((uri) => !isSafeOAuthRedirectUri(uri));\n if (unsafePostLogout) {\n this.sendRegistrationError(res, 'invalid_client_metadata', `post_logout_redirect_uri is not permitted: ${unsafePostLogout}`);\n return;\n }\n postLogoutRedirectUris = body.post_logout_redirect_uris;\n }\n\n const clientName = typeof body.client_name === 'string' && body.client_name.trim().length > 0\n ? body.client_name.trim().slice(0, 100)\n : undefined;\n if (!clientName) {\n this.sendRegistrationError(res, 'invalid_client_metadata', 'client_name is required');\n return;\n }\n\n // The registration confinements, re-applied. See `handleDynamicRegistration` for why each one\n // refuses rather than downgrades; the reasoning is identical and is not repeated here.\n if (body.roles !== undefined) {\n this.sendRegistrationError(res, 'invalid_client_metadata', 'roles cannot be requested at dynamic registration');\n return;\n }\n const requestedScopes = typeof body.scope === 'string' ? body.scope.split(/\\s+/).filter(Boolean) : [];\n const beyondIdentity = requestedScopes.filter((scope) => !OIDC_SUPPORTED_IDENTITY_SCOPES.includes(scope));\n if (beyondIdentity.length > 0) {\n this.sendRegistrationError(res, 'invalid_client_metadata', `scope(s) not available to a dynamically registered client: ${beyondIdentity.join(', ')}`);\n return;\n }\n const requestedGrants = Array.isArray(body.grant_types) ? body.grant_types : [OAuthGrantType.AUTHORIZATION_CODE];\n const forbiddenGrant = requestedGrants.find((grant) => grant !== OAuthGrantType.AUTHORIZATION_CODE && grant !== OAuthGrantType.REFRESH_TOKEN);\n if (forbiddenGrant) {\n this.sendRegistrationError(res, 'invalid_client_metadata', `grant_type not available to a dynamically registered client: ${String(forbiddenGrant)}`);\n return;\n }\n const requestedAuthMethod = body.token_endpoint_auth_method;\n if (requestedAuthMethod !== undefined && requestedAuthMethod !== OAuthTokenEndpointAuthMethod.NONE) {\n this.sendRegistrationError(res, 'invalid_client_metadata', 'only token_endpoint_auth_method=none is available to a dynamically registered client');\n return;\n }\n\n const updated = await this.systemAccess.updateAsSystem<OAuthClientApplication>(\n CoreResourceType.OAUTH_CLIENTS_APPLICATION,\n clientId,\n {\n name: clientName,\n redirectUris,\n postLogoutRedirectUris,\n allowedScopes: requestedScopes.length > 0 ? requestedScopes : [...OIDC_SUPPORTED_IDENTITY_SCOPES],\n },\n );\n if (!updated) {\n this.sendClientConfigurationUnauthorized(res, 'unknown client');\n return;\n }\n\n // assurance-control: WILDO.IDENTITY.CLIENT_IDENTITY_ASSERTION — a self-registered client changed\n // its own registration. Same standing as the registration itself, so the same audit concern:\n // `redirect_uris` is where a client's authorization responses are delivered, and an update is the\n // one way that set moves after registration.\n void this.auditLogs.logDynamicClientRegistered({\n clientId,\n clientName,\n redirectUris,\n postLogoutRedirectUris,\n ipAddress: getClientIpFromRequest(req),\n }).catch((auditError) => this.logger.warn('DYNAMIC_CLIENT_REGISTERED audit emit failed on update (non-fatal)', {\n ...projectCaughtErrorLogFields(auditError),\n }));\n\n res.set('Cache-Control', 'no-store');\n this.jsonSuccess(res, this.clientInformationResponse(clientId, { ...record, ...updated }), 200);\n }\n\n /\n `DELETE /oauth/register/:clientId` — RFC 7592 §2.3 Client Delete Request.\n \n \"If a client has been successfully deprovisioned, the authorization server MUST respond with an\n * HTTP 204 No Content message.\" spec-cite: RFC 7592 §2.3.\n \n Deprovisioned by STATUS, not by removing the row, and the row is what makes that sound: every\n * client-resolution path in this server refuses a non-`ACTIVE` client, so `INACTIVE` is\n * indistinguishable from absent to any protocol caller — while the row survives for the audit\n * trail, which is the thing an operator investigating a deleted client actually needs.\n \n The registration access token is invalidated by the same write, though not by being erased:\n * `authenticateClientConfiguration` refuses a non-`ACTIVE` client before it ever compares a token,\n * so the token authenticates nowhere from this moment. \"If a client is deprovisioned from a server,\n * any outstanding registration access token for that client MUST be invalidated at the same time.\"\n * spec-cite: RFC 7592 §5. Keeping the digest on the row costs nothing and preserves the record of\n * which token the client held, which an operator investigating a deleted client wants.\n \n NOT DONE, and stated rather than implied: \"If possible, the authorization server SHOULD\n * immediately invalidate all existing authorization grants and currently active access tokens, all\n * refresh tokens, and all other tokens associated with this client.\" spec-cite: RFC 7592 §2.3.\n * Already-issued access tokens keep working until they expire. Reaching them means driving the\n * revocation machinery over every token minted for this client, which is a larger change than this\n * endpoint; the client cannot obtain NEW tokens the moment this returns, because the token endpoint\n * resolves the client and refuses it.\n /\n private async handleClientConfigurationDelete(req: Request, res: Response): Promise<void> {\n const authenticated = await this.authenticateClientConfiguration(req, res);\n if (!authenticated) return;\n const { clientId } = authenticated;\n\n const deprovisioned = await this.systemAccess.updateAsSystem<OAuthClientApplication>(\n CoreResourceType.OAUTH_CLIENTS_APPLICATION,\n clientId,\n { status: OAuthClientStatus.INACTIVE },\n );\n if (!deprovisioned) {\n this.sendClientConfigurationUnauthorized(res, 'unknown client');\n return;\n }\n\n res.set('Cache-Control', 'no-store');\n res.status(204).send();\n }\n\n private sendRegistrationError(res: Response, error: string, description: string): void {\n res.set('Cache-Control', 'no-store');\n res.status(400).json({ error, error_description: description });\n }\n\n /\n Per-source-IP registration budget.\n \n Fail-CLOSED on a store error, which is the opposite of how most rate limits behave here and is\n * deliberate: elsewhere a limiter outage degrades an authenticated feature, whereas this one is\n * the sole restraint on anonymous row creation. Refusing registrations during a Redis outage\n * costs a client one retry; failing open costs the database.\n /\n private async withinDynamicRegistrationRate(clientIp: string \| undefined, configuration: DynamicClientRegistrationConfig): Promise<boolean> {\n try {\n const key = `oauth-dynamic-registration:${clientIp ?? 'unknown'}`;\n const count = await this.redisService.incrementRateLimit(key, 3600);\n return count <= configuration.maxRegistrationsPerHourPerIp;\n } catch (error) {\n this.logger.warn('Dynamic-registration rate check failed; refusing (fail-closed)', {\n ...projectCaughtErrorLogFields(error),\n });\n return false;\n }\n }\n\n private async handleAuthorize(req: Request, res: Response): Promise<void> {\n const q = req.query as Record<string, string \| undefined>;\n\n // Single-valued params; a REPEATED query key (Express parses `?scope=a&scope=b` to `string[]`\n // despite the cast) is malformed. Reject cleanly (400) — otherwise `(q.scope).split(...)` throws\n // a 500 and a repeated `resource` reaches the RFC 8707 binding as an array.\n const malformedAuthorizeParam = this.firstMalformedParam(q, ['response_type', 'client_id', 'redirect_uri', 'code_challenge', 'code_challenge_method', 'scope', 'resource', 'state', 'nonce']);\n if (malformedAuthorizeParam) {\n this.sendOAuthError(res, 400, 'invalid_request', `the '${malformedAuthorizeParam}' parameter must be a single string value`);\n return;\n }\n\n if (q.response_type !== 'code') {\n this.sendOAuthError(res, 400, 'unsupported_response_type', 'only response_type=code is supported');\n return;\n }\n if (!q.client_id \|\| !q.redirect_uri) {\n this.sendOAuthError(res, 400, 'invalid_request', 'client_id and redirect_uri are required');\n return;\n }\n if (q.code_challenge_method !== 'S256' \|\| !isValidS256CodeChallenge(q.code_challenge)) {\n // RFC 7636 §4.2: require a well-formed S256 challenge (43 unreserved-base64url chars) at the entry —\n // not merely a present one — so a malformed/low-entropy challenge is rejected before a code is minted.\n this.sendOAuthError(res, 400, 'invalid_request', 'a PKCE S256 code_challenge is required');\n return;\n }\n\n const authenticated = await this.resolveAuthenticatedUser(req);\n if (!authenticated) {\n // The user must authenticate first. A browser-integrated frontend redirects to login here;\n // for an API caller we signal login_required. (Login + consent UI is the frontend follow-up.)\n this.sendOAuthError(res, 401, 'login_required', 'user authentication is required at the authorization endpoint');\n return;\n }\n const { userId, sessionId } = authenticated;\n\n const scope = (q.scope ?? '').split(/\\s+/).filter(Boolean);\n try {\n // S1 (interactive consent): a `requiresConsent` (third-party) client does NOT receive a code\n // straight away — the user must EXPLICITLY approve acting on their behalf. Return\n // `consent_required` + a single-use consent-request token (the frontend renders the consent\n // screen from this and POSTs the decision to `/oauth/authorize/decision`). A trusted /\n // first-party client (`requiresConsent` false — the default) proceeds straight to the code, so\n // machine + trusted flows are UNCHANGED. Server-owned gate: the client cannot suppress it.\n // `userId` is resolved + non-undefined by here (login_required returned above otherwise). Passed so\n // the consent resolver can apply the D4/B same-org gate (a cross-org user always sees consent).\n const consentPosture = await this.authCodeService.resolveAuthorizationClientConsent(q.client_id, q.redirect_uri, userId);\n const { requiresConsent, clientName } = consentPosture;\n // Persistent consent (Item 3, \"remember this app\"): a `requiresConsent` client whose user already\n // has a stored grant covering the requested scopes for this (client, resource) is NOT re-prompted —\n // it falls through to the code-issuance path below (returns `{redirect_to}`), exactly like a trusted\n // client. Scope matching is SUBSET; a request for any new scope re-prompts (see hasCoveringConsentGrant).\n const needsConsent = requiresConsent\n && !(await this.authCodeService.hasCoveringConsentGrant(userId, q.client_id, q.resource, scope));\n if (needsConsent) {\n const { consentToken } = await this.authCodeService.createConsentRequest({\n userId,\n clientId: q.client_id,\n redirectUri: q.redirect_uri,\n scope,\n codeChallenge: q.code_challenge,\n nonce: q.nonce,\n resource: q.resource,\n state: q.state,\n });\n res.set('Cache-Control', 'no-store');\n this.jsonSuccess(res, {\n consent_required: true,\n consent_token: consentToken,\n client: {\n id: q.client_id,\n name: clientName,\n /\n How this client's identity was established, and the two DISPLAY obligations that come\n * with a domain-only identity. All three are here because the specification makes them\n * requirements on the authorization server, and the consent screen cannot satisfy a\n * requirement it was never handed the data for:\n \n \"Authorization servers … MUST clearly display the redirect URI hostname during\n * authorization\" and \"SHOULD display additional warnings for `localhost`-only redirect\n * URIs\".\n * spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Document Security →\n * Localhost Redirect URI Risks\n \n `origin` lets the screen say WHICH trust story applies: a registered client was vetted\n * by someone in this application, a CIMD client proved only that it controls a domain.\n * Sent for both origins so the consent screen has one shape, not two.\n /\n origin: consentPosture.origin,\n redirect_uri_hostname: consentPosture.redirectUriHostname,\n loopback_only_redirects: consentPosture.warnsLoopbackOnlyRedirects,\n },\n scopes: scope,\n resource: q.resource ?? null,\n }, 200);\n return;\n }\n const { code } = await this.authCodeService.issueAuthorizationCode({\n userId,\n clientId: q.client_id,\n redirectUri: q.redirect_uri,\n scope,\n codeChallenge: q.code_challenge,\n codeChallengeMethod: 'S256',\n nonce: q.nonce,\n // RFC 8707 resource indicator — the agent (A2A / MCP) endpoint the client wants the token\n // for. Bound into the code here (authoritative), so the token endpoint mints an `aud`-confined\n // delegated token (B-S2). Absent ⇒ the token exchange fails closed with `invalid_target`.\n resource: q.resource,\n // revocation-C: bind the End-User's OP session to the code → id_token `sid`, so an RP logout\n // (end_session) terminates the exact Wildo login session this delegation was authorized from.\n sessionId,\n });\n // U-30 defense: build the redirect target defensively. `q.redirect_uri` already exact-matched a\n // registered URI (each constrained to a parseable absolute URL by `isSafeOAuthRedirectUri`), so this\n // cannot throw through the front door — but fail with a CLEAN OAuth error rather than a raw 500 if a\n // redirectUri was ever persisted bypassing that refine (a seed / createAsSystem / migration).\n let redirect: URL;\n try {\n redirect = new URL(q.redirect_uri);\n } catch {\n this.sendOAuthError(res, 400, 'invalid_request', 'the redirect_uri bound to this request is not a valid URL');\n return;\n }\n redirect.searchParams.set('code', code);\n if (q.state) redirect.searchParams.set('state', q.state);\n // Return the redirect target as JSON (NOT a 302), mirroring `/oauth/authorize/decision`: the caller\n // is the Bearer-authenticated consent SPA (an XHR), which auto-follows a 302 but cannot read a\n // cross-origin `Location` — so a 302 would neither deliver the code to the client nor forward the\n // user. The SPA does `window.location.assign(redirect_to)` to complete the OAuth redirect.\n this.sendAuthorizationRedirect(res, redirect);\n } catch (error) {\n if (isWildoBackendError(error)) {\n const ctx = (error as { context?: { oauthError?: string; detail?: string } }).context;\n if (ctx?.oauthError) {\n this.sendOAuthError(res, ctx.oauthError === 'invalid_client' ? 401 : 400, ctx.oauthError, ctx.detail);\n return;\n }\n }\n throw error;\n }\n }\n\n /\n `POST /oauth/authorize/decision` — the interactive-consent decision (S1). After `/oauth/authorize`\n * returned `consent_required` for a `requiresConsent` client, the user's approve/deny is POSTed here\n * with the single-use consent-request token. Bearer-authenticated (the same user who authorized).\n * - `decision=approve` → mint the authorization code from the stashed request → return\n * `{ redirect_to: <redirect_uri>?code=&state= }` (200 JSON).\n * - anything else → DENY → return `{ redirect_to: <redirect_uri>?error=access_denied&state= }`\n * (200 JSON, RFC 6749 §4.1.2.1). No code minted.\n \n Returns the redirect target as JSON (NOT an HTTP 302) because the caller is a Bearer-authenticated\n * BROWSER SPA (the interactive consent screen): an XHR carrying the required `Authorization` header\n * auto-follows a 302 and cannot read a cross-origin `Location`, so the SPA could neither read the\n * code nor forward the user. Instead the SPA does `window.location.assign(redirect_to)` to complete\n * the OAuth redirect to the third-party client. The request parameters come from the SERVER-STORED\n * consent token (not the POST body), so the decision cannot tamper with what the user approved.\n /\n private async handleConsentDecision(req: Request, res: Response): Promise<void> {\n const body = (req.body ?? {}) as Record<string, string \| undefined>;\n const malformed = this.firstMalformedParam(body, ['consent_token', 'decision', 'remember']);\n if (malformed) {\n this.sendOAuthError(res, 400, 'invalid_request', `the '${malformed}' parameter must be a single string value`);\n return;\n }\n const authenticated = await this.resolveAuthenticatedUser(req);\n if (!authenticated) {\n this.sendOAuthError(res, 401, 'login_required', 'user authentication is required to record a consent decision');\n return;\n }\n const { userId, sessionId } = authenticated;\n if (!body.consent_token \|\| !body.decision) {\n this.sendOAuthError(res, 400, 'invalid_request', 'consent_token and decision are required');\n return;\n }\n\n try {\n const request = await this.authCodeService.consumeConsentRequest(body.consent_token);\n // Bind the decision to the AUTHENTICATED user: the consent token's subject MUST be the caller,\n // so one user cannot approve/deny another user's pending consent (the token is single-use, so\n // this is already consumed — fail closed without minting anything).\n if (request.userId !== userId) {\n // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — a consent-token user-binding violation\n // (one user attempting to act on another user's pending consent) is a textbook cross-user\n // authorization-abuse signal. Fail closed (403) AND audit it (records BOTH principals — actor +\n // victim). The raw consent-token value is deliberately NOT logged (credential hygiene; it is\n // single-use and already consumed). Fire-and-forget — auditing must never affect the fail-closed 403.\n void this.auditLogs.logOAuthConsentBindingViolation({\n authenticatedUserId: userId,\n boundUserId: request.userId,\n clientId: request.clientId,\n ipAddress: getClientIpFromRequest(req),\n }).catch((auditError) => this.logger.warn('OAUTH_CONSENT_BINDING_VIOLATION audit emit failed (non-fatal)', {\n ...projectCaughtErrorLogFields(auditError),\n }));\n this.sendOAuthError(res, 403, 'access_denied', 'the consent request does not belong to the authenticated user');\n return;\n }\n // U-30 defense: the single-use consent token is ALREADY consumed above (its redirect_uri is only known\n // post-consume), so we cannot pre-validate — but a malformed stored redirect_uri must yield a CLEAN OAuth\n // error, not a raw 500 (the token is spent either way; do not also leak a stack trace). Normally\n // impossible — the stored value passed `isSafeOAuthRedirectUri` at authorize time.\n let redirect: URL;\n try {\n redirect = new URL(request.redirectUri);\n } catch {\n this.sendOAuthError(res, 400, 'invalid_request', 'the redirect_uri bound to this consent request is not a valid URL');\n return;\n }\n if (request.state) redirect.searchParams.set('state', request.state);\n res.set('Cache-Control', 'no-store');\n\n if (body.decision !== 'approve') {\n // DENY (or any non-approve value) — fail closed, no code minted.\n // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — user REFUSES third-party delegated access. The\n // binding check above passed, so the denying user IS `request.userId`. Fire-and-forget.\n void this.auditLogs.logOAuthConsentDenied({\n userId: request.userId,\n clientId: request.clientId,\n scopes: request.scope,\n resource: request.resource,\n ipAddress: getClientIpFromRequest(req),\n }).catch((auditError) => this.logger.warn('OAUTH_CONSENT_DENIED audit emit failed (non-fatal)', {\n ...projectCaughtErrorLogFields(auditError),\n }));\n redirect.searchParams.set('error', 'access_denied');\n // An ERROR response carries `iss` too — explicitly required, and the case that matters most:\n // a mix-up victim is likelier to be handed a failure than a success.\n this.sendAuthorizationRedirect(res, redirect);\n return;\n }\n\n const { code } = await this.authCodeService.issueAuthorizationCode({\n userId: request.userId,\n clientId: request.clientId,\n redirectUri: request.redirectUri,\n scope: request.scope,\n codeChallenge: request.codeChallenge,\n codeChallengeMethod: 'S256',\n nonce: request.nonce,\n resource: request.resource,\n // revocation-C: bind the session that COMPLETES the grant (the decision-time authenticated\n // session, verified `request.userId === userId` above) to the code → id_token `sid`. Using the\n // live decision-time session (not the stored authorize-time one) keeps `sid` pointing at a\n // session that is still alive to be terminated by a later RP end_session.\n sessionId,\n });\n // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — user APPROVES third-party delegated access (a\n // code is now issued and the client may act for them). `remembered` flags whether a durable grant was\n // also requested (the grant CREATION itself is audited separately as A-3 inside `upsertConsentGrant`).\n // Fire-and-forget — auditing must never affect the consent the user already gave.\n void this.auditLogs.logOAuthConsentGranted({\n userId: request.userId,\n clientId: request.clientId,\n scopes: request.scope,\n resource: request.resource,\n remembered: body.remember === 'true',\n ipAddress: getClientIpFromRequest(req),\n }).catch((auditError) => this.logger.warn('OAUTH_CONSENT_GRANTED audit emit failed (non-fatal)', {\n ...projectCaughtErrorLogFields(auditError),\n }));\n // Persistent consent (Item 3): if the user opted to remember this app, store/widen the grant so a\n // future authorize with covering scopes skips the prompt. Best-effort — a store failure must NOT\n // fail the consent the user already gave (the code is already minted).\n if (body.remember === 'true') {\n await this.authCodeService\n .upsertConsentGrant(request.userId, request.clientId, request.resource, request.scope)\n .catch((e) => this.logger.warn('Persistent consent grant store failed (non-fatal)', { ...projectCaughtErrorLogFields(e) }));\n }\n redirect.searchParams.set('code', code);\n this.sendAuthorizationRedirect(res, redirect);\n } catch (error) {\n if (isWildoBackendError(error)) {\n const ctx = (error as { context?: { oauthError?: string; detail?: string } }).context;\n if (ctx?.oauthError) {\n this.sendOAuthError(res, ctx.oauthError === 'invalid_client' ? 401 : 400, ctx.oauthError, ctx.detail);\n return;\n }\n }\n throw error;\n }\n }\n\n /\n `GET /oauth/userinfo` — returns the authenticated user's claims for a valid user Bearer token\n * (OIDC Core §5.3). Always returns `sub`; adds the standard `email`/`profile`-scope claims the\n * access token was granted, resolved via {@link OidcUserClaimsBackendService}. `picture` (avatar)\n * and `locale` claims are a documented follow-up.\n /\n private async handleUserInfo(req: Request, res: Response): Promise<void> {\n const authHeader = req.headers['authorization'];\n if (typeof authHeader !== 'string' \|\| !authHeader.startsWith('Bearer ')) {\n this.sendOAuthError(res, 401, 'invalid_token', 'a bearer access token is required', 'Bearer');\n return;\n }\n let claim: { type?: string; userId?: string; sub?: string; scope?: string[] };\n try {\n claim = (await this.jwtService.verify(authHeader.slice('Bearer '.length).trim())) as typeof claim;\n } catch {\n this.sendOAuthError(res, 401, 'invalid_token', 'access token invalid or expired', 'Bearer');\n return;\n }\n const sub = claim.userId ?? claim.sub;\n if (!sub \|\| claim.type !== ExecutionContext_ExecutionType.USER_REQUEST) {\n this.sendOAuthError(res, 403, 'insufficient_scope', 'userinfo requires a user access token', 'Bearer');\n return;\n }\n // OIDC Core §5.3.2: `sub` plus the standard claims the access token's granted identity scopes\n // (`email` / `profile`) permit. A token carrying no `scope` claim (e.g. a first-party session\n // token) yields just `sub`. The resolver reads the subject's own User/UserProfile and never\n // throws for a missing profile.\n const claims = await this.userClaimsService.resolveUserClaims(sub, claim.scope ?? []);\n res.set('Cache-Control', 'no-store');\n this.jsonSuccess(res, { sub, ...claims }, 200);\n }\n\n /\n Resolve the authenticated user (id + login `sessionId`) from a `Bearer` user access token, else\n * `undefined`. The `sessionId` (revocation-C) is threaded into the OIDC authorization code so the\n * id_token carries `sid` — the handle the RP-Initiated Logout endpoint terminates.\n /\n private async resolveAuthenticatedUser(req: Request): Promise<{ userId: string; sessionId?: string } \| undefined> {\n const authHeader = req.headers['authorization'];\n if (typeof authHeader !== 'string' \|\| !authHeader.startsWith('Bearer ')) return undefined;\n try {\n const claim = (await this.jwtService.verify(authHeader.slice('Bearer '.length).trim())) as { type?: string; userId?: string; sessionId?: string };\n if (claim.type !== ExecutionContext_ExecutionType.USER_REQUEST \|\| !claim.userId) return undefined;\n return { userId: claim.userId, sessionId: claim.sessionId };\n } catch {\n return undefined;\n }\n }\n\n /\n Resolve the client secret (+ optional client_id) from `client_secret_basic`\n * (Authorization: Basic base64(client_id:client_secret)) or `client_secret_post` (body).\n * Values are URL-safe in this system (`oc_` secrets + id), so no percent-decoding is needed.\n /\n private extractClientCredentials(req: Request, body: Record<string, string \| undefined>): { clientId?: string; clientSecret?: string } {\n const authHeader = req.headers['authorization'];\n if (typeof authHeader === 'string' && authHeader.startsWith('Basic ')) {\n const decoded = Buffer.from(authHeader.slice('Basic '.length).trim(), 'base64').toString('utf8');\n const sep = decoded.indexOf(':');\n if (sep >= 0) {\n return {\n clientId: decoded.slice(0, sep) \|\| undefined,\n clientSecret: decoded.slice(sep + 1) \|\| undefined,\n };\n }\n }\n return { clientId: body.client_id \|\| undefined, clientSecret: body.client_secret \|\| undefined };\n }\n\n /*\n OAuth/OIDC request params are single-valued STRINGS, but Express (`extended:true` urlencoded, plus\n * `express.json`) parses a REPEATED key into a `string[]` and a bracketed `k[$regex]=…` / JSON\n * `{\"k\":{…}}` key into an OBJECT — despite the `Record<string,string\|undefined>` cast at the handler\n * boundary. Returns the first `keys` entry that arrived as a NON-STRING (array, object, number, …), or\n * `undefined`.\n \n The caller rejects with `invalid_request` (400) so a non-string can never reach a `.split`/`.includes`\n * (500), slip silently through the RFC 8707 audience comparison, OR — critically — reach a RAW Mongo\n * filter as a `{$regex}` / `{$ne}` operator object. That last case is a NoSQL-operator-injection sink:\n * an object `code`/`token` flows to the consumable-token store's `findOne({ token })` and would\n * consume an arbitrary matching token (password-reset / invitation / magic-link); an object\n * `client_id` selects an arbitrary client. Rejecting EVERY non-string closes both the repeated-param\n * (array) and the injection (object) classes with one guard — an array is simply one kind of non-string.\n */\n private firstMalformedParam(source: Record<string, unknown>, keys: string[]): string \| undefined {\n return keys.find((k) => source[k] !== undefined && typeof source[k] !== 'string');\n }\n\n private sendOAuthError(res: Response, status: number, error: string, description?: string, wwwAuthenticate?: 'Basic' \| 'Bearer'): void {\n res.set('Cache-Control', 'no-store');\n // Token endpoint 401s challenge `Basic` (client auth); userinfo challenges `Bearer`. Other\n // 401s (e.g. authorize login_required) send no challenge.\n const scheme = wwwAuthenticate ?? (status === 401 ? 'Basic' : undefined);\n if (scheme) res.set('WWW-Authenticate', scheme);\n res.status(status).json({ error, ...(description ? { error_description: description } : {}) });\n }\n}\n"]}
1	+ {"version":3,"file":"oauth-provider-controller.backend.service.js","sourceRoot":"","sources":["../../../../../src/security/authentications/controllers/oauth-provider-controller.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAC5I,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AACvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,2FAA2F,CAAC;AAC7I,OAAO,EAAE,mCAAmC,EAAE,MAAM,8FAA8F,CAAC;AACnJ,OAAO,EAAE,4BAA4B,EAAE,8BAA8B,EAAE,gCAAgC,EAAE,MAAM,uFAAuF,CAAC;AACvM,OAAO,EAAE,eAAe,EAAE,MAAM,yEAAyE,CAAC;AAE1G,OAAO,EAAE,iCAAiC,EAAE,uCAAuC,EAAE,2BAA2B,EAAE,MAAM,iFAAiF,CAAC;AAE1M,OAAO,EAAE,gCAAgC,EAAE,MAAM,2FAA2F,CAAC;AAC7I,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,wEAAwE,CAAC;AACxG,OAAO,EAAE,mBAAmB,EAAE,MAAM,kFAAkF,CAAC;AAEvH,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAClG,OAAO,EAAE,kCAAkC,EAAE,wBAAwB,EAAE,MAAM,kGAAkG,CAAC;AAChL,OAAO,EAAE,wBAAwB,EAAE,MAAM,+EAA+E,CAAC;AACzH,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,8BAA8B,EAC9B,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,EAC7B,iBAAiB,EACjB,cAAc,EACd,4BAA4B,EAC5B,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAG/B;;;;;;;;;;;;;;GAcG;AAEI,IAAM,qCAAqC,GAA3C,MAAM,qCAAsC,SAAQ,gCAAgC;IAKvB;IACF;IACC;IACI;IACT;IACI;IACF;IACI;IACC;IAGJ;IAf/D,YACqC,MAAqB,EACR,YAAwC,EACxC,YAAiC,EACjB,YAA8C,EAChD,gBAAyC,EACxC,UAA6B,EACzB,eAAoD,EAC7D,YAA0B,EACtB,SAAkC,EACpC,iBAA+C,EAC3C,WAA6C,EAC5C,YAAwC,EAG5C,eAA8C;QAE3G,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,yBAAyB,CAAC,CAAC;QAbL,iBAAY,GAAZ,YAAY,CAAkC;QAChD,qBAAgB,GAAhB,gBAAgB,CAAyB;QACxC,eAAU,GAAV,UAAU,CAAmB;QACzB,oBAAe,GAAf,eAAe,CAAqC;QAC7D,iBAAY,GAAZ,YAAY,CAAc;QACtB,cAAS,GAAT,SAAS,CAAyB;QACpC,sBAAiB,GAAjB,iBAAiB,CAA8B;QAC3C,gBAAW,GAAX,WAAW,CAAkC;QAC5C,iBAAY,GAAZ,YAAY,CAA4B;QAG5C,oBAAe,GAAf,eAAe,CAA+B;IAG7G,CAAC;IAES,WAAW;QACnB,MAAM,QAAQ,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,CAAC;QAC9F,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,0DAA0D,CAAC,CAAC;QAExG,yFAAyF;QACzF,4FAA4F;QAC5F,6FAA6F;QAC7F,8FAA8F;QAC9F,+FAA+F;QAC/F,6FAA6F;QAC7F,2BAA2B;QAC3B,MAAM,kBAAkB,GAAG,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAEvF,MAAM,YAAY,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,CAAC;QACtG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,kBAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,6CAA6C,CAAC,CAAC;QAE9F,gGAAgG;QAChG,+DAA+D;QAC/D,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;QACzG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,kBAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,aAAa,EAAE,kEAAkE,CAAC,CAAC;QAEpH,MAAM,OAAO,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;QAC5F,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,iDAAiD,CAAC,CAAC;QAE7F,6FAA6F;QAC7F,gFAAgF;QAChF,MAAM,YAAY,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,CAAC;QACtG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,kDAAkD,CAAC,CAAC;QAEnG,+FAA+F;QAC/F,MAAM,UAAU,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,CAAC;QAClG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,4CAA4C,CAAC,CAAC;QAE5F,MAAM,WAAW,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;QACpG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC;QAExE,MAAM,SAAS,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,CAAC;QAChG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,uCAAuC,CAAC,CAAC;QAEtF,qGAAqG;QACrG,qGAAqG;QACrG,0FAA0F;QAC1F,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;QACzG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,aAAa,EAAE,iDAAiD,CAAC,CAAC;QAEnG,kGAAkG;QAClG,yFAAyF;QACzF,mFAAmF;QACnF,MAAM,oBAAoB,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,kCAAkC,CAAC,CAAC;QACxH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,EAAE,mDAAmD,CAAC,CAAC;QAE7G,MAAM,WAAW,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;QACpG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,4DAA4D,CAAC,CAAC;QAE7G,iGAAiG;QACjG,2EAA2E;QAC3E,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,CAAC;QACjH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1G,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,EAAE,4CAA4C,CAAC,CAAC;QAClG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,EAAE,8CAA8C,CAAC,CAAC;QACpG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,8CAA8C,CAAC,CAAC;IACzG,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,YAAY,CAAC,GAAY,EAAE,GAAa;QACpD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAuC,CAAC;QACpE,mGAAmG;QACnG,qFAAqF;QACrF,wFAAwF;QACxF,MAAM,oBAAoB,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;QACxH,IAAI,oBAAoB,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,QAAQ,oBAAoB,2CAA2C,CAAC,CAAC;YAC1H,OAAO;QACT,CAAC;QACD,4FAA4F;QAC5F,gGAAgG;QAChG,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5E,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,yDAAyD,CAAC,CAAC;gBAC5G,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,eAAe,CAAC,2BAA2B,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YACjF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/B,MAAM,OAAO,GAAI,KAAgE,CAAC,OAAO,CAAC;oBAC1F,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;wBACxB,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;wBAClH,OAAO;oBACT,CAAC;gBACH,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvD,+FAA+F;YAC/F,kGAAkG;YAClG,mGAAmG;YACnG,oGAAoG;YACpG,yFAAyF;YACzF,MAAM,yBAAyB,GAAG,OAAO,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAC;YACpE,KAAK,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC;gBACvC,QAAQ,EAAE,yBAAyB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAC1D,mBAAmB,EAAE,yBAAyB;gBAC9C,aAAa,EAAE,IAAI,CAAC,eAAe;gBACnC,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;aACvC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;gBAC7F,GAAG,2BAA2B,CAAC,UAAU,CAAC;aAC3C,CAAC,CAAC,CAAC;QACN,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACK,KAAK,CAAC,gBAAgB,CAAC,GAAY,EAAE,GAAa;QACxD,MAAM,CAAC,GAAG,GAAG,CAAC,KAA2C,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,eAAe,EAAE,0BAA0B,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QACnH,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,QAAQ,SAAS,2CAA2C,CAAC,CAAC;YAC/G,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,EAAE,uCAAuC,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,4FAA4F;QAC5F,kGAAkG;QAClG,qGAAqG;QACrG,sGAAsG;QACtG,wGAAwG;QACxG,MAAM,UAAU,GAAG,GAAG,OAAO,mBAAmB,CAAC;QAEjD,oGAAoG;QACpG,qGAAqG;QACrG,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,CAAC;QAElE,IAAI,MAA0B,CAAC;QAC/B,IAAI,SAA6B,CAAC;QAClC,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC,CAAC,aAAa,IAAI,MAAM,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,gCAAgC,CACpE,CAAC,CAAC,aAAa,EACf,cAAc,CAAC,sBAAsB,EACrC,EAAE,cAAc,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,CACzE,CAA+D,CAAC;gBACjE,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;gBACpB,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC;gBACvB,iGAAiG;gBACjG,8FAA8F;gBAC9F,QAAQ,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,gGAAgG;gBAChG,2FAA2F;YAC7F,CAAC;QACH,CAAC;QAED,oGAAoG;QACpG,+FAA+F;QAC/F,MAAM,gBAAgB,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC;QAEtF,kGAAkG;QAClG,IAAI,iBAAqC,CAAC;QAC1C,IAAI,6BAA6B,GAAG,KAAK,CAAC;QAC1C,IAAI,CAAC,CAAC,wBAAwB,EAAE,CAAC;YAC/B,MAAM,WAAW,GAAG,CAAC,gBAAgB;mBAChC,QAAQ,KAAK,SAAS;mBACtB,MAAM,IAAI,CAAC,eAAe,CAAC,iCAAiC,CAAC,QAAQ,EAAE,CAAC,CAAC,wBAAwB,CAAC,CAAC;YACxG,IAAI,WAAW,EAAE,CAAC;gBAChB,iBAAiB,GAAG,CAAC,CAAC,wBAAwB,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,6BAA6B,GAAG,IAAI,CAAC;YACvC,CAAC;QACH,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAErC,uGAAuG;QACvG,mGAAmG;QACnG,sGAAsG;QACtG,8FAA8F;QAC9F,IAAI,iBAAiB,EAAE,CAAC;YACtB,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC1D,CAAC;YACD,8FAA8F;YAC9F,gGAAgG;YAChG,yCAAyC;YACzC,mBAAmB,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;YAClF,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzI,IAAI,QAAa,CAAC;YAClB,IAAI,CAAC;gBACH,QAAQ,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,8FAA8F;gBAC9F,oGAAoG;gBACpG,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;gBAC9B,OAAO;YACT,CAAC;YACD,sGAAsG;YACtG,4EAA4E;YAC5E,IAAI,CAAC,CAAC,KAAK;gBAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACzD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QAED,sGAAsG;QACtG,mGAAmG;QACnG,8FAA8F;QAC9F,8FAA8F;QAC9F,8FAA8F;QAC9F,sGAAsG;QACtG,qGAAqG;QACrG,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;YACxB,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,wBAAwB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAClJ,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,OAAO,uBAAuB,CAAC,CAAC;YAC9D,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;YACxD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QAED,oGAAoG;QACpG,oGAAoG;QACpG,sGAAsG;QACtG,8BAA8B;QAC9B,mBAAmB,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAClF,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC5H,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACK,uBAAuB,CAC7B,GAAY,EACZ,MAAsI;QAEtI,KAAK,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC;YAC5C,GAAG,MAAM;YACT,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;SACvC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yDAAyD,EAAE;YACnG,GAAG,2BAA2B,CAAC,UAAU,CAAC;SAC3C,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACK,KAAK,CAAC,uBAAuB,CAAC,GAAY,EAAE,GAAa;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,EAAE,uCAAuC,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAwB,CAAC;QACrD,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,mCAAmC,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACjF,4FAA4F;QAC5F,IAAI,YAAY,EAAE,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACvE,CAAC;QACD,mBAAmB,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAClF,oGAAoG;QACpG,kGAAkG;QAClG,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,YAAY,EAAE,MAAM;YAC5B,SAAS,EAAE,YAAY,EAAE,SAAS;YAClC,QAAQ,EAAE,YAAY,EAAE,QAAQ;YAChC,iBAAiB,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC;YACnD,6BAA6B,EAAE,YAAY,EAAE,6BAA6B,IAAI,KAAK;SACpF,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,OAAO,mBAAmB,EAAE,CAAC,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,eAAe,CAAC,IAAa,EAAE,GAAa;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,EAAE,8BAA8B,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,qGAAqG;QACrG,wFAAwF;QACxF,kGAAkG;QAClG,8EAA8E;QAC9E,oGAAoG;QACpG,2GAA2G;QAC3G,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,EAAE,uCAAuC,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,0FAA0F;QAC1F,6FAA6F;QAC7F,8FAA8F;QAC9F,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iHAAiH,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAClJ,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QACjD,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;YACpB,MAAM;YACN,sBAAsB,EAAE,GAAG,OAAO,gBAAgB;YAClD,cAAc,EAAE,GAAG,MAAM,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;YAC1G,QAAQ,EAAE,GAAG,MAAM,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;YACnG,iBAAiB,EAAE,GAAG,MAAM,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE;YAChH,mBAAmB,EAAE,GAAG,MAAM,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE;YAChH,sGAAsG;YACtG,qGAAqG;YACrG,kFAAkF;YAClF,+FAA+F;YAC/F,qCAAqC;YACrC,oBAAoB,EAAE,GAAG,MAAM,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;YACtH,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,eAAe,CAAC;YACpF,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,wBAAwB,EAAE,CAAC,OAAO,CAAC;YACnC,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,4FAA4F;YAC5F,gGAAgG;YAChG,+FAA+F;YAC/F,8FAA8F;YAC9F,+FAA+F;YAC/F,yBAAyB;YACzB,gFAAgF;YAChF,8CAA8C,EAAE,IAAI;YACpD,0FAA0F;YAC1F,+FAA+F;YAC/F,+FAA+F;YAC/F,4FAA4F;YAC5F,qCAAqC,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,oBAAoB,CAAC;YAC5F,yFAAyF;YACzF,gGAAgG;YAChG,2FAA2F;YAC3F,6BAA6B,EAAE,IAAI;YACnC;;;;;;;;;;;;;eAaG;YACH,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,uBAAuB,EAAE,CAAC,MAAM,KAAK,eAAe,CAAC,QAAQ;gBAChF,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC;YACpD;;;;;;;;;;eAUG;YACH,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,CAAC,OAAO;gBACjD,CAAC,CAAC,EAAE,qBAAqB,EAAE,GAAG,MAAM,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,EAAE;gBAC1H,CAAC,CAAC,EAAE,CAAC;YACP,uBAAuB,EAAE,CAAC,QAAQ,CAAC;YACnC,qCAAqC,EAAE,CAAC,OAAO,CAAC;YAChD,oGAAoG;YACpG,iGAAiG;YACjG,sGAAsG;YACtG,wGAAwG;YACxG,oGAAoG;YACpG,iGAAiG;YACjG,kGAAkG;YAClG,4EAA4E;YAC5E,gBAAgB,EAAE,CAAC,GAAG,8BAA8B,CAAC;YACrD,gBAAgB,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,gCAAgC,CAAC;SAC3G,EAAE,GAAG,CAAC,CAAC;IACV,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,GAAa;QACnD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QACjD,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,WAAW,CAAC,GAAY,EAAE,GAAa;QACnD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAuC,CAAC;QACpE,gGAAgG;QAChG,gGAAgG;QAChG,yFAAyF;QACzF,MAAM,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QACxL,IAAI,mBAAmB,EAAE,CAAC;YACxB,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,QAAQ,mBAAmB,2CAA2C,CAAC,CAAC;YACzH,OAAO;QACT,CAAC;QACD,iGAAiG;QACjG,+FAA+F;QAC/F,8GAA8G;QAC9G,6GAA6G;QAC7G,6GAA6G;QAC7G,oGAAoG;QACpG,yGAAyG;QACzG,8FAA8F;QAC9F,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAE7C,IAAI,CAAC;YACH,IAAI,KAAc,CAAC;YACnB,IAAI,IAAI,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;gBAC7C,+EAA+E;gBAC/E,yFAAyF;gBACzF,MAAM,kCAAkC,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;gBAC5I,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC5E,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,4BAA4B,CAAC,CAAC;oBAC9E,OAAO;gBACT,CAAC;gBACD,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,2BAA2B,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnH,CAAC;iBAAM,IAAI,IAAI,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;gBACpD,8FAA8F;gBAC9F,2FAA2F;gBAC3F,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC5E,MAAM,iBAAiB,GAAG,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC;gBACrD,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;oBAClF,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,8DAA8D,CAAC,CAAC;oBACjH,OAAO;gBACT,CAAC;gBACD,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,2BAA2B,CAAC;oBAC1D,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,iBAAiB;oBAC3B,WAAW,EAAE,IAAI,CAAC,YAAY;oBAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;oBAChC,4FAA4F;oBAC5F,4DAA4D;oBAC5D,YAAY;oBACZ,wFAAwF;oBACxF,oFAAoF;oBACpF,uDAAuD;oBACvD,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,IAAI,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;gBAC/C,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;oBACxB,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;oBAC9E,OAAO;gBACT,CAAC;gBACD,6FAA6F;gBAC7F,uFAAuF;gBACvF,4FAA4F;gBAC5F,gEAAgE;gBAChE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC5E,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;YACrG,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,EAAE,eAAe,IAAI,CAAC,UAAU,IAAI,EAAE,oBAAoB,CAAC,CAAC;gBAClH,OAAO;YACT,CAAC;YAED,qDAAqD;YACrD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YACrC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC9B,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,OAAO,GAAI,KAAgE,CAAC,OAAO,CAAC;gBAC1F,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;oBACxB,sFAAsF;oBACtF,yFAAyF;oBACzF,yFAAyF;oBACzF,uFAAuF;oBACvF,4FAA4F;oBAC5F,sFAAsF;oBACtF,IAAI,OAAO,CAAC,UAAU,KAAK,gBAAgB,IAAI,IAAI,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;wBACxF,MAAM,wBAAwB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;wBACzE,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,CAAC;wBAC3C,MAAM,gBAAgB,GAAG,eAAe,EAAE,UAAU,CAAC,SAAS,CAAC;4BAC7D,CAAC,CAAC,SAAS;4BACX,CAAC,CAAC,eAAe,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;wBACnE,KAAK,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC;4BACvC,cAAc,EAAE,cAAc;4BAC9B,gBAAgB;4BAChB,MAAM,EAAE,gBAAgB;4BACxB,SAAS,EAAE,QAAQ;yBACpB,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;4BAC7F,GAAG,2BAA2B,CAAC,UAAU,CAAC;yBAC3C,CAAC,CAAC,CAAC;oBACN,CAAC;oBACD,+EAA+E;oBAC/E,iFAAiF;oBACjF,yFAAyF;oBACzF,wFAAwF;oBACxF,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,KAAK,yBAAyB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;oBAC3K,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC,CAAC,gDAAgD;QAC/D,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,wEAAwE;IAChE,gCAAgC;QACtC,MAAM,QAAQ,GAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAoF,EAAE,yBAAyB,CAAC;QAChK,OAAO;YACL,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,KAAK;YACnC,4BAA4B,EAAE,QAAQ,EAAE,4BAA4B,IAAI,EAAE;SAC3E,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACK,KAAK,CAAC,yBAAyB,CAAC,GAAY,EAAE,GAAa;QACjE,MAAM,aAAa,GAAG,IAAI,CAAC,gCAAgC,EAAE,CAAC;QAC9D,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3B,0FAA0F;YAC1F,yFAAyF;YACzF,qDAAqD;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC7C,gGAAgG;QAChG,yEAAyE;QACzE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACrF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,gDAAgD,EAAE,CAAC,CAAC;YAChI,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAEzD,6FAA6F;QAC7F,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;YACtI,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,sBAAsB,EAAE,oDAAoD,CAAC,CAAC;YAC9G,OAAO;QACT,CAAC;QACD,0FAA0F;QAC1F,qFAAqF;QACrF,8FAA8F;QAC9F,2EAA2E;QAC3E,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,sBAAsB,EAAE,kCAAkC,MAAM,EAAE,CAAC,CAAC;YACpG,OAAO;QACT,CAAC;QAED,wGAAwG;QACxG,wGAAwG;QACxG,kGAAkG;QAClG,yGAAyG;QACzG,4EAA4E;QAC5E,IAAI,sBAAsB,GAAa,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,yBAAyB,KAAK,SAAS,EAAE,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAC7I,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,uDAAuD,CAAC,CAAC;gBACpH,OAAO;YACT,CAAC;YACD,MAAM,gBAAgB,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;YACpG,IAAI,gBAAgB,EAAE,CAAC;gBACrB,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,8CAA8C,gBAAgB,EAAE,CAAC,CAAC;gBAC7H,OAAO;YACT,CAAC;YACD,sBAAsB,GAAG,IAAI,CAAC,yBAAyB,CAAC;QAC1D,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAC3F,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACvC,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,yBAAyB,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QAED,2FAA2F;QAC3F,0FAA0F;QAC1F,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,mDAAmD,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QACD,sFAAsF;QACtF,MAAM,eAAe,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,MAAM,cAAc,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,8BAA8B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1G,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,8DAA8D,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACtJ,OAAO;QACT,CAAC;QACD,2CAA2C;QAC3C,EAAE;QACF,gGAAgG;QAChG,6FAA6F;QAC7F,6FAA6F;QAC7F,4FAA4F;QAC5F,8FAA8F;QAC9F,6FAA6F;QAC7F,iFAAiF;QACjF,EAAE;QACF,iGAAiG;QACjG,+FAA+F;QAC/F,iGAAiG;QACjG,6FAA6F;QAC7F,+FAA+F;QAC/F,QAAQ;QACR,EAAE;QACF,gGAAgG;QAChG,mFAAmF;QACnF,6FAA6F;QAC7F,+FAA+F;QAC/F,8EAA8E;QAC9E,EAAE;QACF,6DAA6D;QAC7D,oFAAoF;QACpF,6DAA6D;QAC7D,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;QACjH,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,cAAc,CAAC,kBAAkB,IAAI,KAAK,KAAK,cAAc,CAAC,aAAa,CAAC,CAAC;QAC9I,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,gEAAgE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YACrJ,OAAO;QACT,CAAC;QACD,+FAA+F;QAC/F,MAAM,mBAAmB,GAAG,IAAI,CAAC,0BAA0B,CAAC;QAC5D,IAAI,mBAAmB,KAAK,SAAS,IAAI,mBAAmB,KAAK,4BAA4B,CAAC,IAAI,EAAE,CAAC;YACnG,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,sFAAsF,CAAC,CAAC;YACnJ,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,iCAAiC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAClF,kGAAkG;QAClG,kGAAkG;QAClG,kGAAkG;QAClG,sEAAsE;QACtE,MAAM,yBAAyB,GAAG,uCAAuC,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,gBAAgB,CAAC,yBAAyB,EAAE;YACjG,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,WAAW,CAAC,WAAW;YAC9B,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,aAAa;YAClD,2FAA2F;YAC3F,KAAK,EAAE,EAAE;YACT,aAAa,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,8BAA8B,CAAC;YACjG,aAAa,EAAE,CAAC,cAAc,CAAC,kBAAkB,CAAC;YAClD,YAAY;YACZ,sBAAsB;YACtB,uBAAuB,EAAE,4BAA4B,CAAC,IAAI;YAC1D,6FAA6F;YAC7F,6FAA6F;YAC7F,eAAe,EAAE,IAAI;YACrB,kBAAkB,EAAE,6BAA6B,CAAC,OAAO;YACzD,YAAY,EAAE,cAAc,CAAC,YAAY;YACzC,YAAY,EAAE,cAAc,CAAC,YAAY;YACzC,2BAA2B,EAAE,yBAAyB,CAAC,2BAA2B;YAClF,6BAA6B,EAAE,yBAAyB,CAAC,6BAA6B;SACvF,EAAE;YACD,oEAAoE;YACpE,2FAA2F;YAC3F,4EAA4E;YAC5E,4BAA4B,EAAE;gBAC5B,oBAAoB,EAAE,cAAc,EAAE,cAAc;gBACpD,0FAA0F;gBAC1F,yFAAyF;gBACzF,4FAA4F;gBAC5F,0CAA0C;gBAC1C,6BAA6B,EAAE,+BAA+B;aAC/D;SACF,CAAoB,CAAC;QAEtB,6FAA6F;QAC7F,gGAAgG;QAChG,2CAA2C;QAC3C,KAAK,IAAI,CAAC,SAAS,CAAC,0BAA0B,CAAC;YAC7C,QAAQ,EAAE,OAAO,CAAC,GAAG;YACrB,UAAU;YACV,YAAY;YACZ,sBAAsB;YACtB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yDAAyD,EAAE;YACnG,GAAG,2BAA2B,CAAC,UAAU,CAAC;SAC3C,CAAC,CAAC,CAAC;QAEJ,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,+FAA+F;QAC/F,8FAA8F;QAC9F,0EAA0E;QAC1E,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;YACpB,SAAS,EAAE,OAAO,CAAC,GAAG;YACtB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAClD,WAAW,EAAE,UAAU;YACvB,aAAa,EAAE,YAAY;YAC3B,yBAAyB,EAAE,sBAAsB;YACjD,WAAW,EAAE,CAAC,cAAc,CAAC,kBAAkB,CAAC;YAChD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,4BAA4B,CAAC,IAAI;YAC7D,KAAK,EAAE,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,8BAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACrG,6FAA6F;YAC7F,uCAAuC;YACvC,yBAAyB,EAAE,yBAAyB,CAAC,UAAU;YAC/D,uBAAuB,EAAE,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC;SACjE,EAAE,GAAG,CAAC,CAAC;IACV,CAAC;IAED;;;;;OAKG;IACK,qBAAqB,CAAC,QAAgB;QAC5C,MAAM,QAAQ,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,CAAC;QACxG,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,CAAC;QAClE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;IACnF,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACK,yBAAyB,CAAC,GAAa,EAAE,QAAa;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,EAAE,8BAA8B,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;IAED,yFAAyF;IACzF;;kFAE8E;IAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACK,KAAK,CAAC,+BAA+B,CAC3C,GAAY,EACZ,GAAa;QAEb,IAAI,CAAC,IAAI,CAAC,gCAAgC,EAAE,CAAC,OAAO,EAAE,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;YAC1E,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;YACvC,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,mCAAmC,CAAC,GAAG,EAAE,yCAAyC,CAAC,CAAC;YACzF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,mCAAmC,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CACjD,gBAAgB,CAAC,yBAAyB,EAC1C,QAAQ,CACT,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,mCAAmC,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,MAAM,CAAC,kBAAkB,KAAK,6BAA6B,CAAC,OAAO,EAAE,CAAC;YACxE,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,yDAAyD,EAAE,CAAC,CAAC;YAC/H,OAAO,IAAI,CAAC;QACd,CAAC;QAED;;;;;;;;;;WAUG;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;YAC/C,IAAI,CAAC,mCAAmC,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;YACnF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,2BAA2B,CAAC;QACtD,6FAA6F;QAC7F,8FAA8F;QAC9F,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,mCAAmC,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;YACnF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACK,wBAAwB,CAAC,SAAiB,EAAE,UAAkB;QACpE,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;QACnF,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,eAAe,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACjG,OAAO,eAAe,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IACxD,CAAC;IAED;;;;;OAKG;IACK,mCAAmC,CAAC,GAAa,EAAE,WAAmB;QAC5E,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,8BAA8B,CAAC,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;;;OASG;IACK,yBAAyB,CAAC,QAAgB,EAAE,MAA8B;QAChF,OAAO;YACL,SAAS,EAAE,QAAQ;YACnB,WAAW,EAAE,MAAM,CAAC,IAAI;YACxB,aAAa,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YACxC,yBAAyB,EAAE,MAAM,CAAC,sBAAsB,IAAI,EAAE;YAC9D,WAAW,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;YACvC,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;YAC1D,KAAK,EAAE,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7C,uBAAuB,EAAE,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC;SAC9D,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,6BAA6B,CAAC,GAAY,EAAE,GAAa;QACrE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3E,IAAI,CAAC,aAAa;YAAE,OAAO;QAE3B,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,yBAAyB,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3G,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,+BAA+B,CAAC,GAAY,EAAE,GAAa;QACvE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3E,IAAI,CAAC,aAAa;YAAE,OAAO;QAC3B,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC;QAE3C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAEzD,gGAAgG;QAChG,0FAA0F;QAC1F,0FAA0F;QAC1F,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,mEAAmE,CAAC,CAAC;YAChI,OAAO;QACT,CAAC;QAED,gGAAgG;QAChG,2FAA2F;QAC3F,gGAAgG;QAChG,gGAAgG;QAChG,MAAM,SAAS,GAAG,CAAC,2BAA2B,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,qBAAqB,CAAC;aAC1H,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC;QAC9C,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,GAAG,SAAS,4CAA4C,CAAC,CAAC;YACrH,OAAO;QACT,CAAC;QAED,iGAAiG;QACjG,8FAA8F;QAC9F,6FAA6F;QAC7F,+FAA+F;QAC/F,mFAAmF;QACnF,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,6CAA6C,CAAC,CAAC;YAC1G,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;YACtI,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,sBAAsB,EAAE,oDAAoD,CAAC,CAAC;YAC9G,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,sBAAsB,EAAE,kCAAkC,MAAM,EAAE,CAAC,CAAC;YACpG,OAAO;QACT,CAAC;QAED,qFAAqF;QACrF,IAAI,sBAAsB,GAAa,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,yBAAyB,KAAK,SAAS,EAAE,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAC7I,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,uDAAuD,CAAC,CAAC;gBACpH,OAAO;YACT,CAAC;YACD,MAAM,gBAAgB,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;YACpG,IAAI,gBAAgB,EAAE,CAAC;gBACrB,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,8CAA8C,gBAAgB,EAAE,CAAC,CAAC;gBAC7H,OAAO;YACT,CAAC;YACD,sBAAsB,GAAG,IAAI,CAAC,yBAAyB,CAAC;QAC1D,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAC3F,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACvC,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,yBAAyB,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QAED,8FAA8F;QAC9F,uFAAuF;QACvF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,mDAAmD,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QACD,MAAM,eAAe,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,MAAM,cAAc,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,8BAA8B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1G,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,8DAA8D,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACtJ,OAAO;QACT,CAAC;QACD,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;QACjH,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,cAAc,CAAC,kBAAkB,IAAI,KAAK,KAAK,cAAc,CAAC,aAAa,CAAC,CAAC;QAC9I,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,gEAAgE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YACrJ,OAAO;QACT,CAAC;QACD,MAAM,mBAAmB,GAAG,IAAI,CAAC,0BAA0B,CAAC;QAC5D,IAAI,mBAAmB,KAAK,SAAS,IAAI,mBAAmB,KAAK,4BAA4B,CAAC,IAAI,EAAE,CAAC;YACnG,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,yBAAyB,EAAE,sFAAsF,CAAC,CAAC;YACnJ,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CACpD,gBAAgB,CAAC,yBAAyB,EAC1C,QAAQ,EACR;YACE,IAAI,EAAE,UAAU;YAChB,YAAY;YACZ,sBAAsB;YACtB,aAAa,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,8BAA8B,CAAC;SAClG,CACF,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,mCAAmC,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,iGAAiG;QACjG,6FAA6F;QAC7F,kGAAkG;QAClG,6CAA6C;QAC7C,KAAK,IAAI,CAAC,SAAS,CAAC,0BAA0B,CAAC;YAC7C,QAAQ;YACR,UAAU;YACV,YAAY;YACZ,sBAAsB;YACtB,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;SACvC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mEAAmE,EAAE;YAC7G,GAAG,2BAA2B,CAAC,UAAU,CAAC;SAC3C,CAAC,CAAC,CAAC;QAEJ,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAClG,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACK,KAAK,CAAC,+BAA+B,CAAC,GAAY,EAAE,GAAa;QACvE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3E,IAAI,CAAC,aAAa;YAAE,OAAO;QAC3B,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC;QAEnC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAC1D,gBAAgB,CAAC,yBAAyB,EAC1C,QAAQ,EACR,EAAE,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE,CACvC,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,mCAAmC,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAEO,qBAAqB,CAAC,GAAa,EAAE,KAAa,EAAE,WAAmB;QAC7E,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,6BAA6B,CAAC,QAA4B,EAAE,aAA8C;QACtH,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,8BAA8B,QAAQ,IAAI,SAAS,EAAE,CAAC;YAClE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACpE,OAAO,KAAK,IAAI,aAAa,CAAC,4BAA4B,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gEAAgE,EAAE;gBACjF,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa;QACvD,MAAM,CAAC,GAAG,GAAG,CAAC,KAA2C,CAAC;QAE1D,8FAA8F;QAC9F,iGAAiG;QACjG,4EAA4E;QAC5E,MAAM,uBAAuB,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9L,IAAI,uBAAuB,EAAE,CAAC;YAC5B,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,QAAQ,uBAAuB,2CAA2C,CAAC,CAAC;YAC7H,OAAO;QACT,CAAC;QAED,IAAI,CAAC,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YAC/B,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,2BAA2B,EAAE,sCAAsC,CAAC,CAAC;YACnG,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;YACpC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;YAC5F,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,qBAAqB,KAAK,MAAM,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC;YACtF,qGAAqG;YACrG,uGAAuG;YACvG,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,wCAAwC,CAAC,CAAC;YAC3F,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,2FAA2F;YAC3F,8FAA8F;YAC9F,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,+DAA+D,CAAC,CAAC;YACjH,OAAO;QACT,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC;QAE5C,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,6FAA6F;YAC7F,kFAAkF;YAClF,4FAA4F;YAC5F,uFAAuF;YACvF,+FAA+F;YAC/F,2FAA2F;YAC3F,oGAAoG;YACpG,gGAAgG;YAChG,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,iCAAiC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACzH,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,cAAc,CAAC;YACvD,kGAAkG;YAClG,oGAAoG;YACpG,qGAAqG;YACrG,0GAA0G;YAC1G,MAAM,YAAY,GAAG,eAAe;mBAC/B,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YACnG,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC;oBACvE,MAAM;oBACN,QAAQ,EAAE,CAAC,CAAC,SAAS;oBACrB,WAAW,EAAE,CAAC,CAAC,YAAY;oBAC3B,KAAK;oBACL,aAAa,EAAE,CAAC,CAAC,cAAc;oBAC/B,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,KAAK,EAAE,CAAC,CAAC,KAAK;iBACf,CAAC,CAAC;gBACH,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBACrC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;oBACpB,gBAAgB,EAAE,IAAI;oBACtB,aAAa,EAAE,YAAY;oBAC3B,MAAM,EAAE;wBACN,EAAE,EAAE,CAAC,CAAC,SAAS;wBACf,IAAI,EAAE,UAAU;wBAChB;;;;;;;;;;;;;;;2BAeG;wBACH,MAAM,EAAE,cAAc,CAAC,MAAM;wBAC7B,qBAAqB,EAAE,cAAc,CAAC,mBAAmB;wBACzD,uBAAuB,EAAE,cAAc,CAAC,0BAA0B;qBACnE;oBACD,MAAM,EAAE,KAAK;oBACb,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;iBAC7B,EAAE,GAAG,CAAC,CAAC;gBACR,OAAO;YACT,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,sBAAsB,CAAC;gBACjE,MAAM;gBACN,QAAQ,EAAE,CAAC,CAAC,SAAS;gBACrB,WAAW,EAAE,CAAC,CAAC,YAAY;gBAC3B,KAAK;gBACL,aAAa,EAAE,CAAC,CAAC,cAAc;gBAC/B,mBAAmB,EAAE,MAAM;gBAC3B,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,0FAA0F;gBAC1F,+FAA+F;gBAC/F,0FAA0F;gBAC1F,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,6FAA6F;gBAC7F,8FAA8F;gBAC9F,SAAS;aACV,CAAC,CAAC;YACH,gGAAgG;YAChG,qGAAqG;YACrG,qGAAqG;YACrG,8FAA8F;YAC9F,IAAI,QAAa,CAAC;YAClB,IAAI,CAAC;gBACH,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,2DAA2D,CAAC,CAAC;gBAC9G,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxC,IAAI,CAAC,CAAC,KAAK;gBAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACzD,oGAAoG;YACpG,+FAA+F;YAC/F,kGAAkG;YAClG,2FAA2F;YAC3F,IAAI,CAAC,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,GAAG,GAAI,KAAgE,CAAC,OAAO,CAAC;gBACtF,IAAI,GAAG,EAAE,UAAU,EAAE,CAAC;oBACpB,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;oBACtG,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,qBAAqB,CAAC,GAAY,EAAE,GAAa;QAC7D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAuC,CAAC;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,eAAe,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5F,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,QAAQ,SAAS,2CAA2C,CAAC,CAAC;YAC/G,OAAO;QACT,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,8DAA8D,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;YAC5F,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACrF,+FAA+F;YAC/F,8FAA8F;YAC9F,oEAAoE;YACpE,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,wGAAwG;gBACxG,0FAA0F;gBAC1F,gGAAgG;gBAChG,6FAA6F;gBAC7F,sGAAsG;gBACtG,KAAK,IAAI,CAAC,SAAS,CAAC,+BAA+B,CAAC;oBAClD,mBAAmB,EAAE,MAAM;oBAC3B,WAAW,EAAE,OAAO,CAAC,MAAM;oBAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;iBACvC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+DAA+D,EAAE;oBACzG,GAAG,2BAA2B,CAAC,UAAU,CAAC;iBAC3C,CAAC,CAAC,CAAC;gBACJ,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,+DAA+D,CAAC,CAAC;gBAChH,OAAO;YACT,CAAC;YACD,uGAAuG;YACvG,0GAA0G;YAC1G,iGAAiG;YACjG,mFAAmF;YACnF,IAAI,QAAa,CAAC;YAClB,IAAI,CAAC;gBACH,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,mEAAmE,CAAC,CAAC;gBACtH,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,KAAK;gBAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACrE,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAErC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAChC,iEAAiE;gBACjE,6GAA6G;gBAC7G,wFAAwF;gBACxF,KAAK,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC;oBACxC,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,MAAM,EAAE,OAAO,CAAC,KAAK;oBACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;iBACvC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE;oBAC9F,GAAG,2BAA2B,CAAC,UAAU,CAAC;iBAC3C,CAAC,CAAC,CAAC;gBACJ,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;gBACpD,6FAA6F;gBAC7F,qEAAqE;gBACrE,IAAI,CAAC,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,sBAAsB,CAAC;gBACjE,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,mBAAmB,EAAE,MAAM;gBAC3B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,2FAA2F;gBAC3F,+FAA+F;gBAC/F,2FAA2F;gBAC3F,0EAA0E;gBAC1E,SAAS;aACV,CAAC,CAAC;YACH,4GAA4G;YAC5G,sGAAsG;YACtG,uGAAuG;YACvG,kFAAkF;YAClF,KAAK,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC;gBACzC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,KAAK;gBACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,UAAU,EAAE,IAAI,CAAC,QAAQ,KAAK,MAAM;gBACpC,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC;aACvC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE;gBAC/F,GAAG,2BAA2B,CAAC,UAAU,CAAC;aAC3C,CAAC,CAAC,CAAC;YACJ,kGAAkG;YAClG,iGAAiG;YACjG,uEAAuE;YACvE,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBAC7B,MAAM,IAAI,CAAC,eAAe;qBACvB,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;qBACrF,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE,EAAE,GAAG,2BAA2B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAChI,CAAC;YACD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxC,IAAI,CAAC,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,GAAG,GAAI,KAAgE,CAAC,OAAO,CAAC;gBACtF,IAAI,GAAG,EAAE,UAAU,EAAE,CAAC;oBACpB,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;oBACtG,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,cAAc,CAAC,GAAY,EAAE,GAAa;QACtD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,mCAAmC,EAAE,QAAQ,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QACD,IAAI,KAAyE,CAAC;QAC9E,IAAI,CAAC;YACH,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAiB,CAAC;QACpG,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,iCAAiC,EAAE,QAAQ,CAAC,CAAC;YAC5F,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC;QACtC,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,8BAA8B,CAAC,YAAY,EAAE,CAAC;YACvE,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE,uCAAuC,EAAE,QAAQ,CAAC,CAAC;YACvG,OAAO;QACT,CAAC;QACD,8FAA8F;QAC9F,8FAA8F;QAC9F,4FAA4F;QAC5F,gCAAgC;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACtF,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,wBAAwB,CAAC,GAAY;QACjD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAA2D,CAAC;YAClJ,IAAI,KAAK,CAAC,IAAI,KAAK,8BAA8B,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAClG,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,wBAAwB,CAAC,GAAY,EAAE,IAAwC;QACrF,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjG,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,OAAO;oBACL,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,SAAS;oBAC5C,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,SAAS;iBAClD,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,SAAS,EAAE,CAAC;IAClG,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,mBAAmB,CAAC,MAA+B,EAAE,IAAc;QACzE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;IACpF,CAAC;IAEO,cAAc,CAAC,GAAa,EAAE,MAAc,EAAE,KAAa,EAAE,WAAoB,EAAE,eAAoC;QAC7H,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,2FAA2F;QAC3F,0DAA0D;QAC1D,MAAM,MAAM,GAAG,eAAe,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACzE,IAAI,MAAM;YAAE,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;CACF,CAAA;AA1pDY,qCAAqC;IADjD,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;IAC7C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAC5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAChD,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IACzC,YAAA,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;IAC7C,YAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAG9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;qCAdA,aAAa;QACM,0BAA0B;QAC1B,mBAAmB;QACH,gCAAgC;QAC9B,uBAAuB;QAC5B,iBAAiB;QACR,mCAAmC;QAC/C,YAAY;QACX,uBAAuB;QACjB,4BAA4B;QAC9B,gCAAgC;GAZpG,qCAAqC,CA0pDjD","sourcesContent":["import 'reflect-metadata';\nimport { timingSafeEqual } from 'node:crypto';\nimport { inject, injectable } from 'inversify';\nimport type { Request, Response } from 'express';\nimport cors from 'cors';\nimport { AbstractControllerBackendService } from '~wildo-backend-lib/base-classes/services/controllers/abstract-controller.backend.service';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ErrorHandlerService } from '~wildo-backend-lib/errors/services/error-handler.backend.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { OAuthProviderTokenBackendService } from '~wildo-backend-lib/security/authentications/services/oauth-provider-token.backend.service';\nimport { OidcAuthorizationCodeBackendService } from '~wildo-backend-lib/security/authentications/services/oidc-authorization-code.backend.service';\nimport { OidcUserClaimsBackendService, OIDC_SUPPORTED_IDENTITY_SCOPES, OIDC_SCOPE_GATED_IDENTITY_CLAIMS } from '~wildo-backend-lib/security/authentications/services/oidc-user-claims.backend.service';\nimport { CimdTrustPolicy } from '~wildo-backend-lib/security/authentications/models/cimd.backend.schemas';\nimport type { DynamicClientRegistrationConfig } from '~wildo-backend-lib/security/authentications/models/cimd.backend.schemas';\nimport { generateOAuthClientSecretMaterial, generateRegistrationAccessTokenMaterial, hashRegistrationAccessToken } from '~wildo-backend-lib/security/oauth-clients/oauth-client-generation.backend.utils';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport { CimdClientMetadataBackendService } from '~wildo-backend-lib/security/authentications/services/cimd-client-metadata.backend.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport { JwtPrivateKeys } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport { AuthControllerUtils } from '~wildo-backend-lib/security/authentications/services/utils/auth-controller.utils';\nimport type { AuthTokenIssuerBackendService } from '~wildo-backend-lib/security/authentications/services/auth-token-issuer.backend.service';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { getClientIpFromRequest } from '~wildo-backend-lib/runtime/utils/request-client-ip.utils';\nimport { assertMachineAuthAttemptWithinRate, recordMachineAuthFailure } from '~wildo-backend-lib/security/authentications/services/utils/machine-auth-rate-limit.backend.utils';\nimport { isValidS256CodeChallenge } from '~wildo-backend-lib/security/authentications/services/utils/pkce.backend.utils';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport {\n ApiKeyScope,\n CoreResourceType,\n ExecutionContext_ExecutionType,\n MANUAL_CONTROLLER_ROUTES_URLS,\n ManualControllerRouteKey,\n OAuthClientRegistrationOrigin,\n OAuthClientStatus,\n OAuthGrantType,\n OAuthTokenEndpointAuthMethod,\n isSafeOAuthRedirectUri,\n isWildoBackendError,\n} from '@wildo-ai/saas-models';\nimport type { OAuthClientApplication } from '@wildo-ai/saas-models';\n\n/*\n OAuth 2.0 Authorization Server endpoints (Wildo-AS-PROVIDER). A THIN transport wrapper\n * over {@link OAuthProviderTokenBackendService} — it parses the request per RFC 6749 and\n * renders the §5.1 success / §5.2 error body; all verification + issuance logic lives in\n * the (unit-tested) service.\n \n Deliberately SEPARATE from the RP-side `AuthenticationControllerBackendService`\n * (Wildo-as-client) per the framework's semantic-distinction rule. The OIDC branch adds\n * `/.well-known/openid-configuration`, `/jwks`, `authorize`, and `userinfo` alongside this\n * token endpoint here.\n \n NOTE: `setupRoutes()` runs inside the `super()` constructor (before this subclass's field\n * initializers), so it only BINDS handlers — `this.tokenService` is read at REQUEST time,\n * by which point the field is set. This is the standard manual-controller pattern.\n /\n@injectable()\nexport class OAuthProviderControllerBackendService extends AbstractControllerBackendService {\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ErrorHandlerService) errorHandler: ErrorHandlerService,\n @inject(SAAS_SERVICE_TYPES.OAuthProviderToken) private readonly tokenService: OAuthProviderTokenBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.JwtBackendService) private readonly jwtService: JwtBackendService,\n @inject(SAAS_SERVICE_TYPES.OidcAuthorizationCode) private readonly authCodeService: OidcAuthorizationCodeBackendService,\n @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) private readonly auditLogs: AuditLogsBackendService,\n @inject(SAAS_SERVICE_TYPES.OidcUserClaims) private readonly userClaimsService: OidcUserClaimsBackendService,\n @inject(SAAS_SERVICE_TYPES.CimdClientMetadata) private readonly cimdService: CimdClientMetadataBackendService,\n @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccess: SystemAccessBackendService,\n // revocation-C: the per-session revocation writer the `/oauth/end-session` handler calls to terminate\n // the OP session named by an id_token's `sid`. Appended LAST so the existing positional DI is untouched.\n @inject(SAAS_SERVICE_TYPES.AuthTokenIssuer) private readonly authTokenIssuer: AuthTokenIssuerBackendService,\n ) {\n super(logger, errorBuilder, errorHandler, 'OAuthProviderController');\n }\n\n protected setupRoutes(): void {\n const tokenUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_TOKEN];\n this.router.post(tokenUrl, this.asyncHandler(this.handleToken.bind(this)));\n this.logRouteRegistration('POST', tokenUrl, 'OAuth 2.0 token endpoint (grant_type=client_credentials)');\n\n // OIDC discovery + JWKS are PUBLIC, non-credentialed metadata that clients (incl. future\n // browser SPAs doing authorization_code) fetch cross-origin. Per OIDC/OAuth convention they\n // must be readable from ANY origin, so they get their own permissive-GET CORS that overrides\n // the app-global frontend-origin allowlist. `origin:''` is safe here BECAUSE these responses\n // carry NO credentials and NO secrets (public keys + public metadata only). The token endpoint\n // is deliberately NOT included — it is a server-side credential endpoint and stays under the\n // restrictive global CORS.\n const publicMetadataCors = cors({ origin: '', methods: ['GET'], credentials: false });\n\n const discoveryUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_DISCOVERY];\n this.router.get(discoveryUrl, publicMetadataCors, this.asyncHandler(this.handleDiscovery.bind(this)));\n this.logRouteRegistration('GET', discoveryUrl, 'OIDC discovery document (public, CORS-open)');\n\n // RFC 8414 alias: many OAuth/MCP clients probe `/.well-known/oauth-authorization-server` FIRST.\n // Serve the SAME discovery document there (public, CORS-open).\n const asMetadataUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_AS_METADATA];\n this.router.get(asMetadataUrl, publicMetadataCors, this.asyncHandler(this.handleDiscovery.bind(this)));\n this.logRouteRegistration('GET', asMetadataUrl, 'RFC 8414 authorization-server metadata alias (public, CORS-open)');\n\n const jwksUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_JWKS];\n this.router.get(jwksUrl, publicMetadataCors, this.asyncHandler(this.handleJwks.bind(this)));\n this.logRouteRegistration('GET', jwksUrl, 'JSON Web Key Set (jwks_uri) (public, CORS-open)');\n\n // authorize is a browser-redirect endpoint (no CORS). userinfo is bearer-credentialed, so it\n // stays under the restrictive global CORS (NOT the public-metadata origin:'').\n const authorizeUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_AUTHORIZE];\n this.router.get(authorizeUrl, this.asyncHandler(this.handleAuthorize.bind(this)));\n this.logRouteRegistration('GET', authorizeUrl, 'OIDC authorization endpoint (authorization_code)');\n\n // S1: interactive-consent decision endpoint — the approve/deny for a `requiresConsent` client.\n const consentUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_CONSENT];\n this.router.post(consentUrl, this.asyncHandler(this.handleConsentDecision.bind(this)));\n this.logRouteRegistration('POST', consentUrl, 'OIDC interactive-consent decision endpoint');\n\n const userInfoUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_USERINFO];\n this.router.get(userInfoUrl, this.asyncHandler(this.handleUserInfo.bind(this)));\n this.logRouteRegistration('GET', userInfoUrl, 'OIDC UserInfo endpoint');\n\n const revokeUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_REVOKE];\n this.router.post(revokeUrl, this.asyncHandler(this.handleRevoke.bind(this)));\n this.logRouteRegistration('POST', revokeUrl, 'OAuth 2.0 token revocation (RFC 7009)');\n\n // OIDC RP-Initiated Logout (revocation-C). A GET browser-redirect endpoint like `authorize` — the RP\n // navigates the user's browser here, so it takes NO CORS (a top-level navigation, not an XHR) and no\n // Bearer middleware (the `id_token_hint` IS the credential, verified inside the handler).\n const endSessionUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION];\n this.router.get(endSessionUrl, this.asyncHandler(this.handleEndSession.bind(this)));\n this.logRouteRegistration('GET', endSessionUrl, 'OIDC RP-Initiated Logout (end_session_endpoint)');\n\n // §6 logout-confirmation decision — the POST the frontend `/oauth/logout-confirm` prompt calls to\n // actually terminate the session. Token-authorized (no Bearer / no CORS); the single-use\n // `OIDC_LOGOUT_CONFIRMATION` token minted by `handleEndSession` is the credential.\n const endSessionConfirmUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION_CONFIRM];\n this.router.post(endSessionConfirmUrl, this.asyncHandler(this.handleEndSessionConfirm.bind(this)));\n this.logRouteRegistration('POST', endSessionConfirmUrl, 'OIDC RP-Initiated Logout §6 confirmation decision');\n\n const registerUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER];\n this.router.post(registerUrl, this.asyncHandler(this.handleDynamicRegistration.bind(this)));\n this.logRouteRegistration('POST', registerUrl, 'RFC 7591 dynamic client registration (404 unless opted in)');\n\n // RFC 7592 §2: ONE client configuration endpoint, three methods. Registered unconditionally like\n // `/oauth/register` above and gated by the same opt-in inside the handler.\n const registerClientUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER_CLIENT];\n this.router.get(registerClientUrl, this.asyncHandler(this.handleClientConfigurationRead.bind(this)));\n this.router.put(registerClientUrl, this.asyncHandler(this.handleClientConfigurationUpdate.bind(this)));\n this.router.delete(registerClientUrl, this.asyncHandler(this.handleClientConfigurationDelete.bind(this)));\n this.logRouteRegistration('GET', registerClientUrl, 'RFC 7592 client read (404 unless opted in)');\n this.logRouteRegistration('PUT', registerClientUrl, 'RFC 7592 client update (404 unless opted in)');\n this.logRouteRegistration('DELETE', registerClientUrl, 'RFC 7592 client delete (404 unless opted in)');\n }\n\n /*\n `POST /oauth/revoke` — RFC 7009 token revocation. Revokes the presented `token` (a user\n * refresh token). Per §2.2 the endpoint returns 200 even for an unknown/invalid token (no\n * token-status oracle).\n \n F-OIDC-6 (RFC 7009 §2.1 client authentication): when the request carries client credentials\n * (`client_secret_basic` via the Authorization header, or `client_secret_post` in the body), the\n * client is authenticated FIRST — a bad secret is `invalid_client` (401) and NO revocation happens.\n * An UNauthenticated revoke stays allowed: §2.1 permits it for a public client, and Wildo's refresh\n * tokens are first-party session tokens that no OAuth client owns, so there is no client↔token\n * binding to additionally enforce. A `client_secret` presented WITHOUT a `client_id` is\n * `invalid_request` (400) — an unnamed client cannot be authenticated.\n /\n private async handleRevoke(req: Request, res: Response): Promise<void> {\n const body = (req.body ?? {}) as Record<string, string \| undefined>;\n // A repeated body param (Express parses `k=a&k=b` into a string[] despite the cast) is a malformed\n // request. Reject cleanly (400) so an array never reaches `hashOAuthClientSecret` or\n // `revokeRefreshToken` (which would 500), consistent with the token/authorize handlers.\n const malformedRevokeParam = this.firstMalformedParam(body, ['token', 'token_type_hint', 'client_id', 'client_secret']);\n if (malformedRevokeParam) {\n this.sendOAuthError(res, 400, 'invalid_request', `the '${malformedRevokeParam}' parameter must be a single string value`);\n return;\n }\n // `extractClientCredentials` already resolves the client id from Basic-header-or-body, so a\n // present `clientSecret` with an absent `clientId` means a secret was posted with no id at all.\n const { clientId, clientSecret } = this.extractClientCredentials(req, body);\n if (clientSecret) {\n if (!clientId) {\n this.sendOAuthError(res, 400, 'invalid_request', 'client_id is required when a client_secret is presented');\n return;\n }\n try {\n await this.authCodeService.verifyPresentedClientSecret(clientId, clientSecret);\n } catch (error) {\n if (isWildoBackendError(error)) {\n const context = (error as { context?: { oauthError?: string; detail?: string } }).context;\n if (context?.oauthError) {\n this.sendOAuthError(res, context.oauthError === 'invalid_client' ? 401 : 400, context.oauthError, context.detail);\n return;\n }\n }\n throw error;\n }\n }\n if (body.token) {\n await this.tokenService.revokeRefreshToken(body.token);\n // A-5: audit the revocation ATTEMPT. RFC 7009 is a no-oracle (200 for unknown tokens), so this\n // records the presented client (if a confidential client authenticated above) + hint, never whose\n // token it was or whether it existed. Reaching here with a `clientSecret` means it verified (a bad\n // secret returned early above). Fire-and-forget — auditing must never affect the RFC 7009 response.\n // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — token lifecycle (revocation).\n const revokeClientAuthenticated = Boolean(clientId && clientSecret);\n void this.auditLogs.logOAuthTokenRevoked({\n clientId: revokeClientAuthenticated ? clientId : undefined,\n clientAuthenticated: revokeClientAuthenticated,\n tokenTypeHint: body.token_type_hint,\n ipAddress: getClientIpFromRequest(req),\n }).catch((auditError) => this.logger.warn('OAUTH_TOKEN_REVOKED audit emit failed (non-fatal)', {\n ...projectCaughtErrorLogFields(auditError),\n }));\n }\n res.set('Cache-Control', 'no-store');\n res.status(200).json({});\n }\n\n /\n `GET /oauth/end-session` — OIDC RP-Initiated Logout 1.0 (revocation-C). A relying party redirects the\n * End-User's browser here to terminate their Wildo OP login session. This is a top-level BROWSER\n * navigation (not an XHR), so it answers with a real 302 redirect — unlike `authorize`/`decision`, which\n * return JSON to a Bearer SPA.\n \n Flow:\n * 1. Verify the `id_token_hint` — a token WE minted (signature + our public issuer), TOLERATING expiry\n * (§2: the hint may be a previously issued, possibly-expired ID token) and audience (its `aud` is the\n * RP, validated by the allowlist below, not the first-party `AUTH_TOKEN`).\n * 2. Extract `sub` (user), `sid` (the session), `azp` (the relying party); validate a presented\n * `post_logout_redirect_uri` against the RP's registered allowlist (EXACT match, `client_id`/`azp` agree).\n * 3. Branch on trust — the §6 logout-confirmation posture (Keycloak-style: skip the prompt for a trusted RP):\n * a. TRUSTED RP (valid hint + exact-match registered redirect) → terminate THAT session inline\n * (`invalidateSession(sid)`, per-session — its access + refresh die on the next request across every\n * front, other sessions live), clear the refresh cookie, and 302 to the RP echoing `state` (§3). No\n * prompt: a known RP presenting an id_token we signed is trusted to log the user out directly.\n * b. NON-trusted but a real session was identified (a valid hint whose redirect is absent / unregistered /\n * mismatched) → do NOT terminate; mint a single-use `OIDC_LOGOUT_CONFIRMATION` token naming the session\n * and 302 to the frontend `/oauth/logout-confirm` §6 prompt. Termination happens at\n * `POST /oauth/end-session/confirm` on the End-User's explicit confirm — this closes the BROWSER-based\n * logout-CSRF vector §6 targets (a cross-origin page cannot read the token to complete the confirm; see\n * `handleEndSessionConfirm` for the full threat model, incl. what it deliberately does NOT defend).\n * c. Nothing to terminate (no / unverifiable / forged hint) → clear the cookie and land on the OP's\n * signed-out page (`/oauth/logged-out`, §5). No prompt — there is nothing to confirm.\n * 4. Audit the logout (`OAUTH_RP_INITIATED_LOGOUT`) at each terminal disposition — for the prompt path (b)\n * that is the confirm endpoint, when the session actually ends.\n \n The signed-out landing (`/oauth/logged-out`) is UNIFORM across the confirm result of (b) and case (c), so\n * the response is not an oracle for whether a session existed. RP-Initiated Logout forbids acting on an\n * invalid hint; RP token revocation is out of scope (RFC 7009); delegated tokens are left to expire.\n * spec-cite: OpenID Connect RP-Initiated Logout 1.0 §2 (the OP terminates the End-User's session; the\n * `id_token_hint` need not be current — \"even when the exp time has passed\"; `post_logout_redirect_uri`\n * MUST have been registered) and §3 (the OP MUST NOT redirect unless the value EXACTLY matches a\n * registered `post_logout_redirect_uri`).\n * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — per-session revocation (RP-Initiated Logout).\n /\n private async handleEndSession(req: Request, res: Response): Promise<void> {\n const q = req.query as Record<string, string \| undefined>;\n const malformed = this.firstMalformedParam(q, ['id_token_hint', 'post_logout_redirect_uri', 'client_id', 'state']);\n if (malformed) {\n this.sendOAuthError(res, 400, 'invalid_request', `the '${malformed}' parameter must be a single string value`);\n return;\n }\n const appBase = this.appConfigService.resolveAppPublicBaseUrl();\n if (!appBase) {\n this.sendOAuthError(res, 503, 'temporarily_unavailable', 'app public base URL is not resolvable');\n return;\n }\n // The OP's own logged-out destination when there is no validated RP redirect: the dedicated\n // \"you have been signed out\" page (`PUBLIC_LAYOUTS_OAUTH_LOGGED_OUT`, route `/oauth/logged-out`),\n // per RP-Initiated Logout 1.0 §5 (the OP displays a logout confirmation rather than redirecting back\n // to the RP). Reached by the no-session branch (c) — where NOTHING is terminated — and by the confirm\n // endpoint after it terminates; the landing is UNIFORM across both so it is not a session-state oracle.\n const landingUrl = `${appBase}/oauth/logged-out`;\n\n // The public issuer id_tokens are minted with (`createJwtForIdToken` sets `iss` to this). Needed to\n // verify the hint against the RIGHT issuer — `getVerifyOptions` otherwise forces the appSlug issuer.\n const issuer = this.appConfigService.resolveApiResourceAudience();\n\n let userId: string \| undefined;\n let sessionId: string \| undefined;\n let clientId: string \| undefined;\n if (q.id_token_hint && issuer) {\n try {\n const claims = (await this.jwtService.verifyWithoutBackendErrorActions(\n q.id_token_hint,\n JwtPrivateKeys.APPLICATION_AUTH_TOKEN,\n { ignoreAudience: true, ignoreExpiration: true, issuerOverride: issuer },\n )) as { sub?: string; sid?: string; azp?: string; aud?: string };\n userId = claims.sub;\n sessionId = claims.sid;\n // The relying party the hint was issued to: `azp` (OIDC authorized party), falling back to `aud`\n // (the id_token audience = the client). Scopes the post_logout_redirect_uri allowlist lookup.\n clientId = claims.azp ?? claims.aud;\n } catch {\n // An invalid / forged hint identifies nothing. Terminate nothing; land the user on the OP page.\n // Deliberately NOT an error — §2 tolerates a stale hint; we simply cannot act on this one.\n }\n }\n\n // RP-Initiated Logout §2: a `client_id` parameter, when present, MUST agree with the hint's client.\n // A mismatch means the request cannot be trusted to name the RP, so no RP redirect is honored.\n const clientIdMismatch = Boolean(q.client_id && clientId && q.client_id !== clientId);\n\n // Validate the post_logout_redirect_uri BEFORE terminating, so the audit records the disposition.\n let validatedRedirect: string \| undefined;\n let postLogoutRedirectUriRejected = false;\n if (q.post_logout_redirect_uri) {\n const canRedirect = !clientIdMismatch\n && clientId !== undefined\n && await this.authCodeService.isRegisteredPostLogoutRedirectUri(clientId, q.post_logout_redirect_uri);\n if (canRedirect) {\n validatedRedirect = q.post_logout_redirect_uri;\n } else {\n postLogoutRedirectUriRejected = true;\n }\n }\n\n res.set('Cache-Control', 'no-store');\n\n // ── Trusted RP logout (the Keycloak-style §6-prompt skip): a valid `id_token_hint` AND an exact-match\n // registered `post_logout_redirect_uri`. The request names a known, allow-listed relying party and\n // carries an id_token WE signed, so it is trusted to terminate the session and return the End-User to\n // the RP WITHOUT an interstitial — the current, unchanged behaviour (RP-Initiated Logout §3).\n if (validatedRedirect) {\n if (sessionId) {\n await this.authTokenIssuer.invalidateSession(sessionId);\n }\n // Best-effort browser hygiene: clear the first-party refresh cookie. The helper sets the same\n // `Path=/api/v1/auth` the cookie was issued with, so the deletion takes effect even though this\n // endpoint lives under a different path.\n AuthControllerUtils.clearRefreshCookie(res, this.appConfigService.applicationEnv);\n this._auditRpInitiatedLogout(req, { userId, sessionId, clientId, sessionTerminated: Boolean(sessionId), postLogoutRedirectUriRejected });\n let redirect: URL;\n try {\n redirect = new URL(validatedRedirect);\n } catch {\n // The allowlist entry passed `isSafeOAuthRedirectUri` at registration, so this is unreachable\n // through the front door; fall back to the landing rather than 500 if a malformed entry slipped in.\n res.redirect(302, landingUrl);\n return;\n }\n // RP-Initiated Logout §2: echo `state` on the post-logout redirect when the RP supplied it (§2 states\n // the OP passes `state` back to the RP; §3 governs the redirection itself).\n if (q.state) redirect.searchParams.set('state', q.state);\n res.redirect(302, redirect.toString());\n return;\n }\n\n // ── §6 confirmation prompt: a NON-trusted logout that still names a real session (a valid hint whose\n // `post_logout_redirect_uri` is absent / unregistered / client-mismatched). Do NOT terminate yet —\n // mint a single-use confirmation token naming the session and 302 the browser to the frontend\n // `/oauth/logout-confirm` prompt. Termination happens only on the End-User's explicit confirm\n // (`POST /oauth/end-session/confirm`), which closes the BROWSER-based logout-CSRF vector (see\n // `handleEndSessionConfirm` for the exact threat model). No audit here — nothing has been terminated;\n // the confirm endpoint audits the actual logout with the clientId/redirect disposition stashed here.\n if (sessionId && userId) {\n const { confirmationToken } = await this.authCodeService.createLogoutConfirmation({ userId, sessionId, clientId, postLogoutRedirectUriRejected });\n const confirmUrl = new URL(`${appBase}/oauth/logout-confirm`);\n confirmUrl.searchParams.set('token', confirmationToken);\n res.redirect(302, confirmUrl.toString());\n return;\n }\n\n // ── Nothing to terminate (no / unverifiable / forged hint): no session was identified, so there is\n // nothing to confirm. Clear the cookie for hygiene and land on the signed-out page — the UNIFORM §5\n // landing, identical to a completed logout, so the response is not an oracle for whether the hint was\n // valid or a session existed.\n AuthControllerUtils.clearRefreshCookie(res, this.appConfigService.applicationEnv);\n this._auditRpInitiatedLogout(req, { userId, sessionId, clientId, sessionTerminated: false, postLogoutRedirectUriRejected });\n res.redirect(302, landingUrl);\n }\n\n /\n Fire-and-forget audit for an RP-Initiated Logout disposition (`OAUTH_RP_INITIATED_LOGOUT`). Auditing\n * must never affect the logout the End-User already performed, so a failure is swallowed at WARN.\n * Called at each terminal disposition: the trusted-RP redirect, the no-session landing, and the §6\n * confirm endpoint (the prompt path audits there, when the session actually ends).\n /\n private _auditRpInitiatedLogout(\n req: Request,\n fields: { userId?: string; sessionId?: string; clientId?: string; sessionTerminated: boolean; postLogoutRedirectUriRejected: boolean },\n ): void {\n void this.auditLogs.logOAuthRpInitiatedLogout({\n ...fields,\n ipAddress: getClientIpFromRequest(req),\n }).catch((auditError) => this.logger.warn('OAUTH_RP_INITIATED_LOGOUT audit emit failed (non-fatal)', {\n ...projectCaughtErrorLogFields(auditError),\n }));\n }\n\n /\n `POST /oauth/end-session/confirm` — the OIDC RP-Initiated Logout §6 confirmation decision\n * (revocation-C). The frontend `/oauth/logout-confirm` prompt calls this with the single-use\n * `OIDC_LOGOUT_CONFIRMATION` token minted by `handleEndSession` when the End-User clicks \"Sign out\".\n * Token-authorized (no Bearer — the End-User may be unauthenticated in the SPA, having arrived via an\n * RP redirect), single-use, short-TTL.\n \n THREAT MODEL — read before strengthening or relaxing this. The prompt+token defends against\n * BROWSER-based logout CSRF: the token is minted into the VICTIM'S browser URL by the GET's 302, and a\n * cross-origin page (an `<img>`/auto-navigation forcing the GET) cannot READ that URL, so it cannot\n * complete the confirm — the classic \"silent logout via a crafted link\" is closed. It does NOT, and by\n * the endpoint's nature cannot, stop a party that HOLDS a valid `id_token` from scripting\n * GET→read-token→POST-confirm headlessly; but that party can already log the user out through the\n * trusted-RP path, because letting an authorized RP end the End-User's session is exactly what\n * RP-Initiated Logout is FOR. So the residual is a bounded session-logout by an id_token holder, not a\n * new capability. Binding the confirm to the victim's OP session (Keycloak's mechanism) is deliberately\n * NOT done: this OP is token-based and the `__wildo_refresh` cookie is scoped to `/api/v1/auth`, so it\n * never reaches `/oauth/`, and the design intentionally allows an unauthenticated SPA to confirm.\n \n * Consumes the token → terminates the named session (`invalidateSession(sid)`) → clears the refresh\n * cookie → audits → returns `{ redirect_to: /oauth/logged-out }` as JSON (the SPA navigates there,\n * mirroring `/oauth/authorize/decision`). A stale / invalid / already-used token is NOT an error: the\n * End-User confirmed a logout, so it lands them on the signed-out page WITHOUT terminating (the session\n * is most likely already gone, and revealing whether the token was live would be a session-state oracle).\n /\n private async handleEndSessionConfirm(req: Request, res: Response): Promise<void> {\n const appBase = this.appConfigService.resolveAppPublicBaseUrl();\n if (!appBase) {\n this.sendOAuthError(res, 503, 'temporarily_unavailable', 'app public base URL is not resolvable');\n return;\n }\n const body = (req.body ?? {}) as { token?: unknown };\n const token = typeof body.token === 'string' ? body.token : '';\n if (!token) {\n this.sendOAuthError(res, 400, 'invalid_request', \"the 'token' parameter is required\");\n return;\n }\n\n res.set('Cache-Control', 'no-store');\n const confirmation = await this.authCodeService.consumeLogoutConfirmation(token);\n // A stale / wrong-type token yields null → land on the signed-out page without terminating.\n if (confirmation?.sessionId) {\n await this.authTokenIssuer.invalidateSession(confirmation.sessionId);\n }\n AuthControllerUtils.clearRefreshCookie(res, this.appConfigService.applicationEnv);\n // Full attribution: the RP the hint named and the redirect disposition were stashed in the token at\n // mint time, so the confirm audit matches what the trusted-RP and no-session paths record inline.\n this._auditRpInitiatedLogout(req, {\n userId: confirmation?.userId,\n sessionId: confirmation?.sessionId,\n clientId: confirmation?.clientId,\n sessionTerminated: Boolean(confirmation?.sessionId),\n postLogoutRedirectUriRejected: confirmation?.postLogoutRedirectUriRejected ?? false,\n });\n res.status(200).json({ redirect_to: `${appBase}/oauth/logged-out` });\n }\n\n /\n `GET /.well-known/openid-configuration` — OIDC discovery metadata. `issuer` is the app's\n * API base URL (matching the `iss` in issued tokens); endpoint URLs are absolute so a client\n * that fetched this doc can reach them directly. The `authorization_endpoint` is the BROWSER-FACING\n * frontend consent/authorize page; the other endpoints are the backend API routes.\n /\n private async handleDiscovery(_req: Request, res: Response): Promise<void> {\n const issuer = this.appConfigService.resolveApiResourceAudience();\n if (!issuer) {\n this.sendOAuthError(res, 503, 'temporarily_unavailable', 'issuer URL is not resolvable');\n return;\n }\n // The `authorization_endpoint` is a BROWSER-FACING page, not the backend API endpoint: a third-party\n // client redirects the user's browser THERE, the SPA establishes the session and (for a\n // `requiresConsent` client) renders the consent screen, then calls the backend `/oauth/authorize`\n // with the user's Bearer. So it points at the frontend consent route (matches\n // `CommonRoutePaths.oauthConsent` in saas-frontend-lib) under the app's public base URL — NOT under\n // the `/api/v1` API mount. The path is a frontend-route literal (route paths are not a closed vocabulary).\n const appBase = this.appConfigService.resolveAppPublicBaseUrl();\n if (!appBase) {\n this.sendOAuthError(res, 503, 'temporarily_unavailable', 'app public base URL is not resolvable');\n return;\n }\n // Deployment guard: a non-https issuer (outside localhost) is a misconfigured public base\n // URL — OIDC relying parties reject a non-https issuer. Surface it loudly rather than let it\n // fail opaquely at the client. (The fix is operator-side: set the external https public URL.)\n if (issuer.startsWith('http://') && !/\\/\\/(localhost\|127\\.0\\.0\\.1)/.test(issuer)) {\n this.logger.warn('OIDC issuer is not https — relying parties will reject it. Set the app public URL to the external https origin.', { issuer });\n }\n res.set('Cache-Control', 'public, max-age=3600');\n this.jsonSuccess(res, {\n issuer,\n authorization_endpoint: `${appBase}/oauth/consent`,\n token_endpoint: `${issuer}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_TOKEN]}`,\n jwks_uri: `${issuer}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_JWKS]}`,\n userinfo_endpoint: `${issuer}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_USERINFO]}`,\n revocation_endpoint: `${issuer}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_REVOKE]}`,\n // OIDC RP-Initiated Logout 1.0 (revocation-C): the `end_session_endpoint` an RP redirects the browser\n // to in order to terminate the End-User's OP session. A backend API route (like revocation), not the\n // browser-facing frontend page — the handler does the termination then redirects.\n // spec-cite: OpenID Connect RP-Initiated Logout 1.0 §2.1 (OpenID Provider Discovery Metadata —\n // `end_session_endpoint: REQUIRED`).\n end_session_endpoint: `${issuer}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION]}`,\n grant_types_supported: ['client_credentials', 'authorization_code', 'refresh_token'],\n response_types_supported: ['code'],\n response_modes_supported: ['query'],\n code_challenge_methods_supported: ['S256'],\n // RFC 9207. This is a CLAIM, not a preference: a client reading `true` here MUST reject any\n // authorization response from this server that arrives without `iss`. It is therefore only safe\n // while `sendAuthorizationRedirect` remains the sole way an authorization response leaves this\n // controller — it is what makes the claim true on the code path, the consent-approve path and\n // the consent-deny path alike. Do not set this to `true` for a server that emits `iss` on only\n // some of its responses.\n // spec-cite: RFC 9207 § 2.3 — `authorization_response_iss_parameter_supported`.\n authorization_response_iss_parameter_supported: true,\n // `none` = PUBLIC client (PKCE, no client secret) — the authorization_code token exchange\n // accepts `client_id` from the body and relies on PKCE (S256) instead of a secret, so a public\n // agent/SPA client is supported. Confidential clients use `client_secret_basic\|post`. Omitting\n // `none` here would (mis)signal confidential-only and block a spec-compliant public client.\n token_endpoint_auth_methods_supported: ['none', 'client_secret_basic', 'client_secret_post'],\n // RFC 8707: this provider honors the `resource` indicator (REQUIRED for a user-delegated\n // authorization_code token — it binds the token `aud` to the A2A/MCP endpoint; the per-endpoint\n // resource value is discovered from the A2A agent card `url` / the MCP RFC 9728 metadata).\n resource_indicators_supported: true,\n /\n CIMD advertisement — DERIVED from the deployment's own posture, never hard-coded true.\n \n \"Authorization servers advertise that they support clients using Client ID Metadata Documents\n * by including the following property in their OAuth Authorization Server metadata:\n * `client_id_metadata_document_supported: true`\"\n * spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Documents → Discovery\n \n The client's documented reaction to this flag is to CHOOSE CIMD over its other options —\n * \"Use Client ID Metadata Documents if the Authorization Server indicates it supports it\" —\n * so advertising it while the policy is `DISABLED` would steer every conformant client into a\n * mechanism this deployment refuses, and its fallback order would already have been spent.\n * Advertising the truth is what lets a client pick DCR or pre-registration instead.\n /\n ...(this.cimdService.deploymentConfiguration().policy === CimdTrustPolicy.DISABLED\n ? {}\n : { client_id_metadata_document_supported: true }),\n /\n `registration_endpoint` — advertised ONLY when the application opted in, for the same\n * reason as the CIMD flag and with the same consequence if it lies.\n \n A client's documented fallback order is \"pre-registered → CIMD → Dynamic Client\n * Registration → prompt the user\", so advertising an endpoint that answers 404 would consume\n * the third rung and push a conformant client straight to prompting a human.\n * spec-cite: MCP 2025-11-25 — Authorization § Client Registration Approaches: \"Use Dynamic\n * Client Registration as a fallback if the Authorization Server supports it (via\n * `registration_endpoint` in OAuth Authorization Server Metadata)\".\n /\n ...(this.dynamicRegistrationConfiguration().enabled\n ? { registration_endpoint: `${issuer}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER]}` }\n : {}),\n subject_types_supported: ['public'],\n id_token_signing_alg_values_supported: ['ES256'],\n // OIDC Discovery RECOMMENDED metadata — DERIVED from the userinfo/ID-token resolver's single-source\n // vocabulary so discovery can never drift from what the ID token actually carries (the OIDC §5.4\n // consistency contract). `openid` is the baseline identity scope; `email`/`profile` gate the identity\n // claims. Scopes are IDENTITY only — authorization is roles-only (scope-based authorization was deleted\n // 2026-07-21). `claims_supported` = the always-present protocol claims + the resolver's scope-gated\n // identity claims; `auth_time` is deliberately NOT advertised (the authorization_code flow never\n // populates it, so advertising it would promise a claim we never deliver). The authorize endpoint\n // redirects the code as query params, so the only response mode is `query`.\n scopes_supported: [...OIDC_SUPPORTED_IDENTITY_SCOPES],\n claims_supported: ['sub', 'iss', 'aud', 'exp', 'iat', 'nonce', 'azp', ...OIDC_SCOPE_GATED_IDENTITY_CLAIMS],\n }, 200);\n }\n\n /\n `GET /oauth/jwks` — the JWKS a relying party uses to verify Wildo-issued tokens. Each JWK's\n * `kid` is the RFC 7638 thumbprint embedded in the token header. Public keys only.\n /\n private async handleJwks(_req: Request, res: Response): Promise<void> {\n res.set('Cache-Control', 'public, max-age=3600');\n this.jsonSuccess(res, this.jwtService.getPublicJwks(), 200);\n }\n\n /\n `POST /oauth/token` — RFC 6749 token endpoint. Serves `grant_type=client_credentials`\n * (the OIDC branch adds `authorization_code`). Accepts `client_secret_basic` (Authorization:\n * Basic) or `client_secret_post` (form body) client authentication.\n /\n private async handleToken(req: Request, res: Response): Promise<void> {\n const body = (req.body ?? {}) as Record<string, string \| undefined>;\n // These OAuth params are single-valued; a REPEATED body key (which Express parses to `string[]`\n // despite the cast) is a malformed request. Reject it cleanly (400) so an array never reaches a\n // `.split`/`.includes` (500) or silently slips through the RFC 8707 audience comparison.\n const malformedTokenParam = this.firstMalformedParam(body, ['grant_type', 'code', 'redirect_uri', 'code_verifier', 'client_id', 'client_secret', 'refresh_token', 'resource', 'scope']);\n if (malformedTokenParam) {\n this.sendOAuthError(res, 400, 'invalid_request', `the '${malformedTokenParam}' parameter must be a single string value`);\n return;\n }\n // Source IP for the per-IP machine-auth failure lockout (see the machine-auth-rate-limit utils).\n // Cheap header parse; only the `client_credentials` grant actually asserts/records against it.\n // security-decision (accepted-low — D11, see .claude/plans/oidc-provider-test-coverage.md § \"ACCEPTED RISK\"):\n // the per-IP brute-force limiter (`assertMachineAuthAttemptWithinRate`) fires ONLY on the client_credentials\n // branch below; the authorization_code + refresh_token secret fronts (and the unauthenticated /oauth/revoke)\n // are DELIBERATELY not per-endpoint rate-limited. 256-bit high-entropy secrets make online guessing\n // infeasible and the global ~1000/min/IP HTTP limiter caps the DoS surface; those fronts are now audited\n // (A-7), so a per-endpoint lockout counter is cheap to add IF the decision is ever revisited.\n const clientIp = getClientIpFromRequest(req);\n\n try {\n let token: unknown;\n if (body.grant_type === 'client_credentials') {\n // Brute-force / DB-read-exhaustion guard: reject a saturated source before the\n // `hashOAuthClientSecret` lookup; the catch below records a failure on `invalid_client`.\n await assertMachineAuthAttemptWithinRate(this.redisService, this.errorBuilder, this.logger, clientIp, this.appConfigService.applicationEnv);\n const { clientId, clientSecret } = this.extractClientCredentials(req, body);\n if (!clientSecret) {\n this.sendOAuthError(res, 401, 'invalid_client', 'missing client credentials');\n return;\n }\n token = await this.tokenService.issueClientCredentialsToken({ clientSecret, clientId, resource: body.resource });\n } else if (body.grant_type === 'authorization_code') {\n // client_id comes from the body (public client) or client auth (confidential); a confidential\n // client ALSO presents client_secret here (client_secret_basic/post), enforced downstream.\n const { clientId, clientSecret } = this.extractClientCredentials(req, body);\n const effectiveClientId = clientId ?? body.client_id;\n if (!effectiveClientId \|\| !body.code \|\| !body.redirect_uri \|\| !body.code_verifier) {\n this.sendOAuthError(res, 400, 'invalid_request', 'code, redirect_uri, code_verifier and client_id are required');\n return;\n }\n token = await this.tokenService.issueAuthorizationCodeToken({\n code: body.code,\n clientId: effectiveClientId,\n redirectUri: body.redirect_uri,\n codeVerifier: body.code_verifier,\n // Presented client secret (if any). REQUIRED for a confidential client, verified during the\n // code exchange; a public (PKCE-only) client presents none.\n clientSecret,\n // RFC 8707 §2.2: a client MAY echo `resource` on the token request. The authorize-bound\n // resource is authoritative; when the token request also names one it MUST match (a\n // confused-deputy cross-check), else `invalid_target`.\n resource: body.resource,\n });\n } else if (body.grant_type === 'refresh_token') {\n if (!body.refresh_token) {\n this.sendOAuthError(res, 400, 'invalid_request', 'refresh_token is required');\n return;\n }\n // Item 5 (OIDC §12.2): pass the presented client credentials so an AUTHENTICATED OIDC client\n // ALSO gets a fresh id_token. The token service authenticates the secret (bad secret ⇒\n // `invalid_client` → 401 via the catch below) before minting; a first-party session refresh\n // presents no credentials → access + refresh only, no id_token.\n const { clientId, clientSecret } = this.extractClientCredentials(req, body);\n token = await this.tokenService.issueRefreshTokenGrant(body.refresh_token, clientId, clientSecret);\n } else {\n this.sendOAuthError(res, 400, 'unsupported_grant_type', `grant_type '${body.grant_type ?? ''}' is not supported`);\n return;\n }\n\n // RFC 6749 §5.1: token responses MUST NOT be cached.\n res.set('Cache-Control', 'no-store');\n res.set('Pragma', 'no-cache');\n this.jsonSuccess(res, token, 200);\n } catch (error) {\n if (isWildoBackendError(error)) {\n const context = (error as { context?: { oauthError?: string; detail?: string } }).context;\n if (context?.oauthError) {\n // Feed the per-IP machine-auth failure lockout AND emit the MACHINE_AUTH_FAILED audit\n // event when a client presented a bad secret to the client-credentials exchange (a guess\n // attempt) — scoped to that grant so authorization_code client-auth failures don't share\n // the machine-front bucket. `invalid_client` = authentication failed (bad secret); the\n // other OAuth errors (unauthorized_client / invalid_scope / invalid_target) are authorized-\n // client request errors, not auth failures, so they neither lock nor emit this event.\n if (context.oauthError === 'invalid_client' && body.grant_type === 'client_credentials') {\n await recordMachineAuthFailure(this.redisService, this.logger, clientIp);\n const presentedSecret = body.client_secret;\n const credentialPrefix = presentedSecret?.startsWith('oc_org_')\n ? 'oc_org_'\n : presentedSecret?.startsWith('oc_app_') ? 'oc_app_' : undefined;\n void this.auditLogs.logMachineAuthFailed({\n credentialKind: 'oauth_client',\n credentialPrefix,\n reason: 'invalid_client',\n ipAddress: clientIp,\n }).catch((auditError) => this.logger.warn('MACHINE_AUTH_FAILED audit emit failed (non-fatal)', {\n ...projectCaughtErrorLogFields(auditError),\n }));\n }\n // RFC 6749 §5.2: `invalid_client` → 401 (with WWW-Authenticate); others → 400.\n // RFC 6749 §5.2 status: invalid_client→401; temporarily_unavailable (server-side\n // misconfig, e.g. an unresolvable issuer/audience)→503; everything else→400. Without the\n // 503 case a server misconfiguration is mislabelled to the client as a 400 bad request.\n this.sendOAuthError(res, context.oauthError === 'invalid_client' ? 401 : context.oauthError === 'temporarily_unavailable' ? 503 : 400, context.oauthError, context.detail);\n return;\n }\n }\n throw error; // unexpected → unified error-handler middleware\n }\n }\n\n /\n `GET /oauth/authorize` — OIDC authorization endpoint (authorization_code + PKCE). Called by the\n * BROWSER-FACING frontend consent page (the discovery `authorization_endpoint`), NOT hit directly by a\n * raw third-party browser: the SPA establishes the user session first and calls this with the user's\n * Bearer. Validates the request + resolves the user, then either:\n * - `requiresConsent` client → returns `{ consent_required, consent_token, client, scopes, resource }`\n * JSON (the SPA renders the consent screen, then POSTs the decision to `/oauth/authorize/decision`); or\n * - trusted client (`requiresConsent` false) → mints the code and returns `{ redirect_to }` JSON.\n * BOTH the trusted code path and the consent-decision path return `redirect_to` as JSON (NOT an HTTP\n * 302): the caller is a Bearer-authenticated XHR that auto-follows a 302 but cannot read a cross-origin\n * `Location`, so the SPA completes the OAuth redirect with `window.location.assign(redirect_to)`.\n \n Errors are returned DIRECTLY (never redirected) — safe against open-redirect; redirecting\n * OAuth errors for a pre-validated `redirect_uri` (RFC 6749 §4.1.2.1) is a follow-up.\n /\n /* The deployment's dynamic-registration posture. Absent ⇒ disabled. /\n private dynamicRegistrationConfiguration(): DynamicClientRegistrationConfig {\n const authored = (this.appConfigService.config?.auth as { dynamicClientRegistration?: DynamicClientRegistrationConfig } \| undefined)?.dynamicClientRegistration;\n return {\n enabled: authored?.enabled ?? false,\n maxRegistrationsPerHourPerIp: authored?.maxRegistrationsPerHourPerIp ?? 10,\n };\n }\n\n /\n `POST /oauth/register` — RFC 7591 dynamic client registration.\n \n ## What this endpoint is, stated plainly\n \n An UNAUTHENTICATED write primitive. Anyone who can reach it creates a durable row in this\n * application's database. That is not a flaw in the design — it is the design, and it is why the\n * endpoint is off by default, rate-limited per source IP, and why everything it creates is\n * confined to the weakest posture the framework can express.\n \n ## The four confinements, and why each one is not optional\n \n 1. No roles, ever. Roles are this framework's single authorization axis. A caller who\n * could name its own roles at an anonymous endpoint would have found a total privilege\n * escalation — the exact bypass `buildOAuthClientMintHandlers`' role-ceiling gate exists to\n * prevent for AUTHENTICATED callers. A request that ASKS for roles is REFUSED rather than\n * quietly downgraded: a client that believes it holds authority it does not have will fail\n * later in a way neither side can diagnose.\n * 2. Identity scopes only (`openid`/`profile`/`email`), for the same reason CIMD is capped\n * there: the ceiling would otherwise be authored by the party it constrains.\n * 3. `registrationOrigin: DYNAMIC`, which `adaptRegisteredClient` maps to\n * `UNAFFILIATED` — so the row lands on the APPLICATION collection for want of an\n * organization WITHOUT inheriting the platform-operator first-party posture that\n * `scope: APPLICATION` normally carries. This is the whole reason the field exists.\n * 4. `authorization_code` only. `client_credentials` is the machine front, where a client\n * acts as ITSELF with its own roles. A self-registered client acting on its own behalf is a\n * principal nobody vouched for; it may only ever act FOR A USER who consented.\n \n ## What is deliberately NOT issued\n \n No `client_secret`. The client is public (`token_endpoint_auth_method: none`) and authenticates\n * with PKCE, which is what MCP's own worked example registers. A row still persists inert secret\n * material because `hashedSecret` is required by the client schema; the REJECTED alternative was\n * making that field optional, which is a reshape across every OAuth-client surface for the sake of\n * one caller. Nothing can present the inert secret — it is never returned and never regenerated.\n \n spec-cite: RFC 7591 § 3.1 — client registration request; § 3.2.1 — client information response.\n * spec-cite: MCP 2025-11-25 — Authorization § Dynamic Client Registration (\"included for\n * backwards compatibility with earlier versions of the MCP authorization spec\"), which is why\n * this ships OFF by default while CIMD is the recommended path.\n /\n private async handleDynamicRegistration(req: Request, res: Response): Promise<void> {\n const configuration = this.dynamicRegistrationConfiguration();\n if (!configuration.enabled) {\n // 404, not 403: an application that has not opted in should be indistinguishable from one\n // whose framework never had the endpoint. A 403 would advertise a capability that is one\n // config flag away, and invite probing for the flag.\n res.status(404).json({ error: 'not_found' });\n return;\n }\n\n const clientIp = getClientIpFromRequest(req);\n // The ONLY thing between an unauthenticated endpoint and unbounded row creation. Applied before\n // any parsing so a malformed flood costs no more than a well-formed one.\n const withinRate = await this.withinDynamicRegistrationRate(clientIp, configuration);\n if (!withinRate) {\n res.status(429).json({ error: 'temporarily_unavailable', error_description: 'too many client registrations from this source' });\n return;\n }\n\n const body = (req.body ?? {}) as Record<string, unknown>;\n\n // RFC 7591 § 2: `redirect_uris` is REQUIRED for a client using the authorization_code grant.\n const redirectUris = body.redirect_uris;\n if (!Array.isArray(redirectUris) \|\| redirectUris.length === 0 \|\| !redirectUris.every((uri): uri is string => typeof uri === 'string')) {\n this.sendRegistrationError(res, 'invalid_redirect_uri', 'redirect_uris must be a non-empty array of strings');\n return;\n }\n // Each URI must independently pass the SAME safety refine every registered client faces —\n // https anywhere, http loopback only, no javascript:/data:, no fragment, no embedded\n // credentials. Checked HERE as well as by the schema so the refusal names the offending value\n // rather than surfacing as a generic validation failure on a system write.\n const unsafe = redirectUris.find((uri) => !isSafeOAuthRedirectUri(uri));\n if (unsafe) {\n this.sendRegistrationError(res, 'invalid_redirect_uri', `redirect_uri is not permitted: ${unsafe}`);\n return;\n }\n\n // revocation-C: `post_logout_redirect_uris` — OPTIONAL OIDC RP-Initiated Logout client metadata (unlike\n // `redirect_uris`, which RFC 7591 requires for authorization_code). When present it must be an array of\n // strings, each held to the SAME `isSafeOAuthRedirectUri` gate as a redirect URI (so a registered\n // post-logout target can never become an open-redirect / off-origin navigation). Absent ⇒ [] (the client\n // simply cannot pass a `post_logout_redirect_uri` to `/oauth/end-session`).\n let postLogoutRedirectUris: string[] = [];\n if (body.post_logout_redirect_uris !== undefined) {\n if (!Array.isArray(body.post_logout_redirect_uris) \|\| !body.post_logout_redirect_uris.every((uri): uri is string => typeof uri === 'string')) {\n this.sendRegistrationError(res, 'invalid_client_metadata', 'post_logout_redirect_uris must be an array of strings');\n return;\n }\n const unsafePostLogout = body.post_logout_redirect_uris.find((uri) => !isSafeOAuthRedirectUri(uri));\n if (unsafePostLogout) {\n this.sendRegistrationError(res, 'invalid_client_metadata', `post_logout_redirect_uri is not permitted: ${unsafePostLogout}`);\n return;\n }\n postLogoutRedirectUris = body.post_logout_redirect_uris;\n }\n\n const clientName = typeof body.client_name === 'string' && body.client_name.trim().length > 0\n ? body.client_name.trim().slice(0, 100)\n : undefined;\n if (!clientName) {\n this.sendRegistrationError(res, 'invalid_client_metadata', 'client_name is required');\n return;\n }\n\n // CONFINEMENT 1 — refuse, never downgrade. `roles` is not an RFC 7591 field at all, so its\n // presence is either a probe or a client that fundamentally misunderstands this endpoint.\n if (body.roles !== undefined) {\n this.sendRegistrationError(res, 'invalid_client_metadata', 'roles cannot be requested at dynamic registration');\n return;\n }\n // CONFINEMENT 2 — a scope request wider than identity is refused for the same reason.\n const requestedScopes = typeof body.scope === 'string' ? body.scope.split(/\\s+/).filter(Boolean) : [];\n const beyondIdentity = requestedScopes.filter((scope) => !OIDC_SUPPORTED_IDENTITY_SCOPES.includes(scope));\n if (beyondIdentity.length > 0) {\n this.sendRegistrationError(res, 'invalid_client_metadata', `scope(s) not available to a dynamically registered client: ${beyondIdentity.join(', ')}`);\n return;\n }\n // CONFINEMENT 4 — authorization_code only.\n //\n // `refresh_token` is TOLERATED here and then NOT granted, and the asymmetry with confinements 1\n // and 2 (which refuse rather than downgrade) is deliberate — do not \"fix\" it into a refusal.\n // A conformant MCP client is TOLD to ask: clients that desire refresh tokens \"SHOULD include\n // `refresh_token` in their `grant_types` client metadata\", and in the same breath \"MUST NOT\n // assume refresh tokens will be issued; the AS retains discretion\". Refusing the registration\n // would therefore reject well-behaved clients for following their own specification, whereas\n // roles and wide scopes are things no client is ever instructed to request here.\n //\n // Substituting instead of refusing is the sanctioned shape: the AS \"MAY reject or replace any of\n // the client's requested metadata values submitted during the registration and substitute them\n // with suitable values\", and MUST \"return all registered metadata about this client\" — which the\n // 201 echo below does, so `grant_types: [\"authorization_code\"]` IS the notification that the\n // request was narrowed. There is no second signal, and per the discretion clause above none is\n // owed.\n //\n // OPEN DESIGN QUESTION, recorded rather than silently settled: whether a dynamically registered\n // PUBLIC client should be granted refresh at all. Granting it extends an anonymous\n // self-registered client's reach without a fresh consent; withholding it means such a client\n // re-consents when its access token expires. Today it is withheld. That is a security posture,\n // not an oversight, and changing it is a deliberate decision — not a bug fix.\n //\n // spec-cite: MCP 2026-07-28 — Authorization § Refresh Tokens\n // (<https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization>).\n // spec-cite: RFC 7591 § 3.2.1 — Client Information Response.\n const requestedGrants = Array.isArray(body.grant_types) ? body.grant_types : [OAuthGrantType.AUTHORIZATION_CODE];\n const forbiddenGrant = requestedGrants.find((grant) => grant !== OAuthGrantType.AUTHORIZATION_CODE && grant !== OAuthGrantType.REFRESH_TOKEN);\n if (forbiddenGrant) {\n this.sendRegistrationError(res, 'invalid_client_metadata', `grant_type not available to a dynamically registered client: ${String(forbiddenGrant)}`);\n return;\n }\n // A confidential auth method would require a secret this endpoint deliberately does not issue.\n const requestedAuthMethod = body.token_endpoint_auth_method;\n if (requestedAuthMethod !== undefined && requestedAuthMethod !== OAuthTokenEndpointAuthMethod.NONE) {\n this.sendRegistrationError(res, 'invalid_client_metadata', 'only token_endpoint_auth_method=none is available to a dynamically registered client');\n return;\n }\n\n const secretMaterial = generateOAuthClientSecretMaterial(ApiKeyScope.APPLICATION);\n // RFC 7592 §3: the registration response carries a `registration_access_token` the client uses at\n // the client configuration endpoint, and a `registration_client_uri` naming that endpoint. Minted\n // here and returned exactly once — there is no way to recover it afterwards, which is why §5 says\n // it \"SHOULD NOT expire while a client is still actively registered\".\n const registrationTokenMaterial = generateRegistrationAccessTokenMaterial();\n const created = await this.systemAccess.createAsSystem(CoreResourceType.OAUTH_CLIENTS_APPLICATION, {\n name: clientName,\n scope: ApiKeyScope.APPLICATION,\n applicationId: this.appConfigService.applicationId,\n // Every confinement, as DATA on the row — so a later read does not have to re-derive them.\n roles: [],\n allowedScopes: requestedScopes.length > 0 ? requestedScopes : [...OIDC_SUPPORTED_IDENTITY_SCOPES],\n allowedGrants: [OAuthGrantType.AUTHORIZATION_CODE],\n redirectUris,\n postLogoutRedirectUris,\n tokenEndpointAuthMethod: OAuthTokenEndpointAuthMethod.NONE,\n // Belt to `adaptRegisteredClient`'s braces: the resolver forces consent for a DYNAMIC client\n // regardless, but a row that also SAYS so cannot mislead an operator reading the collection.\n requiresConsent: true,\n registrationOrigin: OAuthClientRegistrationOrigin.DYNAMIC,\n hashedSecret: secretMaterial.hashedSecret,\n secretPrefix: secretMaterial.secretPrefix,\n registrationAccessTokenHash: registrationTokenMaterial.registrationAccessTokenHash,\n registrationAccessTokenPrefix: registrationTokenMaterial.registrationAccessTokenPrefix,\n }, {\n // `registrationOrigin`, `hashedSecret` and `secretPrefix` all carry\n // `.excludeFromCreate()` — they are server-managed precisely so no caller can author them.\n // This endpoint IS the server-side door, so it re-attaches them explicitly.\n preserveServerInjectedFields: [\n 'registrationOrigin', 'hashedSecret', 'secretPrefix',\n // Same reason as the two above: server-managed, so `.excludeFromCreate()` strips them and\n // this endpoint — the server-side door — re-attaches them explicitly. Omitting them here\n // would persist a client with NO registration access token, and every management call would\n // then fail 401 with nothing to diagnose.\n 'registrationAccessTokenHash', 'registrationAccessTokenPrefix',\n ],\n }) as { _id: string };\n\n // assurance-control: WILDO.IDENTITY.CLIENT_IDENTITY_ASSERTION — an anonymous party created a\n // client identity in this application. Fire-and-forget; auditing must never fail the request it\n // observes, and the row exists either way.\n void this.auditLogs.logDynamicClientRegistered({\n clientId: created._id,\n clientName,\n redirectUris,\n postLogoutRedirectUris,\n ipAddress: clientIp,\n }).catch((auditError) => this.logger.warn('DYNAMIC_CLIENT_REGISTERED audit emit failed (non-fatal)', {\n ...projectCaughtErrorLogFields(auditError),\n }));\n\n res.set('Cache-Control', 'no-store');\n // RFC 7591 § 3.2.1: 201 Created, and the response echoes the registered metadata so the client\n // can see exactly what was accepted — including the fields we NARROWED, which is how a client\n // learns it is confined rather than discovering it at the token endpoint.\n this.jsonSuccess(res, {\n client_id: created._id,\n client_id_issued_at: Math.floor(Date.now() / 1000),\n client_name: clientName,\n redirect_uris: redirectUris,\n post_logout_redirect_uris: postLogoutRedirectUris,\n grant_types: [OAuthGrantType.AUTHORIZATION_CODE],\n response_types: ['code'],\n token_endpoint_auth_method: OAuthTokenEndpointAuthMethod.NONE,\n scope: (requestedScopes.length > 0 ? requestedScopes : [...OIDC_SUPPORTED_IDENTITY_SCOPES]).join(' '),\n // RFC 7592 §3 — both REQUIRED in a registration response that supports management. The token\n // appears here and NOWHERE else, ever.\n registration_access_token: registrationTokenMaterial.plainToken,\n registration_client_uri: this.registrationClientUri(created._id),\n }, 201);\n }\n\n /\n The client configuration endpoint URL for one client — RFC 7592 §3's `registration_client_uri`.\n \n Built from the same issuer the discovery document advertises, so a client that resolved this\n * server through discovery reaches the same origin here.\n /\n private registrationClientUri(clientId: string): string {\n const template = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER_CLIENT];\n const issuer = this.appConfigService.resolveApiResourceAudience();\n return `${issuer}${template.replace(':clientId', encodeURIComponent(clientId))}`;\n }\n\n /\n The SINGLE seam through which every OAuth authorization RESPONSE leaves this server.\n \n It exists to make one invariant unbypassable rather than hand-applied: every authorization\n * response carries the RFC 9207 `iss` parameter. There are three responses today — the trusted-client\n * code path, the consent APPROVE path, and the consent DENY path — and the specification requires the\n * parameter on all of them, \"including error responses\". A fourth response added later cannot forget,\n * because emitting one means calling this.\n * spec-cite: MCP 2026-07-28 — Authorization § Authorization Response Validation.\n \n `iss` is the mix-up defence: it lets a client that talks to more than one authorization server\n * verify that the response came from the one it started the flow with, before it hands the code to a\n * token endpoint. Without it, a client with several configured servers can be induced to redeem a code\n * at the wrong one.\n \n Fails closed when the issuer is unresolvable, and that is the point. A conformant client MUST\n * REJECT a response whose `iss` is missing when the server advertises\n * `authorization_response_iss_parameter_supported: true` — so silently omitting the parameter would\n * turn a local misconfiguration into a response the client is obliged to throw away, with no\n * diagnosis. Refusing here names the cause instead. `503` rather than `400` because an unresolvable\n * issuer is this deployment's fault, never the caller's — matching `handleDiscovery`, which already\n * refuses on the same condition.\n \n spec-cite: MCP 2026-07-28 — Authorization § Authorization Response Validation (the SHOULD to\n * include `iss`, the MUST to advertise it, and the client action table whose `true` + absent row is\n * \"Reject the response\").\n * spec-cite: RFC 9207 § 2 — `iss` in the authorization response; § 2.3 — metadata advertisement.\n /\n private sendAuthorizationRedirect(res: Response, redirect: URL): void {\n const issuer = this.appConfigService.resolveApiResourceAudience();\n if (!issuer) {\n this.sendOAuthError(res, 503, 'temporarily_unavailable', 'issuer URL is not resolvable');\n return;\n }\n redirect.searchParams.set('iss', issuer);\n res.set('Cache-Control', 'no-store');\n this.jsonSuccess(res, { redirect_to: redirect.toString() }, 200);\n }\n\n /* RFC 7591 § 3.2.2 registration-error response: 400 + `error` / `error_description`. /\n / ───────────────────────────────────────────────────────────────────────────\n * RFC 7592 — client configuration endpoint\n * ──────────────────────────────────────────────────────────────────────── /\n\n /\n Authenticate a call to the client configuration endpoint, or answer and return null.\n \n Every RFC 7592 verb shares this, so the refusal ladder cannot drift between them — which is the\n * whole reason it is a helper rather than three copies. The ladder, and why each rung is the code\n * it is:\n \n - 404 when the application has not opted in. Identical to `/oauth/register`: an application\n * without dynamic registration should be indistinguishable from one whose framework never had\n * the endpoint, so a 403 would advertise a capability one config flag away.\n * - 401 with `WWW-Authenticate` when the Bearer token is absent or malformed. \"The client MUST\n * use its registration access token in all calls to this endpoint as an OAuth 2.0 Bearer Token.\"\n * spec-cite: RFC 7592 §2.\n * - 401 when the client does not exist. \"If the client does not exist on this server, the\n * server MUST respond with HTTP 401 Unauthorized and the registration access token used to make\n * this request SHOULD be immediately revoked.\" spec-cite: RFC 7592 §2.1. The SHOULD is moot for\n * us: a token for a client that does not exist has no row to revoke, so there is nothing to do.\n * - 403 when the client exists but was not dynamically registered. \"If the client does not have\n * permission to read its record, the server MUST return an HTTP 403 Forbidden.\" spec-cite: RFC\n * 7592 §2.1. An operator- or organization-registered client is administered through the ordinary\n * authenticated resource surface; it holds no registration access token and must not be\n * reachable here even if one were somehow presented.\n * - 401 when the presented token does not match.\n \n Note the deliberate asymmetry: an unknown client is 401 and a known-but-ineligible one is 403,\n * which is what the specification asks for even though it leaks that a client id exists. That\n * disclosure is bounded — the caller already had to supply the id — and diverging from the\n * specification here would break a conformant client's error handling.\n /\n private async authenticateClientConfiguration(\n req: Request,\n res: Response,\n ): Promise<{ clientId: string; record: OAuthClientApplication } \| null> {\n if (!this.dynamicRegistrationConfiguration().enabled) {\n res.status(404).json({ error: 'not_found' });\n return null;\n }\n\n const header = req.headers.authorization;\n const presented = typeof header === 'string' && header.startsWith('Bearer ')\n ? header.slice('Bearer '.length).trim()\n : undefined;\n if (!presented) {\n this.sendClientConfigurationUnauthorized(res, 'a registration access token is required');\n return null;\n }\n\n const clientId = String(req.params.clientId ?? '');\n if (!clientId) {\n this.sendClientConfigurationUnauthorized(res, 'unknown client');\n return null;\n }\n\n const record = await this.systemAccess.readAsSystem<OAuthClientApplication>(\n CoreResourceType.OAUTH_CLIENTS_APPLICATION,\n clientId,\n ).catch(() => null);\n if (!record) {\n this.sendClientConfigurationUnauthorized(res, 'unknown client');\n return null;\n }\n\n if (record.registrationOrigin !== OAuthClientRegistrationOrigin.DYNAMIC) {\n res.set('Cache-Control', 'no-store');\n res.status(403).json({ error: 'access_denied', error_description: 'this client is not managed through dynamic registration' });\n return null;\n }\n\n /\n * A DEPROVISIONED client is not manageable, and this rung is what makes its registration access\n * token invalid.\n \n \"If a client is deprovisioned from a server, any outstanding registration access token for\n * that client MUST be invalidated at the same time.\" spec-cite: RFC 7592 §5. A token that\n * authenticates at no endpoint is invalidated in the only sense that matters — so `DELETE` marks\n * the client `INACTIVE` and this refuses every later call, rather than clearing the stored hash\n * and losing the record of which token the client held, which an operator investigating a\n * deleted client wants.\n /\n if (record.status !== OAuthClientStatus.ACTIVE) {\n this.sendClientConfigurationUnauthorized(res, 'invalid registration access token');\n return null;\n }\n\n const storedHash = record.registrationAccessTokenHash;\n // Compared through `timingSafeEqual` over the two DIGESTS: both are fixed-length hex, so the\n // buffers can never differ in length and the comparison cannot leak a prefix match by timing.\n if (!storedHash \|\| !this.registrationTokenMatches(presented, storedHash)) {\n this.sendClientConfigurationUnauthorized(res, 'invalid registration access token');\n return null;\n }\n\n return { clientId, record };\n }\n\n /\n Constant-time comparison of a presented registration access token against the stored digest.\n \n Both sides are SHA-256 hex, so they are always the same length and `timingSafeEqual` cannot\n * throw — which is why the digests are compared rather than the raw values.\n /\n private registrationTokenMatches(presented: string, storedHash: string): boolean {\n const presentedDigest = Buffer.from(hashRegistrationAccessToken(presented), 'hex');\n const storedDigest = Buffer.from(storedHash, 'hex');\n if (presentedDigest.length !== storedDigest.length \|\| presentedDigest.length === 0) return false;\n return timingSafeEqual(presentedDigest, storedDigest);\n }\n\n /\n RFC 6750 §3 shape for every unauthenticated refusal at this endpoint.\n \n One description for a missing token and a wrong one, on purpose: distinguishing them tells an\n * unauthenticated caller which half of its guess was right.\n /\n private sendClientConfigurationUnauthorized(res: Response, description: string): void {\n res.set('Cache-Control', 'no-store');\n res.set('WWW-Authenticate', 'Bearer error=\"invalid_token\"');\n res.status(401).json({ error: 'invalid_token', error_description: description });\n }\n\n /\n The client information response body — RFC 7592 §3, minus the two members §2.2 forbids a client\n * to send back.\n \n `registration_access_token` is NOT echoed on read or update. It is returned once, at\n * registration, and we do not rotate it: §5 permits rotation on a read or update (\"MAY\"), and\n * taking that option means a client that loses the response has silently lost management access\n * for good. The specification's own preference — \"SHOULD NOT expire while a client is still\n * actively registered\" — points the same way.\n /\n private clientInformationResponse(clientId: string, record: OAuthClientApplication): Record<string, unknown> {\n return {\n client_id: clientId,\n client_name: record.name,\n redirect_uris: record.redirectUris ?? [],\n post_logout_redirect_uris: record.postLogoutRedirectUris ?? [],\n grant_types: record.allowedGrants ?? [],\n response_types: ['code'],\n token_endpoint_auth_method: record.tokenEndpointAuthMethod,\n scope: (record.allowedScopes ?? []).join(' '),\n registration_client_uri: this.registrationClientUri(clientId),\n };\n }\n\n /\n `GET /oauth/register/:clientId` — RFC 7592 §2.1 Client Read Request.\n \n \"the authorization server responds with an HTTP 200 OK with content type of `application/json`\".\n * spec-cite: RFC 7592 §2.1.\n /\n private async handleClientConfigurationRead(req: Request, res: Response): Promise<void> {\n const authenticated = await this.authenticateClientConfiguration(req, res);\n if (!authenticated) return;\n\n res.set('Cache-Control', 'no-store');\n this.jsonSuccess(res, this.clientInformationResponse(authenticated.clientId, authenticated.record), 200);\n }\n\n /\n `PUT /oauth/register/:clientId` — RFC 7592 §2.2 Client Update Request.\n \n Full replacement, not a patch, and that is the specification's choice rather than ours: \"This\n * request MUST include all client metadata fields as returned to the client from a previous\n * registration, read, or update operation\" and \"Omitted fields MUST be treated as null or empty\n * values by the server, indicating the client's request to delete them from the client's\n * registration.\" spec-cite: RFC 7592 §2.2.\n \n So a client that sends only the field it wants to change DELETES everything else. That is\n * surprising, it is what the specification requires, and it is why `redirect_uris` is re-validated\n * on every update rather than assumed still present.\n \n Every confinement the registration endpoint applies is re-applied here, in the same order. A\n * client that could widen its scopes, add a grant or change its auth method through an update\n * would have found a way around the registration confinements by taking one extra step.\n /\n private async handleClientConfigurationUpdate(req: Request, res: Response): Promise<void> {\n const authenticated = await this.authenticateClientConfiguration(req, res);\n if (!authenticated) return;\n const { clientId, record } = authenticated;\n\n const body = (req.body ?? {}) as Record<string, unknown>;\n\n // \"The client MUST include its `client_id` field in the request, and it MUST be the same as its\n // currently issued client identifier.\" spec-cite: RFC 7592 §2.2. A mismatch is the client\n // addressing one registration and describing another, which is a client bug worth naming.\n if (body.client_id !== clientId) {\n this.sendRegistrationError(res, 'invalid_client_metadata', 'client_id must be present and must match the client being updated');\n return;\n }\n\n // \"The updated client metadata fields request MUST NOT include the `registration_access_token`,\n // `registration_client_uri`, `client_secret_expires_at`, or `client_id_issued_at` fields.\"\n // spec-cite: RFC 7592 §2.2. Refused rather than ignored: a client sending one has misunderstood\n // the contract, and silently dropping it would leave it believing it had rotated its own token.\n const forbidden = ['registration_access_token', 'registration_client_uri', 'client_secret_expires_at', 'client_id_issued_at']\n .find((field) => body[field] !== undefined);\n if (forbidden) {\n this.sendRegistrationError(res, 'invalid_client_metadata', `${forbidden} must not be included in an update request`);\n return;\n }\n\n // \"If the client includes the `client_secret` field in the request, the value of this field MUST\n // match the currently issued client secret for that client. The client MUST NOT be allowed to\n // overwrite its existing client secret with its own chosen value.\" spec-cite: RFC 7592 §2.2.\n // A dynamically registered client is PUBLIC and never received a secret, so any value it sends\n // cannot match one — refuse rather than compare against a secret it does not have.\n if (body.client_secret !== undefined) {\n this.sendRegistrationError(res, 'invalid_client_metadata', 'this client has no client secret to confirm');\n return;\n }\n\n const redirectUris = body.redirect_uris;\n if (!Array.isArray(redirectUris) \|\| redirectUris.length === 0 \|\| !redirectUris.every((uri): uri is string => typeof uri === 'string')) {\n this.sendRegistrationError(res, 'invalid_redirect_uri', 'redirect_uris must be a non-empty array of strings');\n return;\n }\n const unsafe = redirectUris.find((uri) => !isSafeOAuthRedirectUri(uri));\n if (unsafe) {\n this.sendRegistrationError(res, 'invalid_redirect_uri', `redirect_uri is not permitted: ${unsafe}`);\n return;\n }\n\n // Omitted ⇒ emptied, per §2.2. That is the whole reason this reads as a replacement.\n let postLogoutRedirectUris: string[] = [];\n if (body.post_logout_redirect_uris !== undefined) {\n if (!Array.isArray(body.post_logout_redirect_uris) \|\| !body.post_logout_redirect_uris.every((uri): uri is string => typeof uri === 'string')) {\n this.sendRegistrationError(res, 'invalid_client_metadata', 'post_logout_redirect_uris must be an array of strings');\n return;\n }\n const unsafePostLogout = body.post_logout_redirect_uris.find((uri) => !isSafeOAuthRedirectUri(uri));\n if (unsafePostLogout) {\n this.sendRegistrationError(res, 'invalid_client_metadata', `post_logout_redirect_uri is not permitted: ${unsafePostLogout}`);\n return;\n }\n postLogoutRedirectUris = body.post_logout_redirect_uris;\n }\n\n const clientName = typeof body.client_name === 'string' && body.client_name.trim().length > 0\n ? body.client_name.trim().slice(0, 100)\n : undefined;\n if (!clientName) {\n this.sendRegistrationError(res, 'invalid_client_metadata', 'client_name is required');\n return;\n }\n\n // The registration confinements, re-applied. See `handleDynamicRegistration` for why each one\n // refuses rather than downgrades; the reasoning is identical and is not repeated here.\n if (body.roles !== undefined) {\n this.sendRegistrationError(res, 'invalid_client_metadata', 'roles cannot be requested at dynamic registration');\n return;\n }\n const requestedScopes = typeof body.scope === 'string' ? body.scope.split(/\\s+/).filter(Boolean) : [];\n const beyondIdentity = requestedScopes.filter((scope) => !OIDC_SUPPORTED_IDENTITY_SCOPES.includes(scope));\n if (beyondIdentity.length > 0) {\n this.sendRegistrationError(res, 'invalid_client_metadata', `scope(s) not available to a dynamically registered client: ${beyondIdentity.join(', ')}`);\n return;\n }\n const requestedGrants = Array.isArray(body.grant_types) ? body.grant_types : [OAuthGrantType.AUTHORIZATION_CODE];\n const forbiddenGrant = requestedGrants.find((grant) => grant !== OAuthGrantType.AUTHORIZATION_CODE && grant !== OAuthGrantType.REFRESH_TOKEN);\n if (forbiddenGrant) {\n this.sendRegistrationError(res, 'invalid_client_metadata', `grant_type not available to a dynamically registered client: ${String(forbiddenGrant)}`);\n return;\n }\n const requestedAuthMethod = body.token_endpoint_auth_method;\n if (requestedAuthMethod !== undefined && requestedAuthMethod !== OAuthTokenEndpointAuthMethod.NONE) {\n this.sendRegistrationError(res, 'invalid_client_metadata', 'only token_endpoint_auth_method=none is available to a dynamically registered client');\n return;\n }\n\n const updated = await this.systemAccess.updateAsSystem<OAuthClientApplication>(\n CoreResourceType.OAUTH_CLIENTS_APPLICATION,\n clientId,\n {\n name: clientName,\n redirectUris,\n postLogoutRedirectUris,\n allowedScopes: requestedScopes.length > 0 ? requestedScopes : [...OIDC_SUPPORTED_IDENTITY_SCOPES],\n },\n );\n if (!updated) {\n this.sendClientConfigurationUnauthorized(res, 'unknown client');\n return;\n }\n\n // assurance-control: WILDO.IDENTITY.CLIENT_IDENTITY_ASSERTION — a self-registered client changed\n // its own registration. Same standing as the registration itself, so the same audit concern:\n // `redirect_uris` is where a client's authorization responses are delivered, and an update is the\n // one way that set moves after registration.\n void this.auditLogs.logDynamicClientRegistered({\n clientId,\n clientName,\n redirectUris,\n postLogoutRedirectUris,\n ipAddress: getClientIpFromRequest(req),\n }).catch((auditError) => this.logger.warn('DYNAMIC_CLIENT_REGISTERED audit emit failed on update (non-fatal)', {\n ...projectCaughtErrorLogFields(auditError),\n }));\n\n res.set('Cache-Control', 'no-store');\n this.jsonSuccess(res, this.clientInformationResponse(clientId, { ...record, ...updated }), 200);\n }\n\n /\n `DELETE /oauth/register/:clientId` — RFC 7592 §2.3 Client Delete Request.\n \n \"If a client has been successfully deprovisioned, the authorization server MUST respond with an\n * HTTP 204 No Content message.\" spec-cite: RFC 7592 §2.3.\n \n Deprovisioned by STATUS, not by removing the row, and the row is what makes that sound: every\n * client-resolution path in this server refuses a non-`ACTIVE` client, so `INACTIVE` is\n * indistinguishable from absent to any protocol caller — while the row survives for the audit\n * trail, which is the thing an operator investigating a deleted client actually needs.\n \n The registration access token is invalidated by the same write, though not by being erased:\n * `authenticateClientConfiguration` refuses a non-`ACTIVE` client before it ever compares a token,\n * so the token authenticates nowhere from this moment. \"If a client is deprovisioned from a server,\n * any outstanding registration access token for that client MUST be invalidated at the same time.\"\n * spec-cite: RFC 7592 §5. Keeping the digest on the row costs nothing and preserves the record of\n * which token the client held, which an operator investigating a deleted client wants.\n \n NOT DONE, and stated rather than implied: \"If possible, the authorization server SHOULD\n * immediately invalidate all existing authorization grants and currently active access tokens, all\n * refresh tokens, and all other tokens associated with this client.\" spec-cite: RFC 7592 §2.3.\n * Already-issued access tokens keep working until they expire. Reaching them means driving the\n * revocation machinery over every token minted for this client, which is a larger change than this\n * endpoint; the client cannot obtain NEW tokens the moment this returns, because the token endpoint\n * resolves the client and refuses it.\n /\n private async handleClientConfigurationDelete(req: Request, res: Response): Promise<void> {\n const authenticated = await this.authenticateClientConfiguration(req, res);\n if (!authenticated) return;\n const { clientId } = authenticated;\n\n const deprovisioned = await this.systemAccess.updateAsSystem<OAuthClientApplication>(\n CoreResourceType.OAUTH_CLIENTS_APPLICATION,\n clientId,\n { status: OAuthClientStatus.INACTIVE },\n );\n if (!deprovisioned) {\n this.sendClientConfigurationUnauthorized(res, 'unknown client');\n return;\n }\n\n res.set('Cache-Control', 'no-store');\n res.status(204).send();\n }\n\n private sendRegistrationError(res: Response, error: string, description: string): void {\n res.set('Cache-Control', 'no-store');\n res.status(400).json({ error, error_description: description });\n }\n\n /\n Per-source-IP registration budget.\n \n Fail-CLOSED on a store error, which is the opposite of how most rate limits behave here and is\n * deliberate: elsewhere a limiter outage degrades an authenticated feature, whereas this one is\n * the sole restraint on anonymous row creation. Refusing registrations during a Redis outage\n * costs a client one retry; failing open costs the database.\n /\n private async withinDynamicRegistrationRate(clientIp: string \| undefined, configuration: DynamicClientRegistrationConfig): Promise<boolean> {\n try {\n const key = `oauth-dynamic-registration:${clientIp ?? 'unknown'}`;\n const count = await this.redisService.incrementRateLimit(key, 3600);\n return count <= configuration.maxRegistrationsPerHourPerIp;\n } catch (error) {\n this.logger.warn('Dynamic-registration rate check failed; refusing (fail-closed)', {\n ...projectCaughtErrorLogFields(error),\n });\n return false;\n }\n }\n\n private async handleAuthorize(req: Request, res: Response): Promise<void> {\n const q = req.query as Record<string, string \| undefined>;\n\n // Single-valued params; a REPEATED query key (Express parses `?scope=a&scope=b` to `string[]`\n // despite the cast) is malformed. Reject cleanly (400) — otherwise `(q.scope).split(...)` throws\n // a 500 and a repeated `resource` reaches the RFC 8707 binding as an array.\n const malformedAuthorizeParam = this.firstMalformedParam(q, ['response_type', 'client_id', 'redirect_uri', 'code_challenge', 'code_challenge_method', 'scope', 'resource', 'state', 'nonce']);\n if (malformedAuthorizeParam) {\n this.sendOAuthError(res, 400, 'invalid_request', `the '${malformedAuthorizeParam}' parameter must be a single string value`);\n return;\n }\n\n if (q.response_type !== 'code') {\n this.sendOAuthError(res, 400, 'unsupported_response_type', 'only response_type=code is supported');\n return;\n }\n if (!q.client_id \|\| !q.redirect_uri) {\n this.sendOAuthError(res, 400, 'invalid_request', 'client_id and redirect_uri are required');\n return;\n }\n if (q.code_challenge_method !== 'S256' \|\| !isValidS256CodeChallenge(q.code_challenge)) {\n // RFC 7636 §4.2: require a well-formed S256 challenge (43 unreserved-base64url chars) at the entry —\n // not merely a present one — so a malformed/low-entropy challenge is rejected before a code is minted.\n this.sendOAuthError(res, 400, 'invalid_request', 'a PKCE S256 code_challenge is required');\n return;\n }\n\n const authenticated = await this.resolveAuthenticatedUser(req);\n if (!authenticated) {\n // The user must authenticate first. A browser-integrated frontend redirects to login here;\n // for an API caller we signal login_required. (Login + consent UI is the frontend follow-up.)\n this.sendOAuthError(res, 401, 'login_required', 'user authentication is required at the authorization endpoint');\n return;\n }\n const { userId, sessionId } = authenticated;\n\n const scope = (q.scope ?? '').split(/\\s+/).filter(Boolean);\n try {\n // S1 (interactive consent): a `requiresConsent` (third-party) client does NOT receive a code\n // straight away — the user must EXPLICITLY approve acting on their behalf. Return\n // `consent_required` + a single-use consent-request token (the frontend renders the consent\n // screen from this and POSTs the decision to `/oauth/authorize/decision`). A trusted /\n // first-party client (`requiresConsent` false — the default) proceeds straight to the code, so\n // machine + trusted flows are UNCHANGED. Server-owned gate: the client cannot suppress it.\n // `userId` is resolved + non-undefined by here (login_required returned above otherwise). Passed so\n // the consent resolver can apply the D4/B same-org gate (a cross-org user always sees consent).\n const consentPosture = await this.authCodeService.resolveAuthorizationClientConsent(q.client_id, q.redirect_uri, userId);\n const { requiresConsent, clientName } = consentPosture;\n // Persistent consent (Item 3, \"remember this app\"): a `requiresConsent` client whose user already\n // has a stored grant covering the requested scopes for this (client, resource) is NOT re-prompted —\n // it falls through to the code-issuance path below (returns `{redirect_to}`), exactly like a trusted\n // client. Scope matching is SUBSET; a request for any new scope re-prompts (see hasCoveringConsentGrant).\n const needsConsent = requiresConsent\n && !(await this.authCodeService.hasCoveringConsentGrant(userId, q.client_id, q.resource, scope));\n if (needsConsent) {\n const { consentToken } = await this.authCodeService.createConsentRequest({\n userId,\n clientId: q.client_id,\n redirectUri: q.redirect_uri,\n scope,\n codeChallenge: q.code_challenge,\n nonce: q.nonce,\n resource: q.resource,\n state: q.state,\n });\n res.set('Cache-Control', 'no-store');\n this.jsonSuccess(res, {\n consent_required: true,\n consent_token: consentToken,\n client: {\n id: q.client_id,\n name: clientName,\n /\n How this client's identity was established, and the two DISPLAY obligations that come\n * with a domain-only identity. All three are here because the specification makes them\n * requirements on the authorization server, and the consent screen cannot satisfy a\n * requirement it was never handed the data for:\n \n \"Authorization servers … MUST clearly display the redirect URI hostname during\n * authorization\" and \"SHOULD display additional warnings for `localhost`-only redirect\n * URIs\".\n * spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Document Security →\n * Localhost Redirect URI Risks\n \n `origin` lets the screen say WHICH trust story applies: a registered client was vetted\n * by someone in this application, a CIMD client proved only that it controls a domain.\n * Sent for both origins so the consent screen has one shape, not two.\n /\n origin: consentPosture.origin,\n redirect_uri_hostname: consentPosture.redirectUriHostname,\n loopback_only_redirects: consentPosture.warnsLoopbackOnlyRedirects,\n },\n scopes: scope,\n resource: q.resource ?? null,\n }, 200);\n return;\n }\n const { code } = await this.authCodeService.issueAuthorizationCode({\n userId,\n clientId: q.client_id,\n redirectUri: q.redirect_uri,\n scope,\n codeChallenge: q.code_challenge,\n codeChallengeMethod: 'S256',\n nonce: q.nonce,\n // RFC 8707 resource indicator — the agent (A2A / MCP) endpoint the client wants the token\n // for. Bound into the code here (authoritative), so the token endpoint mints an `aud`-confined\n // delegated token (B-S2). Absent ⇒ the token exchange fails closed with `invalid_target`.\n resource: q.resource,\n // revocation-C: bind the End-User's OP session to the code → id_token `sid`, so an RP logout\n // (end_session) terminates the exact Wildo login session this delegation was authorized from.\n sessionId,\n });\n // U-30 defense: build the redirect target defensively. `q.redirect_uri` already exact-matched a\n // registered URI (each constrained to a parseable absolute URL by `isSafeOAuthRedirectUri`), so this\n // cannot throw through the front door — but fail with a CLEAN OAuth error rather than a raw 500 if a\n // redirectUri was ever persisted bypassing that refine (a seed / createAsSystem / migration).\n let redirect: URL;\n try {\n redirect = new URL(q.redirect_uri);\n } catch {\n this.sendOAuthError(res, 400, 'invalid_request', 'the redirect_uri bound to this request is not a valid URL');\n return;\n }\n redirect.searchParams.set('code', code);\n if (q.state) redirect.searchParams.set('state', q.state);\n // Return the redirect target as JSON (NOT a 302), mirroring `/oauth/authorize/decision`: the caller\n // is the Bearer-authenticated consent SPA (an XHR), which auto-follows a 302 but cannot read a\n // cross-origin `Location` — so a 302 would neither deliver the code to the client nor forward the\n // user. The SPA does `window.location.assign(redirect_to)` to complete the OAuth redirect.\n this.sendAuthorizationRedirect(res, redirect);\n } catch (error) {\n if (isWildoBackendError(error)) {\n const ctx = (error as { context?: { oauthError?: string; detail?: string } }).context;\n if (ctx?.oauthError) {\n this.sendOAuthError(res, ctx.oauthError === 'invalid_client' ? 401 : 400, ctx.oauthError, ctx.detail);\n return;\n }\n }\n throw error;\n }\n }\n\n /\n `POST /oauth/authorize/decision` — the interactive-consent decision (S1). After `/oauth/authorize`\n * returned `consent_required` for a `requiresConsent` client, the user's approve/deny is POSTed here\n * with the single-use consent-request token. Bearer-authenticated (the same user who authorized).\n * - `decision=approve` → mint the authorization code from the stashed request → return\n * `{ redirect_to: <redirect_uri>?code=&state= }` (200 JSON).\n * - anything else → DENY → return `{ redirect_to: <redirect_uri>?error=access_denied&state= }`\n * (200 JSON, RFC 6749 §4.1.2.1). No code minted.\n \n Returns the redirect target as JSON (NOT an HTTP 302) because the caller is a Bearer-authenticated\n * BROWSER SPA (the interactive consent screen): an XHR carrying the required `Authorization` header\n * auto-follows a 302 and cannot read a cross-origin `Location`, so the SPA could neither read the\n * code nor forward the user. Instead the SPA does `window.location.assign(redirect_to)` to complete\n * the OAuth redirect to the third-party client. The request parameters come from the SERVER-STORED\n * consent token (not the POST body), so the decision cannot tamper with what the user approved.\n /\n private async handleConsentDecision(req: Request, res: Response): Promise<void> {\n const body = (req.body ?? {}) as Record<string, string \| undefined>;\n const malformed = this.firstMalformedParam(body, ['consent_token', 'decision', 'remember']);\n if (malformed) {\n this.sendOAuthError(res, 400, 'invalid_request', `the '${malformed}' parameter must be a single string value`);\n return;\n }\n const authenticated = await this.resolveAuthenticatedUser(req);\n if (!authenticated) {\n this.sendOAuthError(res, 401, 'login_required', 'user authentication is required to record a consent decision');\n return;\n }\n const { userId, sessionId } = authenticated;\n if (!body.consent_token \|\| !body.decision) {\n this.sendOAuthError(res, 400, 'invalid_request', 'consent_token and decision are required');\n return;\n }\n\n try {\n const request = await this.authCodeService.consumeConsentRequest(body.consent_token);\n // Bind the decision to the AUTHENTICATED user: the consent token's subject MUST be the caller,\n // so one user cannot approve/deny another user's pending consent (the token is single-use, so\n // this is already consumed — fail closed without minting anything).\n if (request.userId !== userId) {\n // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — a consent-token user-binding violation\n // (one user attempting to act on another user's pending consent) is a textbook cross-user\n // authorization-abuse signal. Fail closed (403) AND audit it (records BOTH principals — actor +\n // victim). The raw consent-token value is deliberately NOT logged (credential hygiene; it is\n // single-use and already consumed). Fire-and-forget — auditing must never affect the fail-closed 403.\n void this.auditLogs.logOAuthConsentBindingViolation({\n authenticatedUserId: userId,\n boundUserId: request.userId,\n clientId: request.clientId,\n ipAddress: getClientIpFromRequest(req),\n }).catch((auditError) => this.logger.warn('OAUTH_CONSENT_BINDING_VIOLATION audit emit failed (non-fatal)', {\n ...projectCaughtErrorLogFields(auditError),\n }));\n this.sendOAuthError(res, 403, 'access_denied', 'the consent request does not belong to the authenticated user');\n return;\n }\n // U-30 defense: the single-use consent token is ALREADY consumed above (its redirect_uri is only known\n // post-consume), so we cannot pre-validate — but a malformed stored redirect_uri must yield a CLEAN OAuth\n // error, not a raw 500 (the token is spent either way; do not also leak a stack trace). Normally\n // impossible — the stored value passed `isSafeOAuthRedirectUri` at authorize time.\n let redirect: URL;\n try {\n redirect = new URL(request.redirectUri);\n } catch {\n this.sendOAuthError(res, 400, 'invalid_request', 'the redirect_uri bound to this consent request is not a valid URL');\n return;\n }\n if (request.state) redirect.searchParams.set('state', request.state);\n res.set('Cache-Control', 'no-store');\n\n if (body.decision !== 'approve') {\n // DENY (or any non-approve value) — fail closed, no code minted.\n // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — user REFUSES third-party delegated access. The\n // binding check above passed, so the denying user IS `request.userId`. Fire-and-forget.\n void this.auditLogs.logOAuthConsentDenied({\n userId: request.userId,\n clientId: request.clientId,\n scopes: request.scope,\n resource: request.resource,\n ipAddress: getClientIpFromRequest(req),\n }).catch((auditError) => this.logger.warn('OAUTH_CONSENT_DENIED audit emit failed (non-fatal)', {\n ...projectCaughtErrorLogFields(auditError),\n }));\n redirect.searchParams.set('error', 'access_denied');\n // An ERROR response carries `iss` too — explicitly required, and the case that matters most:\n // a mix-up victim is likelier to be handed a failure than a success.\n this.sendAuthorizationRedirect(res, redirect);\n return;\n }\n\n const { code } = await this.authCodeService.issueAuthorizationCode({\n userId: request.userId,\n clientId: request.clientId,\n redirectUri: request.redirectUri,\n scope: request.scope,\n codeChallenge: request.codeChallenge,\n codeChallengeMethod: 'S256',\n nonce: request.nonce,\n resource: request.resource,\n // revocation-C: bind the session that COMPLETES the grant (the decision-time authenticated\n // session, verified `request.userId === userId` above) to the code → id_token `sid`. Using the\n // live decision-time session (not the stored authorize-time one) keeps `sid` pointing at a\n // session that is still alive to be terminated by a later RP end_session.\n sessionId,\n });\n // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — user APPROVES third-party delegated access (a\n // code is now issued and the client may act for them). `remembered` flags whether a durable grant was\n // also requested (the grant CREATION itself is audited separately as A-3 inside `upsertConsentGrant`).\n // Fire-and-forget — auditing must never affect the consent the user already gave.\n void this.auditLogs.logOAuthConsentGranted({\n userId: request.userId,\n clientId: request.clientId,\n scopes: request.scope,\n resource: request.resource,\n remembered: body.remember === 'true',\n ipAddress: getClientIpFromRequest(req),\n }).catch((auditError) => this.logger.warn('OAUTH_CONSENT_GRANTED audit emit failed (non-fatal)', {\n ...projectCaughtErrorLogFields(auditError),\n }));\n // Persistent consent (Item 3): if the user opted to remember this app, store/widen the grant so a\n // future authorize with covering scopes skips the prompt. Best-effort — a store failure must NOT\n // fail the consent the user already gave (the code is already minted).\n if (body.remember === 'true') {\n await this.authCodeService\n .upsertConsentGrant(request.userId, request.clientId, request.resource, request.scope)\n .catch((e) => this.logger.warn('Persistent consent grant store failed (non-fatal)', { ...projectCaughtErrorLogFields(e) }));\n }\n redirect.searchParams.set('code', code);\n this.sendAuthorizationRedirect(res, redirect);\n } catch (error) {\n if (isWildoBackendError(error)) {\n const ctx = (error as { context?: { oauthError?: string; detail?: string } }).context;\n if (ctx?.oauthError) {\n this.sendOAuthError(res, ctx.oauthError === 'invalid_client' ? 401 : 400, ctx.oauthError, ctx.detail);\n return;\n }\n }\n throw error;\n }\n }\n\n /\n `GET /oauth/userinfo` — returns the authenticated user's claims for a valid user Bearer token\n * (OIDC Core §5.3). Always returns `sub`; adds the standard `email`/`profile`-scope claims the\n * access token was granted, resolved via {@link OidcUserClaimsBackendService}. `picture` (avatar)\n * and `locale` claims are a documented follow-up.\n /\n private async handleUserInfo(req: Request, res: Response): Promise<void> {\n const authHeader = req.headers['authorization'];\n if (typeof authHeader !== 'string' \|\| !authHeader.startsWith('Bearer ')) {\n this.sendOAuthError(res, 401, 'invalid_token', 'a bearer access token is required', 'Bearer');\n return;\n }\n let claim: { type?: string; userId?: string; sub?: string; scope?: string[] };\n try {\n claim = (await this.jwtService.verify(authHeader.slice('Bearer '.length).trim())) as typeof claim;\n } catch {\n this.sendOAuthError(res, 401, 'invalid_token', 'access token invalid or expired', 'Bearer');\n return;\n }\n const sub = claim.userId ?? claim.sub;\n if (!sub \|\| claim.type !== ExecutionContext_ExecutionType.USER_REQUEST) {\n this.sendOAuthError(res, 403, 'insufficient_scope', 'userinfo requires a user access token', 'Bearer');\n return;\n }\n // OIDC Core §5.3.2: `sub` plus the standard claims the access token's granted identity scopes\n // (`email` / `profile`) permit. A token carrying no `scope` claim (e.g. a first-party session\n // token) yields just `sub`. The resolver reads the subject's own User/UserProfile and never\n // throws for a missing profile.\n const claims = await this.userClaimsService.resolveUserClaims(sub, claim.scope ?? []);\n res.set('Cache-Control', 'no-store');\n this.jsonSuccess(res, { sub, ...claims }, 200);\n }\n\n /\n Resolve the authenticated user (id + login `sessionId`) from a `Bearer` user access token, else\n * `undefined`. The `sessionId` (revocation-C) is threaded into the OIDC authorization code so the\n * id_token carries `sid` — the handle the RP-Initiated Logout endpoint terminates.\n /\n private async resolveAuthenticatedUser(req: Request): Promise<{ userId: string; sessionId?: string } \| undefined> {\n const authHeader = req.headers['authorization'];\n if (typeof authHeader !== 'string' \|\| !authHeader.startsWith('Bearer ')) return undefined;\n try {\n const claim = (await this.jwtService.verify(authHeader.slice('Bearer '.length).trim())) as { type?: string; userId?: string; sessionId?: string };\n if (claim.type !== ExecutionContext_ExecutionType.USER_REQUEST \|\| !claim.userId) return undefined;\n return { userId: claim.userId, sessionId: claim.sessionId };\n } catch {\n return undefined;\n }\n }\n\n /\n Resolve the client secret (+ optional client_id) from `client_secret_basic`\n * (Authorization: Basic base64(client_id:client_secret)) or `client_secret_post` (body).\n * Values are URL-safe in this system (`oc_` secrets + id), so no percent-decoding is needed.\n /\n private extractClientCredentials(req: Request, body: Record<string, string \| undefined>): { clientId?: string; clientSecret?: string } {\n const authHeader = req.headers['authorization'];\n if (typeof authHeader === 'string' && authHeader.startsWith('Basic ')) {\n const decoded = Buffer.from(authHeader.slice('Basic '.length).trim(), 'base64').toString('utf8');\n const sep = decoded.indexOf(':');\n if (sep >= 0) {\n return {\n clientId: decoded.slice(0, sep) \|\| undefined,\n clientSecret: decoded.slice(sep + 1) \|\| undefined,\n };\n }\n }\n return { clientId: body.client_id \|\| undefined, clientSecret: body.client_secret \|\| undefined };\n }\n\n /*\n OAuth/OIDC request params are single-valued STRINGS, but Express (`extended:true` urlencoded, plus\n * `express.json`) parses a REPEATED key into a `string[]` and a bracketed `k[$regex]=…` / JSON\n * `{\"k\":{…}}` key into an OBJECT — despite the `Record<string,string\|undefined>` cast at the handler\n * boundary. Returns the first `keys` entry that arrived as a NON-STRING (array, object, number, …), or\n * `undefined`.\n \n The caller rejects with `invalid_request` (400) so a non-string can never reach a `.split`/`.includes`\n * (500), slip silently through the RFC 8707 audience comparison, OR — critically — reach a RAW Mongo\n * filter as a `{$regex}` / `{$ne}` operator object. That last case is a NoSQL-operator-injection sink:\n * an object `code`/`token` flows to the consumable-token store's `findOne({ token })` and would\n * consume an arbitrary matching token (password-reset / invitation / magic-link); an object\n * `client_id` selects an arbitrary client. Rejecting EVERY non-string closes both the repeated-param\n * (array) and the injection (object) classes with one guard — an array is simply one kind of non-string.\n */\n private firstMalformedParam(source: Record<string, unknown>, keys: string[]): string \| undefined {\n return keys.find((k) => source[k] !== undefined && typeof source[k] !== 'string');\n }\n\n private sendOAuthError(res: Response, status: number, error: string, description?: string, wwwAuthenticate?: 'Basic' \| 'Bearer'): void {\n res.set('Cache-Control', 'no-store');\n // Token endpoint 401s challenge `Basic` (client auth); userinfo challenges `Bearer`. Other\n // 401s (e.g. authorize login_required) send no challenge.\n const scheme = wwwAuthenticate ?? (status === 401 ? 'Basic' : undefined);\n if (scheme) res.set('WWW-Authenticate', scheme);\n res.status(status).json({ error, ...(description ? { error_description: description } : {}) });\n }\n}\n"]}