npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.3 → 1.1.4 - Mend

@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1056) hide show

package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"webauthn.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/webauthn.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,gBAAgB,EAAE,MAAM,6DAA6D,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AACjJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAGL,SAAS,EACT,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,qBAAqB,GAAG,GAAG,CAAC,CAAC,YAAY;AAC/C,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AAC3D,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AAC7D;;;GAGG;AACH,MAAM,4BAA4B,GAAG,4BAA4B,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAN,IAAY,6BAGX;AAHD,WAAY,6BAA6B;IACvC,gDAAe,CAAA;IACf,oDAAmB,CAAA;AACrB,CAAC,EAHW,6BAA6B,KAA7B,6BAA6B,QAGxC;AAwBD;;;;;;;;;;;;GAYG;AAGI,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAIqB;IACU;IACJ;IACY;IACL;IAPlD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACX,gBAAyC,EAC7C,YAA0B,EACd,aAA8C,EACnD,YAAwC;QAJrD,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QAC7C,iBAAY,GAAZ,YAAY,CAAc;QACd,kBAAa,GAAb,aAAa,CAAiC;QACnD,iBAAY,GAAZ,YAAY,CAA4B;QAEzG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,gEAAgE;IAEhE,IAAY,IAAI;QACd,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;IAC9D,CAAC;IAED,IAAY,MAAM;QAChB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;IAChE,CAAC;IAED,IAAY,UAAU;QACpB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACH,IAAY,eAAe;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACjE,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACjD,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACH,KAAK,CAAC,2BAA2B,CAC/B,EAAyB,EACzB,MAAc,EACd,KAAa;QAEb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAE/E,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB,IAAI,EAAE,CAAC;QAChG,IAAI,mBAAmB,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,WAAW,mBAAmB,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,KAAK;YACf,eAAe,EAAE,KAAK;YACtB,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;YACxC,wEAAwE;YACxE,0EAA0E;YAC1E,eAAe,EAAE,GAAG,CAAC,WAA+C;YACpE,OAAO,EAAE,GAAG,CAAC,cAAc,GAAG,IAAI;YAClC,sBAAsB,EAAE;gBACtB,uBAAuB,EAAE,GAAG,CAAC,uBAAuB,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB;gBACxG,WAAW,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW;gBAC9D,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;aACvC;YACD,kBAAkB,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClD,EAAE,EAAE,CAAC,CAAC,YAAY;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAsC;aACrD,CAAC,CAAC;SACJ,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,eAAe,CAAC,wBAAwB,GAAG,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC;QAEtG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,0BAA0B,CAC9B,EAAyB,EACzB,MAAc,EACd,QAAkC,EAClC,cAAuB;QAEvB,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,wBAAwB,GAAG,MAAM,CAAC,CAAC;QAC/F,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,MAAM,EAAE,sDAAsD,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC;YACpD,QAAQ;YACR,iBAAiB;YACjB,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,uBAAuB,EAAE,IAAI,CAAC,UAAU,CAAC,gBAAgB,KAAK,UAAU;SACzE,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,MAAM,EAAE,2CAA2C,EAAE;aACjE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAC,gBAAgB,CAAC;QAE/F,MAAM,aAAa,GAA2B;YAC5C,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAClE,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,UAAU,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAa;YACrD,oBAAoB,EAAE,oBAAoB,IAAI,cAAc;YAC5D,kBAAkB,EAAE,kBAAkB,IAAI,KAAK;YAC/C,IAAI,EAAE,cAAc,IAAI,SAAS;YACjC,MAAM,EAAE,YAAY,CAAC,gBAAgB,CAAC,MAAM;YAC5C,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,UAAU,EAAE,SAAS;SACtB,CAAC;QAEF,kCAAkC;QAClC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,kBAAkB,GAAG,CAAC,GAAG,mBAAmB,EAAE,aAAa,CAAC,CAAC;QAEnE,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,CAAC,YAAY,EAAE,CAAC,CAAC;QAC1F,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACH,KAAK,CAAC,6BAA6B,CACjC,EAAyB,EACzB,MAAc,EACd,WAA0C,6BAA6B,CAAC,KAAK;QAE7E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAE/E,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,MAAM,EAAE,iDAAiD,EAAE;aACvE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAClD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC;YACrD,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI;YAC9C,gBAAgB,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChD,EAAE,EAAE,CAAC,CAAC,YAAY;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAsC;aACrD,CAAC,CAAC;SACJ,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACvF,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC;QAErH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,4BAA4B,CAChC,EAAyB,EACzB,MAAc,EACd,QAAoC,EACpC,WAA0C,6BAA6B,CAAC,KAAK;QAE7E,gGAAgG;QAChG,iEAAiE;QACjE,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC;QAE1F,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;gBACvE,MAAM;gBACN,YAAY,EAAE,QAAQ,CAAC,EAAE;aAC1B,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;YACtD,QAAQ;YACR,iBAAiB;YACjB,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,4FAA4F;YAC5F,wFAAwF;YACxF,uBAAuB,EAAE,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,gBAAgB,CAAC,QAAQ;YAC1F,UAAU,EAAE;gBACV,EAAE,EAAE,iBAAiB,CAAC,YAAY;gBAClC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,WAAW,CAAC;gBAChE;;;;;;;;;;;;;;;;;;;;mBAoBG;gBACH,OAAO,EAAE,CAAC;gBACV,UAAU,EAAE,iBAAiB,CAAC,UAAsC;aACrE;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxD,CAAC;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;WA2BG;QACH,MAAM,UAAU,GAAG,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC;QAC9D,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,iBAAiB,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,UAAU,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;YACjG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+EAA+E,EAAE;gBAChG,MAAM;gBACN,YAAY,EAAE,iBAAiB,CAAC,YAAY;gBAC5C,aAAa,EAAE,iBAAiB,CAAC,OAAO;gBACxC,eAAe,EAAE,UAAU;aAC5B,CAAC,CAAC;YACH,6FAA6F;YAC7F,4CAA4C;YAC5C,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,YAAY,EAAE,iBAAiB,CAAC,YAAY;gBAC5C,cAAc,EAAE;oBACd,YAAY,EAAE,iBAAiB,CAAC,YAAY;oBAC5C,aAAa,EAAE,iBAAiB,CAAC,OAAO;oBACxC,eAAe,EAAE,UAAU;oBAC3B,oFAAoF;oBACpF,oFAAoF;oBACpF,6EAA6E;oBAC7E,oBAAoB,EAAE,iBAAiB,CAAC,oBAAoB;oBAC5D,kBAAkB,EAAE,iBAAiB,CAAC,kBAAkB;oBACxD,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzE,QAAQ;iBACT;aACF,CAAC;QACJ,CAAC;QAED,gCAAgC;QAChC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,CAAC,CAAC,YAAY,KAAK,iBAAiB,CAAC,YAAY;YAC/C,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE;YACvD,CAAC,CAAC,CAAC,CACN,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,CAAC,YAAY,EAAE,CAAC,CAAC;QAC3G,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,iBAAiB,CAAC,YAAY,EAAE,CAAC;IAC1E,CAAC;IAED,gEAAgE;IAEhE;;;;;;;;OAQG;IACH,KAAK,CAAC,cAAc,CAAC,EAAyB,EAAE,MAAc;QAC5D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,OAAQ,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,EAAyB,EAAE,MAAc,EAAE,YAAoB;QACpF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;QAE9F,IAAI,kBAAkB,CAAC,MAAM,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,YAAY,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,EAAyB,EAAE,MAAc,EAAE,YAAoB,EAAE,OAAe;QACrG,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;QAE/E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,YAAY,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAC9D,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACK,gBAAgB,CAAC,QAAuC,EAAE,MAAc;QAC9E,MAAM,MAAM,GAAG,QAAQ,KAAK,6BAA6B,CAAC,OAAO;YAC/D,CAAC,CAAC,4BAA4B;YAC9B,CAAC,CAAC,yBAAyB,CAAC;QAC9B,OAAO,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IAED;;;;;;;;OAQG;IACK,oBAAoB,CAAC,QAAuC;QAClE,OAAO,QAAQ,KAAK,6BAA6B,CAAC,OAAO;YACvD,CAAC,CAAC,gBAAgB,CAAC,QAAQ;YAC3B,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,GAAW,EAAE,SAAiB;QAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,sBAAsB,CAAC,GAAW;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAS,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACK,KAAK,CAAC,wBAAwB,CACpC,EAAyB,EACzB,MAAc;QAId,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,MAAM,EAAE;aAC1D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;CACF,CAAA;AApcY,sBAAsB;IAFlC,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,WAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCAJa,aAAa;QACO,uBAAuB;QAC/B,YAAY;QACC,+BAA+B;QACrC,0BAA0B;GARhG,sBAAsB,CAoclC","sourcesContent":["import 'reflect-metadata';\nimport { inject, injectable } from 'inversify';\nimport {\n generateRegistrationOptions,\n verifyRegistrationResponse,\n generateAuthenticationOptions,\n verifyAuthenticationResponse,\n} from '@simplewebauthn/server';\nimport type {\n PublicKeyCredentialCreationOptionsJSON,\n PublicKeyCredentialRequestOptionsJSON,\n RegistrationResponseJSON,\n AuthenticationResponseJSON,\n} from '@simplewebauthn/server';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { UserVerification } from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { AuthCredentialOpsBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-credential-ops.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport {\n UserCredentials,\n PasskeyCredentialEntry,\n ErrorType,\n ErrorCustomMessageReference,\n} from '@wildo-ai/saas-models';\n\nconst CHALLENGE_TTL_SECONDS = 300; // 5 minutes\nconst CHALLENGE_KEY_PREFIX_REG = 'webauthn_challenge:reg:';\nconst CHALLENGE_KEY_PREFIX_AUTH = 'webauthn_challenge:auth:';\n/*\n SEPARATE from the login prefix on purpose — see {@link PasskeyAuthenticationCeremony}. Sharing one\n * key would let an assertion the user produced for LOGIN be redeemed at the step-up door.\n /\nconst CHALLENGE_KEY_PREFIX_STEP_UP = 'webauthn_challenge:stepup:';\n\n/\n Which ceremony a passkey assertion belongs to.\n \n The two differ in the QUESTION they answer, and therefore in what they must demand:\n \n - LOGIN asks \"which principal is this?\". The passkey IS the factor, so possession of the\n * authenticator is the claim, and the app's `passkeyOperational.userVerification` policy decides\n * whether a PIN/biometric is also required.\n * - STEP_UP asks \"is the human still here, right now, and do they intend this irreversible\n * thing?\". Possession alone cannot answer that — a resident credential on an already-unlocked\n * machine would satisfy it with no human intent — so this ceremony pins user verification to\n * REQUIRED regardless of the app policy. Under the common `preferred` setting a login assertion\n * may legitimately carry no UV, and accepting one here would make the strongest-LOOKING factor the\n * weakest door onto the operations `requiresStepUpAuthentication` guards.\n \n They also use SEPARATE challenge keys, which is the load-bearing half. Both challenges are\n * single-use (atomic get-and-delete), but single-use alone does not say WHICH door a signed\n * assertion may open: with a shared key, an assertion the user produced for a login could be\n * replayed to `/auth/reauth` and minted into a step-up token. Distinct keys make a login challenge\n * structurally unredeemable at the step-up door and vice versa.\n \n assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — a re-proof ceremony must not be\n * satisfiable by a credential presented for a different purpose.\n /\nexport enum PasskeyAuthenticationCeremony {\n LOGIN = 'login',\n STEP_UP = 'step_up',\n}\n\n/\n What a passkey assertion verification answers.\n \n `cloneSuspicion` is present ONLY when the assertion's signature verified and its counter did not\n * advance — the W3C cloned-authenticator signal. It is returned rather than audited here because\n * this service deliberately emits no audit rows (see the class header): the caller holds the\n * request's device information and is where the trail is written.\n /\nexport interface PasskeyAuthenticationVerificationResult {\n verified: boolean;\n credentialId: string;\n cloneSuspicion?: {\n credentialId: string;\n storedCounter: number;\n receivedCounter: number;\n credentialDeviceType: string;\n credentialBackedUp: boolean;\n aaguid?: string;\n ceremony: PasskeyAuthenticationCeremony;\n };\n}\n\n/\n WebAuthnBackendService\n \n Encapsulates all WebAuthn/FIDO2 ceremony logic using @simplewebauthn/server.\n * Handles option generation, response verification, challenge management (Redis),\n * and credential CRUD on user credential documents.\n \n This service does NOT:\n * - Manage sessions (AuthSessionStore)\n * - Issue tokens (AuthTokenIssuer)\n * - Audit log (orchestrator/controller responsibility)\n * - Know about the authentication flow (orchestrator's job)\n /\n@injectable()\n\nexport class WebAuthnBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,\n @inject(SAAS_SERVICE_TYPES.AuthCredentialOpsService) private readonly credentialOps: AuthCredentialOpsBackendService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n ) {\n this.logDebug = this.logger.debugByType('WebAuthn');\n this.logger.setDebugTypeLogging('WebAuthn', false);\n }\n\n // ─── Configuration ───────────────────────────────────────────\n\n private get rpId(): string {\n return this.appConfigService.config.auth.passkeyConfig.rpId;\n }\n\n private get rpName(): string {\n return this.appConfigService.config.auth.passkeyConfig.rpName;\n }\n\n private get passkeyOps() {\n return this.appConfigService.config.auth.passkeyOperational;\n }\n\n /\n Derive the expected origin(s) from the app config's runtime endpoints.\n * Returns all configured publicUrl values as valid origins.\n /\n private get expectedOrigins(): string[] {\n const endPoints = this.appConfigService.config.runtime.endPoints;\n const origins: string[] = [];\n for (const [, urls] of Object.entries(endPoints)) {\n if (urls?.publicUrl) {\n origins.push(urls.publicUrl.replace(/\\/$/, ''));\n }\n }\n if (origins.length === 0) {\n origins.push(`https://${this.rpId}`);\n }\n return origins;\n }\n\n // ─── Registration ────────────────────────────────────────────\n\n /\n Generate WebAuthn registration options for a user.\n * The caller is responsible for ensuring the user is authenticated.\n /\n async generateRegistrationOptions(\n ec: ExecutionContext<any>,\n userId: string,\n email: string,\n ): Promise<PublicKeyCredentialCreationOptionsJSON> {\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n\n const maxPasskeys = this.appConfigService.config?.auth?.passkeyConfig?.maxPasskeysPerUser ?? 10;\n if (existingCredentials.length >= maxPasskeys) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: `Maximum of ${maxPasskeys} passkeys reached` },\n });\n }\n\n const ops = this.passkeyOps;\n const options = await generateRegistrationOptions({\n rpName: this.rpName,\n rpID: this.rpId,\n userName: email,\n userDisplayName: email,\n userID: new TextEncoder().encode(userId),\n // Cast: @simplewebauthn narrows to 'direct'\|'enterprise'\|'none' but W3C\n // AttestationConveyancePreference includes 'indirect' — valid at runtime.\n attestationType: ops.attestation as 'direct' \| 'enterprise' \| 'none',\n timeout: ops.timeoutSeconds 1000,\n authenticatorSelection: {\n authenticatorAttachment: ops.authenticatorAttachment === 'any' ? undefined : ops.authenticatorAttachment,\n residentKey: ops.requireResidentKey ? 'required' : 'preferred',\n userVerification: ops.userVerification,\n },\n excludeCredentials: existingCredentials.map((c) => ({\n id: c.credentialId,\n transports: c.transports as AuthenticatorTransport[],\n })),\n });\n\n await this._storeChallenge(CHALLENGE_KEY_PREFIX_REG + userId, options.challenge);\n this.logDebug('Registration options generated', { userId, excludeCount: existingCredentials.length });\n\n return options;\n }\n\n /*\n Verify a WebAuthn registration response and store the new credential.\n * Returns the new credential entry on success.\n /\n async verifyRegistrationResponse(\n ec: ExecutionContext<any>,\n userId: string,\n response: RegistrationResponseJSON,\n credentialName?: string,\n ): Promise<PasskeyCredentialEntry> {\n const expectedChallenge = await this._getAndDeleteChallenge(CHALLENGE_KEY_PREFIX_REG + userId);\n if (!expectedChallenge) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,\n context: { reason: 'WebAuthn registration challenge expired or not found' },\n });\n }\n\n const verification = await verifyRegistrationResponse({\n response,\n expectedChallenge,\n expectedOrigin: this.expectedOrigins,\n expectedRPID: this.rpId,\n requireUserVerification: this.passkeyOps.userVerification === 'required',\n });\n\n if (!verification.verified \|\| !verification.registrationInfo) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,\n context: { reason: 'WebAuthn registration verification failed' },\n });\n }\n\n const { credential, credentialDeviceType, credentialBackedUp } = verification.registrationInfo;\n\n const newCredential: PasskeyCredentialEntry = {\n credentialId: credential.id,\n publicKey: Buffer.from(credential.publicKey).toString('base64url'),\n counter: credential.counter,\n transports: (credential.transports ?? []) as string[],\n credentialDeviceType: credentialDeviceType ?? 'singleDevice',\n credentialBackedUp: credentialBackedUp ?? false,\n name: credentialName ?? 'Passkey',\n aaguid: verification.registrationInfo.aaguid,\n createdAt: new Date(),\n lastUsedAt: undefined,\n };\n\n // Append to the credential record\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n const updatedCredentials = [...existingCredentials, newCredential];\n\n await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n this.logDebug('Passkey registered', { userId, credentialId: newCredential.credentialId });\n return newCredential;\n }\n\n // ─── Authentication ──────────────────────────────────────────\n\n /\n Generate WebAuthn authentication options for a user.\n * Populates allowCredentials from the user's stored passkeys.\n /\n async generateAuthenticationOptions(\n ec: ExecutionContext<any>,\n userId: string,\n ceremony: PasskeyAuthenticationCeremony = PasskeyAuthenticationCeremony.LOGIN,\n ): Promise<PublicKeyCredentialRequestOptionsJSON> {\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n\n if (existingCredentials.length === 0) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,\n context: { reason: 'No passkey credentials registered for this user' },\n });\n }\n\n const options = await generateAuthenticationOptions({\n rpID: this.rpId,\n userVerification: this._userVerificationFor(ceremony),\n timeout: this.passkeyOps.timeoutSeconds 1000,\n allowCredentials: existingCredentials.map((c) => ({\n id: c.credentialId,\n transports: c.transports as AuthenticatorTransport[],\n })),\n });\n\n await this._storeChallenge(this._challengeKeyFor(ceremony, userId), options.challenge);\n this.logDebug('Authentication options generated', { userId, ceremony, credentialCount: existingCredentials.length });\n\n return options;\n }\n\n /*\n Verify a WebAuthn authentication response.\n * Updates the credential counter and lastUsedAt on success.\n /\n async verifyAuthenticationResponse(\n ec: ExecutionContext<any>,\n userId: string,\n response: AuthenticationResponseJSON,\n ceremony: PasskeyAuthenticationCeremony = PasskeyAuthenticationCeremony.LOGIN,\n ): Promise<PasskeyAuthenticationVerificationResult> {\n // Reads ONLY this ceremony's challenge, so an assertion signed for the other door finds nothing\n // to match and is refused — see `PasskeyAuthenticationCeremony`.\n const expectedChallenge = await this._getAndDeleteChallenge(this._challengeKeyFor(ceremony, userId));\n if (!expectedChallenge) {\n return { verified: false, credentialId: response.id };\n }\n\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n const matchedCredential = existingCredentials.find((c) => c.credentialId === response.id);\n\n if (!matchedCredential) {\n this.logger.warn('WebAuthn authentication failed: credential not found', {\n userId,\n credentialId: response.id,\n });\n return { verified: false, credentialId: response.id };\n }\n\n const verification = await verifyAuthenticationResponse({\n response,\n expectedChallenge,\n expectedOrigin: this.expectedOrigins,\n expectedRPID: this.rpId,\n // STEP_UP pins this true even when the app policy is `preferred` — an assertion carrying no\n // user verification proves possession of the authenticator, not presence of the person.\n requireUserVerification: this._userVerificationFor(ceremony) === UserVerification.REQUIRED,\n credential: {\n id: matchedCredential.credentialId,\n publicKey: Buffer.from(matchedCredential.publicKey, 'base64url'),\n /\n * DELIBERATELY 0, NOT the stored counter — and this line is load-bearing, so read the\n * reason before \"fixing\" it.\n \n `@simplewebauthn/server` evaluates its own counter guard BEFORE `verifySignature`\n * (verifyAuthenticationResponse.js:144-151 in 13.3.x, then :154). Handing it the real\n * stored value therefore refuses a counter regression on an assertion whose signature was\n * never checked — so ANY caller who knows a credential id could trigger the refusal, and\n * an alert raised there would be forgeable by an unauthenticated party.\n \n W3C WebAuthn L3 puts the counter comparison at §7.2 step 22, AFTER signature\n * verification at step 21, precisely because a counter regression only means something\n * when the assertion is known to come from something holding the private key. Passing 0\n * makes the library's predicate unsatisfiable — `(counter > 0 \|\| 0 > 0) && counter <= 0`\n * is false for every input — so the library does what we want from it (verify the\n * signature) and the counter decision stays here, below, where it is ours and where it is\n * post-authentication.\n \n spec-cite: W3C Web Authentication Level 3 §7.2 steps 21-22\n * (https://www.w3.org/TR/webauthn-3/#sctn-verifying-assertion).\n /\n counter: 0,\n transports: matchedCredential.transports as AuthenticatorTransport[],\n },\n });\n\n if (!verification.verified) {\n return { verified: false, credentialId: response.id };\n }\n\n /\n * CLONE DETECTION — the spec's predicate, on a signature-verified assertion.\n \n \"If either is non-zero, and the new signCount value is less than or equal to the stored\n * value, a cloned authenticator may exist, or the authenticator may be malfunctioning, or a\n * race condition might exist\" — W3C WebAuthn L3 §6.1.1.\n \n EITHER non-zero, not just the received one. The previous check here read\n * `newCounter > 0 && newCounter <= stored`, which misses the case that matters most\n * operationally: a credential that previously counted and now reports 0. It was also dead\n * code — the library threw first — and it only warned.\n \n A credential whose counter is permanently 0 — which every SYNCED passkey is, because a set\n * of devices cannot maintain a coherent counter — compares 0-against-0, fails the first\n * disjunct, and authenticates normally. That is the whole passkey accommodation and it is why\n * refusing here is not hostile to passkeys.\n \n Refusal, not step-up, and not configurable: three of the four major server implementations\n * fail closed with no switch (SimpleWebAuthn, Duo py_webauthn, ASP.NET Core Identity) and the\n * fourth (Yubico) defaults to it. Nothing authoritative recommends escalating instead.\n \n Returned rather than thrown so BOTH callers take their existing `!verified` branch and\n * produce the same clean AUTHENTICATION refusal — the step-up path used to wrap a library\n * throw as a generic error while login refused cleanly.\n \n spec-cite: W3C Web Authentication Level 3 §6.1.1\n * (https://www.w3.org/TR/webauthn-3/#sctn-sign-counter).\n /\n const newCounter = verification.authenticationInfo.newCounter;\n if ((newCounter > 0 \|\| matchedCredential.counter > 0) && newCounter <= matchedCredential.counter) {\n this.logger.warn('WebAuthn signature counter did not advance on a verified assertion — refusing', {\n userId,\n credentialId: matchedCredential.credentialId,\n storedCounter: matchedCredential.counter,\n receivedCounter: newCounter,\n });\n // The stored counter is NOT advanced: a refused assertion must not move the baseline a later\n // legitimate assertion is compared against.\n return {\n verified: false,\n credentialId: matchedCredential.credentialId,\n cloneSuspicion: {\n credentialId: matchedCredential.credentialId,\n storedCounter: matchedCredential.counter,\n receivedCounter: newCounter,\n // Carried for TRIAGE only — nothing branches on them. A synced credential that once\n // reported a non-zero counter and then regresses is still a signal, so exempting by\n // device type would disable clone detection for the majority of credentials.\n credentialDeviceType: matchedCredential.credentialDeviceType,\n credentialBackedUp: matchedCredential.credentialBackedUp,\n ...(matchedCredential.aaguid ? { aaguid: matchedCredential.aaguid } : {}),\n ceremony,\n },\n };\n }\n\n // Update counter and lastUsedAt\n const updatedCredentials = existingCredentials.map((c) =>\n c.credentialId === matchedCredential.credentialId\n ? { ...c, counter: newCounter, lastUsedAt: new Date() }\n : c,\n );\n\n await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n this.logDebug('Passkey authentication verified', { userId, credentialId: matchedCredential.credentialId });\n return { verified: true, credentialId: matchedCredential.credentialId };\n }\n\n // ─── Credential CRUD ─────────────────────────────────────────\n\n /\n List all passkey credentials for a user, as STORED.\n \n This returns the whole `PasskeyCredentialEntry`, `publicKey` and `counter` included. It is not a\n * safe-field projection, and must not be handed to a caller as one: the projection that reaches a\n * client is built at the controller (`handlePasskeyList`), which selects the credential id, name,\n * timestamps and device flags and nothing else. A new consumer of this method owes its own\n * projection, or it will disclose the stored credential material.\n /\n async getCredentials(ec: ExecutionContext<any>, userId: string): Promise<PasskeyCredentialEntry[]> {\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n return (cred as UserCredentials).passkeyCredentials ?? [];\n }\n\n /\n Remove a passkey credential by its credential ID.\n /\n async removeCredential(ec: ExecutionContext<any>, userId: string, credentialId: string): Promise<void> {\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n const updatedCredentials = existingCredentials.filter((c) => c.credentialId !== credentialId);\n\n if (updatedCredentials.length === existingCredentials.length) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n context: { reason: 'Passkey credential not found', credentialId },\n });\n }\n\n await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n this.logDebug('Passkey removed', { userId, credentialId });\n }\n\n /\n Rename a passkey credential.\n /\n async renameCredential(ec: ExecutionContext<any>, userId: string, credentialId: string, newName: string): Promise<void> {\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n const found = existingCredentials.find((c) => c.credentialId === credentialId);\n\n if (!found) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n context: { reason: 'Passkey credential not found', credentialId },\n });\n }\n\n const updatedCredentials = existingCredentials.map((c) =>\n c.credentialId === credentialId ? { ...c, name: newName } : c,\n );\n\n await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n this.logDebug('Passkey renamed', { userId, credentialId, newName });\n }\n\n // ─── Challenge Management (Redis) ────────────────────────────\n\n /\n The Redis challenge key for a ceremony. Distinct per ceremony so a challenge issued for one door\n * cannot be redeemed at the other — see {@link PasskeyAuthenticationCeremony}.\n /\n private _challengeKeyFor(ceremony: PasskeyAuthenticationCeremony, userId: string): string {\n const prefix = ceremony === PasskeyAuthenticationCeremony.STEP_UP\n ? CHALLENGE_KEY_PREFIX_STEP_UP\n : CHALLENGE_KEY_PREFIX_AUTH;\n return prefix + userId;\n }\n\n /\n The user-verification requirement for a ceremony.\n \n STEP_UP is REQUIRED unconditionally; LOGIN follows the app's `passkeyOperational` policy. The\n * override deliberately does not read the policy at all: an application that lowers it to\n * `preferred` (the common setting) is making a decision about LOGIN ergonomics, and inheriting it\n * here would silently weaken the re-proof that guards irreversible operations. Same reasoning as\n * `requiresStepUpAuthentication` refusing to inherit the per-user-type freshness policy.\n /\n private _userVerificationFor(ceremony: PasskeyAuthenticationCeremony): UserVerification {\n return ceremony === PasskeyAuthenticationCeremony.STEP_UP\n ? UserVerification.REQUIRED\n : this.passkeyOps.userVerification;\n }\n\n private async _storeChallenge(key: string, challenge: string): Promise<void> {\n await this.redisService.set(key, challenge, { ttl: CHALLENGE_TTL_SECONDS });\n }\n\n /\n Atomically read-and-consume a stored challenge. Delegates to\n * `RedisService.getDel`, which applies the same tenant-key scoping and\n * `JSON.parse` deserialization as the `set()` used by `_storeChallenge` —\n * keeping the store/read serialization contract symmetric. (The prior\n * hand-rolled `eval` GETDEL skipped `JSON.parse`, so the challenge came\n * back wrapped in literal quotes and every verification failed.)\n /\n private async _getAndDeleteChallenge(key: string): Promise<string \| null> {\n return this.redisService.getDel<string>(key);\n }\n\n // ─── Internal Helpers ────────────────────────────────────────\n\n /\n Resolve the credential record for a user.\n * Returns the credential document (throws if not found).\n */\n private async _resolveCredentialRecord(\n ec: ExecutionContext<any>,\n userId: string,\n ): Promise<{\n cred: UserCredentials;\n }> {\n const cred = await this.credentialOps.readByUserId(ec, userId);\n if (!cred) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n context: { reason: 'User credentials not found', userId },\n });\n }\n return { cred };\n }\n}\n\ntype AuthenticatorTransport = 'ble' \| 'cable' \| 'hybrid' \| 'internal' \| 'nfc' \| 'smart-card' \| 'usb';\n"]}
1	+ {"version":3,"file":"webauthn.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/auth-methods/webauthn.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,gBAAgB,EAAE,MAAM,6DAA6D,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AACjJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAGL,SAAS,EACT,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,qBAAqB,GAAG,GAAG,CAAC,CAAC,YAAY;AAC/C,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AAC3D,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AAC7D;;;GAGG;AACH,MAAM,4BAA4B,GAAG,4BAA4B,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAN,IAAY,6BAGX;AAHD,WAAY,6BAA6B;IACvC,gDAAe,CAAA;IACf,oDAAmB,CAAA;AACrB,CAAC,EAHW,6BAA6B,KAA7B,6BAA6B,QAGxC;AAwBD;;;;;;;;;;;;GAYG;AAGI,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAIqB;IACU;IACJ;IACY;IACL;IAPlD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACX,gBAAyC,EAC7C,YAA0B,EACd,aAA8C,EACnD,YAAwC;QAJrD,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QAC7C,iBAAY,GAAZ,YAAY,CAAc;QACd,kBAAa,GAAb,aAAa,CAAiC;QACnD,iBAAY,GAAZ,YAAY,CAA4B;QAEzG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,gEAAgE;IAEhE,IAAY,IAAI;QACd,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;IAC9D,CAAC;IAED,IAAY,MAAM;QAChB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;IAChE,CAAC;IAED,IAAY,UAAU;QACpB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACH,IAAY,eAAe;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACjE,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACjD,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACH,KAAK,CAAC,2BAA2B,CAC/B,EAAyB,EACzB,MAAc,EACd,KAAa;QAEb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAE/E,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB,IAAI,EAAE,CAAC;QAChG,IAAI,mBAAmB,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,WAAW,mBAAmB,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,KAAK;YACf,eAAe,EAAE,KAAK;YACtB,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;YACxC,wEAAwE;YACxE,0EAA0E;YAC1E,eAAe,EAAE,GAAG,CAAC,WAA+C;YACpE,OAAO,EAAE,GAAG,CAAC,cAAc,GAAG,IAAI;YAClC,sBAAsB,EAAE;gBACtB,uBAAuB,EAAE,GAAG,CAAC,uBAAuB,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB;gBACxG,WAAW,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW;gBAC9D,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;aACvC;YACD,kBAAkB,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClD,EAAE,EAAE,CAAC,CAAC,YAAY;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAsC;aACrD,CAAC,CAAC;SACJ,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,eAAe,CAAC,wBAAwB,GAAG,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC;QAEtG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,0BAA0B,CAC9B,EAAyB,EACzB,MAAc,EACd,QAAkC,EAClC,cAAuB;QAEvB,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,wBAAwB,GAAG,MAAM,CAAC,CAAC;QAC/F,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,MAAM,EAAE,sDAAsD,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC;YACpD,QAAQ;YACR,iBAAiB;YACjB,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,uBAAuB,EAAE,IAAI,CAAC,UAAU,CAAC,gBAAgB,KAAK,UAAU;SACzE,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,MAAM,EAAE,2CAA2C,EAAE;aACjE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAC,gBAAgB,CAAC;QAE/F,MAAM,aAAa,GAA2B;YAC5C,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAClE,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,UAAU,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAa;YACrD,oBAAoB,EAAE,oBAAoB,IAAI,cAAc;YAC5D,kBAAkB,EAAE,kBAAkB,IAAI,KAAK;YAC/C,IAAI,EAAE,cAAc,IAAI,SAAS;YACjC,MAAM,EAAE,YAAY,CAAC,gBAAgB,CAAC,MAAM;YAC5C,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,UAAU,EAAE,SAAS;SACtB,CAAC;QAEF,kCAAkC;QAClC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,kBAAkB,GAAG,CAAC,GAAG,mBAAmB,EAAE,aAAa,CAAC,CAAC;QAEnE,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,CAAC,YAAY,EAAE,CAAC,CAAC;QAC1F,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACH,KAAK,CAAC,6BAA6B,CACjC,EAAyB,EACzB,MAAc,EACd,WAA0C,6BAA6B,CAAC,KAAK;QAE7E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAE/E,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,MAAM,EAAE,iDAAiD,EAAE;aACvE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAClD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC;YACrD,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI;YAC9C,gBAAgB,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChD,EAAE,EAAE,CAAC,CAAC,YAAY;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAsC;aACrD,CAAC,CAAC;SACJ,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACvF,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC;QAErH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,4BAA4B,CAChC,EAAyB,EACzB,MAAc,EACd,QAAoC,EACpC,WAA0C,6BAA6B,CAAC,KAAK;QAE7E,gGAAgG;QAChG,iEAAiE;QACjE,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC;QAE1F,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;gBACvE,MAAM;gBACN,YAAY,EAAE,QAAQ,CAAC,EAAE;aAC1B,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;YACtD,QAAQ;YACR,iBAAiB;YACjB,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,4FAA4F;YAC5F,wFAAwF;YACxF,uBAAuB,EAAE,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,gBAAgB,CAAC,QAAQ;YAC1F,UAAU,EAAE;gBACV,EAAE,EAAE,iBAAiB,CAAC,YAAY;gBAClC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,WAAW,CAAC;gBAChE;;;;;;;;;;;;;;;;;;;;mBAoBG;gBACH,OAAO,EAAE,CAAC;gBACV,UAAU,EAAE,iBAAiB,CAAC,UAAsC;aACrE;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxD,CAAC;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;WA2BG;QACH,MAAM,UAAU,GAAG,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC;QAC9D,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,iBAAiB,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,UAAU,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;YACjG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+EAA+E,EAAE;gBAChG,MAAM;gBACN,YAAY,EAAE,iBAAiB,CAAC,YAAY;gBAC5C,aAAa,EAAE,iBAAiB,CAAC,OAAO;gBACxC,eAAe,EAAE,UAAU;aAC5B,CAAC,CAAC;YACH,6FAA6F;YAC7F,4CAA4C;YAC5C,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,YAAY,EAAE,iBAAiB,CAAC,YAAY;gBAC5C,cAAc,EAAE;oBACd,YAAY,EAAE,iBAAiB,CAAC,YAAY;oBAC5C,aAAa,EAAE,iBAAiB,CAAC,OAAO;oBACxC,eAAe,EAAE,UAAU;oBAC3B,oFAAoF;oBACpF,oFAAoF;oBACpF,6EAA6E;oBAC7E,oBAAoB,EAAE,iBAAiB,CAAC,oBAAoB;oBAC5D,kBAAkB,EAAE,iBAAiB,CAAC,kBAAkB;oBACxD,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzE,QAAQ;iBACT;aACF,CAAC;QACJ,CAAC;QAED,gCAAgC;QAChC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,CAAC,CAAC,YAAY,KAAK,iBAAiB,CAAC,YAAY;YAC/C,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE;YACvD,CAAC,CAAC,CAAC,CACN,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,CAAC,YAAY,EAAE,CAAC,CAAC;QAC3G,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,iBAAiB,CAAC,YAAY,EAAE,CAAC;IAC1E,CAAC;IAED,gEAAgE;IAEhE;;;;;;;;OAQG;IACH,KAAK,CAAC,cAAc,CAAC,EAAyB,EAAE,MAAc;QAC5D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,OAAQ,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,EAAyB,EAAE,MAAc,EAAE,YAAoB;QACpF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;QAE9F,IAAI,kBAAkB,CAAC,MAAM,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,YAAY,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,EAAyB,EAAE,MAAc,EAAE,YAAoB,EAAE,OAAe;QACrG,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;QAE/E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,YAAY,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAC9D,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACK,gBAAgB,CAAC,QAAuC,EAAE,MAAc;QAC9E,MAAM,MAAM,GAAG,QAAQ,KAAK,6BAA6B,CAAC,OAAO;YAC/D,CAAC,CAAC,4BAA4B;YAC9B,CAAC,CAAC,yBAAyB,CAAC;QAC9B,OAAO,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IAED;;;;;;;;OAQG;IACK,oBAAoB,CAAC,QAAuC;QAClE,OAAO,QAAQ,KAAK,6BAA6B,CAAC,OAAO;YACvD,CAAC,CAAC,gBAAgB,CAAC,QAAQ;YAC3B,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,GAAW,EAAE,SAAiB;QAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,sBAAsB,CAAC,GAAW;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAS,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACK,KAAK,CAAC,wBAAwB,CACpC,EAAyB,EACzB,MAAc;QAId,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,MAAM,EAAE;aAC1D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;CACF,CAAA;AApcY,sBAAsB;IAFlC,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,WAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCAJa,aAAa;QACO,uBAAuB;QAC/B,YAAY;QACC,+BAA+B;QACrC,0BAA0B;GARhG,sBAAsB,CAoclC","sourcesContent":["import 'reflect-metadata';\nimport { inject, injectable } from 'inversify';\nimport {\n generateRegistrationOptions,\n verifyRegistrationResponse,\n generateAuthenticationOptions,\n verifyAuthenticationResponse,\n} from '@simplewebauthn/server';\nimport type {\n PublicKeyCredentialCreationOptionsJSON,\n PublicKeyCredentialRequestOptionsJSON,\n RegistrationResponseJSON,\n AuthenticationResponseJSON,\n} from '@simplewebauthn/server';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { UserVerification } from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { AuthCredentialOpsBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-credential-ops.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport {\n UserCredentials,\n PasskeyCredentialEntry,\n ErrorType,\n ErrorCustomMessageReference,\n} from '@wildo-ai/saas-models';\n\nconst CHALLENGE_TTL_SECONDS = 300; // 5 minutes\nconst CHALLENGE_KEY_PREFIX_REG = 'webauthn_challenge:reg:';\nconst CHALLENGE_KEY_PREFIX_AUTH = 'webauthn_challenge:auth:';\n/*\n SEPARATE from the login prefix on purpose — see {@link PasskeyAuthenticationCeremony}. Sharing one\n * key would let an assertion the user produced for LOGIN be redeemed at the step-up door.\n /\nconst CHALLENGE_KEY_PREFIX_STEP_UP = 'webauthn_challenge:stepup:';\n\n/\n Which ceremony a passkey assertion belongs to.\n \n The two differ in the QUESTION they answer, and therefore in what they must demand:\n \n - LOGIN asks \"which principal is this?\". The passkey IS the factor, so possession of the\n * authenticator is the claim, and the app's `passkeyOperational.userVerification` policy decides\n * whether a PIN/biometric is also required.\n * - STEP_UP asks \"is the human still here, right now, and do they intend this irreversible\n * thing?\". Possession alone cannot answer that — a resident credential on an already-unlocked\n * machine would satisfy it with no human intent — so this ceremony pins user verification to\n * REQUIRED regardless of the app policy. Under the common `preferred` setting a login assertion\n * may legitimately carry no UV, and accepting one here would make the strongest-LOOKING factor the\n * weakest door onto the operations `requiresStepUpAuthentication` guards.\n \n They also use SEPARATE challenge keys, which is the load-bearing half. Both challenges are\n * single-use (atomic get-and-delete), but single-use alone does not say WHICH door a signed\n * assertion may open: with a shared key, an assertion the user produced for a login could be\n * replayed to `/auth/reauth` and minted into a step-up token. Distinct keys make a login challenge\n * structurally unredeemable at the step-up door and vice versa.\n \n assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — a re-proof ceremony must not be\n * satisfiable by a credential presented for a different purpose.\n /\nexport enum PasskeyAuthenticationCeremony {\n LOGIN = 'login',\n STEP_UP = 'step_up',\n}\n\n/\n What a passkey assertion verification answers.\n \n `cloneSuspicion` is present ONLY when the assertion's signature verified and its counter did not\n * advance — the W3C cloned-authenticator signal. It is returned rather than audited here because\n * this service deliberately emits no audit rows (see the class header): the caller holds the\n * request's device information and is where the trail is written.\n /\nexport interface PasskeyAuthenticationVerificationResult {\n verified: boolean;\n credentialId: string;\n cloneSuspicion?: {\n credentialId: string;\n storedCounter: number;\n receivedCounter: number;\n credentialDeviceType: string;\n credentialBackedUp: boolean;\n aaguid?: string;\n ceremony: PasskeyAuthenticationCeremony;\n };\n}\n\n/\n WebAuthnBackendService\n \n Encapsulates all WebAuthn/FIDO2 ceremony logic using @simplewebauthn/server.\n * Handles option generation, response verification, challenge management (Redis),\n * and credential CRUD on user credential documents.\n \n This service does NOT:\n * - Manage sessions (AuthSessionStore)\n * - Issue tokens (AuthTokenIssuer)\n * - Audit log (orchestrator/controller responsibility)\n * - Know about the authentication flow (orchestrator's job)\n /\n@injectable()\n\nexport class WebAuthnBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,\n @inject(SAAS_SERVICE_TYPES.AuthCredentialOpsService) private readonly credentialOps: AuthCredentialOpsBackendService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n ) {\n this.logDebug = this.logger.debugByType('WebAuthn');\n this.logger.setDebugTypeLogging('WebAuthn', false);\n }\n\n // ─── Configuration ───────────────────────────────────────────\n\n private get rpId(): string {\n return this.appConfigService.config.auth.passkeyConfig.rpId;\n }\n\n private get rpName(): string {\n return this.appConfigService.config.auth.passkeyConfig.rpName;\n }\n\n private get passkeyOps() {\n return this.appConfigService.config.auth.passkeyOperational;\n }\n\n /\n Derive the expected origin(s) from the app config's runtime endpoints.\n * Returns all configured publicUrl values as valid origins.\n /\n private get expectedOrigins(): string[] {\n const endPoints = this.appConfigService.config.runtime.endPoints;\n const origins: string[] = [];\n for (const [, urls] of Object.entries(endPoints)) {\n if (urls?.publicUrl) {\n origins.push(urls.publicUrl.replace(/\\/$/, ''));\n }\n }\n if (origins.length === 0) {\n origins.push(`https://${this.rpId}`);\n }\n return origins;\n }\n\n // ─── Registration ────────────────────────────────────────────\n\n /\n Generate WebAuthn registration options for a user.\n * The caller is responsible for ensuring the user is authenticated.\n /\n async generateRegistrationOptions(\n ec: ExecutionContext<any>,\n userId: string,\n email: string,\n ): Promise<PublicKeyCredentialCreationOptionsJSON> {\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n\n const maxPasskeys = this.appConfigService.config?.auth?.passkeyConfig?.maxPasskeysPerUser ?? 10;\n if (existingCredentials.length >= maxPasskeys) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: `Maximum of ${maxPasskeys} passkeys reached` },\n });\n }\n\n const ops = this.passkeyOps;\n const options = await generateRegistrationOptions({\n rpName: this.rpName,\n rpID: this.rpId,\n userName: email,\n userDisplayName: email,\n userID: new TextEncoder().encode(userId),\n // Cast: @simplewebauthn narrows to 'direct'\|'enterprise'\|'none' but W3C\n // AttestationConveyancePreference includes 'indirect' — valid at runtime.\n attestationType: ops.attestation as 'direct' \| 'enterprise' \| 'none',\n timeout: ops.timeoutSeconds 1000,\n authenticatorSelection: {\n authenticatorAttachment: ops.authenticatorAttachment === 'any' ? undefined : ops.authenticatorAttachment,\n residentKey: ops.requireResidentKey ? 'required' : 'preferred',\n userVerification: ops.userVerification,\n },\n excludeCredentials: existingCredentials.map((c) => ({\n id: c.credentialId,\n transports: c.transports as AuthenticatorTransport[],\n })),\n });\n\n await this._storeChallenge(CHALLENGE_KEY_PREFIX_REG + userId, options.challenge);\n this.logDebug('Registration options generated', { userId, excludeCount: existingCredentials.length });\n\n return options;\n }\n\n /*\n Verify a WebAuthn registration response and store the new credential.\n * Returns the new credential entry on success.\n /\n async verifyRegistrationResponse(\n ec: ExecutionContext<any>,\n userId: string,\n response: RegistrationResponseJSON,\n credentialName?: string,\n ): Promise<PasskeyCredentialEntry> {\n const expectedChallenge = await this._getAndDeleteChallenge(CHALLENGE_KEY_PREFIX_REG + userId);\n if (!expectedChallenge) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,\n context: { reason: 'WebAuthn registration challenge expired or not found' },\n });\n }\n\n const verification = await verifyRegistrationResponse({\n response,\n expectedChallenge,\n expectedOrigin: this.expectedOrigins,\n expectedRPID: this.rpId,\n requireUserVerification: this.passkeyOps.userVerification === 'required',\n });\n\n if (!verification.verified \|\| !verification.registrationInfo) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,\n context: { reason: 'WebAuthn registration verification failed' },\n });\n }\n\n const { credential, credentialDeviceType, credentialBackedUp } = verification.registrationInfo;\n\n const newCredential: PasskeyCredentialEntry = {\n credentialId: credential.id,\n publicKey: Buffer.from(credential.publicKey).toString('base64url'),\n counter: credential.counter,\n transports: (credential.transports ?? []) as string[],\n credentialDeviceType: credentialDeviceType ?? 'singleDevice',\n credentialBackedUp: credentialBackedUp ?? false,\n name: credentialName ?? 'Passkey',\n aaguid: verification.registrationInfo.aaguid,\n createdAt: new Date(),\n lastUsedAt: undefined,\n };\n\n // Append to the credential record\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n const updatedCredentials = [...existingCredentials, newCredential];\n\n await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n this.logDebug('Passkey registered', { userId, credentialId: newCredential.credentialId });\n return newCredential;\n }\n\n // ─── Authentication ──────────────────────────────────────────\n\n /\n Generate WebAuthn authentication options for a user.\n * Populates allowCredentials from the user's stored passkeys.\n /\n async generateAuthenticationOptions(\n ec: ExecutionContext<any>,\n userId: string,\n ceremony: PasskeyAuthenticationCeremony = PasskeyAuthenticationCeremony.LOGIN,\n ): Promise<PublicKeyCredentialRequestOptionsJSON> {\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n\n if (existingCredentials.length === 0) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,\n context: { reason: 'No passkey credentials registered for this user' },\n });\n }\n\n const options = await generateAuthenticationOptions({\n rpID: this.rpId,\n userVerification: this._userVerificationFor(ceremony),\n timeout: this.passkeyOps.timeoutSeconds 1000,\n allowCredentials: existingCredentials.map((c) => ({\n id: c.credentialId,\n transports: c.transports as AuthenticatorTransport[],\n })),\n });\n\n await this._storeChallenge(this._challengeKeyFor(ceremony, userId), options.challenge);\n this.logDebug('Authentication options generated', { userId, ceremony, credentialCount: existingCredentials.length });\n\n return options;\n }\n\n /*\n Verify a WebAuthn authentication response.\n * Updates the credential counter and lastUsedAt on success.\n /\n async verifyAuthenticationResponse(\n ec: ExecutionContext<any>,\n userId: string,\n response: AuthenticationResponseJSON,\n ceremony: PasskeyAuthenticationCeremony = PasskeyAuthenticationCeremony.LOGIN,\n ): Promise<PasskeyAuthenticationVerificationResult> {\n // Reads ONLY this ceremony's challenge, so an assertion signed for the other door finds nothing\n // to match and is refused — see `PasskeyAuthenticationCeremony`.\n const expectedChallenge = await this._getAndDeleteChallenge(this._challengeKeyFor(ceremony, userId));\n if (!expectedChallenge) {\n return { verified: false, credentialId: response.id };\n }\n\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n const matchedCredential = existingCredentials.find((c) => c.credentialId === response.id);\n\n if (!matchedCredential) {\n this.logger.warn('WebAuthn authentication failed: credential not found', {\n userId,\n credentialId: response.id,\n });\n return { verified: false, credentialId: response.id };\n }\n\n const verification = await verifyAuthenticationResponse({\n response,\n expectedChallenge,\n expectedOrigin: this.expectedOrigins,\n expectedRPID: this.rpId,\n // STEP_UP pins this true even when the app policy is `preferred` — an assertion carrying no\n // user verification proves possession of the authenticator, not presence of the person.\n requireUserVerification: this._userVerificationFor(ceremony) === UserVerification.REQUIRED,\n credential: {\n id: matchedCredential.credentialId,\n publicKey: Buffer.from(matchedCredential.publicKey, 'base64url'),\n /\n * DELIBERATELY 0, NOT the stored counter — and this line is load-bearing, so read the\n * reason before \"fixing\" it.\n \n `@simplewebauthn/server` evaluates its own counter guard BEFORE `verifySignature`\n * (verifyAuthenticationResponse.js:144-151 in 13.3.x, then :154). Handing it the real\n * stored value therefore refuses a counter regression on an assertion whose signature was\n * never checked — so ANY caller who knows a credential id could trigger the refusal, and\n * an alert raised there would be forgeable by an unauthenticated party.\n \n W3C WebAuthn L3 puts the counter comparison at §7.2 step 22, AFTER signature\n * verification at step 21, precisely because a counter regression only means something\n * when the assertion is known to come from something holding the private key. Passing 0\n * makes the library's predicate unsatisfiable — `(counter > 0 \|\| 0 > 0) && counter <= 0`\n * is false for every input — so the library does what we want from it (verify the\n * signature) and the counter decision stays here, below, where it is ours and where it is\n * post-authentication.\n \n spec-cite: W3C Web Authentication Level 3 §7.2 steps 21-22\n * (https://www.w3.org/TR/webauthn-3/#sctn-verifying-assertion).\n /\n counter: 0,\n transports: matchedCredential.transports as AuthenticatorTransport[],\n },\n });\n\n if (!verification.verified) {\n return { verified: false, credentialId: response.id };\n }\n\n /\n * CLONE DETECTION — the spec's predicate, on a signature-verified assertion.\n \n \"If either is non-zero, and the new signCount value is less than or equal to the stored\n * value, a cloned authenticator may exist, or the authenticator may be malfunctioning, or a\n * race condition might exist\" — W3C WebAuthn L3 §6.1.1.\n \n EITHER non-zero, not just the received one. The previous check here read\n * `newCounter > 0 && newCounter <= stored`, which misses the case that matters most\n * operationally: a credential that previously counted and now reports 0. It was also dead\n * code — the library threw first — and it only warned.\n \n A credential whose counter is permanently 0 — which every SYNCED passkey is, because a set\n * of devices cannot maintain a coherent counter — compares 0-against-0, fails the first\n * disjunct, and authenticates normally. That is the whole passkey accommodation and it is why\n * refusing here is not hostile to passkeys.\n \n Refusal, not step-up, and not configurable: three of the four major server implementations\n * fail closed with no switch (SimpleWebAuthn, Duo py_webauthn, ASP.NET Core Identity) and the\n * fourth (Yubico) defaults to it. Nothing authoritative recommends escalating instead.\n \n Returned rather than thrown so BOTH callers take their existing `!verified` branch and\n * produce the same clean AUTHENTICATION refusal — the step-up path used to wrap a library\n * throw as a generic error while login refused cleanly.\n \n spec-cite: W3C Web Authentication Level 3 §6.1.1\n * (https://www.w3.org/TR/webauthn-3/#sctn-sign-counter).\n /\n const newCounter = verification.authenticationInfo.newCounter;\n if ((newCounter > 0 \|\| matchedCredential.counter > 0) && newCounter <= matchedCredential.counter) {\n this.logger.warn('WebAuthn signature counter did not advance on a verified assertion — refusing', {\n userId,\n credentialId: matchedCredential.credentialId,\n storedCounter: matchedCredential.counter,\n receivedCounter: newCounter,\n });\n // The stored counter is NOT advanced: a refused assertion must not move the baseline a later\n // legitimate assertion is compared against.\n return {\n verified: false,\n credentialId: matchedCredential.credentialId,\n cloneSuspicion: {\n credentialId: matchedCredential.credentialId,\n storedCounter: matchedCredential.counter,\n receivedCounter: newCounter,\n // Carried for TRIAGE only — nothing branches on them. A synced credential that once\n // reported a non-zero counter and then regresses is still a signal, so exempting by\n // device type would disable clone detection for the majority of credentials.\n credentialDeviceType: matchedCredential.credentialDeviceType,\n credentialBackedUp: matchedCredential.credentialBackedUp,\n ...(matchedCredential.aaguid ? { aaguid: matchedCredential.aaguid } : {}),\n ceremony,\n },\n };\n }\n\n // Update counter and lastUsedAt\n const updatedCredentials = existingCredentials.map((c) =>\n c.credentialId === matchedCredential.credentialId\n ? { ...c, counter: newCounter, lastUsedAt: new Date() }\n : c,\n );\n\n await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n this.logDebug('Passkey authentication verified', { userId, credentialId: matchedCredential.credentialId });\n return { verified: true, credentialId: matchedCredential.credentialId };\n }\n\n // ─── Credential CRUD ─────────────────────────────────────────\n\n /\n List all passkey credentials for a user, as STORED.\n \n This returns the whole `PasskeyCredentialEntry`, `publicKey` and `counter` included. It is not a\n * safe-field projection, and must not be handed to a caller as one: the projection that reaches a\n * client is built at the controller (`handlePasskeyList`), which selects the credential id, name,\n * timestamps and device flags and nothing else. A new consumer of this method owes its own\n * projection, or it will disclose the stored credential material.\n /\n async getCredentials(ec: ExecutionContext<any>, userId: string): Promise<PasskeyCredentialEntry[]> {\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n return (cred as UserCredentials).passkeyCredentials ?? [];\n }\n\n /\n Remove a passkey credential by its credential ID.\n /\n async removeCredential(ec: ExecutionContext<any>, userId: string, credentialId: string): Promise<void> {\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n const updatedCredentials = existingCredentials.filter((c) => c.credentialId !== credentialId);\n\n if (updatedCredentials.length === existingCredentials.length) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n context: { reason: 'Passkey credential not found', credentialId },\n });\n }\n\n await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n this.logDebug('Passkey removed', { userId, credentialId });\n }\n\n /\n Rename a passkey credential.\n /\n async renameCredential(ec: ExecutionContext<any>, userId: string, credentialId: string, newName: string): Promise<void> {\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n const found = existingCredentials.find((c) => c.credentialId === credentialId);\n\n if (!found) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n context: { reason: 'Passkey credential not found', credentialId },\n });\n }\n\n const updatedCredentials = existingCredentials.map((c) =>\n c.credentialId === credentialId ? { ...c, name: newName } : c,\n );\n\n await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n this.logDebug('Passkey renamed', { userId, credentialId, newName });\n }\n\n // ─── Challenge Management (Redis) ────────────────────────────\n\n /\n The Redis challenge key for a ceremony. Distinct per ceremony so a challenge issued for one door\n * cannot be redeemed at the other — see {@link PasskeyAuthenticationCeremony}.\n /\n private _challengeKeyFor(ceremony: PasskeyAuthenticationCeremony, userId: string): string {\n const prefix = ceremony === PasskeyAuthenticationCeremony.STEP_UP\n ? CHALLENGE_KEY_PREFIX_STEP_UP\n : CHALLENGE_KEY_PREFIX_AUTH;\n return prefix + userId;\n }\n\n /\n The user-verification requirement for a ceremony.\n \n STEP_UP is REQUIRED unconditionally; LOGIN follows the app's `passkeyOperational` policy. The\n * override deliberately does not read the policy at all: an application that lowers it to\n * `preferred` (the common setting) is making a decision about LOGIN ergonomics, and inheriting it\n * here would silently weaken the re-proof that guards irreversible operations. Same reasoning as\n * `requiresStepUpAuthentication` refusing to inherit the per-user-type freshness policy.\n /\n private _userVerificationFor(ceremony: PasskeyAuthenticationCeremony): UserVerification {\n return ceremony === PasskeyAuthenticationCeremony.STEP_UP\n ? UserVerification.REQUIRED\n : this.passkeyOps.userVerification;\n }\n\n private async _storeChallenge(key: string, challenge: string): Promise<void> {\n await this.redisService.set(key, challenge, { ttl: CHALLENGE_TTL_SECONDS });\n }\n\n /\n Atomically read-and-consume a stored challenge. Delegates to\n * `RedisService.getDel`, which applies the same tenant-key scoping and\n * `JSON.parse` deserialization as the `set()` used by `_storeChallenge` —\n * keeping the store/read serialization contract symmetric. (The prior\n * hand-rolled `eval` GETDEL skipped `JSON.parse`, so the challenge came\n * back wrapped in literal quotes and every verification failed.)\n /\n private async _getAndDeleteChallenge(key: string): Promise<string \| null> {\n return this.redisService.getDel<string>(key);\n }\n\n // ─── Internal Helpers ────────────────────────────────────────\n\n /\n Resolve the credential record for a user.\n * Returns the credential document (throws if not found).\n */\n private async _resolveCredentialRecord(\n ec: ExecutionContext<any>,\n userId: string,\n ): Promise<{\n cred: UserCredentials;\n }> {\n const cred = await this.credentialOps.readByUserId(ec, userId);\n if (!cred) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n context: { reason: 'User credentials not found', userId },\n });\n }\n return { cred };\n }\n}\n\ntype AuthenticatorTransport = 'ble' \| 'cable' \| 'hybrid' \| 'internal' \| 'nfc' \| 'smart-card' \| 'usb';\n"]}

package/dist/esm/security/authentications/services/auth-session-store.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-session-store.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/security/authentications/services/auth-session-store.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,qBAAqB,EAA+B,MAAM,uBAAuB,CAAC;AAK3F;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC9D,6CAA6C;IAC7C,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F,wBAAwB;IACxB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,iCAAiC;IACjC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,sDAAsD;IACtD,iBAAiB,IAAI,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;GAWG;AACH,qBACa,8BAA+B,YAAW,iBAAiB;IAIjC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,YAAY;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAL/E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACf,YAAY,EAAE,YAAY,EACnB,YAAY,EAAE,0BAA0B;IAM3G;;;OAGG;IACI,iBAAiB,IAAI,MAAM;IAIrB,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IA6B7D,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBzF,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAaxC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYxD;;;;;;;;;OASG;IACU,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,qBAAqB,EACrC,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAuDxC;;;OAGG;IACH,OAAO,CAAC,GAAG;CAGZ"}
1	+ {"version":3,"file":"auth-session-store.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/services/auth-session-store.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,qBAAqB,EAA+B,MAAM,uBAAuB,CAAC;AAK3F;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC9D,6CAA6C;IAC7C,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F,wBAAwB;IACxB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,iCAAiC;IACjC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,sDAAsD;IACtD,iBAAiB,IAAI,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;GAWG;AACH,qBACa,8BAA+B,YAAW,iBAAiB;IAIjC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,YAAY;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAL/E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACf,YAAY,EAAE,YAAY,EACnB,YAAY,EAAE,0BAA0B;IAM3G;;;OAGG;IACI,iBAAiB,IAAI,MAAM;IAIrB,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IA6B7D,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBzF,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAaxC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYxD;;;;;;;;;OASG;IACU,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,qBAAqB,EACrC,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAuDxC;;;OAGG;IACH,OAAO,CAAC,GAAG;CAGZ"}

package/dist/esm/security/authentications/services/auth-token-issuer.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-token-issuer.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/security/authentications/services/auth-token-issuer.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAEzH,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,qBAAqB,EAAkC,WAAW,EAAwE,MAAM,uBAAuB,CAAC;AAejL,OAAO,EAEL,KAAK,mCAAmC,EAEzC,MAAM,gFAAgF,CAAC;AASxF;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iGAAiG;IACjG,aAAa,EAAE,OAAO,CAAC;CACxB;AAUD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,uBAAuB,GAAG,CAAC,CAQzG;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,GAAG,IAAI,CAK7F;AAED;;;;;;;;;;;GAWG;AACH,qBACa,6BAA6B;IAIH,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU;IACzB,OAAO,CAAC,QAAQ,CAAC,YAAY;IACpC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAQtF,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IASjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IA1BlC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACxC,UAAU,EAAE,iBAAiB,EAC3B,YAAY,EAAE,0BAA0B,EAC/C,YAAY,EAAE,YAAY,EACR,uBAAuB,EAAE,qCAAqC,EACjE,aAAa,EAAE,yCAAyC,EAQhH,gBAAgB,GAAE,uBAAuB,GAAG,IAAW,EASvD,cAAc,CAAC,EAAE,mCAAmC;IAMvE;;OAEG;IACU,WAAW,CACtB,OAAO,EAAE,qBAAqB,EAC9B,OAAO,GAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAO,GACrG,OAAO,CAAC,UAAU,CAAC;IAgBtB;;;;OAIG;IACU,kBAAkB,CAC7B,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE;QACb,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,WAAW,CAAC;KAC3B,EACD,OAAO,CAAC,EAAE;QACR,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,qBAAqB,CAAC,EAAE,IAAI,CAAC;KAC9B,GACA,OAAO,CAAC,UAAU,CAAC;IAItB;;;OAGG;YACW,mBAAmB;IAiKjC;;;;;;;;;;;;OAYG;IACU,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAkS1E;;;;;OAKG;IACU,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+CpE;;;;;;;;OAQG;IACU,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWtE;;;;;;;;;;;;;OAaG;IACU,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhE;;;;;;;;;;;;;;;OAeG;YACW,4BAA4B;IAkD1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,OAAO,CAAC,eAAe;CAyCxB"}
1	+ {"version":3,"file":"auth-token-issuer.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/services/auth-token-issuer.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAEzH,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,qBAAqB,EAAkC,WAAW,EAAwE,MAAM,uBAAuB,CAAC;AAejL,OAAO,EAEL,KAAK,mCAAmC,EAEzC,MAAM,gFAAgF,CAAC;AASxF;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iGAAiG;IACjG,aAAa,EAAE,OAAO,CAAC;CACxB;AAUD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,uBAAuB,GAAG,CAAC,CAQzG;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,GAAG,IAAI,CAK7F;AAED;;;;;;;;;;;GAWG;AACH,qBACa,6BAA6B;IAIH,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU;IACzB,OAAO,CAAC,QAAQ,CAAC,YAAY;IACpC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAQtF,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IASjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IA1BlC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACxC,UAAU,EAAE,iBAAiB,EAC3B,YAAY,EAAE,0BAA0B,EAC/C,YAAY,EAAE,YAAY,EACR,uBAAuB,EAAE,qCAAqC,EACjE,aAAa,EAAE,yCAAyC,EAQhH,gBAAgB,GAAE,uBAAuB,GAAG,IAAW,EASvD,cAAc,CAAC,EAAE,mCAAmC;IAMvE;;OAEG;IACU,WAAW,CACtB,OAAO,EAAE,qBAAqB,EAC9B,OAAO,GAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAO,GACrG,OAAO,CAAC,UAAU,CAAC;IAgBtB;;;;OAIG;IACU,kBAAkB,CAC7B,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE;QACb,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,WAAW,CAAC;KAC3B,EACD,OAAO,CAAC,EAAE;QACR,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,qBAAqB,CAAC,EAAE,IAAI,CAAC;KAC9B,GACA,OAAO,CAAC,UAAU,CAAC;IAItB;;;OAGG;YACW,mBAAmB;IAiKjC;;;;;;;;;;;;OAYG;IACU,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAkS1E;;;;;OAKG;IACU,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+CpE;;;;;;;;OAQG;IACU,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWtE;;;;;;;;;;;;;OAaG;IACU,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhE;;;;;;;;;;;;;;;OAeG;YACW,4BAA4B;IAkD1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,OAAO,CAAC,eAAe;CAyCxB"}

package/dist/esm/security/authentications/services/auth-token-issuer.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-token-issuer.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/auth-token-issuer.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAE3H,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAyB,8BAA8B,EAAE,WAAW,EAAE,SAAS,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACjL,OAAO,EACL,oCAAoC,EACpC,gCAAgC,GAEjC,MAAM,oFAAoF,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,oCAAoC,EAAE,MAAM,2EAA2E,CAAC;AAC/K,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,wBAAwB,EACxB,iCAAiC,GAClC,MAAM,sGAAsG,CAAC;AAC9G,OAAO,EAAE,kCAAkC,EAAE,MAAM,oEAAoE,CAAC;AACxH,OAAO,EAAE,gCAAgC,EAAE,MAAM,sEAAsE,CAAC;AACxH,OAAO,EACL,oBAAoB,EAEpB,oBAAoB,GACrB,MAAM,gFAAgF,CAAC;AACxF,OAAO,EACL,2BAA2B,GAE5B,MAAM,6FAA6F,CAAC;AAErG,0DAA0D;AAC1D,MAAM,+BAA+B,GAAG,EAAE,CAAC;AA6B3C;;;;;GAKG;AACH,MAAM,8BAA8B,GAAG,MAAM,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;AAExF;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAmB,KAAQ,EAAE,MAA+B;IACpG,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,8BAA8B,EAAE;QAC3D,KAAK,EAAE,MAAM;QACb,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,KAAK;QACf,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC3D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,8BAA8B,IAAI,KAAK,EAAE,CAAC;QAC3F,OAAQ,KAAgF,CAAC,8BAA8B,CAAC,CAAC;IAC3H,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AAEI,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAIc;IACU;IACC;IACE;IACP;IACkB;IACH;IAQxD;IASA;IA1BF,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACX,gBAAyC,EACxC,UAA6B,EAC3B,YAAwC,EAC/C,YAA0B,EACR,uBAA8D,EACjE,aAAwD,EAQhH,mBAAmD,IAAI,EASvD,cAAoD;QAvBjB,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QACxC,eAAU,GAAV,UAAU,CAAmB;QAC3B,iBAAY,GAAZ,YAAY,CAA4B;QAC/C,iBAAY,GAAZ,YAAY,CAAc;QACR,4BAAuB,GAAvB,uBAAuB,CAAuC;QACjE,kBAAa,GAAb,aAAa,CAA2C;QAQhH,qBAAgB,GAAhB,gBAAgB,CAAuC;QASvD,mBAAc,GAAd,cAAc,CAAsC;QAErE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,WAAW,CACtB,OAA8B,EAC9B,UAAoG,EAAE;QAEtG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAE9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;gBAC7F,OAAO,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,mBAAmB,IAAI,IAAI,EAAE;YAC9F,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,IAAI,SAAS;SAC9E,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,kBAAkB,CAC7B,MAAc,EACd,SAAkB,EAClB,YAIC,EACD,OAGC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IAClF,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,mBAAmB,CAC/B,MAAc,EACd,SAAkB,EAClB,sBAA+B,IAAI,EACnC,YAIC,EACD,OASC;QAED,IAAI,aAAkC,CAAC;QACvC,IAAI,sBAAsB,GAAG,YAAY,EAAE,cAAc,CAAC;QAE1D,0EAA0E;QAC1E,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mCAAmC,CAC1E,MAAM,EACN,IAAI,CAAC,aAAa,CAAC,yBAAyB,EAAE,CAC/C,CAAC;QACF,MAAM,IAAI,GACR,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACrC,gBAAgB,CAAC,KAAK,EACtB,OAAO,EACP,EAAE,GAAG,EAAE,MAAM,EAAE,CAChB,CAAC;QACJ,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,IAAI,oBAAoB,KAAK,IAAI,EAAE,CAAC;YAC3C,0FAA0F;YAC1F,0FAA0F;YAC1F,8FAA8F;YAC9F,8FAA8F;YAC9F,2EAA2E;YAC3E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,4BAA4B;gBAC1D,OAAO,EAAE;oBACP,MAAM,EAAE,IAAI;wBACV,CAAC,CAAC,uCAAuC;wBACzC,CAAC,CAAC,oCAAoC;oBACxC,MAAM;oBACN,qFAAqF;oBACrF,2CAA2C;oBAC3C,wBAAwB,EAAE,OAAQ,IAA0C,EAAE,QAAQ;oBACtF,UAAU,EAAE,IAAI,EAAE,MAAM;iBACzB;aACF,CACF,CAAC;QACJ,CAAC;QACD,IACE,OAAO,EAAE,4BAA4B,KAAK,SAAS;eAChD,oBAAoB,KAAK,OAAO,CAAC,4BAA4B,EAChE,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,4BAA4B;gBAC1D,OAAO,EAAE;oBACP,MAAM,EAAE,oDAAoD;oBAC5D,MAAM;iBACP;aACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YACtC,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,oBAAoB,EAAE,CAAC;YAC3D,aAAa,GAAG,KAAK,CAAC;QACxB,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,wCAAwC;QACxC,IAAI,sBAAsB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,sBAAsB,CAAC,EAC7E,CAAC;YACD,sBAAsB,GAAG,SAAS,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,sBAAsB,IAAI,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;YACtD,sBAAsB,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,mBAAmB,GAAG,YAAY,EAAE,mBAAmB,CAAC;QAE9D,MAAM,WAAW,GAAG,oCAAoC,CAAC,KAAK,CAAC;YAC7D,IAAI,EAAE,8BAA8B,CAAC,YAAY;YACjD,MAAM;YACN,oBAAoB;YACpB,WAAW,EAAE,YAAY,EAAE,WAAW,IAAI,WAAW,CAAC,UAAU;YAChE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,yGAAyG;YACzG,uGAAuG;YACvG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAC3E,+DAA+D;QAC/D,qEAAqE;QACrE,2EAA2E;QAC3E,6DAA6D;QAC7D,qEAAqE;QACrE,mEAAmE;QACnE,uEAAuE;QACvE,2CAA2C;QAC3C,MAAM,kBAAkB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC;QACzF,MAAM,2BAA2B,GAAG,kBAAkB,GAAG,EAAE,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAEzF,IAAI,YAAgC,CAAC;QACrC,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAChC,MAAM,YAAY,GAAuC;gBACvD,IAAI,EAAE,8BAA8B,CAAC,YAAY;gBACjD,MAAM;gBACN,oBAAoB;gBACpB,GAAG;gBACH,SAAS,EAAE,SAAS;gBACpB,WAAW,EAAE,YAAY,EAAE,WAAW,IAAI,WAAW,CAAC,UAAU;gBAChE,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,GAAG,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjI,CAAC;YAEF,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CACrD,YAAY,EACZ,OAAO,EAAE,qBAAqB;gBAC5B,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE;gBAC9G,CAAC,CAAC,SAAS,CACd,CAAC;YAEF,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;YAC/E,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,OAAO;YACL,WAAW;YACX,YAAY;YACZ,SAAS,EAAE,2BAA2B;SACvC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAClD,qFAAqF;QACrF,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CACF,CAAC;QACJ,CAAC;QAED,4DAA4D;QAC5D,MAAM,WAAW,GAAG,gCAAgC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACjG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC;QAEhC,0EAA0E;QAC1E,yEAAyE;QACzE,oDAAoD;QACpD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mCAAmC,CACrE,MAAM,CAAC,MAAM,EACb,IAAI,CAAC,aAAa,CAAC,yBAAyB,EAAE,CAC/C,CAAC;QACF,MAAM,WAAW,GACf,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACrC,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CACvB,CAAC;QACJ,MAAM,2BAA2B,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;QAC7E,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;gBACpD,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,WAAW;aAC/C,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,6BAA6B;gBAC3D,OAAO,EAAE;oBACP,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,WAAW;oBAC9C,MAAM,EAAE,eAAe;iBACxB;aACF,CACF,CAAC;QACJ,CAAC;QACD,IACE,2BAA2B,KAAK,IAAI;eACjC,2BAA2B,KAAK,MAAM,CAAC,oBAAoB,EAC9D,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4DAA4D,EAC5D;gBACE,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,yBAAyB,EAAE,MAAM,CAAC,oBAAoB;gBACtD,2BAA2B;aAC5B,CACF,CAAC;YACF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,4BAA4B;gBAC1D,OAAO,EAAE,EAAE,MAAM,EAAE,oCAAoC,EAAE;aAC1D,CACF,CAAC;QACJ,CAAC;QAED,iEAAiE;QACjE,0EAA0E;QAC1E,uEAAuE;QACvE,2CAA2C;QAC3C,gGAAgG;QAChG,oGAAoG;QACpG,oGAAoG;QACpG,sGAAsG;QACtG,qGAAqG;QACrG,uFAAuF;QACvF,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,MAAM,kCAAkC,CAC3E,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAC7C,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE;gBACtE,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,GAAG;gBACpB,aAAa;aACd,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,4BAA4B;aAC3D,CACF,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,iGAAiG;QACjG,8FAA8F;QAC9F,8FAA8F;QAC9F,MAAM,YAAY,GAAG,MAAM,gCAAgC,CACzD,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAChD,CAAC;QACF,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;gBACvE,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,MAAM,CAAC,GAAG;gBACpB,aAAa,EAAE,YAAY,CAAC,aAAa;aAC1C,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,4BAA4B;aAC3D,CACF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAS,GAAG,eAAe,CAAC,iBAAiB,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAChH,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,cAAc,KAAK,2BAA2B,CAAC,OAAO,EAAE,CAAC;gBAC3D,uEAAuE;gBACvE,sEAAsE;gBACtE,uEAAuE;gBACvE,8DAA8D;gBAC9D,sEAAsE;gBACtE,sEAAsE;gBACtE,kEAAkE;gBAClE,sEAAsE;gBACtE,oEAAoE;gBACpE,8DAA8D;gBAC9D,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAChD,GAAG,eAAe,CAAC,uBAAuB,GAAG,MAAM,CAAC,GAAG,EAAE,CAC1D,CAAC;gBACF,IAAI,cAAc,EAAE,CAAC;oBACnB,oEAAoE;oBACpE,qEAAqE;oBACrE,kEAAkE;oBAClE,qDAAqD;oBACrD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2GAA2G,EAAE;wBAC5H,GAAG,EAAE,MAAM,CAAC,GAAG;wBACf,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,IAAI,EAAE,MAAM,CAAC,IAAI;qBAClB,CAAC,CAAC;oBACH,OAAO,cAAc,CAAC;gBACxB,CAAC;gBAED,qEAAqE;gBACrE,sDAAsD;gBACtD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mFAAmF,EAAE;oBACpG,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,MAAM,EAAG,MAAM,CAAC,MAAM;oBACtB,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC,CAAC;gBACH,kEAAkE;gBAClE,sEAAsE;gBACtE,iEAAiE;gBACjE,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC;gBACrF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,EACzD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAC7B,EAAE,GAAG,EAAE,gBAAgB,GAAG,KAAK,EAAE,CAClC,CAAC;gBACF,+FAA+F;gBAC/F,kGAAkG;gBAClG,gGAAgG;gBAChG,mGAAmG;gBACnG,kGAAkG;gBAClG,MAAM,0BAA0B,CAC9B,IAAI,CAAC,YAAY,CAAC,UAAU,CAC1B,SAAS,CAAC,cAAc,EACxB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B,EAAE,CAC3E,EACX;oBACE,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,SAAS,EAAE,MAAM,CAAC,GAAG;oBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,aAAa,EAAE,IAAI;iBACpB,CACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CACF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,wEAAwE;QACxE,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE,EAAE,MAAM,EAAG,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1G,MAAM,iBAAiB,GAAG,MAAM,CAAC,mBAAmB,CAAC;QACrD,MAAM,qBAAqB,GAAG,MAAM,CAAC,cAAc,CAAC;QACpD,MAAM,kBAAkB,GAAG,MAAM,CAAC,WAAW,CAAC;QAC9C,MAAM,0BAA0B,GAAG,MAAM,CAAC,qBAAqB,CAAC;QAEhE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAC9C,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,SAAS,EAChB,IAAI,EACJ;YACE,mBAAmB,EAAE,iBAAiB;YACtC,cAAc,EAAE,qBAAqB;YACrC,WAAW,EAAE,kBAAkB,IAAI,WAAW,CAAC,UAAU;SAC1D,EACD;YACE,GAAG,CAAC,kBAAkB,KAAK,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,IAAI,CAAC,0BAA0B,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7G,4BAA4B,EAAE,MAAM,CAAC,oBAAoB;SAC1D,CACF,CAAC;QAEF,gEAAgE;QAChE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;QACzD,IAAI,GAAG,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,iBAAiB,GAAG,MAAM,CAAC,GAAG,EAAE,EACnD,2BAA2B,CAAC,OAAO,EACnC,EAAE,GAAG,EAAE,CACR,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,kDAAkD,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YAE5F,yEAAyE;YACzE,wEAAwE;YACxE,yEAAyE;YACzE,sEAAsE;YACtE,0EAA0E;YAC1E,yEAAyE;YACzE,EAAE;YACF,wEAAwE;YACxE,sEAAsE;YACtE,gEAAgE;YAChE,uEAAuE;YACvE,sEAAsE;YACtE,uEAAuE;YACvE,iEAAiE;YACjE,wEAAwE;YACxE,wEAAwE;YACxE,mEAAmE;YACnE,sEAAsE;YACtE,oEAAoE;YACpE,sEAAsE;YACtE,0EAA0E;YAC1E,yEAAyE;YACzE,iEAAiE;YACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;YACrE,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,uBAAuB,GAAG,MAAM,CAAC,GAAG,EAAE,EACzD,SAAS,EACT,EAAE,GAAG,EAAE,QAAQ,EAAE,CAClB,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,uDAAuD,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;YACxG,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAClD,mEAAmE;QACnE,yDAAyD;QACzD,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;YACvD,IAAI,CAAC,QAAQ,CAAC,gEAAgE,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,gCAAgC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,yDAAyD,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC;QACtC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,2CAA2C,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,wDAAwD;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAE,GAAc,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe;QACvE,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,qDAAqD,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,iBAAiB,GAAG,GAAG,EAAE,EAAE,2BAA2B,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAExH,4CAA4C;QAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,mBAAmB,GAAG,MAAM,EAAE,CAAC,CAAC;YAC7F,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gDAAgD,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAClG,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,0BAA0B,CAAC,MAAc;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACrF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,oBAAoB,GAAG,MAAM,EAAE,EAClD,UAAU,EACV,EAAE,GAAG,EAAE,gBAAgB,GAAG,KAAK,EAAE,CAClC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACrF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,sBAAsB,GAAG,SAAS,EAAE,EACvD,UAAU,EACV,EAAE,GAAG,EAAE,gBAAgB,GAAG,KAAK,EAAE,CAClC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;IACzG,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,4BAA4B,CAAC,MAAc,EAAE,MAAc,EAAE,cAAuB;QAChG,MAAM,cAAc,GAAG,cAAc;YACnC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,cAAc,CAAC;YAC1D,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,aAAa,GAAG,cAAc,EAAE,IAAI,EAAE,qBAAqB,CAAC;QAClE,MAAM,WAAW,GAAG,CAAC,aAAa,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,+BAA+B,CAAC;QAC3G,gEAAgE;QAChE,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACrF,MAAM,MAAM,GAAG,gBAAgB,GAAG,KAAK,CAAC;QACxC,MAAM,eAAe,GAAG,yBAAyB,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,mBAAmB,GAAG,MAAM,EAAE,CAAC,CAAC;QAE7F,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAC/C,+BAA+B,EAC/B,CAAC,MAAM,CAAC,EACR,CAAC,MAAM,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CACpD,CAAC;YAErB,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,+FAA+F;gBAC/F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChD,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC5B,MAAM,YAAY,GAAG,iCAAiC,CAAC;wBACrD,QAAQ,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC;wBAC7B,eAAe;wBACf,sBAAsB,EAAE,MAAM;qBAC/B,CAAC,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,iBAAiB,GAAG,GAAG,EAAE,EAC5C,2BAA2B,CAAC,OAAO,EACnC,EAAE,GAAG,EAAE,YAAY,EAAE,CACtB,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,2DAA2D,EAAE;oBACzE,MAAM;oBACN,YAAY,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC;oBACrC,WAAW;iBACZ,CAAC,CAAC;gBACH,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0DAA0D;YAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE;gBACnE,MAAM;gBACN,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACK,eAAe,CAAC,KAKvB;QACC,gGAAgG;QAChG,kGAAkG;QAClG,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,KAAK,UAAU;YAChF,CAAC,CAAC,IAAI,CAAC,gBAAgB;YACvB,CAAC,CAAC,SAAS,CAAC;QAEd,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAClE,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAC7C,8FAA8F;YAC9F,wBAAwB;YACxB,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC1B,MAAM,oBAAoB,GAAG,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;YACrF,oBAAoB,CAAC;gBACnB,WAAW,EAAE,oBAAoB,CAAC,oBAAoB;gBACtD,IAAI,EAAE,OAAO;oBACX,CAAC,CAAC,GAAY,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC;wBAC7C,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,UAAU;wBACV,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;wBAClG,iBAAiB,EAAE,KAAK,CAAC,WAAW;wBACpC,aAAa,EAAE,KAAK,CAAC,WAAW;qBACjC,CAAC;oBACF,CAAC,CAAC,SAAS;gBACb,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,2FAA2F;gBAC3F,yFAAyF;gBACzF,OAAO,EAAE;oBACP,cAAc,EAAE,KAAK,CAAC,MAAM;oBAC5B,kBAAkB,EAAE,UAAU;oBAC9B,yBAAyB,EAAE,KAAK,CAAC,WAAW;iBAC7C;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF,CAAA;AAhxBY,6BAA6B;IADzC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAC5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IAOtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;IASvD,WAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;qCAtBM,aAAa;QACO,uBAAuB;QAC5B,iBAAiB;QACb,0BAA0B;QACjC,YAAY,YAEI,yCAAyC;QAQ9F,uBAAuB;GAlBjD,6BAA6B,CAgxBzC","sourcesContent":["import 'reflect-metadata';\nimport crypto from 'crypto';\nimport { inject, injectable, optional } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport { AuthenticationSession, ExecutionContext_ExecutionType, SessionType, ErrorType, ErrorCustomMessageReference, CoreResourceType, UserStatus } from '@wildo-ai/saas-models';\nimport {\n JwtClaim_App_Auth_UserRequest_Schema,\n JwtClaim_App_RefreshToken_Schema,\n Jwt_RefreshToken_CreationParameter,\n} from '~wildo-backend-lib/security/authentications/models/authentications.backend.schemas';\nimport { AUTH_REDIS_KEYS, RefreshTokenBlacklistReason, REFRESH_TOKEN_ROTATION_GRACE_SECONDS } from '~wildo-backend-lib/security/authentications/models/auth-constants.backend';\nimport {\n buildSessionOrderingScore,\n CONCURRENT_SESSION_EVICTION_LUA,\n readIssuedAtMilliseconds,\n resolveEvictedJtiBlacklistSeconds,\n} from '~wildo-backend-lib/security/authentications/services/utils/concurrent-session-eviction.backend.utils';\nimport { evaluateUserTokenInvalidationFence } from '~wildo-backend-lib/security/token-invalidation-fence.backend.utils';\nimport { evaluateSessionInvalidationFence } from '~wildo-backend-lib/security/session-invalidation-fence.backend.utils';\nimport {\n AuditObservationKind,\n type AuditObservationLossMetricsRecorder,\n emitAuditObservation,\n} from '~wildo-backend-lib/monitoring/observability/audit-observation-emission.backend';\nimport {\n getUserAuthorizationVersion,\n type AuthorizationVersionedUser,\n} from '~wildo-backend-lib/security/authentications/models/user-authorization-version.backend.utils';\n\n/** L3: Default max concurrent refresh tokens per user. /\nconst DEFAULT_MAX_CONCURRENT_SESSIONS = 10;\n\n/\n Result of token issuance.\n /\nexport interface AuthTokens {\n accessToken: string;\n refreshToken?: string;\n expiresIn?: number;\n}\n\n/\n A-9 — the machine-readable signal a refresh-token REUSE rejection carries so a CALLER can audit the\n * theft. This issuer performs the family-wide revocation itself but deliberately does NOT audit\n * (see the class JSDoc — TRAP 13: callers decide what to audit); instead it TAGS its thrown rejection\n * with this signal, and each refresh caller reads it via {@link extractRefreshTokenReuseSignal} and\n * emits `USER_REFRESH_TOKEN_REUSE_DETECTED`. Never carries the raw token — only the reused `jti`.\n /\nexport interface RefreshTokenReuseSignal {\n /* The user whose whole token family was revoked (the victim). /\n userId: string;\n /* The reused refresh token's `jti` (the replayed credential id). /\n reusedJti: string;\n /* The session the reused token belonged to, when present on the claim. /\n sessionId?: string;\n /* Whether the `TOKEN_INVALID_BEFORE` family-revoke was written (the action the issuer took). /\n familyRevoked: boolean;\n}\n\n/\n Symbol-keyed so the signal rides the thrown rejection object WITHOUT ever appearing in a string-key\n * serialization or the error sanitizer (the reuse detail is internal, for the auditing caller only).\n * `Symbol.for` (the global registry, not a per-module `Symbol()`) so tag ⇄ extract still match if this\n * module is loaded under both ESM and CJS.\n /\nconst REFRESH_TOKEN_REUSE_SIGNAL_KEY = Symbol.for('wildo.auth.refreshTokenReuseSignal');\n\n/\n Tag a refresh-rejection error with the reuse signal (A-9). The issuer calls this after performing the\n * family revoke; the CALLER reads it back and emits the audit — preserving the issuer's no-audit boundary.\n /\nexport function tagRefreshTokenReuseSignal<E extends object>(error: E, signal: RefreshTokenReuseSignal): E {\n Object.defineProperty(error, REFRESH_TOKEN_REUSE_SIGNAL_KEY, {\n value: signal,\n enumerable: false,\n writable: false,\n configurable: false,\n });\n return error;\n}\n\n/\n Read the refresh-reuse signal off a caught error, or `null` when it is not a reuse rejection (a plain\n * revoked/expired/invalid refresh). A caller uses this to emit `USER_REFRESH_TOKEN_REUSE_DETECTED` for\n * the theft case ONLY, then map the error to its own rejection.\n /\nexport function extractRefreshTokenReuseSignal(error: unknown): RefreshTokenReuseSignal \| null {\n if (error !== null && typeof error === 'object' && REFRESH_TOKEN_REUSE_SIGNAL_KEY in error) {\n return (error as Record<typeof REFRESH_TOKEN_REUSE_SIGNAL_KEY, RefreshTokenReuseSignal>)[REFRESH_TOKEN_REUSE_SIGNAL_KEY];\n }\n return null;\n}\n\n/\n AuthTokenIssuerBackendService\n \n Responsibilities:\n * - Issue access tokens (delegates to JwtBackendService)\n * - Issue refresh tokens (delegates to JwtBackendService)\n \n This service does NOT:\n * - Manage sessions (that's AuthSessionStore)\n * - Verify credentials (that's AuthCredentialVerifier)\n * - Audit log (TRAP 13: callers decide what to audit based on full context)\n /\n@injectable()\nexport class AuthTokenIssuerBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.JwtBackendService) private readonly jwtService: JwtBackendService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,\n @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory) private readonly authEcFactory: AuthExecutionContextFactoryBackendService,\n /\n * The audit trail, `@optional()` and APPENDED LAST — the constructor-parameter discipline, and\n * optional for a second reason: this service sits on the token-issuance path, so a host that\n * binds no audit service must still be able to issue tokens. An observer may never be able to\n * fail the thing it observes.\n /\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) @optional()\n private readonly auditLogsService: AuditLogsBackendService \| null = null,\n /\n * The loss counter behind {@link recordEvictions}, `@optional()` and APPENDED after the audit\n * trail for the same two reasons: the constructor-parameter discipline, and that a host binding\n * no metrics service must still issue tokens. Its absence degrades a dropped eviction record to\n * the log channel — never to a refusal, which would put token issuance behind an observability\n * binding.\n /\n @inject(SAAS_SERVICE_TYPES.MetricsService) @optional()\n private readonly metricsService?: AuditObservationLossMetricsRecorder,\n ) {\n this.logDebug = this.logger.debugByType('AuthTokenIssuer');\n this.logger.setDebugTypeLogging('AuthTokenIssuer', false);\n }\n\n /\n Issue access + refresh tokens for a completed authentication session.\n /\n public async issueTokens(\n session: AuthenticationSession,\n options: { includeRefreshToken?: boolean; lastAuthenticatedAt?: number; activeUserType?: string } = {},\n ): Promise<AuthTokens> {\n const userId = session.userId;\n\n if (!userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_NOT_FOUND,\n context: { missingField: 'userId' },\n });\n }\n\n return this._issueTokensForUser(userId, session.sessionId, options.includeRefreshToken ?? true, {\n lastAuthenticatedAt: options.lastAuthenticatedAt,\n activeUserType: options.activeUserType ?? session.activeUserType ?? undefined,\n });\n }\n\n /\n Issue tokens for an user directly (without a full session).\n * Used by OAuth2/SAML/registration callback flows (TRAP 12) which bypass the session state machine.\n * `activeUserType` is resolved internally from the user record when not provided.\n /\n public async issueTokensForUser(\n userId: string,\n sessionId?: string,\n stepUpClaims?: {\n lastAuthenticatedAt?: number;\n activeUserType?: string;\n sessionType?: SessionType;\n },\n options?: {\n skipSessionTracking?: boolean;\n refreshTokenExpiresAt?: Date;\n },\n ): Promise<AuthTokens> {\n return this._issueTokensForUser(userId, sessionId, true, stepUpClaims, options);\n }\n\n /\n Internal implementation for token issuance.\n * Resolves `activeUserType` from the user DB record when not provided by the caller (N-2).\n /\n private async _issueTokensForUser(\n userId: string,\n sessionId?: string,\n includeRefreshToken: boolean = true,\n stepUpClaims?: {\n lastAuthenticatedAt?: number;\n activeUserType?: string;\n sessionType?: SessionType;\n },\n options?: {\n skipSessionTracking?: boolean;\n refreshTokenExpiresAt?: Date;\n /\n Refresh rotation passes the predecessor's durable authorization\n * version. Rechecking it on the issuance read closes the gap between the\n * refresh preflight read and successor signing.\n /\n expectedAuthorizationVersion?: number;\n },\n ): Promise<AuthTokens> {\n let emailVerified: boolean \| undefined;\n let resolvedActiveUserType = stepUpClaims?.activeUserType;\n\n // Token issuance is a security decision, so the User read and its durable\n // version are mandatory. A best-effort read here would mint an unfenced\n // token precisely when the database boundary is unavailable.\n const tokenEc = await this.authEcFactory.createForAuthenticatedAuthOperation(\n userId,\n this.authEcFactory.getUsersReadOperationPath(),\n );\n const user =\n await this.servicesRegistryHandler.read<AuthorizationVersionedUser>(\n CoreResourceType.USERS,\n tokenEc,\n { _id: userId },\n );\n const authorizationVersion = getUserAuthorizationVersion(user);\n if (!user \|\| authorizationVersion === null) {\n // Two very different faults, deliberately reported apart. Collapsing them into one reason\n // string sent a production investigation looking for a missing version field when the row\n // itself may simply not have been readable — the caller-facing answer is identical either way\n // (fail closed), but the operator-facing one is not: \"no such row\" points at the read's scope\n // or at write visibility, \"no version\" points at the persistence contract.\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: {\n reason: user\n ? 'user_authorization_version_unreadable'\n : 'user_row_not_readable_for_issuance',\n userId,\n // Only ever the SHAPE of what came back — never the value, which is an authorization\n // fence and does not belong in a log line.\n authorizationVersionType: typeof (user as AuthorizationVersionedUser \| null)?._version,\n userStatus: user?.status,\n },\n },\n );\n }\n if (\n options?.expectedAuthorizationVersion !== undefined\n && authorizationVersion !== options.expectedAuthorizationVersion\n ) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: {\n reason: 'user_authorization_version_changed_during_issuance',\n userId,\n },\n },\n );\n }\n\n if (user.status === UserStatus.ACTIVE) {\n emailVerified = true;\n } else if (user.status === UserStatus.PENDING_VERIFICATION) {\n emailVerified = false;\n }\n\n // A caller-carried active type is valid only while the live User still\n // owns it. This prevents direct issuance from preserving a removed auth\n // policy even outside refresh rotation.\n if (resolvedActiveUserType && !user.userTypes?.includes(resolvedActiveUserType)\n ) {\n resolvedActiveUserType = undefined;\n }\n if (!resolvedActiveUserType && user.userTypes?.length) {\n resolvedActiveUserType = user.userTypes[0];\n }\n\n const lastAuthenticatedAt = stepUpClaims?.lastAuthenticatedAt;\n\n const accessClaim = JwtClaim_App_Auth_UserRequest_Schema.parse({\n type: ExecutionContext_ExecutionType.USER_REQUEST,\n userId,\n authorizationVersion,\n sessionType: stepUpClaims?.sessionType ?? SessionType.PERSISTENT,\n ...(emailVerified !== undefined ? { emailVerified } : {}),\n ...(lastAuthenticatedAt !== undefined ? { lastAuthenticatedAt } : {}),\n ...(resolvedActiveUserType ? { activeUserType: resolvedActiveUserType } : {}),\n // revocation-C: carry the session id onto the ACCESS claim (it was already on the refresh claim), so the\n // access-token guard can enforce a per-session revocation fence and the OIDC id_token can carry `sid`.\n ...(sessionId ? { sessionId } : {}),\n });\n\n const accessToken = await this.jwtService.createJwtForAppAuth(accessClaim);\n // Resolved AppConfiguration always has this field (required on\n // `AppConfiguration_JWT_Schema`); operator-authored value flows from\n // `wildo.infra.<env>.config.ts` `serviceAuth.accessTokenExpirationMinutes`\n // through apps-manager bootstrap material and is overlaid by\n // `app-configuration-loader.backend.service.ts`. No literal fallback\n // here on purpose — F-24 (Slice 3.3) made `serviceAuth` the single\n // source of truth, so a missing value should fail the boot rather than\n // silently downgrade to a 15-minute floor.\n const accessTokenMinutes = this.appConfigService.config.jwt.accessTokenExpirationMinutes;\n const accessTokenExpiresInSeconds = accessTokenMinutes 60;\n this.logDebug('Access token issued', { userId, expiresIn: accessTokenExpiresInSeconds });\n\n let refreshToken: string \| undefined;\n if (includeRefreshToken) {\n const jti = crypto.randomUUID();\n const refreshClaim: Jwt_RefreshToken_CreationParameter = {\n type: ExecutionContext_ExecutionType.USER_REQUEST,\n userId,\n authorizationVersion,\n jti,\n sessionId: sessionId,\n sessionType: stepUpClaims?.sessionType ?? SessionType.PERSISTENT,\n ...(lastAuthenticatedAt !== undefined ? { lastAuthenticatedAt } : {}),\n ...(resolvedActiveUserType ? { activeUserType: resolvedActiveUserType } : {}),\n ...(options?.refreshTokenExpiresAt ? { refreshTokenExpiresAt: Math.floor(options.refreshTokenExpiresAt.getTime() / 1000) } : {}),\n };\n\n refreshToken = await this.jwtService.createRefreshToken(\n refreshClaim,\n options?.refreshTokenExpiresAt\n ? { expiresInSeconds: Math.max(1, Math.floor((options.refreshTokenExpiresAt.getTime() - Date.now()) / 1000)) }\n : undefined,\n );\n\n if (!options?.skipSessionTracking) {\n await this._trackAndEnforceSessionLimit(userId, jti, resolvedActiveUserType);\n }\n\n this.logDebug('Refresh token issued', { userId, sessionType: stepUpClaims?.sessionType });\n }\n\n return {\n accessToken,\n refreshToken,\n expiresIn: accessTokenExpiresInSeconds,\n };\n }\n\n /*\n Refresh an access token using a valid refresh token.\n \n Flow:\n * 1. Verify the refresh token JWT signature + expiration\n * 2. Parse claims using JwtClaim_App_RefreshToken_Schema (discriminated union)\n * 3. Issue a fresh access token for the same user\n * 4. Optionally rotate the refresh token (always rotate for security)\n \n @param refreshToken - The JWT refresh token string\n * @returns Fresh access + refresh tokens\n * @throws AUTHENTICATION error if the refresh token is invalid/expired\n /\n public async refreshAccessToken(refreshToken: string): Promise<AuthTokens> {\n // Step 1: Verify the refresh token JWT (signature + expiry + audience=REFRESH_TOKEN)\n let decoded: unknown;\n try {\n decoded = await this.jwtService.verifyRefreshToken(refreshToken);\n } catch (error) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n },\n );\n }\n\n // Step 2: Parse claims using the discriminated union schema\n const parseResult = JwtClaim_App_RefreshToken_Schema.safeParse(decoded);\n if (!parseResult.success) {\n this.logger.warn('Refresh token claims failed validation', { issues: parseResult.error.issues });\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n },\n );\n }\n\n const claims = parseResult.data;\n\n // Step 2b: Read the live User and enforce the durable authorization fence\n // BEFORE the rotation-grace early return. A cached successor must not be\n // returned after userTypes/appRoles/status changed.\n const ec = await this.authEcFactory.createForAuthenticatedAuthOperation(\n claims.userId,\n this.authEcFactory.getUsersReadOperationPath(),\n );\n const currentUser =\n await this.servicesRegistryHandler.read<AuthorizationVersionedUser>(\n CoreResourceType.USERS,\n ec,\n { _id: claims.userId },\n );\n const currentAuthorizationVersion = getUserAuthorizationVersion(currentUser);\n if (!currentUser \|\| currentUser.status !== UserStatus.ACTIVE) {\n this.logger.warn('Refresh token for non-active user', {\n jti: claims.jti,\n userId: claims.userId,\n userStatus: currentUser?.status ?? 'NOT_FOUND',\n });\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n context: {\n userStatus: currentUser?.status ?? 'NOT_FOUND',\n source: 'token_refresh',\n },\n },\n );\n }\n if (\n currentAuthorizationVersion === null\n \|\| currentAuthorizationVersion !== claims.authorizationVersion\n ) {\n this.logger.warn(\n 'Refresh token authorization version no longer matches User',\n {\n jti: claims.jti,\n userId: claims.userId,\n tokenAuthorizationVersion: claims.authorizationVersion,\n currentAuthorizationVersion,\n },\n );\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { reason: 'user_authorization_version_changed' },\n },\n );\n }\n\n // Keep explicit all-session invalidation (password reset / theft\n // detection) ahead of rotation grace as well. AuthorizationVersion closes\n // database authorization races; this timestamp remains the independent\n // credential/session revocation mechanism.\n // GRACE-BOUNDARY (fixed here 2026-07-29, moved to the shared owner 2026-08-01). The fail-closed\n // `<=` — and the full rationale for why the same second must be rejected, and why raising timestamp\n // precision alone would NOT fix it — now lives in {@link evaluateUserTokenInvalidationFence}, which\n // every auth front shares. It was six hand-written copies of this comparison that let the fix land on\n // two of them while four kept the bypassing `<`. Refresh-specific note: this fence is checked BEFORE\n // rotation grace, so a stolen chain cannot ride the grace window past an invalidation.\n const { isRevoked, invalidBefore } = await evaluateUserTokenInvalidationFence(\n this.redisService, claims.userId, claims.iat,\n );\n if (isRevoked) {\n this.logger.warn('Refresh token issued before user-level invalidation', {\n jti: claims.jti,\n userId: claims.userId,\n tokenIat: claims.iat,\n invalidBefore,\n });\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n },\n );\n }\n\n // revocation-C: PER-SESSION fence. Distinct from the user-wide fence above — a single-session\n // terminate (OIDC end_session / per-device logout) evicts THIS session's refresh chain while the\n // user's other sessions stay live. Checked here so the terminated session cannot rotate a new\n // access token; the access guard checks the same fence so the current access token also dies.\n const sessionFence = await evaluateSessionInvalidationFence(\n this.redisService, claims.sessionId, claims.iat,\n );\n if (sessionFence.isRevoked) {\n this.logger.warn('Refresh token issued before per-session invalidation', {\n jti: claims.jti,\n userId: claims.userId,\n sessionId: claims.sessionId,\n tokenIat: claims.iat,\n invalidBefore: sessionFence.invalidBefore,\n });\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n },\n );\n }\n\n // Step 2c: Check JTI blacklist (revoked tokens) with reuse detection.\n const blacklistValue = await this.redisService.get<string>(`${AUTH_REDIS_KEYS.REFRESH_BLACKLIST}${claims.jti}`);\n if (blacklistValue) {\n if (blacklistValue === RefreshTokenBlacklistReason.ROTATED) {\n // IDEMPOTENT-ROTATION GRACE (checked BEFORE theft revocation): a token\n // re-presented within {@link REFRESH_TOKEN_ROTATION_GRACE_SECONDS} of\n // its rotation is almost always a benign race — a lost/retried refresh\n // response, or a second browsing context that read the shared\n // `__wildo_refresh` cookie a beat before the rotation replaced it. In\n // that case the original rotation cached its successor tokens; return\n // that SAME successor so the racing client converges on one token\n // family instead of being force-logged-out. Genuine theft re-presents\n // the token long after this window, by which time the grace key has\n // expired and control falls through to full revocation below.\n const graceSuccessor = await this.redisService.get<AuthTokens>(\n `${AUTH_REDIS_KEYS.REFRESH_GRACE_SUCCESSOR}${claims.jti}`,\n );\n if (graceSuccessor) {\n // Both durable authorizationVersion and explicit Redis invalidation\n // were checked above. Returning the exact cached successor therefore\n // grants nothing beyond the legitimate rotation winner and cannot\n // bypass an intervening User authorization mutation.\n this.logger.info('Refresh-token reuse within rotation grace window — returning cached successor (benign race, NOT revoking)', {\n jti: claims.jti,\n userId: claims.userId,\n type: claims.type,\n });\n return graceSuccessor;\n }\n\n // REUSE DETECTED outside the grace window: the old refresh token may\n // have been stolen — revoke ALL tokens for this user.\n this.logger.warn('REFRESH TOKEN REUSE DETECTED — possible token theft, revoking all tokens for user', {\n jti: claims.jti,\n userId : claims.userId,\n type: claims.type,\n });\n // F-24 (Slice 3.3): refresh-token TTL is required on the resolved\n // AppConfiguration and authoritatively sourced from operator-authored\n // `serviceAuth.refreshTokenExpirationDays`; no literal fallback.\n const refreshTokenDays = this.appConfigService.config.jwt.refreshTokenExpirationDays;\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.TOKEN_INVALID_BEFORE}${claims.userId}`,\n Math.floor(Date.now() / 1000),\n { ttl: refreshTokenDays 86400 },\n );\n // A-9: this issuer performed the family revoke but does NOT audit (TRAP 13 — see class JSDoc).\n // TAG the rejection with the reuse signal so the CALLER emits `USER_REFRESH_TOKEN_REUSE_DETECTED`\n // for this theft (the plain-revoked `else` below throws the UNtagged twin, so a routine revoked\n // token is not mis-audited as theft). Distinct throw here — never falls through to the shared one.\n // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — credential-theft detection + response.\n throw tagRefreshTokenReuseSignal(\n this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN },\n ) as object,\n {\n userId: claims.userId,\n reusedJti: claims.jti,\n sessionId: claims.sessionId,\n familyRevoked: true,\n },\n );\n } else {\n this.logger.warn('Refresh token has been revoked', { jti: claims.jti });\n }\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n },\n );\n }\n\n // Step 3: Issue new tokens — carry forward session-scoped claims, but\n // require the issuance read to observe this same authorization version.\n this.logDebug('Refresh token validated, issuing new tokens', { userId : claims.userId, jti: claims.jti });\n const refreshLastAuthAt = claims.lastAuthenticatedAt;\n const refreshActiveUserType = claims.activeUserType;\n const refreshSessionType = claims.sessionType;\n const refreshTokenExpiresAtClaim = claims.refreshTokenExpiresAt;\n\n const newTokens = await this._issueTokensForUser(\n claims.userId,\n claims.sessionId,\n true,\n {\n lastAuthenticatedAt: refreshLastAuthAt,\n activeUserType: refreshActiveUserType,\n sessionType: refreshSessionType ?? SessionType.PERSISTENT,\n },\n {\n ...(refreshSessionType === SessionType.ONE_OFF ? { skipSessionTracking: true } : {}),\n ...(refreshTokenExpiresAtClaim ? { refreshTokenExpiresAt: new Date(refreshTokenExpiresAtClaim * 1000) } : {}),\n expectedAuthorizationVersion: claims.authorizationVersion,\n },\n );\n\n // Step 4: Blacklist the consumed refresh token JTI as 'rotated'\n const nowSeconds = Math.floor(Date.now() / 1000);\n const ttl = claims.exp ? claims.exp - nowSeconds : 86400;\n if (ttl > 0 && claims.jti) {\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.REFRESH_BLACKLIST}${claims.jti}`,\n RefreshTokenBlacklistReason.ROTATED,\n { ttl },\n );\n this.logDebug('Old refresh token JTI blacklisted after rotation', { jti: claims.jti, ttl });\n\n // Cache the successor under the consumed JTI for the idempotent-rotation\n // grace window so a benign reuse race returns THIS exact successor (see\n // Step 2b) instead of being revoked. The TTL is the grace window clamped\n // to the consumed token's own remaining lifetime — the grace entry is\n // ALWAYS shorter-lived than the blacklist entry above, so once it expires\n // a re-presented token still trips full revocation (theft is preserved).\n //\n // AT-REST EXPOSURE (accepted, bounded): this is the ONLY place the auth\n // subsystem writes live token material to Redis — `REFRESH_BLACKLIST`\n // holds only reason strings, `TOKEN_INVALID_BEFORE` timestamps,\n // `ACTIVE_REFRESH_JTIS` only JTIs, and the session store holds session\n // state, never tokens. We store the FULL successor (incl. the refresh\n // token) because the idempotent guarantee requires returning the exact\n // same tokens — re-issuing would mint a divergent family, and an\n // access-token-only cache would break the lost-rotation-response client\n // (its cookie is still the now-blacklisted predecessor, so it needs the\n // successor refresh token re-sent via `Set-Cookie` to advance). An\n // attacker with Redis read access (snapshot/AOF dump, MONITOR, leaked\n // backup) could therefore harvest refresh tokens minted in the last\n // `graceTtl` seconds — but such an attacker already reads the session\n // store, so the marginal blast radius is one short window. If that window\n // ever needs hardening, encrypt this blob at rest (the read site already\n // fails closed to revocation on a parse miss). It is NOT logged.\n const graceTtl = Math.min(REFRESH_TOKEN_ROTATION_GRACE_SECONDS, ttl);\n if (graceTtl > 0) {\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.REFRESH_GRACE_SUCCESSOR}${claims.jti}`,\n newTokens,\n { ttl: graceTtl },\n );\n this.logDebug('Cached rotation successor for idempotent-grace window', { jti: claims.jti, graceTtl });\n }\n }\n\n return newTokens;\n }\n\n /*\n Revoke a refresh token by adding its JTI to the Redis blacklist.\n * TTL matches the token's remaining lifetime so the entry auto-expires.\n \n Called from the logout route handler.\n /\n public async revokeRefreshToken(refreshToken: string): Promise<void> {\n // Decode the token to extract JTI and exp. We verify the signature\n // so that arbitrary strings can't pollute the blacklist.\n let decoded: unknown;\n try {\n decoded = await this.jwtService.verifyRefreshToken(refreshToken);\n } catch {\n // Token is already invalid/expired — nothing to revoke\n this.logDebug('Refresh token revocation skipped — token is invalid or expired');\n return;\n }\n\n const parseResult = JwtClaim_App_RefreshToken_Schema.safeParse(decoded);\n if (!parseResult.success) {\n this.logDebug('Refresh token revocation skipped — claims are malformed');\n return;\n }\n\n const { jti, exp } = parseResult.data;\n if (!jti) {\n this.logDebug('Refresh token revocation skipped — no JTI');\n return;\n }\n\n // TTL = remaining seconds until token naturally expires\n const nowSeconds = Math.floor(Date.now() / 1000);\n const ttl = exp ? (exp as number) - nowSeconds : 86400; // fallback 24h\n if (ttl <= 0) {\n this.logDebug('Refresh token already expired — no blacklist needed', { jti });\n return;\n }\n\n await this.redisService.set(`${AUTH_REDIS_KEYS.REFRESH_BLACKLIST}${jti}`, RefreshTokenBlacklistReason.REVOKED, { ttl });\n\n // L3: Remove from active refresh tokens set\n const claims = parseResult.data;\n const userId = claims.userId;\n try {\n const setKey = this.redisService.buildKey(`${AUTH_REDIS_KEYS.ACTIVE_REFRESH_JTIS}${userId}`);\n await this.redisService.eval('redis.call(\"ZREM\", KEYS[1], ARGV[1]); return 1', [setKey], [jti]);\n } catch {\n // Non-fatal\n }\n\n this.logDebug('Refresh token revoked', { jti, ttlSeconds: ttl });\n }\n\n /\n Invalidate all refresh tokens for an user by setting a per-user\n * \"invalid before\" timestamp in Redis. All refresh tokens with `iat` before\n * this timestamp will be rejected on next use.\n \n Used on password change/reset (C4) and token reuse detection (H3).\n * TTL matches operator-authored `serviceAuth.refreshTokenExpirationDays`\n * (F-24, Slice 3.3); no literal fallback.\n /\n public async invalidateAllTokensForUser(userId: string): Promise<void> {\n const nowSeconds = Math.floor(Date.now() / 1000);\n const refreshTokenDays = this.appConfigService.config.jwt.refreshTokenExpirationDays;\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.TOKEN_INVALID_BEFORE}${userId}`,\n nowSeconds,\n { ttl: refreshTokenDays 86400 },\n );\n this.logDebug('All tokens invalidated for user', { userId, invalidBefore: nowSeconds });\n }\n\n /*\n revocation-C: invalidate a SINGLE login session by setting a per-session \"invalid before\"\n * timestamp in Redis. Every access/refresh token whose `sessionId` matches AND whose `iat` is at or\n * before this timestamp is rejected on next use — at every first-party auth front: the refresh exchange\n * ({@link refreshAccessToken}), the first-party access guard (`auth-jwt-guard.extractAuthenticatedUser`),\n * and the manual-controller / resource-API / socket-handshake fronts (`execution-context-creator`), all\n * via {@link evaluateSessionInvalidationFence}.\n \n This is the least-privilege sibling of {@link invalidateAllTokensForUser}: it terminates ONE\n * session (the OIDC `end_session_endpoint` / RP-Initiated Logout, and per-device logout), leaving the\n * user's other sessions live. TTL matches operator-authored `jwt.refreshTokenExpirationDays` — the\n * fence only needs to outlive the longest-lived token that could still carry this `sessionId`, after\n * which no such token can exist and the key is dead weight.\n /\n public async invalidateSession(sessionId: string): Promise<void> {\n const nowSeconds = Math.floor(Date.now() / 1000);\n const refreshTokenDays = this.appConfigService.config.jwt.refreshTokenExpirationDays;\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.SESSION_INVALID_BEFORE}${sessionId}`,\n nowSeconds,\n { ttl: refreshTokenDays 86400 },\n );\n this.logDebug('Session invalidated (per-session fence set)', { sessionId, invalidBefore: nowSeconds });\n }\n\n /*\n L3: Track an active refresh token JTI for an user and enforce the concurrent session limit.\n \n Uses a Redis sorted set per user where:\n * - Members = JTI strings\n * - Scores = issuedAt in MILLISECONDS (for FIFO eviction)\n \n When the set exceeds the max size (default 10), the oldest JTI(s) are evicted\n * and blacklisted so they can't be used anymore.\n \n The ordering, the score's unit, and the blacklist TTL all live in\n * `concurrent-session-eviction.backend.utils` — retiring the OLDEST chain is the security property\n * the cap exists to provide, so it is a named, separately-tested policy rather than a detail of\n * this method. See {@link buildSessionOrderingScore} for why whole-second scores silently made the\n * eviction arbitrary.\n /\n private async _trackAndEnforceSessionLimit(userId: string, newJti: string, activeUserType?: string): Promise<void> {\n const userTypeConfig = activeUserType\n ? this.appConfigService.config.userTypes?.[activeUserType]\n : undefined;\n const configuredMax = userTypeConfig?.auth?.maxConcurrentSessions;\n const maxSessions = (configuredMax && configuredMax > 0) ? configuredMax : DEFAULT_MAX_CONCURRENT_SESSIONS;\n // F-24 (Slice 3.3): operator-authored TTL; no literal fallback.\n const refreshTokenDays = this.appConfigService.config.jwt.refreshTokenExpirationDays;\n const setTtl = refreshTokenDays 86400;\n const nowMilliseconds = buildSessionOrderingScore();\n const setKey = this.redisService.buildKey(`${AUTH_REDIS_KEYS.ACTIVE_REFRESH_JTIS}${userId}`);\n\n try {\n const evictedPairs = await this.redisService.eval(\n CONCURRENT_SESSION_EVICTION_LUA,\n [setKey],\n [newJti, String(nowMilliseconds), String(maxSessions), String(setTtl)],\n ) as string[] \| null;\n\n if (evictedPairs && evictedPairs.length > 0) {\n // evictedPairs is [jti, score, jti, score, ...] — blacklist each with its actual remaining TTL\n for (let i = 0; i < evictedPairs.length; i += 2) {\n const jti = evictedPairs[i];\n const remainingTtl = resolveEvictedJtiBlacklistSeconds({\n rawScore: evictedPairs[i + 1],\n nowMilliseconds,\n refreshTokenTtlSeconds: setTtl,\n });\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.REFRESH_BLACKLIST}${jti}`,\n RefreshTokenBlacklistReason.EVICTED,\n { ttl: remainingTtl },\n );\n }\n this.logDebug('Concurrent session limit enforced — evicted oldest tokens', {\n userId,\n evictedCount: evictedPairs.length / 2,\n maxSessions,\n });\n this.recordEvictions({ userId, evictedPairs, maxSessions, nowMilliseconds });\n }\n } catch (error) {\n // Non-fatal: don't block token issuance if tracking fails\n this.logger.warn('Failed to track/enforce concurrent session limit', {\n userId,\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n /*\n Record each retired refresh chain in the audit trail.\n \n Until 2026-09-02 the only trace of an eviction was the debug line above — a security-relevant\n * token-lifecycle act with no durable record, which is exactly what `CLAUDE.md`'s\n * assurance-by-construction rule asks for by name. The cap exists to bound the blast radius of\n * undetected token theft, so a burst of evictions for one principal is among the more interesting\n * things the trail can carry, and it was not carrying it.\n \n `evictedIssuedAt` is what makes the record worth having: the cap's security property is that the\n * OLDEST chain goes, and a record naming only the victim would prove a session ended without\n * proving the right one did. An unreadable score yields ABSENCE rather than a synthesised instant —\n * a fabricated timestamp would make the first-in-first-out claim unfalsifiable.\n \n Feature-DETECTED rather than null-checked, for the reason recorded at the cross-tenant emitter:\n * adding a `log` method breaks partially-mocked doubles, the property is absent, and the CALL\n throws synchronously before any `.catch()` can make it fire-and-forget.\n \n ## Why the detection decides an ARGUMENT rather than an early return\n \n Every emission goes through {@link emitAuditObservation}, which counts a lost one on\n * `audit_observation_dropped_total`. Handing the seam `undefined` is how this site reports\n * `SERVICE_UNAVAILABLE` — the loss shape that reaches no `_createAuditLog` and therefore used to\n * leave nothing behind at all. Returning early on an absent method would restore that silence,\n * which matters here more than it looks: an unbound audit service makes the eviction trail\n * PERMANENTLY empty, and an empty eviction trail reads as \"the cap never fired\".\n \n The count is per RETIRED CHAIN, not per enforcement — one lost row is one lost row, and a cap\n * that evicts four chains while the sink is down has lost four pieces of evidence. The\n * `!evictedJti` skip stays ABOVE the emission for the opposite reason: a pair with no jti is\n * nothing owed, and counting a deliberate skip would fire the loss signal on correct behaviour.\n \n assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — the bound's enforcement is\n * evidenced, naming WHICH chain was retired and when it was issued.\n */\n private recordEvictions(input: {\n userId: string;\n evictedPairs: string[];\n maxSessions: number;\n nowMilliseconds: number;\n }): void {\n // Narrowed to a VALUE rather than to a boolean flag: the emitting closure is created inside the\n // loop, and a captured `const` that is already non-nullish needs no narrowing to survive into it.\n const emitter = typeof this.auditLogsService?.logUserSessionEvicted === 'function'\n ? this.auditLogsService\n : undefined;\n\n for (let index = 0; index < input.evictedPairs.length; index += 2) {\n const evictedJti = input.evictedPairs[index];\n // Nothing was owed for this pair — a deliberate skip, kept above the emission so it can never\n // be counted as a loss.\n if (!evictedJti) continue;\n const issuedAtMilliseconds = readIssuedAtMilliseconds(input.evictedPairs[index + 1]);\n emitAuditObservation({\n observation: AuditObservationKind.USER_SESSION_EVICTED,\n emit: emitter\n ? (): unknown => emitter.logUserSessionEvicted({\n userId: input.userId,\n evictedJti,\n ...(issuedAtMilliseconds === undefined ? {} : { evictedIssuedAt: new Date(issuedAtMilliseconds) }),\n configuredMaximum: input.maxSessions,\n retainedCount: input.maxSessions,\n })\n : undefined,\n metricsService: this.metricsService,\n logger: this.logger,\n // Enough to reconstruct the lost row from the application log: WHOSE session, WHICH chain,\n // and under what bound. The jti is the identity the audit row itself would have carried.\n context: {\n observedUserId: input.userId,\n observedEvictedJti: evictedJti,\n observedConfiguredMaximum: input.maxSessions,\n },\n });\n }\n }\n}\n"]}
1	+ {"version":3,"file":"auth-token-issuer.backend.service.js","sourceRoot":"","sources":["../../../../../src/security/authentications/services/auth-token-issuer.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAE3H,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAyB,8BAA8B,EAAE,WAAW,EAAE,SAAS,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACjL,OAAO,EACL,oCAAoC,EACpC,gCAAgC,GAEjC,MAAM,oFAAoF,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,oCAAoC,EAAE,MAAM,2EAA2E,CAAC;AAC/K,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,wBAAwB,EACxB,iCAAiC,GAClC,MAAM,sGAAsG,CAAC;AAC9G,OAAO,EAAE,kCAAkC,EAAE,MAAM,oEAAoE,CAAC;AACxH,OAAO,EAAE,gCAAgC,EAAE,MAAM,sEAAsE,CAAC;AACxH,OAAO,EACL,oBAAoB,EAEpB,oBAAoB,GACrB,MAAM,gFAAgF,CAAC;AACxF,OAAO,EACL,2BAA2B,GAE5B,MAAM,6FAA6F,CAAC;AAErG,0DAA0D;AAC1D,MAAM,+BAA+B,GAAG,EAAE,CAAC;AA6B3C;;;;;GAKG;AACH,MAAM,8BAA8B,GAAG,MAAM,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;AAExF;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAmB,KAAQ,EAAE,MAA+B;IACpG,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,8BAA8B,EAAE;QAC3D,KAAK,EAAE,MAAM;QACb,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,KAAK;QACf,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC3D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,8BAA8B,IAAI,KAAK,EAAE,CAAC;QAC3F,OAAQ,KAAgF,CAAC,8BAA8B,CAAC,CAAC;IAC3H,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AAEI,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAIc;IACU;IACC;IACE;IACP;IACkB;IACH;IAQxD;IASA;IA1BF,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACX,gBAAyC,EACxC,UAA6B,EAC3B,YAAwC,EAC/C,YAA0B,EACR,uBAA8D,EACjE,aAAwD,EAQhH,mBAAmD,IAAI,EASvD,cAAoD;QAvBjB,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QACxC,eAAU,GAAV,UAAU,CAAmB;QAC3B,iBAAY,GAAZ,YAAY,CAA4B;QAC/C,iBAAY,GAAZ,YAAY,CAAc;QACR,4BAAuB,GAAvB,uBAAuB,CAAuC;QACjE,kBAAa,GAAb,aAAa,CAA2C;QAQhH,qBAAgB,GAAhB,gBAAgB,CAAuC;QASvD,mBAAc,GAAd,cAAc,CAAsC;QAErE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,WAAW,CACtB,OAA8B,EAC9B,UAAoG,EAAE;QAEtG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAE9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;gBAC7F,OAAO,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,mBAAmB,IAAI,IAAI,EAAE;YAC9F,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,IAAI,SAAS;SAC9E,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,kBAAkB,CAC7B,MAAc,EACd,SAAkB,EAClB,YAIC,EACD,OAGC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IAClF,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,mBAAmB,CAC/B,MAAc,EACd,SAAkB,EAClB,sBAA+B,IAAI,EACnC,YAIC,EACD,OASC;QAED,IAAI,aAAkC,CAAC;QACvC,IAAI,sBAAsB,GAAG,YAAY,EAAE,cAAc,CAAC;QAE1D,0EAA0E;QAC1E,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mCAAmC,CAC1E,MAAM,EACN,IAAI,CAAC,aAAa,CAAC,yBAAyB,EAAE,CAC/C,CAAC;QACF,MAAM,IAAI,GACR,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACrC,gBAAgB,CAAC,KAAK,EACtB,OAAO,EACP,EAAE,GAAG,EAAE,MAAM,EAAE,CAChB,CAAC;QACJ,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,IAAI,oBAAoB,KAAK,IAAI,EAAE,CAAC;YAC3C,0FAA0F;YAC1F,0FAA0F;YAC1F,8FAA8F;YAC9F,8FAA8F;YAC9F,2EAA2E;YAC3E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,4BAA4B;gBAC1D,OAAO,EAAE;oBACP,MAAM,EAAE,IAAI;wBACV,CAAC,CAAC,uCAAuC;wBACzC,CAAC,CAAC,oCAAoC;oBACxC,MAAM;oBACN,qFAAqF;oBACrF,2CAA2C;oBAC3C,wBAAwB,EAAE,OAAQ,IAA0C,EAAE,QAAQ;oBACtF,UAAU,EAAE,IAAI,EAAE,MAAM;iBACzB;aACF,CACF,CAAC;QACJ,CAAC;QACD,IACE,OAAO,EAAE,4BAA4B,KAAK,SAAS;eAChD,oBAAoB,KAAK,OAAO,CAAC,4BAA4B,EAChE,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,4BAA4B;gBAC1D,OAAO,EAAE;oBACP,MAAM,EAAE,oDAAoD;oBAC5D,MAAM;iBACP;aACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YACtC,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,oBAAoB,EAAE,CAAC;YAC3D,aAAa,GAAG,KAAK,CAAC;QACxB,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,wCAAwC;QACxC,IAAI,sBAAsB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,sBAAsB,CAAC,EAC7E,CAAC;YACD,sBAAsB,GAAG,SAAS,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,sBAAsB,IAAI,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;YACtD,sBAAsB,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,mBAAmB,GAAG,YAAY,EAAE,mBAAmB,CAAC;QAE9D,MAAM,WAAW,GAAG,oCAAoC,CAAC,KAAK,CAAC;YAC7D,IAAI,EAAE,8BAA8B,CAAC,YAAY;YACjD,MAAM;YACN,oBAAoB;YACpB,WAAW,EAAE,YAAY,EAAE,WAAW,IAAI,WAAW,CAAC,UAAU;YAChE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,yGAAyG;YACzG,uGAAuG;YACvG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAC3E,+DAA+D;QAC/D,qEAAqE;QACrE,2EAA2E;QAC3E,6DAA6D;QAC7D,qEAAqE;QACrE,mEAAmE;QACnE,uEAAuE;QACvE,2CAA2C;QAC3C,MAAM,kBAAkB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC;QACzF,MAAM,2BAA2B,GAAG,kBAAkB,GAAG,EAAE,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAEzF,IAAI,YAAgC,CAAC;QACrC,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAChC,MAAM,YAAY,GAAuC;gBACvD,IAAI,EAAE,8BAA8B,CAAC,YAAY;gBACjD,MAAM;gBACN,oBAAoB;gBACpB,GAAG;gBACH,SAAS,EAAE,SAAS;gBACpB,WAAW,EAAE,YAAY,EAAE,WAAW,IAAI,WAAW,CAAC,UAAU;gBAChE,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,GAAG,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjI,CAAC;YAEF,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CACrD,YAAY,EACZ,OAAO,EAAE,qBAAqB;gBAC5B,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE;gBAC9G,CAAC,CAAC,SAAS,CACd,CAAC;YAEF,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;YAC/E,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,OAAO;YACL,WAAW;YACX,YAAY;YACZ,SAAS,EAAE,2BAA2B;SACvC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAClD,qFAAqF;QACrF,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CACF,CAAC;QACJ,CAAC;QAED,4DAA4D;QAC5D,MAAM,WAAW,GAAG,gCAAgC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACjG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC;QAEhC,0EAA0E;QAC1E,yEAAyE;QACzE,oDAAoD;QACpD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mCAAmC,CACrE,MAAM,CAAC,MAAM,EACb,IAAI,CAAC,aAAa,CAAC,yBAAyB,EAAE,CAC/C,CAAC;QACF,MAAM,WAAW,GACf,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACrC,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CACvB,CAAC;QACJ,MAAM,2BAA2B,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;QAC7E,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;gBACpD,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,WAAW;aAC/C,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,6BAA6B;gBAC3D,OAAO,EAAE;oBACP,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,WAAW;oBAC9C,MAAM,EAAE,eAAe;iBACxB;aACF,CACF,CAAC;QACJ,CAAC;QACD,IACE,2BAA2B,KAAK,IAAI;eACjC,2BAA2B,KAAK,MAAM,CAAC,oBAAoB,EAC9D,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4DAA4D,EAC5D;gBACE,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,yBAAyB,EAAE,MAAM,CAAC,oBAAoB;gBACtD,2BAA2B;aAC5B,CACF,CAAC;YACF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,4BAA4B;gBAC1D,OAAO,EAAE,EAAE,MAAM,EAAE,oCAAoC,EAAE;aAC1D,CACF,CAAC;QACJ,CAAC;QAED,iEAAiE;QACjE,0EAA0E;QAC1E,uEAAuE;QACvE,2CAA2C;QAC3C,gGAAgG;QAChG,oGAAoG;QACpG,oGAAoG;QACpG,sGAAsG;QACtG,qGAAqG;QACrG,uFAAuF;QACvF,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,MAAM,kCAAkC,CAC3E,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAC7C,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE;gBACtE,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,GAAG;gBACpB,aAAa;aACd,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,4BAA4B;aAC3D,CACF,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,iGAAiG;QACjG,8FAA8F;QAC9F,8FAA8F;QAC9F,MAAM,YAAY,GAAG,MAAM,gCAAgC,CACzD,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAChD,CAAC;QACF,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;gBACvE,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,MAAM,CAAC,GAAG;gBACpB,aAAa,EAAE,YAAY,CAAC,aAAa;aAC1C,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EACpB,2BAA2B,CAAC,4BAA4B;aAC3D,CACF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAS,GAAG,eAAe,CAAC,iBAAiB,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAChH,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,cAAc,KAAK,2BAA2B,CAAC,OAAO,EAAE,CAAC;gBAC3D,uEAAuE;gBACvE,sEAAsE;gBACtE,uEAAuE;gBACvE,8DAA8D;gBAC9D,sEAAsE;gBACtE,sEAAsE;gBACtE,kEAAkE;gBAClE,sEAAsE;gBACtE,oEAAoE;gBACpE,8DAA8D;gBAC9D,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAChD,GAAG,eAAe,CAAC,uBAAuB,GAAG,MAAM,CAAC,GAAG,EAAE,CAC1D,CAAC;gBACF,IAAI,cAAc,EAAE,CAAC;oBACnB,oEAAoE;oBACpE,qEAAqE;oBACrE,kEAAkE;oBAClE,qDAAqD;oBACrD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2GAA2G,EAAE;wBAC5H,GAAG,EAAE,MAAM,CAAC,GAAG;wBACf,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,IAAI,EAAE,MAAM,CAAC,IAAI;qBAClB,CAAC,CAAC;oBACH,OAAO,cAAc,CAAC;gBACxB,CAAC;gBAED,qEAAqE;gBACrE,sDAAsD;gBACtD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mFAAmF,EAAE;oBACpG,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,MAAM,EAAG,MAAM,CAAC,MAAM;oBACtB,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC,CAAC;gBACH,kEAAkE;gBAClE,sEAAsE;gBACtE,iEAAiE;gBACjE,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC;gBACrF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,EACzD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAC7B,EAAE,GAAG,EAAE,gBAAgB,GAAG,KAAK,EAAE,CAClC,CAAC;gBACF,+FAA+F;gBAC/F,kGAAkG;gBAClG,gGAAgG;gBAChG,mGAAmG;gBACnG,kGAAkG;gBAClG,MAAM,0BAA0B,CAC9B,IAAI,CAAC,YAAY,CAAC,UAAU,CAC1B,SAAS,CAAC,cAAc,EACxB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B,EAAE,CAC3E,EACX;oBACE,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,SAAS,EAAE,MAAM,CAAC,GAAG;oBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,aAAa,EAAE,IAAI;iBACpB,CACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CACF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,wEAAwE;QACxE,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE,EAAE,MAAM,EAAG,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1G,MAAM,iBAAiB,GAAG,MAAM,CAAC,mBAAmB,CAAC;QACrD,MAAM,qBAAqB,GAAG,MAAM,CAAC,cAAc,CAAC;QACpD,MAAM,kBAAkB,GAAG,MAAM,CAAC,WAAW,CAAC;QAC9C,MAAM,0BAA0B,GAAG,MAAM,CAAC,qBAAqB,CAAC;QAEhE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAC9C,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,SAAS,EAChB,IAAI,EACJ;YACE,mBAAmB,EAAE,iBAAiB;YACtC,cAAc,EAAE,qBAAqB;YACrC,WAAW,EAAE,kBAAkB,IAAI,WAAW,CAAC,UAAU;SAC1D,EACD;YACE,GAAG,CAAC,kBAAkB,KAAK,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,IAAI,CAAC,0BAA0B,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7G,4BAA4B,EAAE,MAAM,CAAC,oBAAoB;SAC1D,CACF,CAAC;QAEF,gEAAgE;QAChE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;QACzD,IAAI,GAAG,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,iBAAiB,GAAG,MAAM,CAAC,GAAG,EAAE,EACnD,2BAA2B,CAAC,OAAO,EACnC,EAAE,GAAG,EAAE,CACR,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,kDAAkD,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YAE5F,yEAAyE;YACzE,wEAAwE;YACxE,yEAAyE;YACzE,sEAAsE;YACtE,0EAA0E;YAC1E,yEAAyE;YACzE,EAAE;YACF,wEAAwE;YACxE,sEAAsE;YACtE,gEAAgE;YAChE,uEAAuE;YACvE,sEAAsE;YACtE,uEAAuE;YACvE,iEAAiE;YACjE,wEAAwE;YACxE,wEAAwE;YACxE,mEAAmE;YACnE,sEAAsE;YACtE,oEAAoE;YACpE,sEAAsE;YACtE,0EAA0E;YAC1E,yEAAyE;YACzE,iEAAiE;YACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;YACrE,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,uBAAuB,GAAG,MAAM,CAAC,GAAG,EAAE,EACzD,SAAS,EACT,EAAE,GAAG,EAAE,QAAQ,EAAE,CAClB,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,uDAAuD,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;YACxG,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAClD,mEAAmE;QACnE,yDAAyD;QACzD,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;YACvD,IAAI,CAAC,QAAQ,CAAC,gEAAgE,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,gCAAgC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,yDAAyD,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC;QACtC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,2CAA2C,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,wDAAwD;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAE,GAAc,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe;QACvE,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,qDAAqD,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,iBAAiB,GAAG,GAAG,EAAE,EAAE,2BAA2B,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAExH,4CAA4C;QAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,mBAAmB,GAAG,MAAM,EAAE,CAAC,CAAC;YAC7F,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gDAAgD,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAClG,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,0BAA0B,CAAC,MAAc;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACrF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,oBAAoB,GAAG,MAAM,EAAE,EAClD,UAAU,EACV,EAAE,GAAG,EAAE,gBAAgB,GAAG,KAAK,EAAE,CAClC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACrF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,sBAAsB,GAAG,SAAS,EAAE,EACvD,UAAU,EACV,EAAE,GAAG,EAAE,gBAAgB,GAAG,KAAK,EAAE,CAClC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;IACzG,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,4BAA4B,CAAC,MAAc,EAAE,MAAc,EAAE,cAAuB;QAChG,MAAM,cAAc,GAAG,cAAc;YACnC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,cAAc,CAAC;YAC1D,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,aAAa,GAAG,cAAc,EAAE,IAAI,EAAE,qBAAqB,CAAC;QAClE,MAAM,WAAW,GAAG,CAAC,aAAa,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,+BAA+B,CAAC;QAC3G,gEAAgE;QAChE,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACrF,MAAM,MAAM,GAAG,gBAAgB,GAAG,KAAK,CAAC;QACxC,MAAM,eAAe,GAAG,yBAAyB,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,mBAAmB,GAAG,MAAM,EAAE,CAAC,CAAC;QAE7F,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAC/C,+BAA+B,EAC/B,CAAC,MAAM,CAAC,EACR,CAAC,MAAM,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CACpD,CAAC;YAErB,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,+FAA+F;gBAC/F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChD,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC5B,MAAM,YAAY,GAAG,iCAAiC,CAAC;wBACrD,QAAQ,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC;wBAC7B,eAAe;wBACf,sBAAsB,EAAE,MAAM;qBAC/B,CAAC,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,iBAAiB,GAAG,GAAG,EAAE,EAC5C,2BAA2B,CAAC,OAAO,EACnC,EAAE,GAAG,EAAE,YAAY,EAAE,CACtB,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,2DAA2D,EAAE;oBACzE,MAAM;oBACN,YAAY,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC;oBACrC,WAAW;iBACZ,CAAC,CAAC;gBACH,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0DAA0D;YAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE;gBACnE,MAAM;gBACN,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACK,eAAe,CAAC,KAKvB;QACC,gGAAgG;QAChG,kGAAkG;QAClG,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,KAAK,UAAU;YAChF,CAAC,CAAC,IAAI,CAAC,gBAAgB;YACvB,CAAC,CAAC,SAAS,CAAC;QAEd,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAClE,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAC7C,8FAA8F;YAC9F,wBAAwB;YACxB,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC1B,MAAM,oBAAoB,GAAG,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;YACrF,oBAAoB,CAAC;gBACnB,WAAW,EAAE,oBAAoB,CAAC,oBAAoB;gBACtD,IAAI,EAAE,OAAO;oBACX,CAAC,CAAC,GAAY,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC;wBAC7C,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,UAAU;wBACV,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;wBAClG,iBAAiB,EAAE,KAAK,CAAC,WAAW;wBACpC,aAAa,EAAE,KAAK,CAAC,WAAW;qBACjC,CAAC;oBACF,CAAC,CAAC,SAAS;gBACb,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,2FAA2F;gBAC3F,yFAAyF;gBACzF,OAAO,EAAE;oBACP,cAAc,EAAE,KAAK,CAAC,MAAM;oBAC5B,kBAAkB,EAAE,UAAU;oBAC9B,yBAAyB,EAAE,KAAK,CAAC,WAAW;iBAC7C;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF,CAAA;AAhxBY,6BAA6B;IADzC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAC5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IAOtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;IASvD,WAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;qCAtBM,aAAa;QACO,uBAAuB;QAC5B,iBAAiB;QACb,0BAA0B;QACjC,YAAY,YAEI,yCAAyC;QAQ9F,uBAAuB;GAlBjD,6BAA6B,CAgxBzC","sourcesContent":["import 'reflect-metadata';\nimport crypto from 'crypto';\nimport { inject, injectable, optional } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport { AuthenticationSession, ExecutionContext_ExecutionType, SessionType, ErrorType, ErrorCustomMessageReference, CoreResourceType, UserStatus } from '@wildo-ai/saas-models';\nimport {\n JwtClaim_App_Auth_UserRequest_Schema,\n JwtClaim_App_RefreshToken_Schema,\n Jwt_RefreshToken_CreationParameter,\n} from '~wildo-backend-lib/security/authentications/models/authentications.backend.schemas';\nimport { AUTH_REDIS_KEYS, RefreshTokenBlacklistReason, REFRESH_TOKEN_ROTATION_GRACE_SECONDS } from '~wildo-backend-lib/security/authentications/models/auth-constants.backend';\nimport {\n buildSessionOrderingScore,\n CONCURRENT_SESSION_EVICTION_LUA,\n readIssuedAtMilliseconds,\n resolveEvictedJtiBlacklistSeconds,\n} from '~wildo-backend-lib/security/authentications/services/utils/concurrent-session-eviction.backend.utils';\nimport { evaluateUserTokenInvalidationFence } from '~wildo-backend-lib/security/token-invalidation-fence.backend.utils';\nimport { evaluateSessionInvalidationFence } from '~wildo-backend-lib/security/session-invalidation-fence.backend.utils';\nimport {\n AuditObservationKind,\n type AuditObservationLossMetricsRecorder,\n emitAuditObservation,\n} from '~wildo-backend-lib/monitoring/observability/audit-observation-emission.backend';\nimport {\n getUserAuthorizationVersion,\n type AuthorizationVersionedUser,\n} from '~wildo-backend-lib/security/authentications/models/user-authorization-version.backend.utils';\n\n/** L3: Default max concurrent refresh tokens per user. /\nconst DEFAULT_MAX_CONCURRENT_SESSIONS = 10;\n\n/\n Result of token issuance.\n /\nexport interface AuthTokens {\n accessToken: string;\n refreshToken?: string;\n expiresIn?: number;\n}\n\n/\n A-9 — the machine-readable signal a refresh-token REUSE rejection carries so a CALLER can audit the\n * theft. This issuer performs the family-wide revocation itself but deliberately does NOT audit\n * (see the class JSDoc — TRAP 13: callers decide what to audit); instead it TAGS its thrown rejection\n * with this signal, and each refresh caller reads it via {@link extractRefreshTokenReuseSignal} and\n * emits `USER_REFRESH_TOKEN_REUSE_DETECTED`. Never carries the raw token — only the reused `jti`.\n /\nexport interface RefreshTokenReuseSignal {\n /* The user whose whole token family was revoked (the victim). /\n userId: string;\n /* The reused refresh token's `jti` (the replayed credential id). /\n reusedJti: string;\n /* The session the reused token belonged to, when present on the claim. /\n sessionId?: string;\n /* Whether the `TOKEN_INVALID_BEFORE` family-revoke was written (the action the issuer took). /\n familyRevoked: boolean;\n}\n\n/\n Symbol-keyed so the signal rides the thrown rejection object WITHOUT ever appearing in a string-key\n * serialization or the error sanitizer (the reuse detail is internal, for the auditing caller only).\n * `Symbol.for` (the global registry, not a per-module `Symbol()`) so tag ⇄ extract still match if this\n * module is loaded under both ESM and CJS.\n /\nconst REFRESH_TOKEN_REUSE_SIGNAL_KEY = Symbol.for('wildo.auth.refreshTokenReuseSignal');\n\n/\n Tag a refresh-rejection error with the reuse signal (A-9). The issuer calls this after performing the\n * family revoke; the CALLER reads it back and emits the audit — preserving the issuer's no-audit boundary.\n /\nexport function tagRefreshTokenReuseSignal<E extends object>(error: E, signal: RefreshTokenReuseSignal): E {\n Object.defineProperty(error, REFRESH_TOKEN_REUSE_SIGNAL_KEY, {\n value: signal,\n enumerable: false,\n writable: false,\n configurable: false,\n });\n return error;\n}\n\n/\n Read the refresh-reuse signal off a caught error, or `null` when it is not a reuse rejection (a plain\n * revoked/expired/invalid refresh). A caller uses this to emit `USER_REFRESH_TOKEN_REUSE_DETECTED` for\n * the theft case ONLY, then map the error to its own rejection.\n /\nexport function extractRefreshTokenReuseSignal(error: unknown): RefreshTokenReuseSignal \| null {\n if (error !== null && typeof error === 'object' && REFRESH_TOKEN_REUSE_SIGNAL_KEY in error) {\n return (error as Record<typeof REFRESH_TOKEN_REUSE_SIGNAL_KEY, RefreshTokenReuseSignal>)[REFRESH_TOKEN_REUSE_SIGNAL_KEY];\n }\n return null;\n}\n\n/\n AuthTokenIssuerBackendService\n \n Responsibilities:\n * - Issue access tokens (delegates to JwtBackendService)\n * - Issue refresh tokens (delegates to JwtBackendService)\n \n This service does NOT:\n * - Manage sessions (that's AuthSessionStore)\n * - Verify credentials (that's AuthCredentialVerifier)\n * - Audit log (TRAP 13: callers decide what to audit based on full context)\n /\n@injectable()\nexport class AuthTokenIssuerBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.JwtBackendService) private readonly jwtService: JwtBackendService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,\n @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory) private readonly authEcFactory: AuthExecutionContextFactoryBackendService,\n /\n * The audit trail, `@optional()` and APPENDED LAST — the constructor-parameter discipline, and\n * optional for a second reason: this service sits on the token-issuance path, so a host that\n * binds no audit service must still be able to issue tokens. An observer may never be able to\n * fail the thing it observes.\n /\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) @optional()\n private readonly auditLogsService: AuditLogsBackendService \| null = null,\n /\n * The loss counter behind {@link recordEvictions}, `@optional()` and APPENDED after the audit\n * trail for the same two reasons: the constructor-parameter discipline, and that a host binding\n * no metrics service must still issue tokens. Its absence degrades a dropped eviction record to\n * the log channel — never to a refusal, which would put token issuance behind an observability\n * binding.\n /\n @inject(SAAS_SERVICE_TYPES.MetricsService) @optional()\n private readonly metricsService?: AuditObservationLossMetricsRecorder,\n ) {\n this.logDebug = this.logger.debugByType('AuthTokenIssuer');\n this.logger.setDebugTypeLogging('AuthTokenIssuer', false);\n }\n\n /\n Issue access + refresh tokens for a completed authentication session.\n /\n public async issueTokens(\n session: AuthenticationSession,\n options: { includeRefreshToken?: boolean; lastAuthenticatedAt?: number; activeUserType?: string } = {},\n ): Promise<AuthTokens> {\n const userId = session.userId;\n\n if (!userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_NOT_FOUND,\n context: { missingField: 'userId' },\n });\n }\n\n return this._issueTokensForUser(userId, session.sessionId, options.includeRefreshToken ?? true, {\n lastAuthenticatedAt: options.lastAuthenticatedAt,\n activeUserType: options.activeUserType ?? session.activeUserType ?? undefined,\n });\n }\n\n /\n Issue tokens for an user directly (without a full session).\n * Used by OAuth2/SAML/registration callback flows (TRAP 12) which bypass the session state machine.\n * `activeUserType` is resolved internally from the user record when not provided.\n /\n public async issueTokensForUser(\n userId: string,\n sessionId?: string,\n stepUpClaims?: {\n lastAuthenticatedAt?: number;\n activeUserType?: string;\n sessionType?: SessionType;\n },\n options?: {\n skipSessionTracking?: boolean;\n refreshTokenExpiresAt?: Date;\n },\n ): Promise<AuthTokens> {\n return this._issueTokensForUser(userId, sessionId, true, stepUpClaims, options);\n }\n\n /\n Internal implementation for token issuance.\n * Resolves `activeUserType` from the user DB record when not provided by the caller (N-2).\n /\n private async _issueTokensForUser(\n userId: string,\n sessionId?: string,\n includeRefreshToken: boolean = true,\n stepUpClaims?: {\n lastAuthenticatedAt?: number;\n activeUserType?: string;\n sessionType?: SessionType;\n },\n options?: {\n skipSessionTracking?: boolean;\n refreshTokenExpiresAt?: Date;\n /\n Refresh rotation passes the predecessor's durable authorization\n * version. Rechecking it on the issuance read closes the gap between the\n * refresh preflight read and successor signing.\n /\n expectedAuthorizationVersion?: number;\n },\n ): Promise<AuthTokens> {\n let emailVerified: boolean \| undefined;\n let resolvedActiveUserType = stepUpClaims?.activeUserType;\n\n // Token issuance is a security decision, so the User read and its durable\n // version are mandatory. A best-effort read here would mint an unfenced\n // token precisely when the database boundary is unavailable.\n const tokenEc = await this.authEcFactory.createForAuthenticatedAuthOperation(\n userId,\n this.authEcFactory.getUsersReadOperationPath(),\n );\n const user =\n await this.servicesRegistryHandler.read<AuthorizationVersionedUser>(\n CoreResourceType.USERS,\n tokenEc,\n { _id: userId },\n );\n const authorizationVersion = getUserAuthorizationVersion(user);\n if (!user \|\| authorizationVersion === null) {\n // Two very different faults, deliberately reported apart. Collapsing them into one reason\n // string sent a production investigation looking for a missing version field when the row\n // itself may simply not have been readable — the caller-facing answer is identical either way\n // (fail closed), but the operator-facing one is not: \"no such row\" points at the read's scope\n // or at write visibility, \"no version\" points at the persistence contract.\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: {\n reason: user\n ? 'user_authorization_version_unreadable'\n : 'user_row_not_readable_for_issuance',\n userId,\n // Only ever the SHAPE of what came back — never the value, which is an authorization\n // fence and does not belong in a log line.\n authorizationVersionType: typeof (user as AuthorizationVersionedUser \| null)?._version,\n userStatus: user?.status,\n },\n },\n );\n }\n if (\n options?.expectedAuthorizationVersion !== undefined\n && authorizationVersion !== options.expectedAuthorizationVersion\n ) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: {\n reason: 'user_authorization_version_changed_during_issuance',\n userId,\n },\n },\n );\n }\n\n if (user.status === UserStatus.ACTIVE) {\n emailVerified = true;\n } else if (user.status === UserStatus.PENDING_VERIFICATION) {\n emailVerified = false;\n }\n\n // A caller-carried active type is valid only while the live User still\n // owns it. This prevents direct issuance from preserving a removed auth\n // policy even outside refresh rotation.\n if (resolvedActiveUserType && !user.userTypes?.includes(resolvedActiveUserType)\n ) {\n resolvedActiveUserType = undefined;\n }\n if (!resolvedActiveUserType && user.userTypes?.length) {\n resolvedActiveUserType = user.userTypes[0];\n }\n\n const lastAuthenticatedAt = stepUpClaims?.lastAuthenticatedAt;\n\n const accessClaim = JwtClaim_App_Auth_UserRequest_Schema.parse({\n type: ExecutionContext_ExecutionType.USER_REQUEST,\n userId,\n authorizationVersion,\n sessionType: stepUpClaims?.sessionType ?? SessionType.PERSISTENT,\n ...(emailVerified !== undefined ? { emailVerified } : {}),\n ...(lastAuthenticatedAt !== undefined ? { lastAuthenticatedAt } : {}),\n ...(resolvedActiveUserType ? { activeUserType: resolvedActiveUserType } : {}),\n // revocation-C: carry the session id onto the ACCESS claim (it was already on the refresh claim), so the\n // access-token guard can enforce a per-session revocation fence and the OIDC id_token can carry `sid`.\n ...(sessionId ? { sessionId } : {}),\n });\n\n const accessToken = await this.jwtService.createJwtForAppAuth(accessClaim);\n // Resolved AppConfiguration always has this field (required on\n // `AppConfiguration_JWT_Schema`); operator-authored value flows from\n // `wildo.infra.<env>.config.ts` `serviceAuth.accessTokenExpirationMinutes`\n // through apps-manager bootstrap material and is overlaid by\n // `app-configuration-loader.backend.service.ts`. No literal fallback\n // here on purpose — F-24 (Slice 3.3) made `serviceAuth` the single\n // source of truth, so a missing value should fail the boot rather than\n // silently downgrade to a 15-minute floor.\n const accessTokenMinutes = this.appConfigService.config.jwt.accessTokenExpirationMinutes;\n const accessTokenExpiresInSeconds = accessTokenMinutes 60;\n this.logDebug('Access token issued', { userId, expiresIn: accessTokenExpiresInSeconds });\n\n let refreshToken: string \| undefined;\n if (includeRefreshToken) {\n const jti = crypto.randomUUID();\n const refreshClaim: Jwt_RefreshToken_CreationParameter = {\n type: ExecutionContext_ExecutionType.USER_REQUEST,\n userId,\n authorizationVersion,\n jti,\n sessionId: sessionId,\n sessionType: stepUpClaims?.sessionType ?? SessionType.PERSISTENT,\n ...(lastAuthenticatedAt !== undefined ? { lastAuthenticatedAt } : {}),\n ...(resolvedActiveUserType ? { activeUserType: resolvedActiveUserType } : {}),\n ...(options?.refreshTokenExpiresAt ? { refreshTokenExpiresAt: Math.floor(options.refreshTokenExpiresAt.getTime() / 1000) } : {}),\n };\n\n refreshToken = await this.jwtService.createRefreshToken(\n refreshClaim,\n options?.refreshTokenExpiresAt\n ? { expiresInSeconds: Math.max(1, Math.floor((options.refreshTokenExpiresAt.getTime() - Date.now()) / 1000)) }\n : undefined,\n );\n\n if (!options?.skipSessionTracking) {\n await this._trackAndEnforceSessionLimit(userId, jti, resolvedActiveUserType);\n }\n\n this.logDebug('Refresh token issued', { userId, sessionType: stepUpClaims?.sessionType });\n }\n\n return {\n accessToken,\n refreshToken,\n expiresIn: accessTokenExpiresInSeconds,\n };\n }\n\n /*\n Refresh an access token using a valid refresh token.\n \n Flow:\n * 1. Verify the refresh token JWT signature + expiration\n * 2. Parse claims using JwtClaim_App_RefreshToken_Schema (discriminated union)\n * 3. Issue a fresh access token for the same user\n * 4. Optionally rotate the refresh token (always rotate for security)\n \n @param refreshToken - The JWT refresh token string\n * @returns Fresh access + refresh tokens\n * @throws AUTHENTICATION error if the refresh token is invalid/expired\n /\n public async refreshAccessToken(refreshToken: string): Promise<AuthTokens> {\n // Step 1: Verify the refresh token JWT (signature + expiry + audience=REFRESH_TOKEN)\n let decoded: unknown;\n try {\n decoded = await this.jwtService.verifyRefreshToken(refreshToken);\n } catch (error) {\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n },\n );\n }\n\n // Step 2: Parse claims using the discriminated union schema\n const parseResult = JwtClaim_App_RefreshToken_Schema.safeParse(decoded);\n if (!parseResult.success) {\n this.logger.warn('Refresh token claims failed validation', { issues: parseResult.error.issues });\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n },\n );\n }\n\n const claims = parseResult.data;\n\n // Step 2b: Read the live User and enforce the durable authorization fence\n // BEFORE the rotation-grace early return. A cached successor must not be\n // returned after userTypes/appRoles/status changed.\n const ec = await this.authEcFactory.createForAuthenticatedAuthOperation(\n claims.userId,\n this.authEcFactory.getUsersReadOperationPath(),\n );\n const currentUser =\n await this.servicesRegistryHandler.read<AuthorizationVersionedUser>(\n CoreResourceType.USERS,\n ec,\n { _id: claims.userId },\n );\n const currentAuthorizationVersion = getUserAuthorizationVersion(currentUser);\n if (!currentUser \|\| currentUser.status !== UserStatus.ACTIVE) {\n this.logger.warn('Refresh token for non-active user', {\n jti: claims.jti,\n userId: claims.userId,\n userStatus: currentUser?.status ?? 'NOT_FOUND',\n });\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n context: {\n userStatus: currentUser?.status ?? 'NOT_FOUND',\n source: 'token_refresh',\n },\n },\n );\n }\n if (\n currentAuthorizationVersion === null\n \|\| currentAuthorizationVersion !== claims.authorizationVersion\n ) {\n this.logger.warn(\n 'Refresh token authorization version no longer matches User',\n {\n jti: claims.jti,\n userId: claims.userId,\n tokenAuthorizationVersion: claims.authorizationVersion,\n currentAuthorizationVersion,\n },\n );\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n context: { reason: 'user_authorization_version_changed' },\n },\n );\n }\n\n // Keep explicit all-session invalidation (password reset / theft\n // detection) ahead of rotation grace as well. AuthorizationVersion closes\n // database authorization races; this timestamp remains the independent\n // credential/session revocation mechanism.\n // GRACE-BOUNDARY (fixed here 2026-07-29, moved to the shared owner 2026-08-01). The fail-closed\n // `<=` — and the full rationale for why the same second must be rejected, and why raising timestamp\n // precision alone would NOT fix it — now lives in {@link evaluateUserTokenInvalidationFence}, which\n // every auth front shares. It was six hand-written copies of this comparison that let the fix land on\n // two of them while four kept the bypassing `<`. Refresh-specific note: this fence is checked BEFORE\n // rotation grace, so a stolen chain cannot ride the grace window past an invalidation.\n const { isRevoked, invalidBefore } = await evaluateUserTokenInvalidationFence(\n this.redisService, claims.userId, claims.iat,\n );\n if (isRevoked) {\n this.logger.warn('Refresh token issued before user-level invalidation', {\n jti: claims.jti,\n userId: claims.userId,\n tokenIat: claims.iat,\n invalidBefore,\n });\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n },\n );\n }\n\n // revocation-C: PER-SESSION fence. Distinct from the user-wide fence above — a single-session\n // terminate (OIDC end_session / per-device logout) evicts THIS session's refresh chain while the\n // user's other sessions stay live. Checked here so the terminated session cannot rotate a new\n // access token; the access guard checks the same fence so the current access token also dies.\n const sessionFence = await evaluateSessionInvalidationFence(\n this.redisService, claims.sessionId, claims.iat,\n );\n if (sessionFence.isRevoked) {\n this.logger.warn('Refresh token issued before per-session invalidation', {\n jti: claims.jti,\n userId: claims.userId,\n sessionId: claims.sessionId,\n tokenIat: claims.iat,\n invalidBefore: sessionFence.invalidBefore,\n });\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference:\n ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n },\n );\n }\n\n // Step 2c: Check JTI blacklist (revoked tokens) with reuse detection.\n const blacklistValue = await this.redisService.get<string>(`${AUTH_REDIS_KEYS.REFRESH_BLACKLIST}${claims.jti}`);\n if (blacklistValue) {\n if (blacklistValue === RefreshTokenBlacklistReason.ROTATED) {\n // IDEMPOTENT-ROTATION GRACE (checked BEFORE theft revocation): a token\n // re-presented within {@link REFRESH_TOKEN_ROTATION_GRACE_SECONDS} of\n // its rotation is almost always a benign race — a lost/retried refresh\n // response, or a second browsing context that read the shared\n // `__wildo_refresh` cookie a beat before the rotation replaced it. In\n // that case the original rotation cached its successor tokens; return\n // that SAME successor so the racing client converges on one token\n // family instead of being force-logged-out. Genuine theft re-presents\n // the token long after this window, by which time the grace key has\n // expired and control falls through to full revocation below.\n const graceSuccessor = await this.redisService.get<AuthTokens>(\n `${AUTH_REDIS_KEYS.REFRESH_GRACE_SUCCESSOR}${claims.jti}`,\n );\n if (graceSuccessor) {\n // Both durable authorizationVersion and explicit Redis invalidation\n // were checked above. Returning the exact cached successor therefore\n // grants nothing beyond the legitimate rotation winner and cannot\n // bypass an intervening User authorization mutation.\n this.logger.info('Refresh-token reuse within rotation grace window — returning cached successor (benign race, NOT revoking)', {\n jti: claims.jti,\n userId: claims.userId,\n type: claims.type,\n });\n return graceSuccessor;\n }\n\n // REUSE DETECTED outside the grace window: the old refresh token may\n // have been stolen — revoke ALL tokens for this user.\n this.logger.warn('REFRESH TOKEN REUSE DETECTED — possible token theft, revoking all tokens for user', {\n jti: claims.jti,\n userId : claims.userId,\n type: claims.type,\n });\n // F-24 (Slice 3.3): refresh-token TTL is required on the resolved\n // AppConfiguration and authoritatively sourced from operator-authored\n // `serviceAuth.refreshTokenExpirationDays`; no literal fallback.\n const refreshTokenDays = this.appConfigService.config.jwt.refreshTokenExpirationDays;\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.TOKEN_INVALID_BEFORE}${claims.userId}`,\n Math.floor(Date.now() / 1000),\n { ttl: refreshTokenDays 86400 },\n );\n // A-9: this issuer performed the family revoke but does NOT audit (TRAP 13 — see class JSDoc).\n // TAG the rejection with the reuse signal so the CALLER emits `USER_REFRESH_TOKEN_REUSE_DETECTED`\n // for this theft (the plain-revoked `else` below throws the UNtagged twin, so a routine revoked\n // token is not mis-audited as theft). Distinct throw here — never falls through to the shared one.\n // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — credential-theft detection + response.\n throw tagRefreshTokenReuseSignal(\n this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n { customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN },\n ) as object,\n {\n userId: claims.userId,\n reusedJti: claims.jti,\n sessionId: claims.sessionId,\n familyRevoked: true,\n },\n );\n } else {\n this.logger.warn('Refresh token has been revoked', { jti: claims.jti });\n }\n throw this.errorBuilder.buildError(\n ErrorType.AUTHENTICATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n },\n );\n }\n\n // Step 3: Issue new tokens — carry forward session-scoped claims, but\n // require the issuance read to observe this same authorization version.\n this.logDebug('Refresh token validated, issuing new tokens', { userId : claims.userId, jti: claims.jti });\n const refreshLastAuthAt = claims.lastAuthenticatedAt;\n const refreshActiveUserType = claims.activeUserType;\n const refreshSessionType = claims.sessionType;\n const refreshTokenExpiresAtClaim = claims.refreshTokenExpiresAt;\n\n const newTokens = await this._issueTokensForUser(\n claims.userId,\n claims.sessionId,\n true,\n {\n lastAuthenticatedAt: refreshLastAuthAt,\n activeUserType: refreshActiveUserType,\n sessionType: refreshSessionType ?? SessionType.PERSISTENT,\n },\n {\n ...(refreshSessionType === SessionType.ONE_OFF ? { skipSessionTracking: true } : {}),\n ...(refreshTokenExpiresAtClaim ? { refreshTokenExpiresAt: new Date(refreshTokenExpiresAtClaim * 1000) } : {}),\n expectedAuthorizationVersion: claims.authorizationVersion,\n },\n );\n\n // Step 4: Blacklist the consumed refresh token JTI as 'rotated'\n const nowSeconds = Math.floor(Date.now() / 1000);\n const ttl = claims.exp ? claims.exp - nowSeconds : 86400;\n if (ttl > 0 && claims.jti) {\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.REFRESH_BLACKLIST}${claims.jti}`,\n RefreshTokenBlacklistReason.ROTATED,\n { ttl },\n );\n this.logDebug('Old refresh token JTI blacklisted after rotation', { jti: claims.jti, ttl });\n\n // Cache the successor under the consumed JTI for the idempotent-rotation\n // grace window so a benign reuse race returns THIS exact successor (see\n // Step 2b) instead of being revoked. The TTL is the grace window clamped\n // to the consumed token's own remaining lifetime — the grace entry is\n // ALWAYS shorter-lived than the blacklist entry above, so once it expires\n // a re-presented token still trips full revocation (theft is preserved).\n //\n // AT-REST EXPOSURE (accepted, bounded): this is the ONLY place the auth\n // subsystem writes live token material to Redis — `REFRESH_BLACKLIST`\n // holds only reason strings, `TOKEN_INVALID_BEFORE` timestamps,\n // `ACTIVE_REFRESH_JTIS` only JTIs, and the session store holds session\n // state, never tokens. We store the FULL successor (incl. the refresh\n // token) because the idempotent guarantee requires returning the exact\n // same tokens — re-issuing would mint a divergent family, and an\n // access-token-only cache would break the lost-rotation-response client\n // (its cookie is still the now-blacklisted predecessor, so it needs the\n // successor refresh token re-sent via `Set-Cookie` to advance). An\n // attacker with Redis read access (snapshot/AOF dump, MONITOR, leaked\n // backup) could therefore harvest refresh tokens minted in the last\n // `graceTtl` seconds — but such an attacker already reads the session\n // store, so the marginal blast radius is one short window. If that window\n // ever needs hardening, encrypt this blob at rest (the read site already\n // fails closed to revocation on a parse miss). It is NOT logged.\n const graceTtl = Math.min(REFRESH_TOKEN_ROTATION_GRACE_SECONDS, ttl);\n if (graceTtl > 0) {\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.REFRESH_GRACE_SUCCESSOR}${claims.jti}`,\n newTokens,\n { ttl: graceTtl },\n );\n this.logDebug('Cached rotation successor for idempotent-grace window', { jti: claims.jti, graceTtl });\n }\n }\n\n return newTokens;\n }\n\n /*\n Revoke a refresh token by adding its JTI to the Redis blacklist.\n * TTL matches the token's remaining lifetime so the entry auto-expires.\n \n Called from the logout route handler.\n /\n public async revokeRefreshToken(refreshToken: string): Promise<void> {\n // Decode the token to extract JTI and exp. We verify the signature\n // so that arbitrary strings can't pollute the blacklist.\n let decoded: unknown;\n try {\n decoded = await this.jwtService.verifyRefreshToken(refreshToken);\n } catch {\n // Token is already invalid/expired — nothing to revoke\n this.logDebug('Refresh token revocation skipped — token is invalid or expired');\n return;\n }\n\n const parseResult = JwtClaim_App_RefreshToken_Schema.safeParse(decoded);\n if (!parseResult.success) {\n this.logDebug('Refresh token revocation skipped — claims are malformed');\n return;\n }\n\n const { jti, exp } = parseResult.data;\n if (!jti) {\n this.logDebug('Refresh token revocation skipped — no JTI');\n return;\n }\n\n // TTL = remaining seconds until token naturally expires\n const nowSeconds = Math.floor(Date.now() / 1000);\n const ttl = exp ? (exp as number) - nowSeconds : 86400; // fallback 24h\n if (ttl <= 0) {\n this.logDebug('Refresh token already expired — no blacklist needed', { jti });\n return;\n }\n\n await this.redisService.set(`${AUTH_REDIS_KEYS.REFRESH_BLACKLIST}${jti}`, RefreshTokenBlacklistReason.REVOKED, { ttl });\n\n // L3: Remove from active refresh tokens set\n const claims = parseResult.data;\n const userId = claims.userId;\n try {\n const setKey = this.redisService.buildKey(`${AUTH_REDIS_KEYS.ACTIVE_REFRESH_JTIS}${userId}`);\n await this.redisService.eval('redis.call(\"ZREM\", KEYS[1], ARGV[1]); return 1', [setKey], [jti]);\n } catch {\n // Non-fatal\n }\n\n this.logDebug('Refresh token revoked', { jti, ttlSeconds: ttl });\n }\n\n /\n Invalidate all refresh tokens for an user by setting a per-user\n * \"invalid before\" timestamp in Redis. All refresh tokens with `iat` before\n * this timestamp will be rejected on next use.\n \n Used on password change/reset (C4) and token reuse detection (H3).\n * TTL matches operator-authored `serviceAuth.refreshTokenExpirationDays`\n * (F-24, Slice 3.3); no literal fallback.\n /\n public async invalidateAllTokensForUser(userId: string): Promise<void> {\n const nowSeconds = Math.floor(Date.now() / 1000);\n const refreshTokenDays = this.appConfigService.config.jwt.refreshTokenExpirationDays;\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.TOKEN_INVALID_BEFORE}${userId}`,\n nowSeconds,\n { ttl: refreshTokenDays 86400 },\n );\n this.logDebug('All tokens invalidated for user', { userId, invalidBefore: nowSeconds });\n }\n\n /*\n revocation-C: invalidate a SINGLE login session by setting a per-session \"invalid before\"\n * timestamp in Redis. Every access/refresh token whose `sessionId` matches AND whose `iat` is at or\n * before this timestamp is rejected on next use — at every first-party auth front: the refresh exchange\n * ({@link refreshAccessToken}), the first-party access guard (`auth-jwt-guard.extractAuthenticatedUser`),\n * and the manual-controller / resource-API / socket-handshake fronts (`execution-context-creator`), all\n * via {@link evaluateSessionInvalidationFence}.\n \n This is the least-privilege sibling of {@link invalidateAllTokensForUser}: it terminates ONE\n * session (the OIDC `end_session_endpoint` / RP-Initiated Logout, and per-device logout), leaving the\n * user's other sessions live. TTL matches operator-authored `jwt.refreshTokenExpirationDays` — the\n * fence only needs to outlive the longest-lived token that could still carry this `sessionId`, after\n * which no such token can exist and the key is dead weight.\n /\n public async invalidateSession(sessionId: string): Promise<void> {\n const nowSeconds = Math.floor(Date.now() / 1000);\n const refreshTokenDays = this.appConfigService.config.jwt.refreshTokenExpirationDays;\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.SESSION_INVALID_BEFORE}${sessionId}`,\n nowSeconds,\n { ttl: refreshTokenDays 86400 },\n );\n this.logDebug('Session invalidated (per-session fence set)', { sessionId, invalidBefore: nowSeconds });\n }\n\n /*\n L3: Track an active refresh token JTI for an user and enforce the concurrent session limit.\n \n Uses a Redis sorted set per user where:\n * - Members = JTI strings\n * - Scores = issuedAt in MILLISECONDS (for FIFO eviction)\n \n When the set exceeds the max size (default 10), the oldest JTI(s) are evicted\n * and blacklisted so they can't be used anymore.\n \n The ordering, the score's unit, and the blacklist TTL all live in\n * `concurrent-session-eviction.backend.utils` — retiring the OLDEST chain is the security property\n * the cap exists to provide, so it is a named, separately-tested policy rather than a detail of\n * this method. See {@link buildSessionOrderingScore} for why whole-second scores silently made the\n * eviction arbitrary.\n /\n private async _trackAndEnforceSessionLimit(userId: string, newJti: string, activeUserType?: string): Promise<void> {\n const userTypeConfig = activeUserType\n ? this.appConfigService.config.userTypes?.[activeUserType]\n : undefined;\n const configuredMax = userTypeConfig?.auth?.maxConcurrentSessions;\n const maxSessions = (configuredMax && configuredMax > 0) ? configuredMax : DEFAULT_MAX_CONCURRENT_SESSIONS;\n // F-24 (Slice 3.3): operator-authored TTL; no literal fallback.\n const refreshTokenDays = this.appConfigService.config.jwt.refreshTokenExpirationDays;\n const setTtl = refreshTokenDays 86400;\n const nowMilliseconds = buildSessionOrderingScore();\n const setKey = this.redisService.buildKey(`${AUTH_REDIS_KEYS.ACTIVE_REFRESH_JTIS}${userId}`);\n\n try {\n const evictedPairs = await this.redisService.eval(\n CONCURRENT_SESSION_EVICTION_LUA,\n [setKey],\n [newJti, String(nowMilliseconds), String(maxSessions), String(setTtl)],\n ) as string[] \| null;\n\n if (evictedPairs && evictedPairs.length > 0) {\n // evictedPairs is [jti, score, jti, score, ...] — blacklist each with its actual remaining TTL\n for (let i = 0; i < evictedPairs.length; i += 2) {\n const jti = evictedPairs[i];\n const remainingTtl = resolveEvictedJtiBlacklistSeconds({\n rawScore: evictedPairs[i + 1],\n nowMilliseconds,\n refreshTokenTtlSeconds: setTtl,\n });\n await this.redisService.set(\n `${AUTH_REDIS_KEYS.REFRESH_BLACKLIST}${jti}`,\n RefreshTokenBlacklistReason.EVICTED,\n { ttl: remainingTtl },\n );\n }\n this.logDebug('Concurrent session limit enforced — evicted oldest tokens', {\n userId,\n evictedCount: evictedPairs.length / 2,\n maxSessions,\n });\n this.recordEvictions({ userId, evictedPairs, maxSessions, nowMilliseconds });\n }\n } catch (error) {\n // Non-fatal: don't block token issuance if tracking fails\n this.logger.warn('Failed to track/enforce concurrent session limit', {\n userId,\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n /*\n Record each retired refresh chain in the audit trail.\n \n Until 2026-09-02 the only trace of an eviction was the debug line above — a security-relevant\n * token-lifecycle act with no durable record, which is exactly what `CLAUDE.md`'s\n * assurance-by-construction rule asks for by name. The cap exists to bound the blast radius of\n * undetected token theft, so a burst of evictions for one principal is among the more interesting\n * things the trail can carry, and it was not carrying it.\n \n `evictedIssuedAt` is what makes the record worth having: the cap's security property is that the\n * OLDEST chain goes, and a record naming only the victim would prove a session ended without\n * proving the right one did. An unreadable score yields ABSENCE rather than a synthesised instant —\n * a fabricated timestamp would make the first-in-first-out claim unfalsifiable.\n \n Feature-DETECTED rather than null-checked, for the reason recorded at the cross-tenant emitter:\n * adding a `log` method breaks partially-mocked doubles, the property is absent, and the CALL\n throws synchronously before any `.catch()` can make it fire-and-forget.\n \n ## Why the detection decides an ARGUMENT rather than an early return\n \n Every emission goes through {@link emitAuditObservation}, which counts a lost one on\n * `audit_observation_dropped_total`. Handing the seam `undefined` is how this site reports\n * `SERVICE_UNAVAILABLE` — the loss shape that reaches no `_createAuditLog` and therefore used to\n * leave nothing behind at all. Returning early on an absent method would restore that silence,\n * which matters here more than it looks: an unbound audit service makes the eviction trail\n * PERMANENTLY empty, and an empty eviction trail reads as \"the cap never fired\".\n \n The count is per RETIRED CHAIN, not per enforcement — one lost row is one lost row, and a cap\n * that evicts four chains while the sink is down has lost four pieces of evidence. The\n * `!evictedJti` skip stays ABOVE the emission for the opposite reason: a pair with no jti is\n * nothing owed, and counting a deliberate skip would fire the loss signal on correct behaviour.\n \n assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — the bound's enforcement is\n * evidenced, naming WHICH chain was retired and when it was issued.\n */\n private recordEvictions(input: {\n userId: string;\n evictedPairs: string[];\n maxSessions: number;\n nowMilliseconds: number;\n }): void {\n // Narrowed to a VALUE rather than to a boolean flag: the emitting closure is created inside the\n // loop, and a captured `const` that is already non-nullish needs no narrowing to survive into it.\n const emitter = typeof this.auditLogsService?.logUserSessionEvicted === 'function'\n ? this.auditLogsService\n : undefined;\n\n for (let index = 0; index < input.evictedPairs.length; index += 2) {\n const evictedJti = input.evictedPairs[index];\n // Nothing was owed for this pair — a deliberate skip, kept above the emission so it can never\n // be counted as a loss.\n if (!evictedJti) continue;\n const issuedAtMilliseconds = readIssuedAtMilliseconds(input.evictedPairs[index + 1]);\n emitAuditObservation({\n observation: AuditObservationKind.USER_SESSION_EVICTED,\n emit: emitter\n ? (): unknown => emitter.logUserSessionEvicted({\n userId: input.userId,\n evictedJti,\n ...(issuedAtMilliseconds === undefined ? {} : { evictedIssuedAt: new Date(issuedAtMilliseconds) }),\n configuredMaximum: input.maxSessions,\n retainedCount: input.maxSessions,\n })\n : undefined,\n metricsService: this.metricsService,\n logger: this.logger,\n // Enough to reconstruct the lost row from the application log: WHOSE session, WHICH chain,\n // and under what bound. The jti is the identity the audit row itself would have carried.\n context: {\n observedUserId: input.userId,\n observedEvictedJti: evictedJti,\n observedConfiguredMaximum: input.maxSessions,\n },\n });\n }\n }\n}\n"]}

package/dist/esm/security/authentications/services/authentication-orchestrator.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authentication-orchestrator.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/security/authentications/services/authentication-orchestrator.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EACL,yBAAyB,EACzB,eAAe,EAOf,mBAAmB,EAGpB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAEhK,OAAO,EAQL,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EAOtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAA4C,MAAM,uBAAuB,CAAC;AACrG,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAmB,oBAAoB,EAAE,sBAAsB,EAAE,kBAAkB,EAAmB,MAAM,uBAAuB,CAAC;AAQ7N,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAOzH,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,KAAK,EACV,2CAA2C,EAC5C,MAAM,yFAAyF,CAAC;AAGjG,OAAO,EAAE,8BAA8B,EAAE,MAAM,yFAAyF,CAAC;AACzI,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,6BAA6B,EAAmB,MAAM,wFAAwF,CAAC;AACxJ,OAAO,EAAE,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AAIpI,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AAExG,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AACzJ,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wGAAwG,CAAC;AACpJ,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AAEjK,OAAO,EAAE,qBAAqB,EAAE,MAAM,4FAA4F,CAAC;AACnI,OAAO,EAAE,sCAAsC,EAAE,MAAM,8GAA8G,CAAC;AACtK,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AASjJ;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,2BAA2B,GAAG,sBAAsB,GAAG;IACjE;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,wCAAwC;IAgCd,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACpC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEjC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAErB,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEhC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAEtB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEtD,OAAO,CAAC,QAAQ,CAAC,eAAe;IAEhB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAEzC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAExB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAGnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE1E,OAAO,CAAC,QAAQ,CAAC,6BAA6B;IAIH,OAAO,CAAC,QAAQ,CAAC,cAAc;IAlE5E,uHAAuH;IACvH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gCAAgC,CAAM;IAC9D,qHAAqH;IACrH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iCAAiC,CAAK;IAC9D,uEAAuE;IACvE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAK;IAEzD;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oCAAoC,CAAiB;IAC7E,2HAA2H;IAC3H,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mCAAmC,CAAU;IAErE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IAExF;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAA6B;gBAGhB,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACtC,YAAY,EAAE,0BAA0B,EAC7B,uBAAuB,EAAE,qCAAqC,EAC1D,oBAAoB,EAAE,yCAAyC,EACjF,gBAAgB,EAAE,uBAAuB,EAEzC,YAAY,EAAE,8BAA8B,EACtC,kBAAkB,EAAE,oCAAoC,EAC/D,WAAW,EAAE,6BAA6B,EAEnC,sBAAsB,EAAE,6BAA6B,EAC/D,YAAY,EAAE,YAAY,EACf,gBAAgB,EAAE,uBAAuB,EAExC,iBAAiB,EAAE,+BAA+B,EAEtC,gBAAgB,EAAE,oCAAoC,EAE3E,eAAe,EAAE,sBAAsB,EAEvB,cAAc,EAAE,sCAAsC,EAEhE,UAAU,EAAE,4BAA4B,EAErC,aAAa,EAAE,+BAA+B,EAGnD,mBAAmB,EAAE,0BAA0B,EACpD,cAAc,EAAE,cAAc,EAEzE,6BAA6B,EAC5C,2CAA2C,EAGe,cAAc,EAAE,qBAAqB;IAMnG;;;;OAIG;IACH,OAAO,KAAK,aAAa,GAYxB;IAED,OAAO,KAAK,SAAS,GAEpB;IAED,OAAO,KAAK,eAAe,GAE1B;IAUD;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAQ1B;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAqC1C;IAEF;;;;OAIG;YACW,kCAAkC;IAUhD;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAQhC;;OAEG;IACH,OAAO,CAAC,6BAA6B;IAIrC,OAAO,CAAC,iCAAiC;IAsBzC,OAAO,CAAC,qBAAqB;IAM7B;;OAEG;IACH,+FAA+F;IAC/F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gCAAgC,CAAgB;YAE1D,aAAa;IAqD3B;;OAEG;YACW,UAAU;IA+BxB,0FAA0F;IAC1F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAK;IAEtD;;;;;;OAMG;YACW,aAAa;IA4C3B;;OAEG;YACW,aAAa;IAK3B;;;OAGG;YACW,wBAAwB;IAyDtC;;;;;;;;;;;;;;;;;OAiBG;YACW,2BAA2B;IAyCzC;;;;;;;;;;;OAWG;YACW,oBAAoB;IAiBlC;;OAEG;YACW,6BAA6B;IAuB3C,OAAO,CAAC,kBAAkB;IAS1B;;;OAGG;YACW,iCAAiC;IA6GlC,QAAQ,CACnB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,qBAAqB,EAAE,yBAAyB,EAChD,cAAc,CAAC,EAAE,MAAM,EACvB,mBAAmB,CAAC,EAAE,MAAM,GAC3B,OAAO,CAAC,0BAA0B,CAAC;IAwMtC;;;;;;;;;;;OAWG;IACU,gCAAgC,CAC3C,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,UAAU,EAAE,kBAAkB,EAC9B,eAAe,CAAC,EAAE,qBAAqB,GAAG,IAAI,GAC7C,OAAO,CAAC,eAAe,EAAE,CAAC;YAIf,+BAA+B;YAY/B,gCAAgC;IAiB9C;;;OAGG;YACW,wBAAwB;IAsBzB,oBAAoB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,mBAAmB,EAAE,mBAAmB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAsY5I;;;;OAIG;IACU,yBAAyB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,kBAAkB,CAAC;QAC7B,UAAU,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACxD,cAAc,CAAC,EAAE,MAAM,CAAC;KACpB,GACL,OAAO,CAAC,qBAAqB,CAAC;IAajC;;;;;;OAMG;IACU,wBAAwB,CACnC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,cAAc,CAAC,EAAE,MAAM,EACvB,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EACvD,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,qBAAqB,CAAC;IAiBjC;;;OAGG;YACW,4BAA4B;IAsE1C;;;OAGG;YACW,4BAA4B;IAgB1C;;;;OAIG;IACU,iCAAiC,CAC5C,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAwCjC;;;OAGG;IACU,qBAAqB,CAChC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,qBAAqB,CAAC;IAyOpB,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAoL1H;;;;;OAKG;IACU,6BAA6B,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAa/H;;;;;;;;OAQG;IACU,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAC/E,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;IAiIF;;;;;OAKG;IACU,oBAAoB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IA2EhI;;;OAGG;YACW,eAAe;IAkD7B;;;;;;OAMG;IACU,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAsFxH;;;;;;OAMG;IACU,mBAAmB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAwI9H;;;;;;;;;;;;;;;;OAgBG;YACW,iBAAiB;IA2E/B,0HAA0H;IAE1H;;;;;;;;;;;;;;;;;;;OAmBG;YACW,yCAAyC;IAcvD;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,0BAA0B;IAuHxC,4FAA4F;IAC5F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAsB;IAEnE;;;;OAIG;YACW,uBAAuB;IAoDrC;;;;OAIG;IACU,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,yBAAyB,UAAQ,GAAG,OAAO,CAAC;QACxL,OAAO,EAAE,IAAI,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IA4FF;;;OAGG;IACU,eAAe,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAoYhN;;;;OAIG;IACU,UAAU,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAiM1J;;;;OAIG;IACU,kBAAkB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAkG5H;;;OAGG;YACW,aAAa;IA0C3B;;OAEG;IACH,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,yBAAyB;IA6BjC,OAAO,CAAC,iCAAiC;IAmBzC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,iCAAiC;IA0DzC,OAAO,CAAC,gCAAgC;YAqC1B,2BAA2B;CAwH1C"}
1	+ {"version":3,"file":"authentication-orchestrator.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/services/authentication-orchestrator.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EACL,yBAAyB,EACzB,eAAe,EAOf,mBAAmB,EAGpB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAEhK,OAAO,EAQL,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EAOtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAA4C,MAAM,uBAAuB,CAAC;AACrG,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAmB,oBAAoB,EAAE,sBAAsB,EAAE,kBAAkB,EAAmB,MAAM,uBAAuB,CAAC;AAQ7N,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAOzH,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,KAAK,EACV,2CAA2C,EAC5C,MAAM,yFAAyF,CAAC;AAGjG,OAAO,EAAE,8BAA8B,EAAE,MAAM,yFAAyF,CAAC;AACzI,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,6BAA6B,EAAmB,MAAM,wFAAwF,CAAC;AACxJ,OAAO,EAAE,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AAIpI,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AAExG,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AACzJ,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wGAAwG,CAAC;AACpJ,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AAEjK,OAAO,EAAE,qBAAqB,EAAE,MAAM,4FAA4F,CAAC;AACnI,OAAO,EAAE,sCAAsC,EAAE,MAAM,8GAA8G,CAAC;AACtK,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AASjJ;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,2BAA2B,GAAG,sBAAsB,GAAG;IACjE;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,wCAAwC;IAgCd,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACpC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEjC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAErB,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEhC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAEtB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEtD,OAAO,CAAC,QAAQ,CAAC,eAAe;IAEhB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAEzC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAExB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAGnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE1E,OAAO,CAAC,QAAQ,CAAC,6BAA6B;IAIH,OAAO,CAAC,QAAQ,CAAC,cAAc;IAlE5E,uHAAuH;IACvH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gCAAgC,CAAM;IAC9D,qHAAqH;IACrH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iCAAiC,CAAK;IAC9D,uEAAuE;IACvE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAK;IAEzD;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oCAAoC,CAAiB;IAC7E,2HAA2H;IAC3H,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mCAAmC,CAAU;IAErE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IAExF;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAA6B;gBAGhB,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACtC,YAAY,EAAE,0BAA0B,EAC7B,uBAAuB,EAAE,qCAAqC,EAC1D,oBAAoB,EAAE,yCAAyC,EACjF,gBAAgB,EAAE,uBAAuB,EAEzC,YAAY,EAAE,8BAA8B,EACtC,kBAAkB,EAAE,oCAAoC,EAC/D,WAAW,EAAE,6BAA6B,EAEnC,sBAAsB,EAAE,6BAA6B,EAC/D,YAAY,EAAE,YAAY,EACf,gBAAgB,EAAE,uBAAuB,EAExC,iBAAiB,EAAE,+BAA+B,EAEtC,gBAAgB,EAAE,oCAAoC,EAE3E,eAAe,EAAE,sBAAsB,EAEvB,cAAc,EAAE,sCAAsC,EAEhE,UAAU,EAAE,4BAA4B,EAErC,aAAa,EAAE,+BAA+B,EAGnD,mBAAmB,EAAE,0BAA0B,EACpD,cAAc,EAAE,cAAc,EAEzE,6BAA6B,EAC5C,2CAA2C,EAGe,cAAc,EAAE,qBAAqB;IAMnG;;;;OAIG;IACH,OAAO,KAAK,aAAa,GAYxB;IAED,OAAO,KAAK,SAAS,GAEpB;IAED,OAAO,KAAK,eAAe,GAE1B;IAUD;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAQ1B;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAqC1C;IAEF;;;;OAIG;YACW,kCAAkC;IAUhD;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAQhC;;OAEG;IACH,OAAO,CAAC,6BAA6B;IAIrC,OAAO,CAAC,iCAAiC;IAsBzC,OAAO,CAAC,qBAAqB;IAM7B;;OAEG;IACH,+FAA+F;IAC/F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gCAAgC,CAAgB;YAE1D,aAAa;IAqD3B;;OAEG;YACW,UAAU;IA+BxB,0FAA0F;IAC1F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAK;IAEtD;;;;;;OAMG;YACW,aAAa;IA4C3B;;OAEG;YACW,aAAa;IAK3B;;;OAGG;YACW,wBAAwB;IAyDtC;;;;;;;;;;;;;;;;;OAiBG;YACW,2BAA2B;IAyCzC;;;;;;;;;;;OAWG;YACW,oBAAoB;IAiBlC;;OAEG;YACW,6BAA6B;IAuB3C,OAAO,CAAC,kBAAkB;IAS1B;;;OAGG;YACW,iCAAiC;IA6GlC,QAAQ,CACnB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,qBAAqB,EAAE,yBAAyB,EAChD,cAAc,CAAC,EAAE,MAAM,EACvB,mBAAmB,CAAC,EAAE,MAAM,GAC3B,OAAO,CAAC,0BAA0B,CAAC;IAwMtC;;;;;;;;;;;OAWG;IACU,gCAAgC,CAC3C,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,UAAU,EAAE,kBAAkB,EAC9B,eAAe,CAAC,EAAE,qBAAqB,GAAG,IAAI,GAC7C,OAAO,CAAC,eAAe,EAAE,CAAC;YAIf,+BAA+B;YAY/B,gCAAgC;IAiB9C;;;OAGG;YACW,wBAAwB;IAsBzB,oBAAoB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,mBAAmB,EAAE,mBAAmB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAsY5I;;;;OAIG;IACU,yBAAyB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,kBAAkB,CAAC;QAC7B,UAAU,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACxD,cAAc,CAAC,EAAE,MAAM,CAAC;KACpB,GACL,OAAO,CAAC,qBAAqB,CAAC;IAajC;;;;;;OAMG;IACU,wBAAwB,CACnC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,cAAc,CAAC,EAAE,MAAM,EACvB,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EACvD,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,qBAAqB,CAAC;IAiBjC;;;OAGG;YACW,4BAA4B;IAsE1C;;;OAGG;YACW,4BAA4B;IAgB1C;;;;OAIG;IACU,iCAAiC,CAC5C,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAwCjC;;;OAGG;IACU,qBAAqB,CAChC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,qBAAqB,CAAC;IAyOpB,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAoL1H;;;;;OAKG;IACU,6BAA6B,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAa/H;;;;;;;;OAQG;IACU,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAC/E,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;IAiIF;;;;;OAKG;IACU,oBAAoB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IA2EhI;;;OAGG;YACW,eAAe;IAkD7B;;;;;;OAMG;IACU,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAsFxH;;;;;;OAMG;IACU,mBAAmB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAwI9H;;;;;;;;;;;;;;;;OAgBG;YACW,iBAAiB;IA2E/B,0HAA0H;IAE1H;;;;;;;;;;;;;;;;;;;OAmBG;YACW,yCAAyC;IAcvD;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,0BAA0B;IAuHxC,4FAA4F;IAC5F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAsB;IAEnE;;;;OAIG;YACW,uBAAuB;IAoDrC;;;;OAIG;IACU,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,yBAAyB,UAAQ,GAAG,OAAO,CAAC;QACxL,OAAO,EAAE,IAAI,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IA4FF;;;OAGG;IACU,eAAe,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAoYhN;;;;OAIG;IACU,UAAU,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAiM1J;;;;OAIG;IACU,kBAAkB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAkG5H;;;OAGG;YACW,aAAa;IA0C3B;;OAEG;IACH,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,yBAAyB;IA6BjC,OAAO,CAAC,iCAAiC;IAmBzC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,iCAAiC;IA0DzC,OAAO,CAAC,gCAAgC;YAqC1B,2BAA2B;CAwH1C"}