@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (1056) hide show
  1. package/dist/esm/__tests__/fixture-deep-partial.d.ts.map +1 -1
  2. package/dist/esm/__tests__/integration/redis-integration-gate.d.ts.map +1 -1
  3. package/dist/esm/__tests__/setup.d.ts.map +1 -1
  4. package/dist/esm/__tests__/test-container.d.ts.map +1 -1
  5. package/dist/esm/applications/models/applications.backend.schemas.d.ts.map +1 -1
  6. package/dist/esm/applications/seeds/application-metadata-defaults.seeds.d.ts.map +1 -1
  7. package/dist/esm/applications/services/worker-remote-client-factory.backend.service.d.ts.map +1 -1
  8. package/dist/esm/applications/services/worker-remote-client-factory.backend.service.js.map +1 -1
  9. package/dist/esm/base-classes/models/manual-controllers.backend.definition.d.ts.map +1 -1
  10. package/dist/esm/base-classes/models/manual-controllers.backend.definition.js.map +1 -1
  11. package/dist/esm/base-classes/models/repositories.backend.schemas.d.ts.map +1 -1
  12. package/dist/esm/base-classes/services/__tests__/mock-resource-operation-helper.service.d.ts +1 -1
  13. package/dist/esm/base-classes/services/__tests__/mock-resource-operation-helper.service.d.ts.map +1 -1
  14. package/dist/esm/base-classes/services/batches/batches-cronjobs-custom-execution.service.d.ts.map +1 -1
  15. package/dist/esm/base-classes/services/batches/batches-cronjobs-executor.backend.service.d.ts.map +1 -1
  16. package/dist/esm/base-classes/services/batches/batches-cronjobs-resource-execution.backend.service.d.ts.map +1 -1
  17. package/dist/esm/base-classes/services/batches/child-lifecycle-teardown.batch.backend.service.d.ts.map +1 -1
  18. package/dist/esm/base-classes/services/batches/child-lifecycle-teardown.batch.backend.service.js.map +1 -1
  19. package/dist/esm/base-classes/services/batches/credential-expiry-sweep.batch.backend.service.d.ts.map +1 -1
  20. package/dist/esm/base-classes/services/batches/credential-expiry-sweep.batch.backend.service.js +12 -1
  21. package/dist/esm/base-classes/services/batches/credential-expiry-sweep.batch.backend.service.js.map +1 -1
  22. package/dist/esm/base-classes/services/batches/engine-custom-batch-manifests.d.ts.map +1 -1
  23. package/dist/esm/base-classes/services/batches/engine-custom-batch-manifests.js.map +1 -1
  24. package/dist/esm/base-classes/services/batches/resource-retention-sweep.batch.backend.service.d.ts.map +1 -1
  25. package/dist/esm/base-classes/services/batches/suspension-reactivation-sweep.batch.backend.service.d.ts.map +1 -1
  26. package/dist/esm/base-classes/services/controllers/abstract-controller.backend.service.d.ts.map +1 -1
  27. package/dist/esm/base-classes/services/controllers/controller-resource.backend.service.d.ts.map +1 -1
  28. package/dist/esm/base-classes/services/controllers/controller-resource.backend.service.js.map +1 -1
  29. package/dist/esm/base-classes/services/controllers/controllers-registry-handler.backend.service.d.ts.map +1 -1
  30. package/dist/esm/base-classes/services/controllers/controllers-registry-handler.backend.service.js.map +1 -1
  31. package/dist/esm/base-classes/services/controllers/utils/audit-access-fields.backend.utils.d.ts.map +1 -1
  32. package/dist/esm/base-classes/services/controllers/utils/operation-response-serializer.backend.utils.d.ts.map +1 -1
  33. package/dist/esm/base-classes/services/controllers/validate-field-handler.backend.service.d.ts.map +1 -1
  34. package/dist/esm/base-classes/services/repositories/__tests__/method-span-scan.guard-helpers.d.ts.map +1 -1
  35. package/dist/esm/base-classes/services/repositories/__tests__/mock-repositories-registry-handler.service.d.ts.map +1 -1
  36. package/dist/esm/base-classes/services/repositories/field-clearing-partition.backend.d.ts.map +1 -1
  37. package/dist/esm/base-classes/services/repositories/http-api/http-api-filter-translation.backend.d.ts.map +1 -1
  38. package/dist/esm/base-classes/services/repositories/http-api/http-api-provider-access.backend.d.ts.map +1 -1
  39. package/dist/esm/base-classes/services/repositories/http-api/http-api-provider-access.backend.js +13 -4
  40. package/dist/esm/base-classes/services/repositories/http-api/http-api-provider-access.backend.js.map +1 -1
  41. package/dist/esm/base-classes/services/repositories/http-api/http-api-query.backend.d.ts.map +1 -1
  42. package/dist/esm/base-classes/services/repositories/http-api/http-api-read-client.backend.d.ts.map +1 -1
  43. package/dist/esm/base-classes/services/repositories/http-api/http-api-read-client.backend.js +17 -0
  44. package/dist/esm/base-classes/services/repositories/http-api/http-api-read-client.backend.js.map +1 -1
  45. package/dist/esm/base-classes/services/repositories/http-api/http-api-resource-repository.backend.service.d.ts.map +1 -1
  46. package/dist/esm/base-classes/services/repositories/http-api/http-api-resource-repository.backend.service.js.map +1 -1
  47. package/dist/esm/base-classes/services/repositories/http-api/http-api-rest-operation-reference.backend.d.ts.map +1 -1
  48. package/dist/esm/base-classes/services/repositories/http-api/http-api-rest-operation-reference.backend.js.map +1 -1
  49. package/dist/esm/base-classes/services/repositories/http-api/http-api-row-projection.backend.d.ts.map +1 -1
  50. package/dist/esm/base-classes/services/repositories/http-api/http-api-subject-erasure-effect.backend.d.ts.map +1 -1
  51. package/dist/esm/base-classes/services/repositories/http-api/http-api-transport.backend.d.ts.map +1 -1
  52. package/dist/esm/base-classes/services/repositories/http-api/http-api-transport.backend.js.map +1 -1
  53. package/dist/esm/base-classes/services/repositories/http-api/odata-query-compiler.backend.d.ts.map +1 -1
  54. package/dist/esm/base-classes/services/repositories/http-api/odoo-jsonrpc-compiler.backend.d.ts.map +1 -1
  55. package/dist/esm/base-classes/services/repositories/http-api/rest-json-query-compiler.backend.d.ts.map +1 -1
  56. package/dist/esm/base-classes/services/repositories/infrastructure-tier-contract.backend.d.ts.map +1 -1
  57. package/dist/esm/base-classes/services/repositories/infrastructure-tier-contract.backend.js.map +1 -1
  58. package/dist/esm/base-classes/services/repositories/introspection/introspection-resource-repository.backend.service.d.ts.map +1 -1
  59. package/dist/esm/base-classes/services/repositories/introspection/introspection-resource-source.backend.port.d.ts.map +1 -1
  60. package/dist/esm/base-classes/services/repositories/postgresql-resource-repository.backend.service.d.ts +57 -0
  61. package/dist/esm/base-classes/services/repositories/postgresql-resource-repository.backend.service.d.ts.map +1 -1
  62. package/dist/esm/base-classes/services/repositories/postgresql-resource-repository.backend.service.js +95 -2
  63. package/dist/esm/base-classes/services/repositories/postgresql-resource-repository.backend.service.js.map +1 -1
  64. package/dist/esm/base-classes/services/repositories/repositories-registry-handler.backend.service.d.ts.map +1 -1
  65. package/dist/esm/base-classes/services/repositories/repositories-registry-handler.backend.service.js.map +1 -1
  66. package/dist/esm/base-classes/services/repositories/repository-guarded-mutation.backend.types.d.ts.map +1 -1
  67. package/dist/esm/base-classes/services/repositories/repository-resource.backend.service.d.ts +5 -2
  68. package/dist/esm/base-classes/services/repositories/repository-resource.backend.service.d.ts.map +1 -1
  69. package/dist/esm/base-classes/services/repositories/repository-resource.backend.service.js +14 -3
  70. package/dist/esm/base-classes/services/repositories/repository-resource.backend.service.js.map +1 -1
  71. package/dist/esm/base-classes/services/repositories/repository-version-metadata.backend.utils.d.ts.map +1 -1
  72. package/dist/esm/base-classes/services/repositories/resource-write-integrity.backend.d.ts.map +1 -1
  73. package/dist/esm/base-classes/services/repositories/seed-row-default-materialization.backend.d.ts +72 -0
  74. package/dist/esm/base-classes/services/repositories/seed-row-default-materialization.backend.d.ts.map +1 -0
  75. package/dist/esm/base-classes/services/repositories/seed-row-default-materialization.backend.js +88 -0
  76. package/dist/esm/base-classes/services/repositories/seed-row-default-materialization.backend.js.map +1 -0
  77. package/dist/esm/base-classes/services/repositories/unique-constraint-conflict-reference.backend.d.ts.map +1 -1
  78. package/dist/esm/base-classes/services/resource-operations-helper.backend.service.d.ts.map +1 -1
  79. package/dist/esm/base-classes/services/services/__tests__/mock-services-registry-handler.service.d.ts.map +1 -1
  80. package/dist/esm/base-classes/services/services/__tests__/mock-system-access.service.d.ts.map +1 -1
  81. package/dist/esm/base-classes/services/services/read-only-field-change.backend.utils.d.ts.map +1 -1
  82. package/dist/esm/base-classes/services/services/resource-operation-audit-emission.backend.utils.d.ts.map +1 -1
  83. package/dist/esm/base-classes/services/services/resource-operation-custom-implementation-base.backend.service.d.ts.map +1 -1
  84. package/dist/esm/base-classes/services/services/resource-operation-custom-implementation-base.backend.service.js.map +1 -1
  85. package/dist/esm/base-classes/services/services/resource-operation-custom-implementation-registry.backend.service.d.ts.map +1 -1
  86. package/dist/esm/base-classes/services/services/resource-operation-custom-implementation.factory.backend.d.ts.map +1 -1
  87. package/dist/esm/base-classes/services/services/resource-operation-implementation-coverage.backend.utils.d.ts.map +1 -1
  88. package/dist/esm/base-classes/services/services/resource-operation-server-injected-fields.backend.utils.d.ts.map +1 -1
  89. package/dist/esm/base-classes/services/services/resource-operation-transaction-persistence.backend.utils.d.ts.map +1 -1
  90. package/dist/esm/base-classes/services/services/resource-status-transition.custom-impl.backend.service.d.ts.map +1 -1
  91. package/dist/esm/base-classes/services/services/resource-status-transition.custom-impl.backend.service.js.map +1 -1
  92. package/dist/esm/base-classes/services/services/resource-status-transition.definitions.backend.d.ts.map +1 -1
  93. package/dist/esm/base-classes/services/services/resource-status-transition.definitions.backend.js.map +1 -1
  94. package/dist/esm/base-classes/services/services/services-registry-handler.backend.service.d.ts.map +1 -1
  95. package/dist/esm/base-classes/services/services/services-registry-handler.backend.service.js +44 -6
  96. package/dist/esm/base-classes/services/services/services-registry-handler.backend.service.js.map +1 -1
  97. package/dist/esm/base-classes/services/services/system-access.backend.service.d.ts.map +1 -1
  98. package/dist/esm/base-classes/services/services/system-access.backend.service.js.map +1 -1
  99. package/dist/esm/base-classes/utils/backend-type-utils.d.ts.map +1 -1
  100. package/dist/esm/base-classes/utils/single-subject-addressing.backend.utils.d.ts.map +1 -1
  101. package/dist/esm/billing/batches/billing-reconciliation.batch.backend.service.d.ts.map +1 -1
  102. package/dist/esm/billing/batches/billing-reconciliation.batch.backend.service.js.map +1 -1
  103. package/dist/esm/billing/batches/usage-flush.batch.backend.service.d.ts.map +1 -1
  104. package/dist/esm/billing/batches/usage-flush.batch.backend.service.js.map +1 -1
  105. package/dist/esm/billing/models/billing-provider-event-settlement.backend.schemas.d.ts.map +1 -1
  106. package/dist/esm/billing/models/billing-provider-event-settlement.backend.schemas.js.map +1 -1
  107. package/dist/esm/billing/services/back-office/abstract-billing.backend.service.d.ts.map +1 -1
  108. package/dist/esm/billing/services/back-office/billing-feature-sync.backend.service.d.ts.map +1 -1
  109. package/dist/esm/billing/services/back-office/billing-reconciliation.backend.service.d.ts +1 -1
  110. package/dist/esm/billing/services/back-office/billing-reconciliation.backend.service.d.ts.map +1 -1
  111. package/dist/esm/billing/services/back-office/billing-reconciliation.backend.service.js +5 -4
  112. package/dist/esm/billing/services/back-office/billing-reconciliation.backend.service.js.map +1 -1
  113. package/dist/esm/billing/services/back-office/billing-state.backend.service.d.ts.map +1 -1
  114. package/dist/esm/billing/services/back-office/billing-state.backend.service.js +11 -1
  115. package/dist/esm/billing/services/back-office/billing-state.backend.service.js.map +1 -1
  116. package/dist/esm/billing/services/back-office/billing-subject-erasure-effect.backend.d.ts.map +1 -1
  117. package/dist/esm/billing/services/back-office/product-catalog-sync.backend.service.d.ts.map +1 -1
  118. package/dist/esm/billing/services/back-office/product-catalog-sync.backend.service.js.map +1 -1
  119. package/dist/esm/billing/services/back-office/usage-metering.backend.service.d.ts.map +1 -1
  120. package/dist/esm/billing/services/back-office/usage-metering.backend.service.js.map +1 -1
  121. package/dist/esm/billing/services/billing-adapter-registry.backend.d.ts.map +1 -1
  122. package/dist/esm/billing/services/billing-adapter-registry.backend.js.map +1 -1
  123. package/dist/esm/billing/services/billing-checkout-metadata.backend.utils.d.ts.map +1 -1
  124. package/dist/esm/billing/services/billing-checkout-metadata.backend.utils.js.map +1 -1
  125. package/dist/esm/billing/services/billing.utils.d.ts.map +1 -1
  126. package/dist/esm/billing/services/custom-impl/billing-account.mutations.custom-impl.backend.service.d.ts.map +1 -1
  127. package/dist/esm/billing/services/custom-impl/billing-account.mutations.custom-impl.backend.service.js.map +1 -1
  128. package/dist/esm/billing/services/custom-impl/billing-custom-impl-utils.backend.d.ts +32 -0
  129. package/dist/esm/billing/services/custom-impl/billing-custom-impl-utils.backend.d.ts.map +1 -1
  130. package/dist/esm/billing/services/custom-impl/billing-custom-impl-utils.backend.js +32 -1
  131. package/dist/esm/billing/services/custom-impl/billing-custom-impl-utils.backend.js.map +1 -1
  132. package/dist/esm/billing/services/custom-impl/billing-custom-implementations.backend.d.ts.map +1 -1
  133. package/dist/esm/billing/services/custom-impl/billing-custom-implementations.backend.js.map +1 -1
  134. package/dist/esm/billing/services/custom-impl/credit-pool.custom-ops.custom-impl.backend.service.d.ts.map +1 -1
  135. package/dist/esm/billing/services/custom-impl/promotion.custom-ops.custom-impl.backend.service.d.ts.map +1 -1
  136. package/dist/esm/billing/services/custom-impl/promotion.custom-ops.custom-impl.backend.service.js.map +1 -1
  137. package/dist/esm/billing/services/custom-impl/subscription.mutations.custom-impl.backend.service.d.ts.map +1 -1
  138. package/dist/esm/billing/services/custom-impl/subscription.mutations.custom-impl.backend.service.js.map +1 -1
  139. package/dist/esm/billing/services/stripe-standard-billing-provider.backend.service.d.ts +9 -6
  140. package/dist/esm/billing/services/stripe-standard-billing-provider.backend.service.d.ts.map +1 -1
  141. package/dist/esm/billing/services/stripe-standard-billing-provider.backend.service.js +9 -6
  142. package/dist/esm/billing/services/stripe-standard-billing-provider.backend.service.js.map +1 -1
  143. package/dist/esm/billing/services/webhooks/__tests__/settlement-ledger.test-double.d.ts.map +1 -1
  144. package/dist/esm/billing/services/webhooks/__tests__/settlement-ledger.test-double.js.map +1 -1
  145. package/dist/esm/billing/services/webhooks/billing-webhook-adapter.backend.service.d.ts.map +1 -1
  146. package/dist/esm/billing/services/webhooks/billing-webhook-capability-handler.backend.service.d.ts.map +1 -1
  147. package/dist/esm/billing/services/webhooks/billing-webhook-event-router.backend.service.d.ts.map +1 -1
  148. package/dist/esm/billing/services/webhooks/billing-webhook-event-router.backend.service.js +50 -3
  149. package/dist/esm/billing/services/webhooks/billing-webhook-event-router.backend.service.js.map +1 -1
  150. package/dist/esm/billing/testing/billing-test-fixtures.d.ts.map +1 -1
  151. package/dist/esm/billing/testing/mock-billing-provider.d.ts.map +1 -1
  152. package/dist/esm/billing/testing/mock-billing-provider.js.map +1 -1
  153. package/dist/esm/charts/controllers/chart.backend.controller.d.ts.map +1 -1
  154. package/dist/esm/charts/services/chart-registry.backend.service.d.ts +80 -7
  155. package/dist/esm/charts/services/chart-registry.backend.service.d.ts.map +1 -1
  156. package/dist/esm/charts/services/chart-registry.backend.service.js +115 -8
  157. package/dist/esm/charts/services/chart-registry.backend.service.js.map +1 -1
  158. package/dist/esm/companion-exports.d.ts.map +1 -1
  159. package/dist/esm/compliance/audit-trails/audit-logs.custom-impl.backend.service.d.ts.map +1 -1
  160. package/dist/esm/compliance/audit-trails/batches/audit-logs-archive.batch.backend.service.d.ts.map +1 -1
  161. package/dist/esm/compliance/audit-trails/batches/audit-logs-archive.batch.backend.service.js.map +1 -1
  162. package/dist/esm/compliance/audit-trails/batches/immudb-audit-reconcile.batch.backend.service.d.ts.map +1 -1
  163. package/dist/esm/compliance/audit-trails/batches/siem-webhook-delivery.batch.backend.service.d.ts.map +1 -1
  164. package/dist/esm/compliance/audit-trails/services/__tests__/mock-audit-logs.service.d.ts.map +1 -1
  165. package/dist/esm/compliance/audit-trails/services/audit-event-dispatcher.backend.service.d.ts.map +1 -1
  166. package/dist/esm/compliance/audit-trails/services/audit-event-dispatcher.backend.service.js.map +1 -1
  167. package/dist/esm/compliance/audit-trails/services/audit-logs.backend.service.d.ts +107 -4
  168. package/dist/esm/compliance/audit-trails/services/audit-logs.backend.service.d.ts.map +1 -1
  169. package/dist/esm/compliance/audit-trails/services/audit-logs.backend.service.js +176 -5
  170. package/dist/esm/compliance/audit-trails/services/audit-logs.backend.service.js.map +1 -1
  171. package/dist/esm/compliance/audit-trails/services/composite-audit-log-sink.backend.d.ts.map +1 -1
  172. package/dist/esm/compliance/audit-trails/services/composite-audit-log-sink.backend.js.map +1 -1
  173. package/dist/esm/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.d.ts.map +1 -1
  174. package/dist/esm/compliance/audit-trails/services/siem-export-config-cache-invalidation.custom-impl.backend.service.js.map +1 -1
  175. package/dist/esm/compliance/audit-trails/services/siem-webhook-delivery.backend.service.d.ts.map +1 -1
  176. package/dist/esm/compliance/audit-trails/services/siem-webhook-delivery.backend.service.js.map +1 -1
  177. package/dist/esm/compliance/audit-trails/services/utils/leased-value-cache.backend.utils.d.ts.map +1 -1
  178. package/dist/esm/compliance/audit-trails/services/utils/leased-value-cache.backend.utils.js.map +1 -1
  179. package/dist/esm/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.d.ts.map +1 -1
  180. package/dist/esm/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.js +21 -0
  181. package/dist/esm/compliance/audit-trails/services/utils/ocsf-activity-mapping.backend.utils.js.map +1 -1
  182. package/dist/esm/compliance/audit-trails/services/utils/ocsf-class-mapping.backend.utils.d.ts.map +1 -1
  183. package/dist/esm/compliance/audit-trails/services/utils/siem-dictionary.backend.utils.d.ts.map +1 -1
  184. package/dist/esm/compliance/audit-trails/services/utils/siem-ocsf-projection.backend.utils.d.ts.map +1 -1
  185. package/dist/esm/compliance/audit-trails/services/utils/siem-projection-contract.backend.utils.d.ts.map +1 -1
  186. package/dist/esm/compliance/audit-trails/utils/audit-actor.backend.utils.d.ts.map +1 -1
  187. package/dist/esm/compliance/audit-trails/utils/layer2-audit-provider-boot-diagnostic.backend.utils.d.ts.map +1 -1
  188. package/dist/esm/compliance/index.d.ts.map +1 -1
  189. package/dist/esm/compliance/privacy/retention-hide-predicate.backend.d.ts.map +1 -1
  190. package/dist/esm/compliance/privacy/services/subject-erasure-external-effects.backend.service.d.ts.map +1 -1
  191. package/dist/esm/compliance/privacy/services/subject-session-revocation.backend.service.d.ts.map +1 -1
  192. package/dist/esm/config/bootstrap/application-runtime-profile.backend.d.ts.map +1 -1
  193. package/dist/esm/config/bootstrap/application-runtime-profile.backend.js.map +1 -1
  194. package/dist/esm/config/bootstrap/minion-initialization-projection.backend.d.ts.map +1 -1
  195. package/dist/esm/config/bootstrap/runtime-principal-attestation.backend.service.d.ts.map +1 -1
  196. package/dist/esm/config/bootstrap/runtime-principal-attestation.backend.service.js +3 -0
  197. package/dist/esm/config/bootstrap/runtime-principal-attestation.backend.service.js.map +1 -1
  198. package/dist/esm/config/bootstrap/runtime-principal.backend.service.d.ts.map +1 -1
  199. package/dist/esm/config/custom/application-config-controller.backend.service.d.ts.map +1 -1
  200. package/dist/esm/config/models/app-config-secrets.backend.schemas.d.ts.map +1 -1
  201. package/dist/esm/config/models/app-config.backend-authored.definitions.d.ts.map +1 -1
  202. package/dist/esm/config/models/app-config.backend.schemas.d.ts +4 -4
  203. package/dist/esm/config/models/app-config.backend.schemas.d.ts.map +1 -1
  204. package/dist/esm/config/models/app-config.backend.schemas.js.map +1 -1
  205. package/dist/esm/config/models/app-env-config.backend.schemas.d.ts.map +1 -1
  206. package/dist/esm/config/models/apps-manager-transport.backend.definitions.d.ts +36 -0
  207. package/dist/esm/config/models/apps-manager-transport.backend.definitions.d.ts.map +1 -0
  208. package/dist/esm/config/models/apps-manager-transport.backend.definitions.js +36 -0
  209. package/dist/esm/config/models/apps-manager-transport.backend.definitions.js.map +1 -0
  210. package/dist/esm/config/models/config-mutation-boundary.utils.d.ts.map +1 -1
  211. package/dist/esm/config/models/postgresql-env-config.backend.schemas.d.ts.map +1 -1
  212. package/dist/esm/config/models/provider-runtime-artifact.backend.schemas.d.ts.map +1 -1
  213. package/dist/esm/config/models/provider-runtime-artifact.backend.schemas.js.map +1 -1
  214. package/dist/esm/config/models/runtime-topology.backend.contracts.d.ts.map +1 -1
  215. package/dist/esm/config/services/__tests__/mock-app-configuration.service.d.ts.map +1 -1
  216. package/dist/esm/config/services/app-configuration-loader.backend.service.d.ts.map +1 -1
  217. package/dist/esm/config/services/app-configuration-loader.backend.service.js +3 -0
  218. package/dist/esm/config/services/app-configuration-loader.backend.service.js.map +1 -1
  219. package/dist/esm/config/services/app-configuration.backend.service.d.ts.map +1 -1
  220. package/dist/esm/config/services/app-configuration.backend.service.js.map +1 -1
  221. package/dist/esm/config/services/app-configuration.backend.utils.d.ts.map +1 -1
  222. package/dist/esm/config/services/app-configuration.backend.utils.js.map +1 -1
  223. package/dist/esm/config/services/application-startup-config-validator.backend.service.d.ts +12 -0
  224. package/dist/esm/config/services/application-startup-config-validator.backend.service.d.ts.map +1 -1
  225. package/dist/esm/config/services/application-startup-config-validator.backend.service.js +28 -0
  226. package/dist/esm/config/services/application-startup-config-validator.backend.service.js.map +1 -1
  227. package/dist/esm/data-seeding/batches/data-seeding-run-cleanup.batch.backend.service.d.ts.map +1 -1
  228. package/dist/esm/data-seeding/batches/data-seeding-scheduled-rerun.batch.backend.service.d.ts.map +1 -1
  229. package/dist/esm/data-seeding/controllers/data-seeding-admin.backend.contracts.d.ts.map +1 -1
  230. package/dist/esm/data-seeding/controllers/data-seeding-admin.backend.controller.d.ts.map +1 -1
  231. package/dist/esm/data-seeding/data-seeding-models.d.ts.map +1 -1
  232. package/dist/esm/data-seeding/models/business-key-resolver.shared.utils.d.ts.map +1 -1
  233. package/dist/esm/data-seeding/models/data-seed-execution-context.shared.types.d.ts.map +1 -1
  234. package/dist/esm/data-seeding/models/data-seed-migrator-runner.shared.utils.d.ts.map +1 -1
  235. package/dist/esm/data-seeding/models/data-seed-reconciler.shared.utils.d.ts.map +1 -1
  236. package/dist/esm/data-seeding/models/data-seed-row-metadata.shared.schemas.d.ts.map +1 -1
  237. package/dist/esm/data-seeding/models/data-seed-row-metadata.shared.utils.d.ts.map +1 -1
  238. package/dist/esm/data-seeding/models/data-seed-run.shared.resources-config.schemas.d.ts.map +1 -1
  239. package/dist/esm/data-seeding/models/data-seed-run.shared.schemas.d.ts.map +1 -1
  240. package/dist/esm/data-seeding/models/data-seed-trigger-mode-matrix.shared.utils.d.ts.map +1 -1
  241. package/dist/esm/data-seeding/models/data-seed.shared.schemas.d.ts.map +1 -1
  242. package/dist/esm/data-seeding/services/data-seed-application-bootstrap.backend.d.ts.map +1 -1
  243. package/dist/esm/data-seeding/services/data-seed-dispatcher.backend.service.d.ts.map +1 -1
  244. package/dist/esm/data-seeding/services/data-seed-registry.backend.service.d.ts.map +1 -1
  245. package/dist/esm/data-seeding/services/data-seed-scope-resolver-registry.backend.service.d.ts.map +1 -1
  246. package/dist/esm/data-seeding/services/engines/additive-seed-engine.backend.service.d.ts.map +1 -1
  247. package/dist/esm/data-seeding/services/engines/lazy-seed-engine.backend.service.d.ts.map +1 -1
  248. package/dist/esm/data-seeding/services/engines/manual-seed-engine.backend.service.d.ts.map +1 -1
  249. package/dist/esm/data-seeding/services/engines/sync-seed-engine.backend.service.d.ts.map +1 -1
  250. package/dist/esm/data-seeding/services/engines/upgrade-seed-engine.backend.service.d.ts.map +1 -1
  251. package/dist/esm/data-seeding/services/shared/data-seed-business-key.shared.utils.d.ts.map +1 -1
  252. package/dist/esm/data-seeding/services/shared/data-seed-error.shared.utils.d.ts.map +1 -1
  253. package/dist/esm/data-seeding/services/shared/data-seed-run-counters.shared.types.d.ts.map +1 -1
  254. package/dist/esm/data-seeding/services/shared/data-seed-run-ledger.backend.d.ts.map +1 -1
  255. package/dist/esm/data-seeding/services/shared/data-seed-scope-anchor.shared.types.d.ts.map +1 -1
  256. package/dist/esm/data-seeding/services/shared/data-seed-scope-iteration.shared.utils.d.ts.map +1 -1
  257. package/dist/esm/data-seeding/services/shared/data-seed-scope-resolution.backend.d.ts.map +1 -1
  258. package/dist/esm/databases/models/aggregation.backend.schemas.d.ts.map +1 -1
  259. package/dist/esm/databases/models/databases.backend.schemas.d.ts.map +1 -1
  260. package/dist/esm/databases/models/filter.backend.schemas.d.ts.map +1 -1
  261. package/dist/esm/databases/models/resolve-persistence-adapter.backend.utils.d.ts.map +1 -1
  262. package/dist/esm/databases/models/sql.backend.schemas.d.ts.map +1 -1
  263. package/dist/esm/databases/models/transaction.shared.schemas.d.ts.map +1 -1
  264. package/dist/esm/databases/services/__tests__/mock-mongo-transaction-registry.service.d.ts.map +1 -1
  265. package/dist/esm/databases/services/__tests__/mock-mongodb.service.d.ts.map +1 -1
  266. package/dist/esm/databases/services/__tests__/mock-mongoose-model.service.d.ts.map +1 -1
  267. package/dist/esm/databases/services/__tests__/mock-redis.service.d.ts.map +1 -1
  268. package/dist/esm/databases/services/__tests__/mock-zod-mongoose-schema-convertor.service.d.ts.map +1 -1
  269. package/dist/esm/databases/services/aggregation/aggregation-authorization.backend.service.d.ts.map +1 -1
  270. package/dist/esm/databases/services/aggregation/aggregation-query.backend.service.d.ts.map +1 -1
  271. package/dist/esm/databases/services/aggregation/computed-measure-evaluator.backend.service.d.ts.map +1 -1
  272. package/dist/esm/databases/services/aggregation/field-access-validator.backend.service.d.ts.map +1 -1
  273. package/dist/esm/databases/services/aggregation/time-series-densifier.backend.service.d.ts.map +1 -1
  274. package/dist/esm/databases/services/aggregation/topn-processor.backend.service.d.ts.map +1 -1
  275. package/dist/esm/databases/services/aggregation/window-function-processor.backend.service.d.ts.map +1 -1
  276. package/dist/esm/databases/services/db-utils.d.ts.map +1 -1
  277. package/dist/esm/databases/services/mongo-aggregation.backend.service.d.ts.map +1 -1
  278. package/dist/esm/databases/services/mongodb.service.d.ts.map +1 -1
  279. package/dist/esm/databases/services/postgresql-aggregation.backend.service.d.ts.map +1 -1
  280. package/dist/esm/databases/services/postgresql-database.backend.service.d.ts.map +1 -1
  281. package/dist/esm/databases/services/postgresql-development-provisioning.backend.d.ts.map +1 -1
  282. package/dist/esm/databases/services/postgresql-filter.backend.service.d.ts.map +1 -1
  283. package/dist/esm/databases/services/postgresql-migration-runner.backend.d.ts.map +1 -1
  284. package/dist/esm/databases/services/postgresql-schema-ddl.backend.d.ts.map +1 -1
  285. package/dist/esm/databases/services/postgresql-schema-migration-sql.backend.d.ts.map +1 -1
  286. package/dist/esm/databases/services/postgresql-schema-plan-diff.backend.d.ts.map +1 -1
  287. package/dist/esm/databases/services/postgresql-schema-plan-diff.backend.js.map +1 -1
  288. package/dist/esm/databases/services/postgresql-schema-plan-lockfile.backend.d.ts.map +1 -1
  289. package/dist/esm/databases/services/redis.service.d.ts.map +1 -1
  290. package/dist/esm/databases/services/resource-persistence-unit-of-work.backend.service.d.ts.map +1 -1
  291. package/dist/esm/databases/services/schema-planning-standalone.backend.d.ts.map +1 -1
  292. package/dist/esm/databases/services/zod-to-mongoose-schema-convertor.backend.service.d.ts.map +1 -1
  293. package/dist/esm/databases/services/zod-to-sql-hybrid-schema.planner.d.ts.map +1 -1
  294. package/dist/esm/databases/utils/postgresql-identifier.backend.utils.d.ts.map +1 -1
  295. package/dist/esm/errors/services/__tests__/mock-error-builder.service.d.ts.map +1 -1
  296. package/dist/esm/errors/services/error-builder.backend.service.d.ts.map +1 -1
  297. package/dist/esm/errors/services/error-builder.backend.service.js.map +1 -1
  298. package/dist/esm/errors/services/error-handler.backend.service.d.ts.map +1 -1
  299. package/dist/esm/errors/services/error-handler.backend.service.js.map +1 -1
  300. package/dist/esm/errors/services/rate-limit.backend.service.d.ts.map +1 -1
  301. package/dist/esm/errors/services/rate-limit.backend.service.js.map +1 -1
  302. package/dist/esm/errors/utils/error-log-level-classification.backend.utils.d.ts.map +1 -1
  303. package/dist/esm/errors/utils/error-log-level-classification.backend.utils.js.map +1 -1
  304. package/dist/esm/errors/utils/rate-limit-environment-relaxation.backend.utils.d.ts.map +1 -1
  305. package/dist/esm/errors/utils/rate-limit-environment-relaxation.backend.utils.js.map +1 -1
  306. package/dist/esm/external-data/batches/external-data-pipeline-scheduled-run.batch.backend.service.d.ts.map +1 -1
  307. package/dist/esm/external-data/controllers/external-data-admin.backend.contracts.d.ts.map +1 -1
  308. package/dist/esm/external-data/controllers/external-data-admin.backend.controller.d.ts.map +1 -1
  309. package/dist/esm/external-data/external-data-extraction-source.backend.d.ts.map +1 -1
  310. package/dist/esm/external-data/external-data-models.exports.d.ts.map +1 -1
  311. package/dist/esm/external-data/external-data-pipeline-run.backend.service.d.ts.map +1 -1
  312. package/dist/esm/external-data/external-data-pipeline-run.backend.service.js.map +1 -1
  313. package/dist/esm/external-data/external-data-transform.backend.d.ts.map +1 -1
  314. package/dist/esm/external-data/models/external-data-pipeline-state.backend.schemas.d.ts.map +1 -1
  315. package/dist/esm/external-providers/models/external-providers.backend.schemas.d.ts.map +1 -1
  316. package/dist/esm/external-providers/models/provider-selection-resolution-evidence.backend.definitions.d.ts.map +1 -1
  317. package/dist/esm/external-providers/models/provider-selection-resolution-evidence.backend.definitions.js.map +1 -1
  318. package/dist/esm/external-providers/operations/provider-operation-executor.backend.service.d.ts +102 -52
  319. package/dist/esm/external-providers/operations/provider-operation-executor.backend.service.d.ts.map +1 -1
  320. package/dist/esm/external-providers/operations/provider-operation-executor.backend.service.js +117 -71
  321. package/dist/esm/external-providers/operations/provider-operation-executor.backend.service.js.map +1 -1
  322. package/dist/esm/external-providers/operations/provider-operation-request.backend.d.ts.map +1 -1
  323. package/dist/esm/external-providers/operations/provider-operation-request.backend.js.map +1 -1
  324. package/dist/esm/external-providers/operations/provider-request-signing.backend.d.ts.map +1 -1
  325. package/dist/esm/external-providers/operations/provider-request-signing.backend.js +26 -7
  326. package/dist/esm/external-providers/operations/provider-request-signing.backend.js.map +1 -1
  327. package/dist/esm/external-providers/operations/provider-rest-call-client.backend.d.ts.map +1 -1
  328. package/dist/esm/external-providers/operations/provider-rest-call-client.backend.js.map +1 -1
  329. package/dist/esm/external-providers/services/__tests__/mock-external-providers-registry.service.d.ts.map +1 -1
  330. package/dist/esm/external-providers/services/__tests__/mock-external-providers-registry.service.js.map +1 -1
  331. package/dist/esm/external-providers/services/backend-provider-loader.backend.service.d.ts.map +1 -1
  332. package/dist/esm/external-providers/services/backend-provider-loader.backend.service.js.map +1 -1
  333. package/dist/esm/external-providers/services/backend-provider-registry.backend.service.d.ts.map +1 -1
  334. package/dist/esm/external-providers/services/backend-provider-registry.backend.service.js.map +1 -1
  335. package/dist/esm/external-providers/services/document-extraction.backend.service.d.ts +81 -34
  336. package/dist/esm/external-providers/services/document-extraction.backend.service.d.ts.map +1 -1
  337. package/dist/esm/external-providers/services/document-extraction.backend.service.js +179 -98
  338. package/dist/esm/external-providers/services/document-extraction.backend.service.js.map +1 -1
  339. package/dist/esm/external-providers/services/embeddings.backend.service.d.ts.map +1 -1
  340. package/dist/esm/external-providers/services/embeddings.backend.service.js.map +1 -1
  341. package/dist/esm/external-providers/services/external-api-handler.backend.service.d.ts.map +1 -1
  342. package/dist/esm/external-providers/services/external-providers-registry.backend.service.d.ts +121 -0
  343. package/dist/esm/external-providers/services/external-providers-registry.backend.service.d.ts.map +1 -1
  344. package/dist/esm/external-providers/services/external-providers-registry.backend.service.js +151 -0
  345. package/dist/esm/external-providers/services/external-providers-registry.backend.service.js.map +1 -1
  346. package/dist/esm/external-providers/services/frontend-bootstrap.backend.service.d.ts +15 -1
  347. package/dist/esm/external-providers/services/frontend-bootstrap.backend.service.d.ts.map +1 -1
  348. package/dist/esm/external-providers/services/frontend-bootstrap.backend.service.js +60 -4
  349. package/dist/esm/external-providers/services/frontend-bootstrap.backend.service.js.map +1 -1
  350. package/dist/esm/features/controllers/features.backend.controller.d.ts.map +1 -1
  351. package/dist/esm/features/services/__tests__/mock-feature-definition-registry.service.d.ts.map +1 -1
  352. package/dist/esm/features/services/__tests__/mock-feature-resolution.service.d.ts.map +1 -1
  353. package/dist/esm/features/services/application-features-admin-write-path.custom-impl.backend.service.d.ts.map +1 -1
  354. package/dist/esm/features/services/feature-definition-registry.backend.service.d.ts.map +1 -1
  355. package/dist/esm/features/services/feature-gate.backend.service.d.ts.map +1 -1
  356. package/dist/esm/features/services/feature-resolution.backend.service.d.ts.map +1 -1
  357. package/dist/esm/features/services/organization-features-admin-write-path.custom-impl.backend.service.d.ts.map +1 -1
  358. package/dist/esm/features/services/scope-feature-ledger-relationship.backend.utils.d.ts.map +1 -1
  359. package/dist/esm/features/services/scope-features-cache-invalidation.custom-impl.backend.service.d.ts.map +1 -1
  360. package/dist/esm/features/testing/feature-test-utils.d.ts.map +1 -1
  361. package/dist/esm/files/batches/files-cleanup.batch.backend.service.d.ts.map +1 -1
  362. package/dist/esm/files/constraints/file-analyzers.types.d.ts.map +1 -1
  363. package/dist/esm/files/constraints/file-constraint-resolver-chain.backend.service.d.ts.map +1 -1
  364. package/dist/esm/files/constraints/file-constraint.types.d.ts.map +1 -1
  365. package/dist/esm/files/constraints/file-validation.backend.service.d.ts.map +1 -1
  366. package/dist/esm/files/constraints/resource-field-constraint-resolver.backend.service.d.ts.map +1 -1
  367. package/dist/esm/files/controllers/file.controller.d.ts.map +1 -1
  368. package/dist/esm/files/controllers/file.controller.js.map +1 -1
  369. package/dist/esm/files/handlers/file-upload-route-locals.backend.types.d.ts.map +1 -1
  370. package/dist/esm/files/handlers/file-upload-route-locals.backend.types.js.map +1 -1
  371. package/dist/esm/files/handlers/resource-file-upload-handler.backend.service.d.ts +37 -0
  372. package/dist/esm/files/handlers/resource-file-upload-handler.backend.service.d.ts.map +1 -1
  373. package/dist/esm/files/handlers/resource-file-upload-handler.backend.service.js +221 -21
  374. package/dist/esm/files/handlers/resource-file-upload-handler.backend.service.js.map +1 -1
  375. package/dist/esm/files/scanning/clamav-scanner.backend.service.d.ts.map +1 -1
  376. package/dist/esm/files/scanning/file-scan.types.d.ts.map +1 -1
  377. package/dist/esm/files/scanning/yara-scanner.backend.service.d.ts.map +1 -1
  378. package/dist/esm/files/scanning/yara-scanner.backend.service.js +20 -2
  379. package/dist/esm/files/scanning/yara-scanner.backend.service.js.map +1 -1
  380. package/dist/esm/files/services/__tests__/mock-file-field-detection.service.d.ts.map +1 -1
  381. package/dist/esm/files/services/__tests__/mock-file-operation-handler.service.d.ts.map +1 -1
  382. package/dist/esm/files/services/__tests__/mock-file-repository.service.d.ts.map +1 -1
  383. package/dist/esm/files/services/file-field-detection.backend.service.d.ts.map +1 -1
  384. package/dist/esm/files/services/file-operation-handler.backend.service.d.ts.map +1 -1
  385. package/dist/esm/files/services/file-operation-handler.backend.service.js.map +1 -1
  386. package/dist/esm/files/services/file-population.backend.service.d.ts.map +1 -1
  387. package/dist/esm/files/services/file-scanning.backend.service.d.ts.map +1 -1
  388. package/dist/esm/files/services/file-scanning.backend.service.js +5 -0
  389. package/dist/esm/files/services/file-scanning.backend.service.js.map +1 -1
  390. package/dist/esm/files/services/file-text-extraction.backend.service.d.ts.map +1 -1
  391. package/dist/esm/files/services/file-text-extraction.backend.service.js +8 -5
  392. package/dist/esm/files/services/file-text-extraction.backend.service.js.map +1 -1
  393. package/dist/esm/files/services/file-upload-grant.backend.service.d.ts.map +1 -1
  394. package/dist/esm/files/services/file-upload-grant.backend.service.js.map +1 -1
  395. package/dist/esm/files/services/files.backend.service.d.ts.map +1 -1
  396. package/dist/esm/files/services/files.backend.service.js +3 -1
  397. package/dist/esm/files/services/files.backend.service.js.map +1 -1
  398. package/dist/esm/files/services/rag-source-field-detection.backend.service.d.ts.map +1 -1
  399. package/dist/esm/files/storage/application-storage-key.backend.utils.d.ts.map +1 -1
  400. package/dist/esm/files/storage/application-storage-key.backend.utils.js.map +1 -1
  401. package/dist/esm/files/storage/file-storage-path-resolver.backend.service.d.ts.map +1 -1
  402. package/dist/esm/files/storage/file-storage-provider.types.d.ts +36 -1
  403. package/dist/esm/files/storage/file-storage-provider.types.d.ts.map +1 -1
  404. package/dist/esm/files/storage/file-storage-provider.types.js.map +1 -1
  405. package/dist/esm/files/storage/file-storage-router.backend.service.d.ts +21 -3
  406. package/dist/esm/files/storage/file-storage-router.backend.service.d.ts.map +1 -1
  407. package/dist/esm/files/storage/file-storage-router.backend.service.js +38 -5
  408. package/dist/esm/files/storage/file-storage-router.backend.service.js.map +1 -1
  409. package/dist/esm/files/storage/google-drive-storage-provider.backend.service.d.ts +87 -0
  410. package/dist/esm/files/storage/google-drive-storage-provider.backend.service.d.ts.map +1 -0
  411. package/dist/esm/files/storage/google-drive-storage-provider.backend.service.js +340 -0
  412. package/dist/esm/files/storage/google-drive-storage-provider.backend.service.js.map +1 -0
  413. package/dist/esm/files/storage/local-directory-storage-provider.backend.service.d.ts.map +1 -1
  414. package/dist/esm/files/storage/local-directory-storage-provider.backend.service.js.map +1 -1
  415. package/dist/esm/files/storage/storage-credential-provider.backend.utils.d.ts.map +1 -1
  416. package/dist/esm/files/storage/storage-platform-sts-credential-resolver.backend.utils.d.ts.map +1 -1
  417. package/dist/esm/files/storage/storage-sts-credential-resolver.backend.utils.d.ts.map +1 -1
  418. package/dist/esm/files/storage/storage-sts-credential-resolver.backend.utils.js +10 -3
  419. package/dist/esm/files/storage/storage-sts-credential-resolver.backend.utils.js.map +1 -1
  420. package/dist/esm/files/storage/wildo-managed-storage-provider.backend.service.d.ts.map +1 -1
  421. package/dist/esm/files/storage/wildo-managed-storage-provider.backend.service.js.map +1 -1
  422. package/dist/esm/files/utils/file-field-schema-path.backend.utils.d.ts.map +1 -1
  423. package/dist/esm/files/utils/file-field-schema-path.backend.utils.js.map +1 -1
  424. package/dist/esm/files/utils/file-upload.utils.d.ts.map +1 -1
  425. package/dist/esm/files/utils/file-uploader.utils.d.ts.map +1 -1
  426. package/dist/esm/files/utils/file-uploader.utils.js.map +1 -1
  427. package/dist/esm/files/utils/file-validation.utils.d.ts.map +1 -1
  428. package/dist/esm/files/utils/image-derivation.backend.utils.d.ts.map +1 -1
  429. package/dist/esm/files/utils/image-thumbnail.backend.utils.d.ts.map +1 -1
  430. package/dist/esm/files/utils/office-document-text-extraction.backend.utils.d.ts.map +1 -1
  431. package/dist/esm/files/utils/office-document-text-extraction.backend.utils.js.map +1 -1
  432. package/dist/esm/files/utils/rag-source-field-schema-path.backend.utils.d.ts.map +1 -1
  433. package/dist/esm/files/utils/storage-application-identity.backend.utils.d.ts.map +1 -1
  434. package/dist/esm/flows-actors/a2a/batches/a2a-abandoned-task-sweep.batch.backend.service.d.ts.map +1 -1
  435. package/dist/esm/flows-actors/a2a/batches/a2a-abandoned-task-sweep.batch.backend.service.js.map +1 -1
  436. package/dist/esm/flows-actors/a2a/batches/a2a-push-delivery.batch.backend.service.d.ts.map +1 -1
  437. package/dist/esm/flows-actors/a2a/controllers/a2a.controller.d.ts.map +1 -1
  438. package/dist/esm/flows-actors/a2a/controllers/a2a.controller.js.map +1 -1
  439. package/dist/esm/flows-actors/a2a/models/a2a-dialect.backend.schemas.d.ts.map +1 -1
  440. package/dist/esm/flows-actors/a2a/models/a2a-push-notification-delivery.backend.utils.d.ts.map +1 -1
  441. package/dist/esm/flows-actors/a2a/models/a2a-push-notification.backend.schemas.d.ts.map +1 -1
  442. package/dist/esm/flows-actors/a2a/models/a2a.backend.schemas.d.ts.map +1 -1
  443. package/dist/esm/flows-actors/a2a/models/a2a.backend.schemas.js.map +1 -1
  444. package/dist/esm/flows-actors/a2a/services/a2a-push-delivery-log.repository.d.ts.map +1 -1
  445. package/dist/esm/flows-actors/a2a/services/a2a-push-dispatcher.backend.service.d.ts.map +1 -1
  446. package/dist/esm/flows-actors/a2a/services/a2a-task-cancellation.backend.service.d.ts.map +1 -1
  447. package/dist/esm/flows-actors/a2a/services/a2a-task-cancellation.backend.service.js.map +1 -1
  448. package/dist/esm/flows-actors/a2a/services/a2a-task.backend.service.d.ts.map +1 -1
  449. package/dist/esm/flows-actors/a2a/services/a2a-task.backend.service.js.map +1 -1
  450. package/dist/esm/flows-actors/a2a/services/a2a-token-budget.backend.service.d.ts.map +1 -1
  451. package/dist/esm/flows-actors/a2a/services/a2a-token-budget.backend.service.js.map +1 -1
  452. package/dist/esm/flows-actors/a2a/services/a2a.backend.service.d.ts.map +1 -1
  453. package/dist/esm/flows-actors/a2a/services/a2a.backend.service.js.map +1 -1
  454. package/dist/esm/flows-actors/controllers/flows-actors.controller.d.ts.map +1 -1
  455. package/dist/esm/flows-actors/models/agent-catalogs.backend.definitions.d.ts.map +1 -1
  456. package/dist/esm/flows-actors/models/agent-catalogs.backend.definitions.js.map +1 -1
  457. package/dist/esm/flows-actors/models/agent-facets.backend.definitions.d.ts.map +1 -1
  458. package/dist/esm/flows-actors/models/agents.backend.definitions.d.ts.map +1 -1
  459. package/dist/esm/flows-actors/models/core-facets.backend.definitions.d.ts.map +1 -1
  460. package/dist/esm/flows-actors/models/core-facets.backend.definitions.js.map +1 -1
  461. package/dist/esm/flows-actors/models/flows-actors.backend.definitions.d.ts.map +1 -1
  462. package/dist/esm/flows-actors/models/flows-actors.backend.schemas.d.ts.map +1 -1
  463. package/dist/esm/flows-actors/models/flows-actors.backend.schemas.js.map +1 -1
  464. package/dist/esm/flows-actors/models/function-tools.backend.definitions.d.ts +107 -16
  465. package/dist/esm/flows-actors/models/function-tools.backend.definitions.d.ts.map +1 -1
  466. package/dist/esm/flows-actors/models/function-tools.backend.definitions.js +118 -18
  467. package/dist/esm/flows-actors/models/function-tools.backend.definitions.js.map +1 -1
  468. package/dist/esm/flows-actors/models/market-generation.actors-system.backend.definitions.d.ts.map +1 -1
  469. package/dist/esm/flows-actors/models/market-generation.actors-system.backend.definitions.js.map +1 -1
  470. package/dist/esm/flows-actors/models/mcp-client.backend.definitions.d.ts.map +1 -1
  471. package/dist/esm/flows-actors/models/mcp-client.backend.definitions.js.map +1 -1
  472. package/dist/esm/flows-actors/services/__tests__/fixtures/meta-workflow-evaluation-treatment.test-fixture.d.ts.map +1 -1
  473. package/dist/esm/flows-actors/services/actors-system.backend.service.d.ts.map +1 -1
  474. package/dist/esm/flows-actors/services/actors-system.backend.service.js.map +1 -1
  475. package/dist/esm/flows-actors/services/agent-call-trace-sink.backend.d.ts.map +1 -1
  476. package/dist/esm/flows-actors/services/agent-facets.backend.service.d.ts.map +1 -1
  477. package/dist/esm/flows-actors/services/agents.backend.service.d.ts +104 -5
  478. package/dist/esm/flows-actors/services/agents.backend.service.d.ts.map +1 -1
  479. package/dist/esm/flows-actors/services/agents.backend.service.js +263 -31
  480. package/dist/esm/flows-actors/services/agents.backend.service.js.map +1 -1
  481. package/dist/esm/flows-actors/services/context-curation.backend.service.d.ts.map +1 -1
  482. package/dist/esm/flows-actors/services/conversational-execution.backend.service.d.ts +46 -1
  483. package/dist/esm/flows-actors/services/conversational-execution.backend.service.d.ts.map +1 -1
  484. package/dist/esm/flows-actors/services/conversational-execution.backend.service.js +193 -6
  485. package/dist/esm/flows-actors/services/conversational-execution.backend.service.js.map +1 -1
  486. package/dist/esm/flows-actors/services/flows-actors-registry.service.d.ts.map +1 -1
  487. package/dist/esm/flows-actors/services/flows-actors-registry.service.js.map +1 -1
  488. package/dist/esm/flows-actors/services/flows.backend.services.d.ts.map +1 -1
  489. package/dist/esm/flows-actors/services/flows.backend.services.js.map +1 -1
  490. package/dist/esm/flows-actors/services/llm-observability-agent-call-trace-sink.backend.d.ts.map +1 -1
  491. package/dist/esm/flows-actors/services/llm-observability-agent-call-trace-sink.backend.js.map +1 -1
  492. package/dist/esm/flows-actors/services/mcp-client.backend.service.d.ts.map +1 -1
  493. package/dist/esm/flows-actors/services/mcp-client.backend.service.js +3 -0
  494. package/dist/esm/flows-actors/services/mcp-client.backend.service.js.map +1 -1
  495. package/dist/esm/flows-actors/services/mcp-credential-resolver.backend.service.d.ts +99 -0
  496. package/dist/esm/flows-actors/services/mcp-credential-resolver.backend.service.d.ts.map +1 -0
  497. package/dist/esm/flows-actors/services/mcp-credential-resolver.backend.service.js +155 -0
  498. package/dist/esm/flows-actors/services/mcp-credential-resolver.backend.service.js.map +1 -0
  499. package/dist/esm/flows-actors/services/meta-workflow-evaluation-treatment-compiler.backend.service.d.ts.map +1 -1
  500. package/dist/esm/flows-actors/services/meta-workflow-standard-action-contracts.backend.service.d.ts.map +1 -1
  501. package/dist/esm/flows-actors/services/meta-workflow-standard-evaluation-contracts.backend.service.d.ts.map +1 -1
  502. package/dist/esm/flows-actors/services/meta-workflow-structured-artifact-action-compiler.backend.service.d.ts.map +1 -1
  503. package/dist/esm/flows-actors/services/prompt-compiler.backend.service.d.ts.map +1 -1
  504. package/dist/esm/flows-actors/services/prompt-compiler.backend.service.js.map +1 -1
  505. package/dist/esm/flows-actors/utils/acp-session-runner.backend.utils.d.ts.map +1 -1
  506. package/dist/esm/flows-actors/utils/acp-session-runner.backend.utils.js +9 -0
  507. package/dist/esm/flows-actors/utils/acp-session-runner.backend.utils.js.map +1 -1
  508. package/dist/esm/flows-actors/utils/bounded-subprocess.backend.utils.d.ts.map +1 -1
  509. package/dist/esm/flows-actors/utils/flows-actors-frontend-extractor.utils.d.ts.map +1 -1
  510. package/dist/esm/flows-actors/utils/meta-workflow-canonical-json.backend.utils.d.ts.map +1 -1
  511. package/dist/esm/flows-actors/utils/meta-workflow-canonical-json.backend.utils.js.map +1 -1
  512. package/dist/esm/flows-actors/utils/meta-workflow-structured-generation-plan.backend.utils.d.ts.map +1 -1
  513. package/dist/esm/flows-actors/utils/meta-workflow-structured-generation-plan.backend.utils.js.map +1 -1
  514. package/dist/esm/flows-actors/utils/prompt-ir-adapters.backend.utils.d.ts.map +1 -1
  515. package/dist/esm/flows-actors/utils/tool-approval-modification.backend.utils.d.ts +77 -0
  516. package/dist/esm/flows-actors/utils/tool-approval-modification.backend.utils.d.ts.map +1 -0
  517. package/dist/esm/flows-actors/utils/tool-approval-modification.backend.utils.js +164 -0
  518. package/dist/esm/flows-actors/utils/tool-approval-modification.backend.utils.js.map +1 -0
  519. package/dist/esm/flows-actors/utils/tool-approval-signing.backend.utils.d.ts +48 -0
  520. package/dist/esm/flows-actors/utils/tool-approval-signing.backend.utils.d.ts.map +1 -0
  521. package/dist/esm/flows-actors/utils/tool-approval-signing.backend.utils.js +101 -0
  522. package/dist/esm/flows-actors/utils/tool-approval-signing.backend.utils.js.map +1 -0
  523. package/dist/esm/guidance/batches/dormancy-detection.batch.backend.service.d.ts.map +1 -1
  524. package/dist/esm/guidance/services/guidance-trigger-evaluator.backend.service.d.ts.map +1 -1
  525. package/dist/esm/guidance/services/lifecycle-custom-implementations.backend.d.ts.map +1 -1
  526. package/dist/esm/guidance/services/lifecycle-evaluator.backend.service.d.ts.map +1 -1
  527. package/dist/esm/guidance/services/lifecycle-scope-id.backend.utils.d.ts.map +1 -1
  528. package/dist/esm/guidance/services/milestone-condition-registry.backend.service.d.ts.map +1 -1
  529. package/dist/esm/guidance/services/milestone-definition-registry.backend.service.d.ts.map +1 -1
  530. package/dist/esm/guidance/services/milestone-evaluator.backend.service.d.ts.map +1 -1
  531. package/dist/esm/guidance/services/milestone-evaluator.backend.service.js.map +1 -1
  532. package/dist/esm/guidance/services/progression-state-store.backend.service.d.ts.map +1 -1
  533. package/dist/esm/guidance/services/progression-state-store.backend.service.js.map +1 -1
  534. package/dist/esm/guidance/services/scoped-state-read-custom-implementations.backend.d.ts.map +1 -1
  535. package/dist/esm/i18n/controllers/i18n-controller.backend.service.d.ts.map +1 -1
  536. package/dist/esm/i18n/controllers/i18n-controller.backend.service.js.map +1 -1
  537. package/dist/esm/i18n/services/i18n.backend.service.d.ts.map +1 -1
  538. package/dist/esm/index.d.ts +0 -1
  539. package/dist/esm/index.d.ts.map +1 -1
  540. package/dist/esm/index.js +0 -1
  541. package/dist/esm/index.js.map +1 -1
  542. package/dist/esm/inject/models/container.d.ts +10 -0
  543. package/dist/esm/inject/models/container.d.ts.map +1 -1
  544. package/dist/esm/inject/models/container.js +49 -1
  545. package/dist/esm/inject/models/container.js.map +1 -1
  546. package/dist/esm/inject/models/service-types.d.ts +3 -0
  547. package/dist/esm/inject/models/service-types.d.ts.map +1 -1
  548. package/dist/esm/inject/models/service-types.js +3 -0
  549. package/dist/esm/inject/models/service-types.js.map +1 -1
  550. package/dist/esm/mcp/controllers/mcp.controller.d.ts.map +1 -1
  551. package/dist/esm/mcp/controllers/mcp.controller.js +50 -3
  552. package/dist/esm/mcp/controllers/mcp.controller.js.map +1 -1
  553. package/dist/esm/mcp/models/mcp-protocol.backend.schemas.d.ts.map +1 -1
  554. package/dist/esm/mcp/models/mcp-tool.backend.schemas.d.ts.map +1 -1
  555. package/dist/esm/mcp/models/mcp-tool.backend.schemas.js.map +1 -1
  556. package/dist/esm/mcp/services/mcp-server.backend.service.d.ts.map +1 -1
  557. package/dist/esm/mcp/services/mcp-server.backend.service.js.map +1 -1
  558. package/dist/esm/mcp/services/mcp-tool-adapter.backend.service.d.ts.map +1 -1
  559. package/dist/esm/mcp/services/mcp-tool-adapter.backend.service.js.map +1 -1
  560. package/dist/esm/mcp/services/resource-server-instances-registry.backend.service.d.ts.map +1 -1
  561. package/dist/esm/mcp/utils/zod-to-mcp-json-schema.backend.utils.d.ts.map +1 -1
  562. package/dist/esm/meta-workflow-runtime.exports.d.ts.map +1 -1
  563. package/dist/esm/monitoring/analytics/controllers/analytics.backend.controller.d.ts.map +1 -1
  564. package/dist/esm/monitoring/analytics/controllers/analytics.backend.controller.js.map +1 -1
  565. package/dist/esm/monitoring/analytics/services/value-moment-definition-registry.backend.service.d.ts.map +1 -1
  566. package/dist/esm/monitoring/analytics/services/value-moment-definition-registry.backend.service.js.map +1 -1
  567. package/dist/esm/monitoring/analytics/services/value-moment-engine.backend.service.d.ts.map +1 -1
  568. package/dist/esm/monitoring/analytics/services/value-moment-engine.backend.service.js.map +1 -1
  569. package/dist/esm/monitoring/analytics/services/value-moment-handler-registry.backend.service.d.ts.map +1 -1
  570. package/dist/esm/monitoring/analytics/services/value-moment-handler-registry.backend.service.js.map +1 -1
  571. package/dist/esm/monitoring/logger/models/logger.backend.schemas.d.ts.map +1 -1
  572. package/dist/esm/monitoring/logger/models/logger.backend.schemas.js.map +1 -1
  573. package/dist/esm/monitoring/logger/services/__tests__/mock-logger.service.d.ts.map +1 -1
  574. package/dist/esm/monitoring/logger/services/logger.service.d.ts +12 -0
  575. package/dist/esm/monitoring/logger/services/logger.service.d.ts.map +1 -1
  576. package/dist/esm/monitoring/logger/services/logger.service.js +3 -3
  577. package/dist/esm/monitoring/logger/services/logger.service.js.map +1 -1
  578. package/dist/esm/monitoring/logger/utils/log-severity-floor.backend.utils.d.ts.map +1 -1
  579. package/dist/esm/monitoring/logger/utils/log-severity-floor.backend.utils.js.map +1 -1
  580. package/dist/esm/monitoring/logger/utils/log-value-normalization.backend.utils.d.ts.map +1 -1
  581. package/dist/esm/monitoring/observability/audit-observation-emission.backend.d.ts +10 -6
  582. package/dist/esm/monitoring/observability/audit-observation-emission.backend.d.ts.map +1 -1
  583. package/dist/esm/monitoring/observability/audit-observation-emission.backend.js +10 -6
  584. package/dist/esm/monitoring/observability/audit-observation-emission.backend.js.map +1 -1
  585. package/dist/esm/monitoring/observability/models/observability.backend.schemas.d.ts.map +1 -1
  586. package/dist/esm/monitoring/observability/models/observability.backend.schemas.js.map +1 -1
  587. package/dist/esm/monitoring/observability/otel-preload.d.ts.map +1 -1
  588. package/dist/esm/monitoring/observability/otel-sdk-global-handle.d.ts.map +1 -1
  589. package/dist/esm/monitoring/observability/services/__tests__/mock-metrics.service.d.ts.map +1 -1
  590. package/dist/esm/monitoring/observability/services/metrics.service.d.ts.map +1 -1
  591. package/dist/esm/monitoring/observability/services/metrics.service.js.map +1 -1
  592. package/dist/esm/monitoring/observability/services/observability.backend.service.d.ts.map +1 -1
  593. package/dist/esm/notifications/email/components/email-components.d.ts.map +1 -1
  594. package/dist/esm/notifications/email/models/email-template-definition.d.ts.map +1 -1
  595. package/dist/esm/notifications/email/models/email-transport.backend.definitions.d.ts.map +1 -1
  596. package/dist/esm/notifications/email/services/email-batch-send.batch.backend.service.d.ts.map +1 -1
  597. package/dist/esm/notifications/email/services/email-template-registry.backend.service.d.ts.map +1 -1
  598. package/dist/esm/notifications/email/services/email-template-registry.backend.service.js.map +1 -1
  599. package/dist/esm/notifications/email/services/email-template-validator.backend.service.d.ts.map +1 -1
  600. package/dist/esm/notifications/email/services/email-template-validator.backend.service.js.map +1 -1
  601. package/dist/esm/notifications/email/services/email.backend.service.d.ts +47 -6
  602. package/dist/esm/notifications/email/services/email.backend.service.d.ts.map +1 -1
  603. package/dist/esm/notifications/email/services/email.backend.service.js +86 -36
  604. package/dist/esm/notifications/email/services/email.backend.service.js.map +1 -1
  605. package/dist/esm/notifications/email/utils/color-conversion.utils.d.ts.map +1 -1
  606. package/dist/esm/notifications/email/utils/color-conversion.utils.js.map +1 -1
  607. package/dist/esm/notifications/email/utils/interpolate-email-label.utils.d.ts.map +1 -1
  608. package/dist/esm/notifications/email/utils/zod-to-typescript.utils.d.ts.map +1 -1
  609. package/dist/esm/notifications/services/notification-badge.backend.service.d.ts.map +1 -1
  610. package/dist/esm/notifications/services/notification-badge.backend.service.js.map +1 -1
  611. package/dist/esm/notifications/services/notifications-dispatcher.backend.service.d.ts.map +1 -1
  612. package/dist/esm/notifications/services/notifications-dispatcher.backend.service.js.map +1 -1
  613. package/dist/esm/notifications/sms/models/sms-transport.backend.definitions.d.ts +32 -0
  614. package/dist/esm/notifications/sms/models/sms-transport.backend.definitions.d.ts.map +1 -0
  615. package/dist/esm/notifications/sms/models/sms-transport.backend.definitions.js +32 -0
  616. package/dist/esm/notifications/sms/models/sms-transport.backend.definitions.js.map +1 -0
  617. package/dist/esm/notifications/sms/services/sms.backend.service.d.ts +64 -10
  618. package/dist/esm/notifications/sms/services/sms.backend.service.d.ts.map +1 -1
  619. package/dist/esm/notifications/sms/services/sms.backend.service.js +277 -82
  620. package/dist/esm/notifications/sms/services/sms.backend.service.js.map +1 -1
  621. package/dist/esm/notifications/webhooks/controllers/webhook-auto-controller.backend.service.d.ts.map +1 -1
  622. package/dist/esm/notifications/webhooks/controllers/webhook-auto-controller.backend.service.js.map +1 -1
  623. package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.d.ts.map +1 -1
  624. package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service.js.map +1 -1
  625. package/dist/esm/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.utils.d.ts.map +1 -1
  626. package/dist/esm/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.d.ts.map +1 -1
  627. package/dist/esm/notifications/webhooks/outbound/m2m-webhook-signed-request.backend.utils.js.map +1 -1
  628. package/dist/esm/notifications/webhooks/outbound/services/m2m-webhook-delivery-log.custom-impl.backend.service.d.ts.map +1 -1
  629. package/dist/esm/notifications/webhooks/outbound/services/m2m-webhook-delivery-log.repository.d.ts.map +1 -1
  630. package/dist/esm/notifications/webhooks/outbound/services/m2m-webhook-dispatcher.backend.service.d.ts.map +1 -1
  631. package/dist/esm/notifications/webhooks/outbound/services/webhook-config-public-key.custom-impl.backend.service.d.ts.map +1 -1
  632. package/dist/esm/notifications/webhooks/outbound/services/webhook-config-test-endpoint.custom-impl.backend.service.d.ts.map +1 -1
  633. package/dist/esm/notifications/webhooks/outbound/services/webhook-config-test-endpoint.custom-impl.backend.service.js.map +1 -1
  634. package/dist/esm/notifications/webhooks/outbound/services/webhook-config.backend.service.d.ts.map +1 -1
  635. package/dist/esm/notifications/webhooks/services/polymorphic-lookup.backend.service.d.ts.map +1 -1
  636. package/dist/esm/notifications/webhooks/services/webhook-handler.backend.service.d.ts.map +1 -1
  637. package/dist/esm/notifications/webhooks/services/webhook-handler.backend.service.js.map +1 -1
  638. package/dist/esm/organizations/batches/organization-member-invitation-sweep.batch.backend.service.d.ts.map +1 -1
  639. package/dist/esm/organizations/batches/organization-purge.batch.backend.service.d.ts.map +1 -1
  640. package/dist/esm/organizations/batches/organization-purge.batch.backend.service.js.map +1 -1
  641. package/dist/esm/organizations/services/authority-change-audit.backend.utils.d.ts.map +1 -1
  642. package/dist/esm/organizations/services/invitation-acceptance.backend.utils.d.ts.map +1 -1
  643. package/dist/esm/organizations/services/org-creation-on-registration.backend.utils.d.ts.map +1 -1
  644. package/dist/esm/organizations/services/org-member-roles-validation.backend.utils.d.ts.map +1 -1
  645. package/dist/esm/organizations/services/organization-custom-implementation.backend.service.d.ts.map +1 -1
  646. package/dist/esm/organizations/services/organization-custom-implementation.backend.service.js.map +1 -1
  647. package/dist/esm/organizations/services/organization-deletion-audit.custom-impl.backend.service.d.ts.map +1 -1
  648. package/dist/esm/organizations/services/organization-member-custom-implementation.backend.service.d.ts.map +1 -1
  649. package/dist/esm/organizations/services/organization-onboarding-operation.backend.utils.d.ts.map +1 -1
  650. package/dist/esm/organizations/services/organization-unit-custom-implementation.backend.service.d.ts.map +1 -1
  651. package/dist/esm/organizations/services/organization-unit-member-custom-implementation.backend.service.d.ts.map +1 -1
  652. package/dist/esm/organizations/services/scim-provisioning-gate.backend.utils.d.ts.map +1 -1
  653. package/dist/esm/organizations/services/user-org-type-grant.backend.utils.d.ts.map +1 -1
  654. package/dist/esm/organizations/services/user-type-revocation-on-org-leave.backend.utils.d.ts.map +1 -1
  655. package/dist/esm/pdf-templates/__tests__/fixtures/tiny-pdf-template.fixture.d.ts.map +1 -1
  656. package/dist/esm/pdf-templates/models/pdf-template-binding.d.ts.map +1 -1
  657. package/dist/esm/pdf-templates/models/pdf-template-definition.d.ts.map +1 -1
  658. package/dist/esm/pdf-templates/services/pdf-generated-file-writer.backend.service.d.ts.map +1 -1
  659. package/dist/esm/pdf-templates/services/pdf-generation-orchestrator.backend.service.d.ts.map +1 -1
  660. package/dist/esm/pdf-templates/services/pdf-renderer.backend.service.d.ts.map +1 -1
  661. package/dist/esm/pdf-templates/services/pdf-template-binding.backend.service.d.ts.map +1 -1
  662. package/dist/esm/queue/adapters/in-memory-queue-adapter.backend.service.d.ts.map +1 -1
  663. package/dist/esm/queue/adapters/in-memory-queue-adapter.backend.service.js.map +1 -1
  664. package/dist/esm/queue/adapters/queue-adapter.backend.binding.d.ts.map +1 -1
  665. package/dist/esm/queue/adapters/queue-adapter.backend.binding.js.map +1 -1
  666. package/dist/esm/queue/adapters/queue-adapter.backend.interface.d.ts.map +1 -1
  667. package/dist/esm/queue/adapters/queue-adapter.backend.interface.js.map +1 -1
  668. package/dist/esm/queue/adapters/queue-adapter.backend.options.d.ts.map +1 -1
  669. package/dist/esm/queue/adapters/queue-adapter.backend.options.js.map +1 -1
  670. package/dist/esm/queue/adapters/rabbitmq-adapter.backend.service.d.ts.map +1 -1
  671. package/dist/esm/queue/adapters/rabbitmq-adapter.backend.service.js.map +1 -1
  672. package/dist/esm/queue/apps-crontabs-manager.backend.service.d.ts.map +1 -1
  673. package/dist/esm/queue/cron-job-sync.backend.service.d.ts.map +1 -1
  674. package/dist/esm/queue/domain-queue-consumer.backend.service.d.ts.map +1 -1
  675. package/dist/esm/queue/domain-queue-consumer.backend.service.js.map +1 -1
  676. package/dist/esm/queue/job-completion-registry.backend.service.d.ts.map +1 -1
  677. package/dist/esm/queue/job-consumer.backend.service.d.ts.map +1 -1
  678. package/dist/esm/queue/job-consumer.backend.service.js.map +1 -1
  679. package/dist/esm/queue/job-executor.backend.service.d.ts.map +1 -1
  680. package/dist/esm/queue/job-executor.backend.service.js.map +1 -1
  681. package/dist/esm/queue/job-payload-storage.backend.service.d.ts.map +1 -1
  682. package/dist/esm/queue/job-status-tracking.backend.service.d.ts.map +1 -1
  683. package/dist/esm/queue/queue-monitoring.backend.service.d.ts.map +1 -1
  684. package/dist/esm/queue/queue-monitoring.backend.service.js.map +1 -1
  685. package/dist/esm/queue/queue-worker-initializer.backend.service.d.ts.map +1 -1
  686. package/dist/esm/queue/queue-worker-initializer.backend.service.js.map +1 -1
  687. package/dist/esm/queue/queue.backend.service.d.ts.map +1 -1
  688. package/dist/esm/queue/queue.backend.service.js.map +1 -1
  689. package/dist/esm/queue/scheduled-message-verifier.backend.service.d.ts.map +1 -1
  690. package/dist/esm/queue/worker-shutdown-manager.backend.service.d.ts.map +1 -1
  691. package/dist/esm/queue/worker-shutdown-manager.backend.service.js.map +1 -1
  692. package/dist/esm/rag/batches/rag-embedding-drain.batch.backend.service.d.ts.map +1 -1
  693. package/dist/esm/rag/batches/rag-reconciliation-sweep.batch.backend.service.d.ts.map +1 -1
  694. package/dist/esm/rag/models/rag-chunk-store.backend.types.d.ts.map +1 -1
  695. package/dist/esm/rag/models/rag-retrieval.backend.types.d.ts.map +1 -1
  696. package/dist/esm/rag/services/mongodb-rag-chunk-store.backend.service.d.ts.map +1 -1
  697. package/dist/esm/rag/services/postgresql-rag-chunk-store.backend.service.d.ts.map +1 -1
  698. package/dist/esm/rag/services/rag-chunk-collection.mongodb-ddl.backend.d.ts.map +1 -1
  699. package/dist/esm/rag/services/rag-chunk-retrieval.mongodb-query.backend.d.ts.map +1 -1
  700. package/dist/esm/rag/services/rag-chunk-retrieval.postgresql-query.backend.d.ts.map +1 -1
  701. package/dist/esm/rag/services/rag-chunk-store.backend.service.d.ts.map +1 -1
  702. package/dist/esm/rag/services/rag-chunk-table.postgresql-ddl.backend.d.ts.map +1 -1
  703. package/dist/esm/rag/services/rag-ingestion.backend.service.d.ts.map +1 -1
  704. package/dist/esm/rag/services/rag-retrieval.backend.service.d.ts.map +1 -1
  705. package/dist/esm/rag/utils/rag-chunk-fusion.backend.utils.d.ts.map +1 -1
  706. package/dist/esm/rag/utils/rag-chunk-removal.backend.utils.d.ts.map +1 -1
  707. package/dist/esm/rag/utils/rag-chunk-row-shaping.backend.utils.d.ts.map +1 -1
  708. package/dist/esm/rag/utils/rag-chunking.backend.utils.d.ts.map +1 -1
  709. package/dist/esm/rag/utils/rag-chunking.backend.utils.js.map +1 -1
  710. package/dist/esm/rag/utils/rag-context-assembly.backend.utils.d.ts.map +1 -1
  711. package/dist/esm/rag/utils/rag-context-assembly.backend.utils.js.map +1 -1
  712. package/dist/esm/rag/utils/rag-ingestion-trigger.backend.utils.d.ts.map +1 -1
  713. package/dist/esm/rag/utils/rag-retrieval-scope.backend.utils.d.ts.map +1 -1
  714. package/dist/esm/rag/utils/rag-source-field-value.backend.utils.d.ts.map +1 -1
  715. package/dist/esm/requests/models/api-routes.backend.defintions.d.ts.map +1 -1
  716. package/dist/esm/requests/models/requests.backend.schemas.d.ts.map +1 -1
  717. package/dist/esm/requests/service/platform-mutualized-handler.backend.service.d.ts.map +1 -1
  718. package/dist/esm/requests/service/platform-requests.backend.utils.d.ts.map +1 -1
  719. package/dist/esm/requests/service/remote-client-base.backend.service.d.ts.map +1 -1
  720. package/dist/esm/requests/service/serverless-services-handler.backend.service.d.ts.map +1 -1
  721. package/dist/esm/requests/service/websocket.service.d.ts.map +1 -1
  722. package/dist/esm/requests/service/websocket.service.js +49 -1
  723. package/dist/esm/requests/service/websocket.service.js.map +1 -1
  724. package/dist/esm/resources/backend-resource-registry.exports.d.ts.map +1 -1
  725. package/dist/esm/resources/models/custom-service-implementations.backend.definition.d.ts.map +1 -1
  726. package/dist/esm/resources/models/custom-service-implementations.backend.definition.js +2 -0
  727. package/dist/esm/resources/models/custom-service-implementations.backend.definition.js.map +1 -1
  728. package/dist/esm/resources/models/index.d.ts.map +1 -1
  729. package/dist/esm/resources/models/resources-operations.backend.definitions.d.ts.map +1 -1
  730. package/dist/esm/resources/models/resources-operations.backend.definitions.js.map +1 -1
  731. package/dist/esm/resources/models/resources-relationships.backend.definitions.d.ts.map +1 -1
  732. package/dist/esm/resources/models/resources-relationships.backend.definitions.js.map +1 -1
  733. package/dist/esm/resources/models/resources-types.backend.schemas.d.ts.map +1 -1
  734. package/dist/esm/resources/models/resources-types.backend.schemas.js.map +1 -1
  735. package/dist/esm/resources/models/resources.backend.schemas.d.ts.map +1 -1
  736. package/dist/esm/resources/models/virtual-fields.backend.types.d.ts.map +1 -1
  737. package/dist/esm/resources/services/__tests__/mock-resources-registry.service.d.ts.map +1 -1
  738. package/dist/esm/resources/services/resource-context.backend.service.d.ts.map +1 -1
  739. package/dist/esm/resources/services/resource-id.backend.service.d.ts.map +1 -1
  740. package/dist/esm/resources/services/resource-population.backend.service.d.ts +17 -2
  741. package/dist/esm/resources/services/resource-population.backend.service.d.ts.map +1 -1
  742. package/dist/esm/resources/services/resource-population.backend.service.js +74 -18
  743. package/dist/esm/resources/services/resource-population.backend.service.js.map +1 -1
  744. package/dist/esm/resources/services/resources-registry.backend.service.d.ts +23 -0
  745. package/dist/esm/resources/services/resources-registry.backend.service.d.ts.map +1 -1
  746. package/dist/esm/resources/services/resources-registry.backend.service.js +31 -0
  747. package/dist/esm/resources/services/resources-registry.backend.service.js.map +1 -1
  748. package/dist/esm/resources/services/virtual-fields.backend.service.d.ts.map +1 -1
  749. package/dist/esm/resources/utils/resource-retention.backend.utils.d.ts.map +1 -1
  750. package/dist/esm/runtime/controllers/health-controller.backend.service.d.ts.map +1 -1
  751. package/dist/esm/runtime/controllers/health-controller.backend.service.js.map +1 -1
  752. package/dist/esm/runtime/domain-module.backend.definitions.d.ts.map +1 -1
  753. package/dist/esm/runtime/domain-module.backend.definitions.js.map +1 -1
  754. package/dist/esm/runtime/models/execution-context.backend.schemas.d.ts.map +1 -1
  755. package/dist/esm/runtime/models/request-context.als.backend.d.ts.map +1 -1
  756. package/dist/esm/runtime/models/runtime.backend.schemas.d.ts.map +1 -1
  757. package/dist/esm/runtime/services/execution-context-creator.backend.service.d.ts.map +1 -1
  758. package/dist/esm/runtime/services/execution-context-creator.backend.service.js.map +1 -1
  759. package/dist/esm/runtime/services/execution-context-handler.backend.service.d.ts.map +1 -1
  760. package/dist/esm/runtime/services/health-readiness-contributor.backend.interface.d.ts.map +1 -1
  761. package/dist/esm/runtime/services/health-readiness-contributor.backend.interface.js.map +1 -1
  762. package/dist/esm/runtime/services/http-server.backend.service.d.ts.map +1 -1
  763. package/dist/esm/runtime/services/http-server.backend.service.js +10 -0
  764. package/dist/esm/runtime/services/http-server.backend.service.js.map +1 -1
  765. package/dist/esm/runtime/services/start-application.backend.service.d.ts.map +1 -1
  766. package/dist/esm/runtime/services/start-application.backend.service.js +26 -12
  767. package/dist/esm/runtime/services/start-application.backend.service.js.map +1 -1
  768. package/dist/esm/runtime/services/utils/oauth-body-cap.backend.utils.d.ts.map +1 -1
  769. package/dist/esm/runtime/testing/execution-context-test-fixtures.d.ts.map +1 -1
  770. package/dist/esm/runtime/testing/mock-execution-context-creator.service.d.ts.map +1 -1
  771. package/dist/esm/runtime/utils/application-startup-config-access.backend.utils.d.ts.map +1 -1
  772. package/dist/esm/runtime/utils/feature-gated-core-resource-exclusions.backend.utils.d.ts.map +1 -1
  773. package/dist/esm/runtime/utils/request-client-ip.utils.d.ts.map +1 -1
  774. package/dist/esm/runtime/utils/scan-default-exports.backend.utils.d.ts.map +1 -1
  775. package/dist/esm/security/api-keys/api-key-generation.backend.utils.d.ts.map +1 -1
  776. package/dist/esm/security/api-keys/api-keys.custom-impl.backend.service.d.ts.map +1 -1
  777. package/dist/esm/security/api-keys/api-keys.custom-impl.backend.service.js.map +1 -1
  778. package/dist/esm/security/authentications/batches/anonymous-session-cleanup.batch.backend.service.d.ts.map +1 -1
  779. package/dist/esm/security/authentications/batches/anonymous-session-cleanup.batch.backend.service.js.map +1 -1
  780. package/dist/esm/security/authentications/controllers/auth-method-management-controller.backend.service.d.ts.map +1 -1
  781. package/dist/esm/security/authentications/controllers/authentication-controller.backend.service.d.ts +22 -0
  782. package/dist/esm/security/authentications/controllers/authentication-controller.backend.service.d.ts.map +1 -1
  783. package/dist/esm/security/authentications/controllers/authentication-controller.backend.service.js +84 -0
  784. package/dist/esm/security/authentications/controllers/authentication-controller.backend.service.js.map +1 -1
  785. package/dist/esm/security/authentications/controllers/oauth-provider-controller.backend.service.d.ts.map +1 -1
  786. package/dist/esm/security/authentications/controllers/oauth-provider-controller.backend.service.js.map +1 -1
  787. package/dist/esm/security/authentications/models/auth-constants.backend.d.ts.map +1 -1
  788. package/dist/esm/security/authentications/models/authentications.backend.schemas.d.ts.map +1 -1
  789. package/dist/esm/security/authentications/models/authorization-client.backend.schemas.d.ts.map +1 -1
  790. package/dist/esm/security/authentications/models/cimd.backend.schemas.d.ts.map +1 -1
  791. package/dist/esm/security/authentications/models/cimd.backend.schemas.js.map +1 -1
  792. package/dist/esm/security/authentications/models/federated-auth-transport.backend.definitions.d.ts +37 -0
  793. package/dist/esm/security/authentications/models/federated-auth-transport.backend.definitions.d.ts.map +1 -0
  794. package/dist/esm/security/authentications/models/federated-auth-transport.backend.definitions.js +37 -0
  795. package/dist/esm/security/authentications/models/federated-auth-transport.backend.definitions.js.map +1 -0
  796. package/dist/esm/security/authentications/models/identity-persistence-boundaries.backend.d.ts.map +1 -1
  797. package/dist/esm/security/authentications/models/jwt.backend.schemas.d.ts.map +1 -1
  798. package/dist/esm/security/authentications/models/oauth2-connection.backend.schemas.d.ts +15 -0
  799. package/dist/esm/security/authentications/models/oauth2-connection.backend.schemas.d.ts.map +1 -1
  800. package/dist/esm/security/authentications/models/oauth2-connection.backend.schemas.js.map +1 -1
  801. package/dist/esm/security/authentications/models/saml-authentication.backend.schemas.d.ts.map +1 -1
  802. package/dist/esm/security/authentications/models/sso-connection.backend.schemas.d.ts.map +1 -1
  803. package/dist/esm/security/authentications/models/user-authorization-version.backend.utils.d.ts.map +1 -1
  804. package/dist/esm/security/authentications/seeds/enterprise-config-defaults.seeds.d.ts.map +1 -1
  805. package/dist/esm/security/authentications/services/__tests__/mock-auth-execution-context-factory.service.d.ts.map +1 -1
  806. package/dist/esm/security/authentications/services/__tests__/mock-auth-token-issuer.service.d.ts.map +1 -1
  807. package/dist/esm/security/authentications/services/__tests__/oauth-provider-audit-spies.mock.d.ts.map +1 -1
  808. package/dist/esm/security/authentications/services/admin-config/__tests__/mock-domain-to-org-lookup.service.d.ts.map +1 -1
  809. package/dist/esm/security/authentications/services/admin-config/__tests__/mock-enterprise-user-provisioning.service.d.ts.map +1 -1
  810. package/dist/esm/security/authentications/services/admin-config/auth-organization-configuration.service.d.ts.map +1 -1
  811. package/dist/esm/security/authentications/services/admin-config/auth-organization-configuration.service.js.map +1 -1
  812. package/dist/esm/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.d.ts.map +1 -1
  813. package/dist/esm/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.js.map +1 -1
  814. package/dist/esm/security/authentications/services/admin-config/domain-verification.backend.service.d.ts.map +1 -1
  815. package/dist/esm/security/authentications/services/admin-config/domain-verification.backend.service.js.map +1 -1
  816. package/dist/esm/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.d.ts.map +1 -1
  817. package/dist/esm/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.js.map +1 -1
  818. package/dist/esm/security/authentications/services/admin-config/oidc-discovery.backend.service.d.ts.map +1 -1
  819. package/dist/esm/security/authentications/services/admin-config/oidc-discovery.backend.service.js +2 -1
  820. package/dist/esm/security/authentications/services/admin-config/oidc-discovery.backend.service.js.map +1 -1
  821. package/dist/esm/security/authentications/services/anonymous-session.backend.service.d.ts +9 -2
  822. package/dist/esm/security/authentications/services/anonymous-session.backend.service.d.ts.map +1 -1
  823. package/dist/esm/security/authentications/services/anonymous-session.backend.service.js +9 -2
  824. package/dist/esm/security/authentications/services/anonymous-session.backend.service.js.map +1 -1
  825. package/dist/esm/security/authentications/services/auth-credential-verifier.backend.service.d.ts.map +1 -1
  826. package/dist/esm/security/authentications/services/auth-execution-context-factory.backend.service.d.ts.map +1 -1
  827. package/dist/esm/security/authentications/services/auth-methods/auth-method-management.backend.service.d.ts.map +1 -1
  828. package/dist/esm/security/authentications/services/auth-methods/auth-method-management.backend.service.js.map +1 -1
  829. package/dist/esm/security/authentications/services/auth-methods/auth-mfa.backend.service.d.ts.map +1 -1
  830. package/dist/esm/security/authentications/services/auth-methods/auth-password-reset.backend.service.d.ts.map +1 -1
  831. package/dist/esm/security/authentications/services/auth-methods/auth-phone-verification.backend.service.d.ts.map +1 -1
  832. package/dist/esm/security/authentications/services/auth-methods/auth-registration.backend.service.d.ts.map +1 -1
  833. package/dist/esm/security/authentications/services/auth-methods/auth-registration.backend.service.js.map +1 -1
  834. package/dist/esm/security/authentications/services/auth-methods/oauth2-authentication.backend.service.d.ts +97 -0
  835. package/dist/esm/security/authentications/services/auth-methods/oauth2-authentication.backend.service.d.ts.map +1 -1
  836. package/dist/esm/security/authentications/services/auth-methods/oauth2-authentication.backend.service.js +218 -26
  837. package/dist/esm/security/authentications/services/auth-methods/oauth2-authentication.backend.service.js.map +1 -1
  838. package/dist/esm/security/authentications/services/auth-methods/oauth2-connection-resolver.backend.service.d.ts +14 -0
  839. package/dist/esm/security/authentications/services/auth-methods/oauth2-connection-resolver.backend.service.d.ts.map +1 -1
  840. package/dist/esm/security/authentications/services/auth-methods/oauth2-connection-resolver.backend.service.js +36 -0
  841. package/dist/esm/security/authentications/services/auth-methods/oauth2-connection-resolver.backend.service.js.map +1 -1
  842. package/dist/esm/security/authentications/services/auth-methods/saml-assertion-validator.backend.service.d.ts.map +1 -1
  843. package/dist/esm/security/authentications/services/auth-methods/saml-authentication.backend.service.d.ts.map +1 -1
  844. package/dist/esm/security/authentications/services/auth-methods/saml-metadata.backend.service.d.ts.map +1 -1
  845. package/dist/esm/security/authentications/services/auth-methods/saml-replay-guard.backend.service.d.ts.map +1 -1
  846. package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.d.ts.map +1 -1
  847. package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.js.map +1 -1
  848. package/dist/esm/security/authentications/services/auth-session-store.backend.service.d.ts.map +1 -1
  849. package/dist/esm/security/authentications/services/auth-token-issuer.backend.service.d.ts.map +1 -1
  850. package/dist/esm/security/authentications/services/auth-token-issuer.backend.service.js.map +1 -1
  851. package/dist/esm/security/authentications/services/authentication-orchestrator.backend.service.d.ts.map +1 -1
  852. package/dist/esm/security/authentications/services/authentication-orchestrator.backend.service.js.map +1 -1
  853. package/dist/esm/security/authentications/services/cimd-client-metadata.backend.service.d.ts.map +1 -1
  854. package/dist/esm/security/authentications/services/cimd-client-metadata.backend.service.js.map +1 -1
  855. package/dist/esm/security/authentications/services/custom-impls/auth-custom-implementations.backend.d.ts.map +1 -1
  856. package/dist/esm/security/authentications/services/custom-impls/auth-custom-implementations.backend.js.map +1 -1
  857. package/dist/esm/security/authentications/services/custom-impls/scim-tokens.custom-impl.backend.service.d.ts.map +1 -1
  858. package/dist/esm/security/authentications/services/custom-impls/siem-delivery-dlq.custom-impl.backend.service.d.ts.map +1 -1
  859. package/dist/esm/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.d.ts.map +1 -1
  860. package/dist/esm/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.js +57 -1
  861. package/dist/esm/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.js.map +1 -1
  862. package/dist/esm/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.d.ts.map +1 -1
  863. package/dist/esm/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.js.map +1 -1
  864. package/dist/esm/security/authentications/services/custom-impls/sso-connection.custom-impl.backend.service.d.ts.map +1 -1
  865. package/dist/esm/security/authentications/services/custom-impls/sso-connection.custom-impl.backend.service.js +11 -1
  866. package/dist/esm/security/authentications/services/custom-impls/sso-connection.custom-impl.backend.service.js.map +1 -1
  867. package/dist/esm/security/authentications/services/email-verification-initiator.backend.service.d.ts.map +1 -1
  868. package/dist/esm/security/authentications/services/machine-token-issuer.backend.service.d.ts.map +1 -1
  869. package/dist/esm/security/authentications/services/oauth-provider-token.backend.service.d.ts.map +1 -1
  870. package/dist/esm/security/authentications/services/oauth-provider-token.backend.service.js.map +1 -1
  871. package/dist/esm/security/authentications/services/oidc-authorization-code.backend.service.d.ts.map +1 -1
  872. package/dist/esm/security/authentications/services/oidc-authorization-code.backend.service.js.map +1 -1
  873. package/dist/esm/security/authentications/services/oidc-user-claims.backend.service.d.ts.map +1 -1
  874. package/dist/esm/security/authentications/services/resolve-active-member-orgs.backend.utils.d.ts.map +1 -1
  875. package/dist/esm/security/authentications/services/utils/__tests__/mock-auth-user-lookup.service.d.ts.map +1 -1
  876. package/dist/esm/security/authentications/services/utils/auth-controller.utils.d.ts.map +1 -1
  877. package/dist/esm/security/authentications/services/utils/auth-credential-ops.backend.service.d.ts.map +1 -1
  878. package/dist/esm/security/authentications/services/utils/auth-policy-resolution.backend.utils.d.ts.map +1 -1
  879. package/dist/esm/security/authentications/services/utils/auth-policy-resolution.backend.utils.js.map +1 -1
  880. package/dist/esm/security/authentications/services/utils/auth-response-helper.backend.service.d.ts.map +1 -1
  881. package/dist/esm/security/authentications/services/utils/auth-user-lookup.backend.service.d.ts.map +1 -1
  882. package/dist/esm/security/authentications/services/utils/auth-user-lookup.backend.service.js.map +1 -1
  883. package/dist/esm/security/authentications/services/utils/concurrent-session-eviction.backend.utils.d.ts.map +1 -1
  884. package/dist/esm/security/authentications/services/utils/ensure-user-profile.backend.utils.d.ts.map +1 -1
  885. package/dist/esm/security/authentications/services/utils/external-turn-rate-limit.backend.utils.d.ts.map +1 -1
  886. package/dist/esm/security/authentications/services/utils/external-turn-rate-limit.backend.utils.js.map +1 -1
  887. package/dist/esm/security/authentications/services/utils/machine-auth-rate-limit.backend.utils.d.ts.map +1 -1
  888. package/dist/esm/security/authentications/services/utils/pkce.backend.utils.d.ts.map +1 -1
  889. package/dist/esm/security/authentications/services/utils/saml-java-availability.d.ts.map +1 -1
  890. package/dist/esm/security/authentications/utils/application-auth-policy-audit.backend.utils.d.ts.map +1 -1
  891. package/dist/esm/security/authentications/utils/enterprise-sso-enforcement.backend.utils.d.ts.map +1 -1
  892. package/dist/esm/security/authentications/utils/enterprise-sso-enforcement.backend.utils.js.map +1 -1
  893. package/dist/esm/security/authentications/utils/one-off-session-lifetime.backend.utils.d.ts.map +1 -1
  894. package/dist/esm/security/authentications/utils/social-oauth2-purpose.backend.utils.d.ts.map +1 -1
  895. package/dist/esm/security/authorizations/access-grant-decision.factory.backend.d.ts +59 -0
  896. package/dist/esm/security/authorizations/access-grant-decision.factory.backend.d.ts.map +1 -0
  897. package/dist/esm/security/authorizations/access-grant-decision.factory.backend.js +111 -0
  898. package/dist/esm/security/authorizations/access-grant-decision.factory.backend.js.map +1 -0
  899. package/dist/esm/security/authorizations/access-grant-lifecycle-audit.backend.d.ts +57 -0
  900. package/dist/esm/security/authorizations/access-grant-lifecycle-audit.backend.d.ts.map +1 -0
  901. package/dist/esm/security/authorizations/access-grant-lifecycle-audit.backend.js +133 -0
  902. package/dist/esm/security/authorizations/access-grant-lifecycle-audit.backend.js.map +1 -0
  903. package/dist/esm/security/authorizations/application-access-grant-custom-implementation.backend.service.d.ts +41 -0
  904. package/dist/esm/security/authorizations/application-access-grant-custom-implementation.backend.service.d.ts.map +1 -0
  905. package/dist/esm/security/authorizations/application-access-grant-custom-implementation.backend.service.js +157 -0
  906. package/dist/esm/security/authorizations/application-access-grant-custom-implementation.backend.service.js.map +1 -0
  907. package/dist/esm/security/authorizations/application-wide-read-admission.backend.d.ts +84 -0
  908. package/dist/esm/security/authorizations/application-wide-read-admission.backend.d.ts.map +1 -0
  909. package/dist/esm/security/authorizations/application-wide-read-admission.backend.js +99 -0
  910. package/dist/esm/security/authorizations/application-wide-read-admission.backend.js.map +1 -0
  911. package/dist/esm/security/authorizations/authorization-denial-audit.backend.utils.d.ts.map +1 -1
  912. package/dist/esm/security/authorizations/cross-tenant-read-observation.backend.d.ts.map +1 -1
  913. package/dist/esm/security/authorizations/cross-tenant-read-observation.backend.js.map +1 -1
  914. package/dist/esm/security/authorizations/initiator-organization-confinement.backend.d.ts.map +1 -1
  915. package/dist/esm/security/authorizations/junction-scope-resolution.backend.d.ts.map +1 -1
  916. package/dist/esm/security/authorizations/organization-owner-floor.backend.utils.d.ts.map +1 -1
  917. package/dist/esm/security/authorizations/organization-owner-floor.backend.utils.js.map +1 -1
  918. package/dist/esm/security/authorizations/organization-unit-narrowing-enforcement.backend.d.ts.map +1 -1
  919. package/dist/esm/security/authorizations/platform-access-grant-custom-implementation.backend.service.d.ts.map +1 -1
  920. package/dist/esm/security/authorizations/platform-access-grant-custom-implementation.backend.service.js +20 -181
  921. package/dist/esm/security/authorizations/platform-access-grant-custom-implementation.backend.service.js.map +1 -1
  922. package/dist/esm/security/authorizations/privileged-access-review.backend.utils.d.ts.map +1 -1
  923. package/dist/esm/security/authorizations/relationship-foreign-key-filter.backend.d.ts.map +1 -1
  924. package/dist/esm/security/authorizations/role-ceiling.backend.utils.d.ts.map +1 -1
  925. package/dist/esm/security/authorizations/role-ceiling.backend.utils.js.map +1 -1
  926. package/dist/esm/security/authorizations/role-conferral.backend.utils.d.ts +40 -0
  927. package/dist/esm/security/authorizations/role-conferral.backend.utils.d.ts.map +1 -1
  928. package/dist/esm/security/authorizations/role-conferral.backend.utils.js +43 -1
  929. package/dist/esm/security/authorizations/role-conferral.backend.utils.js.map +1 -1
  930. package/dist/esm/security/authorizations/scope-root-collection-confinement.backend.d.ts +27 -17
  931. package/dist/esm/security/authorizations/scope-root-collection-confinement.backend.d.ts.map +1 -1
  932. package/dist/esm/security/authorizations/scope-root-collection-confinement.backend.js +27 -17
  933. package/dist/esm/security/authorizations/scope-root-collection-confinement.backend.js.map +1 -1
  934. package/dist/esm/security/authorizations/services/authorizations.backend.service.d.ts +72 -0
  935. package/dist/esm/security/authorizations/services/authorizations.backend.service.d.ts.map +1 -1
  936. package/dist/esm/security/authorizations/services/authorizations.backend.service.js +153 -10
  937. package/dist/esm/security/authorizations/services/authorizations.backend.service.js.map +1 -1
  938. package/dist/esm/security/authorizations/super-admin-floor.backend.utils.d.ts.map +1 -1
  939. package/dist/esm/security/authorizations/super-admin-floor.backend.utils.js.map +1 -1
  940. package/dist/esm/security/connected-accounts/connection-target-authorization.backend.d.ts.map +1 -1
  941. package/dist/esm/security/connected-accounts/connection-target-authorization.backend.js.map +1 -1
  942. package/dist/esm/security/connected-accounts/controllers/provider-connection.controller.backend.service.d.ts +139 -1
  943. package/dist/esm/security/connected-accounts/controllers/provider-connection.controller.backend.service.d.ts.map +1 -1
  944. package/dist/esm/security/connected-accounts/controllers/provider-connection.controller.backend.service.js +474 -33
  945. package/dist/esm/security/connected-accounts/controllers/provider-connection.controller.backend.service.js.map +1 -1
  946. package/dist/esm/security/connected-accounts/organization-provider-credential-resolver.port.d.ts +40 -0
  947. package/dist/esm/security/connected-accounts/organization-provider-credential-resolver.port.d.ts.map +1 -1
  948. package/dist/esm/security/connected-accounts/organization-provider-credential-resolver.port.js.map +1 -1
  949. package/dist/esm/security/connected-accounts/provider-oauth2-refresher.port.d.ts.map +1 -1
  950. package/dist/esm/security/connected-accounts/provider-oauth2-refresher.port.js.map +1 -1
  951. package/dist/esm/security/connected-accounts/services/organization-provider-credential-store.backend.service.d.ts +19 -0
  952. package/dist/esm/security/connected-accounts/services/organization-provider-credential-store.backend.service.d.ts.map +1 -1
  953. package/dist/esm/security/connected-accounts/services/organization-provider-credential-store.backend.service.js +38 -0
  954. package/dist/esm/security/connected-accounts/services/organization-provider-credential-store.backend.service.js.map +1 -1
  955. package/dist/esm/security/connected-accounts/services/organization-provider-credentials.custom-impl.backend.service.d.ts.map +1 -1
  956. package/dist/esm/security/connected-accounts/services/organization-provider-credentials.custom-impl.backend.service.js.map +1 -1
  957. package/dist/esm/security/connected-accounts/services/provider-oauth2-exchange.backend.d.ts.map +1 -1
  958. package/dist/esm/security/connected-accounts/services/provider-oauth2-exchange.backend.js +17 -1
  959. package/dist/esm/security/connected-accounts/services/provider-oauth2-exchange.backend.js.map +1 -1
  960. package/dist/esm/security/connected-accounts/services/provider-oauth2-pending-authorization.backend.service.d.ts +14 -0
  961. package/dist/esm/security/connected-accounts/services/provider-oauth2-pending-authorization.backend.service.d.ts.map +1 -1
  962. package/dist/esm/security/connected-accounts/services/provider-oauth2-pending-authorization.backend.service.js +16 -0
  963. package/dist/esm/security/connected-accounts/services/provider-oauth2-pending-authorization.backend.service.js.map +1 -1
  964. package/dist/esm/security/connected-accounts/services/provider-oauth2-refresher.backend.service.d.ts.map +1 -1
  965. package/dist/esm/security/connected-accounts/services/provider-oauth2-refresher.backend.service.js +1 -1
  966. package/dist/esm/security/connected-accounts/services/provider-oauth2-refresher.backend.service.js.map +1 -1
  967. package/dist/esm/security/connected-accounts/services/user-provider-credential-store.backend.service.d.ts +19 -0
  968. package/dist/esm/security/connected-accounts/services/user-provider-credential-store.backend.service.d.ts.map +1 -1
  969. package/dist/esm/security/connected-accounts/services/user-provider-credential-store.backend.service.js +45 -2
  970. package/dist/esm/security/connected-accounts/services/user-provider-credential-store.backend.service.js.map +1 -1
  971. package/dist/esm/security/connected-accounts/services/user-provider-credentials.custom-impl.backend.service.d.ts.map +1 -1
  972. package/dist/esm/security/connected-accounts/services/user-provider-credentials.custom-impl.backend.service.js.map +1 -1
  973. package/dist/esm/security/connected-accounts/user-provider-credential-resolver.port.d.ts +37 -1
  974. package/dist/esm/security/connected-accounts/user-provider-credential-resolver.port.d.ts.map +1 -1
  975. package/dist/esm/security/connected-accounts/user-provider-credential-resolver.port.js.map +1 -1
  976. package/dist/esm/security/connected-accounts/utils/provider-credential-envelope.backend.utils.d.ts.map +1 -1
  977. package/dist/esm/security/connected-accounts/utils/provider-credential-envelope.backend.utils.js.map +1 -1
  978. package/dist/esm/security/connected-accounts/utils/stored-credential-value.backend.utils.d.ts.map +1 -1
  979. package/dist/esm/security/connected-accounts/utils/stored-credential-value.backend.utils.js.map +1 -1
  980. package/dist/esm/security/connected-accounts/utils/user-delegated-access-token-slot.backend.utils.d.ts +34 -0
  981. package/dist/esm/security/connected-accounts/utils/user-delegated-access-token-slot.backend.utils.d.ts.map +1 -0
  982. package/dist/esm/security/connected-accounts/utils/user-delegated-access-token-slot.backend.utils.js +39 -0
  983. package/dist/esm/security/connected-accounts/utils/user-delegated-access-token-slot.backend.utils.js.map +1 -0
  984. package/dist/esm/security/consumable-tokens/batches/consumable-tokens-cleanup.batch.backend.service.d.ts.map +1 -1
  985. package/dist/esm/security/consumable-tokens/consumable-token-models.exports.d.ts.map +1 -1
  986. package/dist/esm/security/consumable-tokens/models/consumable-tokens.backend.resources-config.schemas.d.ts.map +1 -1
  987. package/dist/esm/security/consumable-tokens/models/consumable-tokens.shared.schemas.d.ts.map +1 -1
  988. package/dist/esm/security/consumable-tokens/models/index.d.ts.map +1 -1
  989. package/dist/esm/security/consumable-tokens/services/__tests__/mock-consumable-token.service.d.ts.map +1 -1
  990. package/dist/esm/security/consumable-tokens/services/consumable-token.backend.service.d.ts.map +1 -1
  991. package/dist/esm/security/consumable-tokens/services/consumable-token.backend.service.js.map +1 -1
  992. package/dist/esm/security/credential-rotation-grace.backend.utils.d.ts.map +1 -1
  993. package/dist/esm/security/credential-rotation-grace.backend.utils.js.map +1 -1
  994. package/dist/esm/security/jwt/services/auth-jwt-guard.backend.service.d.ts.map +1 -1
  995. package/dist/esm/security/jwt/services/jwt.backend.service.d.ts.map +1 -1
  996. package/dist/esm/security/jwt/services/wildo-worker-bootstrap-client.backend.service.d.ts +13 -0
  997. package/dist/esm/security/jwt/services/wildo-worker-bootstrap-client.backend.service.d.ts.map +1 -1
  998. package/dist/esm/security/jwt/services/wildo-worker-bootstrap-client.backend.service.js +14 -0
  999. package/dist/esm/security/jwt/services/wildo-worker-bootstrap-client.backend.service.js.map +1 -1
  1000. package/dist/esm/security/jwt/utils/jwt-verification-error-classification.backend.utils.d.ts.map +1 -1
  1001. package/dist/esm/security/oauth-clients/oauth-client-generation.backend.utils.d.ts.map +1 -1
  1002. package/dist/esm/security/oauth-clients/oauth-client-generation.backend.utils.js.map +1 -1
  1003. package/dist/esm/security/oauth-clients/oauth-clients.custom-impl.backend.service.d.ts.map +1 -1
  1004. package/dist/esm/security/oauth-clients/oauth-clients.custom-impl.backend.service.js.map +1 -1
  1005. package/dist/esm/security/outbound/outbound-request-deadline.backend.utils.d.ts +39 -0
  1006. package/dist/esm/security/outbound/outbound-request-deadline.backend.utils.d.ts.map +1 -0
  1007. package/dist/esm/security/outbound/outbound-request-deadline.backend.utils.js +60 -0
  1008. package/dist/esm/security/outbound/outbound-request-deadline.backend.utils.js.map +1 -0
  1009. package/dist/esm/security/outbound/outbound-request-headers.backend.utils.d.ts +66 -0
  1010. package/dist/esm/security/outbound/outbound-request-headers.backend.utils.d.ts.map +1 -0
  1011. package/dist/esm/security/outbound/outbound-request-headers.backend.utils.js +75 -0
  1012. package/dist/esm/security/outbound/outbound-request-headers.backend.utils.js.map +1 -0
  1013. package/dist/esm/security/scim/controllers/scim.backend.controller.d.ts.map +1 -1
  1014. package/dist/esm/security/scim/controllers/scim.backend.controller.js.map +1 -1
  1015. package/dist/esm/security/scim/models/scim-protocol.backend.schemas.d.ts.map +1 -1
  1016. package/dist/esm/security/scim/models/scim-protocol.backend.schemas.js.map +1 -1
  1017. package/dist/esm/security/scim/utils/scim-attribute-path-resolver.backend.utils.d.ts.map +1 -1
  1018. package/dist/esm/security/scim/utils/scim-filter-parser.d.ts.map +1 -1
  1019. package/dist/esm/security/scim/utils/scim-response-formatter.d.ts.map +1 -1
  1020. package/dist/esm/security/session-invalidation-fence.backend.utils.d.ts.map +1 -1
  1021. package/dist/esm/security/ssrf/outbound-target-guard.backend.utils.d.ts.map +1 -1
  1022. package/dist/esm/security/ssrf/outbound-target-guard.backend.utils.js.map +1 -1
  1023. package/dist/esm/security/ssrf/pinned-outbound-fetch.backend.utils.d.ts.map +1 -1
  1024. package/dist/esm/security/ssrf/pinned-outbound-fetch.backend.utils.js.map +1 -1
  1025. package/dist/esm/security/token-invalidation-fence.backend.utils.d.ts.map +1 -1
  1026. package/dist/esm/testing.d.ts.map +1 -1
  1027. package/dist/esm/users/services/inbound-contact-custom-implementation.backend.service.d.ts.map +1 -1
  1028. package/dist/esm/users/services/user-deletion-audit.custom-impl.backend.service.d.ts.map +1 -1
  1029. package/dist/esm/users/services/user-force-password-reset.custom-impl.backend.service.d.ts.map +1 -1
  1030. package/dist/esm/users/services/user-read-retained.custom-impl.backend.service.d.ts.map +1 -1
  1031. package/dist/esm/users/services/user-read-retained.custom-impl.backend.service.js.map +1 -1
  1032. package/dist/esm/users/services/user-role-administration.custom-impl.backend.service.d.ts.map +1 -1
  1033. package/dist/esm/users/services/user-self-custom-implementations.backend.d.ts.map +1 -1
  1034. package/dist/esm/users/services/user-super-admin-floor.custom-impl.backend.service.d.ts.map +1 -1
  1035. package/dist/tsconfig.build.tsbuildinfo +1 -1
  1036. package/package.json +9 -9
  1037. package/dist/esm/external-providers/services/flow-actor-design.backend.service.d.ts +0 -45
  1038. package/dist/esm/external-providers/services/flow-actor-design.backend.service.d.ts.map +0 -1
  1039. package/dist/esm/external-providers/services/flow-actor-design.backend.service.js +0 -22
  1040. package/dist/esm/external-providers/services/flow-actor-design.backend.service.js.map +0 -1
  1041. package/dist/esm/notifications/email/models/email-context-provider.interface.d.ts +0 -0
  1042. package/dist/esm/notifications/email/models/email-context-provider.interface.d.ts.map +0 -0
  1043. package/dist/esm/notifications/email/models/email-context-provider.interface.js +0 -0
  1044. package/dist/esm/notifications/email/models/email-context-provider.interface.js.map +0 -0
  1045. package/dist/esm/notifications/email/services/email-context-provider-registry.backend.service.d.ts +0 -0
  1046. package/dist/esm/notifications/email/services/email-context-provider-registry.backend.service.d.ts.map +0 -0
  1047. package/dist/esm/notifications/email/services/email-context-provider-registry.backend.service.js +0 -0
  1048. package/dist/esm/notifications/email/services/email-context-provider-registry.backend.service.js.map +0 -0
  1049. package/dist/esm/notifications/email/services/email-template-compiler.backend.service.d.ts +0 -0
  1050. package/dist/esm/notifications/email/services/email-template-compiler.backend.service.d.ts.map +0 -0
  1051. package/dist/esm/notifications/email/services/email-template-compiler.backend.service.js +0 -0
  1052. package/dist/esm/notifications/email/services/email-template-compiler.backend.service.js.map +0 -0
  1053. package/dist/esm/notifications/email/services/email-template-sandbox.backend.service.d.ts +0 -0
  1054. package/dist/esm/notifications/email/services/email-template-sandbox.backend.service.d.ts.map +0 -0
  1055. package/dist/esm/notifications/email/services/email-template-sandbox.backend.service.js +0 -0
  1056. package/dist/esm/notifications/email/services/email-template-sandbox.backend.service.js.map +0 -0
package/dist/esm/security/authentications/services/authentication-orchestrator.backend.service.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"authentication-orchestrator.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/authentication-orchestrator.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAG9G,OAAO,EAAE,yBAAyB,EAAE,MAAM,+FAA+F,CAAC;AAE1I,OAAO,EAIL,wBAAwB,EACxB,+BAA+B,EAC/B,2BAA2B,EAC3B,SAAS,EACT,mBAAmB,EAGnB,UAAU,GACX,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAC5G,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAEhK,OAAO,EACL,SAAS,EACT,gCAAgC,EAChC,UAAU,EACV,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,4BAA4B,EAK5B,2BAA2B,EAC3B,0BAA0B,EAC1B,YAAY,EACZ,aAAa,EACb,sBAAsB,EACtB,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAErG,OAAO,EACL,8BAA8B,EAC9B,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,uBAAuB,EAAE,MAAM,sFAAsF,CAAC;AAC/H,OAAO,EAAE,uBAAuB,EAAE,MAAM,6EAA6E,CAAC;AACtH,OAAO,EACL,oCAAoC,EACpC,mCAAmC,GACpC,MAAM,2FAA2F,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AAKvF,0BAA0B;AAC1B,OAAO,EAAE,8BAA8B,EAAE,MAAM,yFAAyF,CAAC;AACzI,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,6BAA6B,EAAmB,MAAM,wFAAwF,CAAC;AACxJ,OAAO,EAAE,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AAIpI,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AACxG,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AAEzJ,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,eAAe,EAAE,MAAM,2EAA2E,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,MAAM,4FAA4F,CAAC;AACnI,OAAO,EAAE,sCAAsC,EAAE,MAAM,8GAA8G,CAAC;AACtK,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AACjJ,OAAO,EAAE,mBAAmB,EAAE,MAAM,kFAAkF,CAAC;AACvH,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,0CAA0C,GAC3C,MAAM,4FAA4F,CAAC;AACpG,OAAO,EAAE,kCAAkC,EAAE,MAAM,uFAAuF,CAAC;AA2C3I;;;;;;;;;;;;;;;;;;GAkBG;AAEI,IAAM,wCAAwC,GAA9C,MAAM,wCAAwC;;IAgCG;IACU;IACG;IACW;IACI;IAClB;IAEA;IACM;IACP;IAEO;IACV;IACW;IAEC;IAEY;IAErB;IAEgB;IAEV;IAEG;IAGL;IACL;IAE3C;IAI2C;IAlE9D,uHAAuH;IAC/G,MAAM,CAAU,gCAAgC,GAAG,EAAE,CAAC;IAC9D,qHAAqH;IAC7G,MAAM,CAAU,iCAAiC,GAAG,CAAC,CAAC;IAC9D,uEAAuE;IAC/D,MAAM,CAAU,4BAA4B,GAAG,CAAC,CAAC;IAEzD;;;;;;;OAOG;IACK,MAAM,CAAU,oCAAoC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAC7E,2HAA2H;IACnH,MAAM,CAAU,mCAAmC,GAAG,MAAM,CAAC;IAEpD,QAAQ,CAA+D;IAExF;;;;;;OAMG;IACc,wBAAwB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEtE,YACsD,MAAqB,EACX,gBAAyC,EACtC,YAAwC,EAC7B,uBAA8D,EAC1D,oBAA+D,EACjF,gBAAyC,EAEzC,YAA4C,EACtC,kBAAwD,EAC/D,WAA0C,EAEnC,sBAAqD,EAC/D,YAA0B,EACf,gBAAyC,EAExC,iBAAkD,EAEtC,gBAAsD,EAE3E,eAAuC,EAEvB,cAAsD,EAEhE,UAAwC,EAErC,aAA8C,EAGnD,mBAA+C,EACpD,cAA8B,EAEzE,6BAC4B,EAGe,cAAqC;QAnC7C,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QACtC,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC1D,yBAAoB,GAApB,oBAAoB,CAA2C;QACjF,qBAAgB,GAAhB,gBAAgB,CAAyB;QAEzC,iBAAY,GAAZ,YAAY,CAAgC;QACtC,uBAAkB,GAAlB,kBAAkB,CAAsC;QAC/D,gBAAW,GAAX,WAAW,CAA+B;QAEnC,2BAAsB,GAAtB,sBAAsB,CAA+B;QAC/D,iBAAY,GAAZ,YAAY,CAAc;QACf,qBAAgB,GAAhB,gBAAgB,CAAyB;QAExC,sBAAiB,GAAjB,iBAAiB,CAAiC;QAEtC,qBAAgB,GAAhB,gBAAgB,CAAsC;QAE3E,oBAAe,GAAf,eAAe,CAAwB;QAEvB,mBAAc,GAAd,cAAc,CAAwC;QAEhE,eAAU,GAAV,UAAU,CAA8B;QAErC,kBAAa,GAAb,aAAa,CAAiC;QAGnD,wBAAmB,GAAnB,mBAAmB,CAA4B;QACpD,mBAAc,GAAd,cAAc,CAAgB;QAEzE,kCAA6B,GAA7B,6BAA6B,CACD;QAGe,mBAAc,GAAd,cAAc,CAAuB;QAEjG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;IACvE,CAAC;IAED;;;;OAIG;IACH,IAAY,aAAa;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,gBAAgB,EAAE,CAAC,EAAE,sBAAsB,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,EAAE,CAAC;QACxH,CAAC;QACD,OAAO;YACL,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;YACpE,sBAAsB,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;YAChF,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;YAC5D,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;SACzF,CAAC;IACJ,CAAC;IAED,IAAY,SAAS;QACnB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;IAC1D,CAAC;IAED,IAAY,eAAe;QACzB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC;IAChE,CAAC;IAED,gGAAgG;IAChG,mGAAmG;IACnG,8FAA8F;IAE9F,kCAAkC;IAClC,8CAA8C;IAC9C,kCAAkC;IAElC;;;;OAIG;IACK,kBAAkB,CAAC,cAA8B;QACvD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAC;YAC3E,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QACD,OAAO,0CAAwC,CAAC,oBAAoB,CAAC;IACvE,CAAC;IAED;;;OAGG;IACK,MAAM,CAAU,oBAAoB,GAAuB;QACjE,kBAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE;QACnD,SAAS,EAAE;YACT,UAAU,EAAE,KAAK;YACjB,gBAAgB,EAAE,KAAK;YACvB,yBAAyB,EAAE,CAAC;YAC5B,oBAAoB,EAAE,IAAI;SAC3B;QACD,YAAY,EAAE;YACZ,yFAAyF;YACzF,uFAAuF;YACvF,IAAI,EAAE,gBAAgB,CAAC,QAAQ;YAC/B,cAAc,EAAE,EAAE;YAClB,iBAAiB,EAAE,qBAAqB,CAAC,sBAAsB;YAC/D,kBAAkB,EAAE,KAAK;SAC1B;QACD,cAAc,EAAE;YACd,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,GAAG;YACd,gBAAgB,EAAE,IAAI;YACtB,gBAAgB,EAAE,IAAI;YACtB,cAAc,EAAE,IAAI;YACpB,mBAAmB,EAAE,KAAK;YAC1B,UAAU,EAAE,CAAC;SACd;QACD,sBAAsB,EAAE,0CAAwC,CAAC,gCAAgC;QACjG,aAAa,EAAE;YACb,gBAAgB,EAAE,CAAC;YACnB,sBAAsB,EAAE,EAAE;YAC1B,kBAAkB,EAAE,KAAK;YACzB,0BAA0B,EAAE,EAAE;SAC/B;QACD,eAAe,EAAE,IAAI;QACrB,gBAAgB,EAAE;YAChB,sBAAsB,EAAE,IAAI;YAC5B,6BAA6B,EAAE,KAAK;SACrC;KACF,CAAC;IAEF;;;;OAIG;IACK,KAAK,CAAC,kCAAkC,CAC9C,EAAyB,EACzB,cAAyC,EACzC,MAAc;QAEd,IAAI,CAAC,cAAc;YAAE,OAAO,0CAAwC,CAAC,oBAAoB,CAAC;QAC1F,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;QAC/F,OAAO,SAAS,IAAI,0CAAwC,CAAC,oBAAoB,CAAC;IACpF,CAAC;IAED;;;;OAIG;IACK,wBAAwB,CAAC,MAAkB;QACjD,MAAM,SAAS,GAAoB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QAChF,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,IAAI,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,6BAA6B,CAAC,OAA8B;QAClE,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACzD,CAAC;IAEO,iCAAiC,CAAC,mBAAuC,EAAE,QAAmC;QACpH,IAAI,CAAC,mBAAmB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtC,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,CAAC,qCAAqC,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;QAClH,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;gBACvF,OAAO,EAAE;oBACP,wBAAwB;oBACxB,mBAAmB;oBACnB,cAAc,EAAE,QAAQ;iBACzB;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,iDAAiD;IACjD,kCAAkC;IAE1B,qBAAqB,CAAC,cAA8B;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,sBAAsB,GAAG,EAAE,CAAC;IAC5C,CAAC;IAGD;;OAEG;IACH,+FAA+F;IACvF,MAAM,CAAU,gCAAgC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAEhE,KAAK,CAAC,aAAa,CACzB,SAAiB,EACjB,eAA2C,0BAA0B,CAAC,OAAO,EAC7E,UAOI,EAAE;QAEN,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACnE,MAAM,kBAAkB,GAAG,OAAO,CAAC,OAAO,KAAK,kBAAkB,CAAC,YAAY,IAAI,OAAO,CAAC,OAAO,KAAK,kBAAkB,CAAC,UAAU,CAAC;QACpI,MAAM,UAAU,GAAG,kBAAkB;YACnC,CAAC,CAAC,0CAAwC,CAAC,gCAAgC;YAC3E,CAAC,CAAC,UAAU,CAAC,sBAAsB,GAAG,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;QAE9D,MAAM,OAAO,GAA0B;YACrC,SAAS;YACT,KAAK,EAAE,YAAY;YACnB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,kBAAkB,CAAC,KAAK;YACpD,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,GAAG;YACd,SAAS;YACT,YAAY,EAAE,GAAG;YACjB,gBAAgB,EAAE,EAAE;YACpB,2BAA2B,EAAE,EAAE;YAC/B,4BAA4B,EAAE,EAAE;YAChC,0BAA0B,EAAE,EAAE;YAC9B,2BAA2B,EAAE,EAAE;YAC/B,yBAAyB,EAAE,EAAE;YAC7B,WAAW,EAAE,KAAK;YAClB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,0CAAwC,CAAC,4BAA4B;YACzF,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,UAAU,CAAC,aAAa,CAAC,gBAAgB;YACtD,qBAAqB,EAAE,EAAE;YACzB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,OAAO,EAAE,CAAC;SACX,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,uCAAuC,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAEhG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,UAAU,CAAC,SAAiB;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEvD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,iEAAiE;QACjE,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,gCAAgC,SAAS,EAAE,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,kEAAkE;QAClE,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,0CAAwC,CAAC,iCAAiC,GAAG,EAAE,GAAG,IAAI,CAAC;YAC3G,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YACjE,IAAI,YAAY,GAAG,WAAW,EAAE,CAAC;gBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC1C,IAAI,CAAC,QAAQ,CAAC,uCAAuC,SAAS,EAAE,EAAE;oBAChE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC;oBAC7C,YAAY,EAAE,0CAAwC,CAAC,iCAAiC;iBACzF,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,0FAA0F;IAClF,MAAM,CAAU,yBAAyB,GAAG,CAAC,CAAC;IAEtD;;;;;;OAMG;IACK,KAAK,CAAC,aAAa,CACzB,SAAiB,EACjB,OAAuC;QAEvC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,0CAAwC,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,CAAC;YAC/G,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;YAC7C,MAAM,cAAc,GAAG,2BAA2B,CAAC,KAAK,CAAC;gBACvD,GAAG,OAAO;gBACV,GAAG,OAAO;gBACV,YAAY,EAAE,IAAI,IAAI,EAAE;gBACxB,OAAO,EAAE,eAAe,GAAG,CAAC;aAC7B,CAAC,CAAC;YAEH,6CAA6C;YAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CACjD,SAAS,EACT,cAAc,EACd,eAAe,EACf,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC,cAAc,CAAC,CAC1D,CAAC;YAEF,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,QAAQ,CAAC,mCAAmC,SAAS,EAAE,EAAE;oBAC5D,KAAK,EAAE,cAAc,CAAC,KAAK;oBAC3B,OAAO,EAAE,cAAc,CAAC,OAAO;iBAChC,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,oEAAoE;YACpE,IAAI,CAAC,QAAQ,CAAC,4CAA4C,OAAO,GAAG,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,iFAAiF;QACjF,oFAAoF;QACpF,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,4DAA4D,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAChG,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa,CAAC,SAAiB;QAC3C,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,mCAAmC,SAAS,EAAE,CAAC,CAAC;IAChE,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,wBAAwB,CACpC,EAAyB,EACzB,SAAiB;QAEjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QAClE,MAAM,cAAc,GAAG,aAAa,CAAC,aAAa,CAAC;QACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC;QAE/C,IAAI,uBAAuB,GAAG,cAAc,CAAC,sBAAsB,CAAC;QAEpE,iHAAiH;QACjH,IAAI,MAAM,IAAI,cAAc,CAAC,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAClE,IAAI,CAAC;gBACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,EAAE,OAAO,CAAC,MAAO,CAAC,CAAC;gBACzF,MAAM,UAAU,GAAG,CAAC,cAAc,CAAC,0BAA0B,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC;gBAC1E,uBAAuB,GAAG,IAAI,CAAC,GAAG,CAChC,cAAc,CAAC,sBAAsB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,EAClE,UAAU,CACX,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;YACzD,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAmC;YAC9C,QAAQ;YACR,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK;YACjE,YAAY,EAAE,MAAM;gBAClB,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;gBAC5D,CAAC,CAAC,SAAS;SACd,CAAC;QAEF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEpE,IAAI,MAAM,IAAI,cAAc,EAAE,MAAM,EAAE,CAAC;YACrC,qFAAqF;YACrF,2FAA2F;YAC3F,MAAM,IAAI,CAAC,2BAA2B,CACpC,EAAE,EACF,cAAc,CAAC,MAAM,EACrB,cAAc,CAAC,KAAK,IAAI,SAAS,EACjC,uBAAuB,EACvB,cAAc,CAAC,UAAU,EACzB,SAAS,EACT,oBAAoB,CAAC,qBAAqB,CAC3C,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,2BAA2B,CACvC,EAAyB,EACzB,YAAoB,EACpB,KAAa,EACb,sBAA8B,EAC9B,UAA+C,EAC/C,SAAiB,EACjB,MAA4B;QAE5B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtE,IACE,aAAa,KAAK,SAAS;YAC3B,KAAK,GAAG,aAAa,GAAG,0CAAwC,CAAC,oCAAoC,EACrG,CAAC;YACD,OAAO,CAAC,+DAA+D;QACzE,CAAC;QACD,IAAI,IAAI,CAAC,wBAAwB,CAAC,IAAI,IAAI,0CAAwC,CAAC,mCAAmC,EAAE,CAAC;YACvH,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACpE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACvD,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;QAC9F,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;YAC/C,MAAM,EAAE,YAAY;YACpB,KAAK,EAAE,KAAK,IAAI,SAAS;YACzB,UAAU,EAAE,UAAU,CAAC,QAAQ;YAC/B,eAAe,EAAE,sBAAsB;YACvC,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;YAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;YAC7C,SAAS;YACT,MAAM;SACP,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;IACxB,CAAC;IAED,kCAAkC;IAClC,mDAAmD;IACnD,kCAAkC;IAElC;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,oBAAoB,CAAC,KAAa;QAC9C,MAAM,GAAG,GAAG,GAAG,eAAe,CAAC,cAAc,GAAG,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACtE,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,GAAG,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,+DAA+D;IAC/D,wDAAwD;IACxD,iEAAiE;IACjE,8DAA8D;IAC9D,8DAA8D;IAC9D,iEAAiE;IACjE,kEAAkE;IAElE,kCAAkC;IAClC,mBAAmB;IACnB,kCAAkC;IAElC;;OAEG;IACK,KAAK,CAAC,6BAA6B,CACzC,EAAyB,EACzB,QAA+B,EAC/B,KAAa,EACb,SAAiB;QAEjB,IAAI,CAAC,QAAQ,CAAC,gDAAgD,SAAS,WAAW,KAAK,EAAE,CAAC,CAAC;QAE3F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAEjE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACtE,MAAM,YAAY,GAAG,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;YACxH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;aACjC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,kBAAkB,CAAC,IAAU,EAAE,SAAiB;QACtD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;YAAE,OAAO;QAE9C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;YACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;YACjF,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,iCAAiC,CAC7C,EAAyB,EACzB,SAAiB,EACjB,MAAc,EACd,UAAsB;QAEtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;gBAClF,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACtD,MAAM,mBAAmB,GAAG,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC7D,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,CAAC,GAAG,cAAc,EAAE,UAAU,CAAC,CAAC;QAEpC,oGAAoG;QACpG,MAAM,cAAc,GAAG,SAAS,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;QAE5F,sFAAsF;QACtF,sFAAsF;QACtF,IAAI,cAAc,IAAI,OAAO,CAAC,yBAAyB,IAAI,OAAO,CAAC,yBAAyB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxG,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;oBACvF,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,2BAA2B,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,cAAc;YAC7B,CAAC,CAAC,0BAA0B,CAAC,SAAS;YACtC,CAAC,CAAC,0BAA0B,CAAC,sBAAsB,CAAC;QAEtD,8DAA8D;QAC9D,MAAM,aAAa,GAAG,MAAM;YAC1B,CAAC,CAAC,MAAM,IAAI,CAAC,kCAAkC,CAAC,EAAE,EAAE,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC;YACnF,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QAEhD,sGAAsG;QACtG,sGAAsG;QACtG,uGAAuG;QACvG,kGAAkG;QAClG,wGAAwG;QACxG,qGAAqG;QACrG,IAAI,CAAC,cAAc,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACtG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;gBACvF,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,wCAAwC,EAAE;aAClF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAmC;YACpD,KAAK,EAAE,QAAQ;YACf,gBAAgB,EAAE,mBAAmB;YACrC,QAAQ,EAAE,CAAC,EAAE,8CAA8C;YAC3D,MAAM,EAAE,MAAM;SACf,CAAC;QAEF,6EAA6E;QAC7E,yEAAyE;QACzE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;YACrF,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACtB,MAAM,uBAAuB,GAAG,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,SAAS,CAAC,CAAC;gBAE/F,IAAI,CAAC,uBAAuB,EAAE,CAAC;oBAC7B,yEAAyE;oBACzE,MAAM,mBAAmB,GAAG,SAAS,CAAC,sBAAsB,EAAE,CAAC;oBAC/D,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,MAAM,CACpD,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAC3C,CAAC;oBAEF,aAAa,CAAC,KAAK,GAAG,0BAA0B,CAAC,uBAAuB,CAAC;oBACzE,aAAa,CAAC,WAAW,GAAG,IAAI,CAAC;oBACjC,aAAa,CAAC,gBAAgB,GAAG,aAAa,CAAC,SAAS,EAAE,gBAAgB,IAAI,KAAK,CAAC;oBACpF,aAAa,CAAC,QAAQ,GAAG,YAAY,CAAC,cAAc,CAAC;oBACrD,aAAa,CAAC,0BAA0B,GAAG,mBAAmB,CAAC;gBACjE,CAAC;qBAAM,CAAC;oBACN,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;oBAEnG,aAAa,CAAC,WAAW,GAAG,IAAI,CAAC;oBACjC,aAAa,CAAC,gBAAgB,GAAG,aAAa,CAAC,gBAAgB,CAAC;oBAChE,aAAa,CAAC,4BAA4B,GAAG,aAAa,CAAC,gBAAgB,CAAC;oBAC5E,aAAa,CAAC,2BAA2B,GAAG,QAAQ,CAAC,eAAe,CAAC;oBACrE,aAAa,CAAC,yBAAyB,GAAG,aAAa,CAAC,aAAa,CAAC;gBACxE,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAEnD,6DAA6D;QAC7D,IAAI,aAAa,CAAC,aAAa,CAAC,kBAAkB,IAAI,MAAM,EAAE,CAAC;YAC7D,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;QACH,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,8BAA8B;IAC9B,kCAAkC;IAE3B,KAAK,CAAC,QAAQ,CACnB,EAAyB,EACzB,qBAAgD,EAChD,cAAuB,EACvB,mBAA4B;QAE5B,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAAC;QAEpD,IAAI,CAAC,QAAQ,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;QAE7D,0DAA0D;QAC1D,8DAA8D;QAC9D,0GAA0G;QAC1G,gDAAgD;QAChD,yDAAyD;QACzD,6DAA6D;QAC7D,8DAA8D;QAC9D,8DAA8D;QAC9D,wDAAwD;QACxD,2DAA2D;QAC3D,4DAA4D;QAC5D,4DAA4D;QAC5D,6DAA6D;QAC7D,uCAAuC;QAEvC,gFAAgF;QAChF,sEAAsE;QACtE,mEAAmE;QACnE,uEAAuE;QACvE,sEAAsE;QACtE,oCAAoC;QAEpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAEjE,IAAI,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAC,IAAI,WAAW,KAAK,EAAE,CAAC,CAAC;QAE1E,6EAA6E;QAC7E,yFAAyF;QACzF,uDAAuD;QACvD,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAE,IAAwC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3F,MAAM,gBAAgB,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,cAAc,CAAC;QAE9F,4CAA4C;QAC5C,6DAA6D;QAC7D,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACvD,IAAI,eAAe,GAAiC,IAAI,CAAC;QAEzD,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,eAAe,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;YAClF,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,QAAQ,CAAC,yCAAyC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,iEAAiE;QACjE,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,EAAE,CAAC;QAExD,0FAA0F;QAC1F,IAAI,CAAC,iCAAiC,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;QAE9E,MAAM,UAAU,GAAG,CAAC,IAAI,IAAI,gBAAgB,CAAC;YAC3C,CAAC,CAAC,MAAM,IAAI,CAAC,kCAAkC,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC;YAC/E,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QAC9C,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,EAAE,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QAEvG;;;;;;;;;;;;;;;;;;;WAmBG;QAEH,sEAAsE;QACtE,4EAA4E;QAC5E,8EAA8E;QAC9E,IAAI,yBAAyB,CAAC,eAAe,CAAC,EAAE,CAAC;YAC/C,MAAM,cAAc,GAAG,0CAA0C,CAC/D,kBAAkB,EAClB,eAAe,CAChB,CAAC;YACF,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC;YAC9B,kBAAkB,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;QAC7C,CAAC;QAED,6FAA6F;QAC7F,qEAAqE;QACrE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,0BAA0B,CAAC,UAAU,EAAE;YACzF,UAAU;YACV,cAAc,EAAE,gBAAgB;SACjC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;YAClC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;YAC1B,UAAU,EAAE,CAAC,CAAC,IAAI;YAClB,MAAM,EAAE,IAAI,EAAE,GAAG;YACjB,2BAA2B,EAAE,kBAAkB;YAC/C,OAAO,EAAE,eAAe,EAAE,OAAO;YACjC,SAAS,EAAE,eAAe,EAAE,SAAS;SACtC,CAAC,CAAC;QAEH;;;;;;;;;;;;;;;;;WAiBG;QACH,MAAM,0BAA0B,GAAG,eAAe,EAAE,OAAO;YACzD,CAAC,CAAC,MAAM,IAAI,CAAC,yCAAyC,CAAC,EAAE,EAAE,eAAe,CAAC,OAAO,CAAC;YACnF,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,oBAAoB,GAAG,eAAe;YAC1C,CAAC,CAAC;gBACE,gBAAgB,EAAE,eAAe,CAAC,eAAe,EAAE,WAAW;gBAC9D,GAAG,8BAA8B,CAAC,0BAA0B,EAAE;oBAC5D,iFAAiF;oBACjF,OAAO,EACL,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;wBACxC,WAAW,EAAE,qBAAqB,CAAC,MAAM;wBACzC,KAAK,EAAE,eAAe,CAAC,OAAO;qBAC/B,CAAC;2BACC,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;4BAC3C,WAAW,EAAE,qBAAqB,CAAC,MAAM;4BACzC,KAAK,EAAE,eAAe,CAAC,OAAO;yBAC/B,CAAC;oBACJ,kFAAkF;oBAClF,yFAAyF;oBACzF,qFAAqF;oBACrF,qFAAqF;oBACrF,YAAY,EAAE,SAAS;iBACxB,CAAC;aACH;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,uEAAuE;QACvE,4EAA4E;QAC5E,6DAA6D;QAC7D,IAAI,CAAC,IAAI,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5F,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YACrH,IAAI,cAAc,EAAE,CAAC;gBACnB,kBAAkB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED;;;;;;;;;;;;;;WAcG;QAEH,MAAM,OAAO,GAAG;YACd,SAAS;YACT,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;YAC1B,UAAU,EAAE,IAAI,EAAE,6CAA6C;YAC/D,kBAAkB;YAClB,wBAAwB,EAAE,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YAClG,mBAAmB,EAAE,EAAE;YACvB,WAAW,EAAE,KAAK;YAClB,kBAAkB,EAAE,0CAAwC,CAAC,4BAA4B;YACzF,oBAAoB;YACpB,qBAAqB,EAAE,EAAE;SAC1B,CAAC;QACF,OAAO,gCAAgC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,kCAAkC;IAClC,0BAA0B;IAC1B,kCAAkC;IAElC;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,gCAAgC,CAC3C,EAAyB,EACzB,UAA8B,EAC9B,eAA8C;QAE9C,OAAO,IAAI,CAAC,+BAA+B,CAAC,EAAE,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;IAC/E,CAAC;IAEO,KAAK,CAAC,+BAA+B,CAAC,EAAyB,EAAE,eAA8C,EAAE,UAA+B;QACtJ,MAAM,MAAM,GAAG,UAAU,IAAI,0CAAwC,CAAC,oBAAoB,CAAC;QAC3F,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE,EAAE,CAAC;YACvD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;YACpG,IAAI,eAAe,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,gCAAgC,CAAC,UAA+B;QAC5E,MAAM,MAAM,GAAG,UAAU,IAAI,0CAAwC,CAAC,oBAAoB,CAAC;QAC3F,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,sBAAsB,EAAE,EAAE,CAAC;YACxD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YACrG,IAAI,eAAe,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,EAAE,oBAAoB,IAAI,EAAE,CAAC;QAChE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,wBAAwB,CAAC,eAA6B,EAAE,UAA+B;QAKnG,MAAM,MAAM,GAAG,UAAU,IAAI,0CAAwC,CAAC,oBAAoB,CAAC;QAC3F,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC,CAAC;QAC7E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAa,eAAe,CAAC,CAAC;QACzD,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,gBAAgB,CAAC;QAC9D,IAAI,aAAa,GAAiB,gBAAgB;aAC/C,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACtB,IAAI,gBAAgB,EAAE,CAAC;YACrB,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,SAAS,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC;IAC/D,CAAC;IAED,kCAAkC;IAClC,0BAA0B;IAC1B,kCAAkC;IAE3B,KAAK,CAAC,oBAAoB,CAAC,EAAyB,EAAE,mBAAwC;QACnG,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEzF,2BAA2B;QAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAClD,MAAM,YAAY,GAAG,IAAI,CAAC,iCAAiC,CAAC,SAAS,EAAE,mBAAmB,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACxH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;gBAClF,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE;aACrC,CAAC,CAAC;QACL,CAAC;QAED,8BAA8B;QAC9B,IAAI,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,MAAM,EAAE,CAAC;YACxD,MAAM,YAAY,GAAG,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,KAAK,EAAE;gBAC3F,YAAY,EAAE,KAAK;gBACnB,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE;aACrC,CAAC,CAAC;QACL,CAAC;QAED,2EAA2E;QAC3E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;YAClC,0BAA0B,CAAC,UAAU;YACrC,0BAA0B,CAAC,wBAAwB;SACpD,CAAC,CAAC;QACH,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;aACnF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAE1B,sEAAsE;QACtE,EAAE;QACF,+DAA+D;QAC/D,6DAA6D;QAC7D,+DAA+D;QAC/D,iEAAiE;QACjE,mEAAmE;QACnE,oEAAoE;QACpE,6DAA6D;QAC7D,8DAA8D;QAC9D,kEAAkE;QAClE,+DAA+D;QAC/D,oEAAoE;QACpE,wCAAwC;QACxC,EAAE;QACF,4DAA4D;QAC5D,iEAAiE;QACjE,2BAA2B;QAC3B,kEAAkE;QAClE,6DAA6D;QAC7D,+DAA+D;QAC/D,mEAAmE;QACnE,6DAA6D;QAC7D,kDAAkD;QAClD,kEAAkE;QAClE,+DAA+D;QAC/D,yDAAyD;QACzD,iEAAiE;QACjE,gEAAgE;QAChE,iEAAiE;QACjE,mEAAmE;QACnE,kEAAkE;QAClE,iEAAiE;QACjE,mEAAmE;QACnE,gEAAgE;QAChE,mEAAmE;QACnE,iEAAiE;QACjE,qDAAqD;QACrD,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,mEAAmE;QACnE,qDAAqD;QACrD,EAAE;QACF,mEAAmE;QACnE,gEAAgE;QAChE,2DAA2D;QAC3D,uDAAuD;QACvD,2CAA2C;QAC3C,8CAA8C;QAC9C,8DAA8D;QAC9D,8DAA8D;QAC9D,4DAA4D;QAC5D,gEAAgE;QAChE,8DAA8D;QAC9D,aAAa;QACb,EAAE;QACF,qEAAqE;QACrE,6DAA6D;QAC7D,iEAAiE;QACjE,kEAAkE;QAClE,4DAA4D;QAC5D,8DAA8D;QAC9D,6CAA6C;QAC7C,EAAE;QACF,kEAAkE;QAClE,6DAA6D;QAC7D,gEAAgE;QAChE,+DAA+D;QAC/D,2DAA2D;QAC3D,0DAA0D;QAC1D,gDAAgD;QAChD,+DAA+D;QAC/D,gEAAgE;QAChE,iEAAiE;QACjE,iEAAiE;QACjE,gEAAgE;QAChE,gEAAgE;QAChE,8DAA8D;QAC9D,0DAA0D;QAC1D,iEAAiE;QACjE,6DAA6D;QAC7D,8DAA8D;QAC9D,gEAAgE;QAChE,EAAE;QACF,gEAAgE;QAChE,8DAA8D;QAC9D,kEAAkE;QAClE,2DAA2D;QAC3D,+DAA+D;QAC/D,8DAA8D;QAC9D,qBAAqB;QACrB,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC;QAChD,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,GAAG,eAAe,CAAC,cAAc,GAAG,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7G,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,GAAG,eAAe,CAAC,WAAW,GAAG,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACnG,CAAC;QAED;;;;;;;;;;;;;;;;WAgBG;QAEH,eAAe;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACrF,MAAM,MAAM,GAAI,IAAa,CAAC,GAAG,CAAC;QAElC,yFAAyF;QACzF,mFAAmF;QACnF,wFAAwF;QACxF,yFAAyF;QACzF,wFAAwF;QACxF,sFAAsF;QACtF,mFAAmF;QACnF,8EAA8E;QAC9E,sFAAsF;QACtF,oFAAoF;QACpF,oFAAoF;QACpF,0DAA0D;QAC1D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kCAAkC,CAAC,EAAE,EAAE,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QAC1G,IAAI,CAAC,eAAe,CAAC,kBAAkB,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACtE,MAAM,YAAY,GAAG,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,KAAK,EAAE;gBAC3F,UAAU,EAAE,UAAU,CAAC,QAAQ;gBAC/B,YAAY,EAAE,CAAC,MAAM;aACtB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;gBAC7F,OAAO,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;aACjC,CAAC,CAAC;QACL,CAAC;QAED,iDAAiD;QACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAE1E,sFAAsF;QACtF,uFAAuF;QACvF,oFAAoF;QACpF,uFAAuF;QACvF,uFAAuF;QACvF,kFAAkF;QAClF,sDAAsD;QACtD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAChC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACtE,MAAM,YAAY,GAAG,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,KAAK,EAAE;gBAC3F,UAAU,EAAE,UAAU,CAAC,QAAQ;gBAC/B,YAAY,EAAE,CAAC,MAAM;aACtB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;gBAC7F,OAAO,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;aACjC,CAAC,CAAC;QACL,CAAC;QAED,qEAAqE;QACrE,mEAAmE;QACnE,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,mEAAmE;QACnE,8DAA8D;QAC9D,kEAAkE;QAClE,iBAAiB;QACjB,EAAE;QACF,oEAAoE;QACpE,qEAAqE;QACrE,qEAAqE;QACrE,kEAAkE;QAClE,sEAAsE;QACtE,iCAAiC;QACjC,EAAE;QACF,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,sCAAsC;QACtC,+BAA+B;QAC/B,oCAAoC;QACpC,+BAA+B;QAC/B,wEAAwE;QACxE,aAAa;QACb,EAAE;QACF,8CAA8C;QAC9C,0EAA0E;QAC1E,oEAAoE;QACpE,sEAAsE;QACtE,wEAAwE;QACxE,gCAAgC;QAChC,wEAAwE;QACxE,qEAAqE;QACrE,uBAAuB;QACvB,EAAE;QACF,gFAAgF;QAChF,2FAA2F;QAC3F,kGAAkG;QAClG,gGAAgG;QAChG,iGAAiG;QACjG,iGAAiG;QACjG,yFAAyF;QACzF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CACxC,GAAG,eAAe,CAAC,cAAc,GAAG,KAAK,CAAC,WAAW,EAAE,EAAE,EACzD,IAAI,CAAC,aAAa,CAAC,gBAAgB,EACnC,IAAI,CAAC,aAAa,CAAC,sBAAsB,GAAG,EAAE,EAC9C,SAAS,EACT,qFAAqF,EACrF;gBACE,SAAS,EAAE,SAAS,CAAC,cAAc;gBACnC,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,YAAY,EAAE,EAAE,sBAAsB,EAAE,IAAI,CAAC,aAAa,CAAC,sBAAsB,EAAE;aACpF,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,kBAAkB,EAAE,CAAC;YAC5B,IACE,mBAAmB,CAAC,kBAAkB,CAAC;gBACvC,kBAAkB,CAAC,sBAAsB,KAAK,2BAA2B,CAAC,6BAA6B,EACvG,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,2BAA2B,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,sBAAsB,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,oBAAoB,CAAC,uBAAuB,CAAC,CAAC;gBACpL,CAAC;gBAAC,MAAM,CAAC;oBACP,kFAAkF;gBACpF,CAAC;YACH,CAAC;YACD,MAAM,kBAAkB,CAAC;QAC3B,CAAC;QAED,uBAAuB;QACvB,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;YAClC,KAAK,EAAE,0BAA0B,CAAC,wBAAwB;YAC1D,aAAa,EAAE,eAAe,CAAC,KAAK;SACrC,CAAC,CAAC;QAEH,6CAA6C;QAC7C,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACnD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACrF,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;QAEhF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAC7D,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACtG,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,MAAM,iBAAiB,GAAG,YAAY;gBACpC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;gBACtE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,sBAAsB,GAAG,EAAE,CAAC;YACnD,MAAM,sBAAsB,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,GAAG,EAAE,CAAC,CAAC;YAEjE,0EAA0E;YAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YACtC,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBAC7C,KAAK;gBACL,UAAU,EAAE,UAAU,CAAC,QAAQ;gBAC/B,aAAa,EAAE,qBAAqB;gBACpC,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,iBAAiB,EAAE,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,QAAQ,GAAG,CAAC;gBAC7D,SAAS;aACV,CAAC,CAAC;YAEH,MAAM,YAAY,GAAG,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,KAAK,EAAE;gBAC3F,UAAU,EAAE,UAAU,CAAC,QAAQ;gBAC/B,YAAY,EAAE,CAAC,MAAM;gBACrB,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;aACtC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,MAAM;oBAC5B,CAAC,CAAC,2BAA2B,CAAC,6BAA6B;oBAC3D,CAAC,CAAC,2BAA2B,CAAC,uCAAuC;gBACvE,OAAO,EAAE;oBACP,KAAK;oBACL,YAAY;oBACZ,GAAG,CAAC,MAAM,IAAI;wBACZ,sBAAsB;wBACtB,iBAAiB;wBACjB,OAAO,EAAE,qFAAqF;qBAC/F,CAAC;iBACH;aACF,CAAC,CAAC;QACL,CAAC;QAED,qCAAqC;QACrC,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAE3E,oEAAoE;QACpE,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAEvC;;;;;;;WAOG;QACH,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,IAAI,CAAC,0BAA0B,CACnC,EAAE,EACF,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,OAAO,EACf,MAAM,EACL,IAAa,CAAC,KAAK,EACpB,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,IAAI,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,IAAI,EAAE,EAAE,CAC1F,CAAC;YAEF,MAAM,IAAI,CAAC,uBAAuB,CAChC,EAAE,EACF,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,OAAO,EACf,MAAM,CACP,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,iCAAiC,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEzF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,iCAAiC,CAC3C,SAAS,EACT,eAAe,CAAC,KAAK,EACrB,UAAU,CAAC,QAAQ,EACnB,EAAE,EAAE,+EAA+E;QACnF;YACE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,IAAI,EAAE;YACxD,WAAW,EAAE,cAAc,EAAE,WAAW,IAAI,KAAK;YACjD,mBAAmB,EAAE,cAAc,EAAE,4BAA4B,IAAI,EAAE;YACvE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB;YACtD,2BAA2B,EAAE,cAAc,EAAE,2BAA2B,IAAI,EAAE;YAC9E,yBAAyB,EAAE,cAAc,EAAE,yBAAyB,IAAI,EAAE;YAC1E,QAAQ,EAAE,cAAc,EAAE,QAAQ;YAClC,0BAA0B,EAAE,cAAc,EAAE,0BAA0B,IAAI,EAAE;SAC7E,CACF,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,4BAA4B;IAC5B,kCAAkC;IAElC;;;;OAIG;IACI,KAAK,CAAC,yBAAyB,CACpC,MAAc,EACd,KAAa,EACb,UAKI,EAAE;QAEN,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,0BAA0B,CAAC,UAAU,EAAE;YACzF,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,kBAAkB,CAAC,YAAY;YAC3D,KAAK;YACL,MAAM;YACN,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,wBAAwB,CACnC,EAAyB,EACzB,MAAc,EACd,KAAa,EACb,cAAuB,EACvB,UAAuD,EACvD,OAA4B;QAE5B,MAAM,UAAU,GAAG,cAAc;YAC/B,CAAC,CAAC,MAAM,IAAI,CAAC,kCAAkC,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC;YAC3E,CAAC,CAAC,0CAAwC,CAAC,oBAAoB,CAAC;QAElE,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,0BAA0B,CAAC,cAAc,EAAE;YAC7F,cAAc;YACd,OAAO,EAAE,OAAO,IAAI,kBAAkB,CAAC,YAAY;YACnD,KAAK;YACL,MAAM;YACN,UAAU;SACX,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,4BAA4B,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,4BAA4B,CACxC,EAAyB,EACzB,OAA8B,EAC9B,UAA8B,EAC9B,MAAc;QAEd,IAAI,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,cAAc,EAAE,CAAC;YAChE,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAElF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAE/D,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,uBAAuB,GAAG,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,SAAS,CAAC,CAAC;YAEhG,IAAI,uBAAuB,EAAE,CAAC;gBAC5B,IAAI,IAAI,IAAI,IAAI,CAAC,kBAAkB,KAAK,kBAAkB,CAAC,QAAQ,EAAE,CAAC;oBACpE,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,QAAQ,EAA8B,CAAC,CAAC;gBACrI,CAAC;gBACD,OAAO,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,eAAe,GAAG,UAAU,CAAC,SAAS,EAAE,yBAAyB,IAAI,CAAC,CAAC;YAC7E,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC;gBAClC,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC,CAAC;gBAEnE,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;wBAChD,kBAAkB,EAAE,kBAAkB,CAAC,KAAK;wBAC5C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,IAAI,IAAI,EAAE;qBAC1B,CAAC,CAAC;gBACjC,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE;oBAC1D,KAAK,EAAE,0BAA0B,CAAC,oBAAoB;oBACtD,QAAQ,EAAE,YAAY,CAAC,QAAQ;oBAC/B,iBAAiB,EAAE,cAAc,CAAC,WAAW,EAAE;oBAC/C,WAAW,EAAE,IAAI;iBAClB,CAAC,CAAC;gBACH,OAAO,OAAO,IAAI,OAAO,CAAC;YAC5B,CAAC;YAED,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,OAAO,EAA8B,CAAC,CAAC;YACpI,CAAC;YAED,MAAM,mBAAmB,GAAG,SAAS,CAAC,sBAAsB,EAAE,CAAC;YAC/D,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,MAAM,CACpD,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,CACxC,CAAC;YAEF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE;gBAC1D,KAAK,EAAE,0BAA0B,CAAC,uBAAuB;gBACzD,QAAQ,EAAE,YAAY,CAAC,cAAc;gBACrC,WAAW,EAAE,IAAI;gBACjB,gBAAgB,EAAE,UAAU,CAAC,SAAS,EAAE,gBAAgB,IAAI,KAAK;gBACjE,0BAA0B,EAAE,mBAAmB;aAChD,CAAC,CAAC;YACH,OAAO,OAAO,IAAI,OAAO,CAAC;QAC5B,CAAC;QAED,IAAI,IAAI,IAAI,IAAI,CAAC,kBAAkB,KAAK,kBAAkB,CAAC,YAAY,IAAI,IAAI,CAAC,kBAAkB,KAAK,kBAAkB,CAAC,QAAQ,EAAE,CAAC;YACnI,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,YAAY,EAA8B,CAAC,CAAC;QACzI,CAAC;QACD,OAAO,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,4BAA4B,CAAC,OAA8B;QACvE,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE;gBAC1D,KAAK,EAAE,0BAA0B,CAAC,kBAAkB;gBACpD,QAAQ,EAAE,YAAY,CAAC,UAAU;aAClC,CAAC,CAAC;YACH,OAAO,OAAO,IAAI,OAAO,CAAC;QAC5B,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE;YAC1D,KAAK,EAAE,0BAA0B,CAAC,SAAS;YAC3C,QAAQ,EAAE,YAAY,CAAC,QAAQ;SAChC,CAAC,CAAC;QACH,OAAO,OAAO,IAAI,OAAO,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,iCAAiC,CAC5C,EAAyB,EACzB,SAAiB;QAEjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;aACnF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,uBAAuB;YACpE,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,yBAAyB,EAAE,CAAC;YAC3E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,wBAAwB;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,wFAAwF;QACxF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACvE,MAAM,eAAe,GAAG,SAAS,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,eAAe,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,SAAS,CAAC,CAAC;QAE9E,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;aACrE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,IAAI,IAAI,CAAC,kBAAkB,KAAK,kBAAkB,CAAC,QAAQ,EAAE,CAAC;YACpE,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,QAAQ,EAA8B,CAAC,CAAC;QACrI,CAAC;QAED,OAAO,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,qBAAqB,CAChC,EAAyB,EACzB,SAAiB,EACjB,gBAAwB;QAExB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;aACnF,CAAC,CAAC;QACL,CAAC;QAED,6EAA6E;QAC7E,2EAA2E;QAC3E,kDAAkD;QAClD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM;YAC9B,CAAC,CAAC,MAAM,mCAAmC,CACzC,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,YAAY,EACjB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,CACf;YACD,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE;gBAC3D,KAAK,EAAE,0BAA0B,CAAC,SAAS;gBAC3C,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,cAAc,EAAE,SAAS;gBACzB,cAAc,EAAE,SAAS,CAAC,cAAc;aACzC,CAAC,CAAC;YACH,OAAO,QAAQ,IAAI;gBACjB,GAAG,OAAO;gBACV,KAAK,EAAE,0BAA0B,CAAC,SAAS;gBAC3C,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,cAAc,EAAE,SAAS;gBACzB,cAAc,EAAE,SAAS,CAAC,cAAc;aACzC,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,kBAAkB,EAAE,CAAC;YACpE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,wBAAwB;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;aAC5F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,iBAAiB;aACtE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE;YAClD,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM;YAC9B,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,UAAU,GAAG,MAAM,EAAE,iBAAiB,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,UAAU,EAAE,cAAc,CAAC;QAC1C,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC9C,IACE,CAAC,MAAM;eACJ,CAAC,UAAU;eACX,CAAC,cAAc;eACf,MAAM,EAAE,aAAa,KAAK,sBAAsB,CAAC,UAAU;eAC3D,CAAC,MAAM,CAAC,4BAA4B,EAAE,QAAQ,CAAC,cAAc,CAAC,EACjE,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;gBACzE,OAAO,EAAE;oBACP,MAAM,EAAE,mCAAmC;oBAC3C,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,cAAc;iBACf;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACzD,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,CACxB,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;gBACzE,OAAO,EAAE;oBACP,MAAM,EAAE,kCAAkC;oBAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;iBACvC;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE;oBACP,UAAU,EAAE,WAAW,CAAC,MAAM;oBAC9B,MAAM,EAAE,yBAAyB;iBAClC;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;gBACzE,OAAO,EAAE;oBACP,MAAM,EAAE,6CAA6C;oBACrD,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,cAAc;iBACf;aACF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,WAAW,GAAG,2BAA2B,CAC7C,MAAM,EAAE,SAAS,EACjB,UAAU,CAAC,SAAS,IAAI,EAAE,EAC1B,WAAW,CAAC,SAAS,IAAI,EAAE,EAC3B,8BAA8B,CAAC,mBAAmB,CACnD,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;gBACzE,OAAO,EAAE;oBACP,OAAO,EAAE,8BAA8B,CAAC,mBAAmB;oBAC3D,eAAe,EAAE,WAAW,CAAC,eAAe;oBAC5C,cAAc,EAAE,OAAO,CAAC,cAAc;iBACvC;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;YAClE,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;YACjE,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,kBAAkB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;gBAC3C,mEAAmE;gBACnE,0EAA0E;gBAC1E,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC/D,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,EACvB,cAAc,CACf,CAAC;gBACF,IACE,CAAC,iBAAiB;uBACf,iBAAiB,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;uBAC9C,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,cAAc,CAAC,EACzD,CAAC;oBACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;wBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;wBACzE,OAAO,EAAE;4BACP,MAAM,EAAE,6CAA6C;4BACrD,cAAc,EAAE,OAAO,CAAC,cAAc;4BACtC,cAAc;yBACf;qBACF,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,wBAAwB,GAAG,2BAA2B,CAC1D,MAAM,CAAC,SAAS,EAChB,UAAU,CAAC,SAAS,IAAI,EAAE,EAC1B,iBAAiB,CAAC,SAAS,IAAI,EAAE,EACjC,8BAA8B,CAAC,mBAAmB,CACnD,CAAC;gBACF,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,CAAC;oBACtC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;wBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;wBACzE,OAAO,EAAE;4BACP,OAAO,EAAE,8BAA8B,CAAC,mBAAmB;4BAC3D,eAAe,EAAE,wBAAwB,CAAC,eAAe;4BACzD,cAAc,EAAE,OAAO,CAAC,cAAc;yBACvC;qBACF,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,EAAE,EAAE;oBAClD,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,SAAS,EAAE,OAAO,CAAC,KAAK;oBACxB,cAAc;oBACd,gBAAgB,EAAE,WAAW;oBAC7B,iBAAiB,EAAE;wBACjB,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE;4BACxB,cAAc,EAAE;gCACd,4BAA4B,EAAE,CAAC,cAAc,CAAC;gCAC9C,aAAa,EAAE,sBAAsB,CAAC,GAAG;gCACzC,gBAAgB,EAAE,MAAM,EAAE,gBAAgB;6BAC3C;yBACF;qBACF;oBACD,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;oBACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;oBAC7C,cAAc;iBACf,CAAC,CAAC;gBACH,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC;oBACpD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;wBAChE,OAAO,EAAE;4BACP,MAAM,EAAE,6CAA6C;4BACrD,SAAS,EAAE,OAAO,CAAC,SAAS;4BAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;yBACvC;qBACF,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,uBAAuB,CAAC,EAAE,EAAE;oBAChC,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,cAAc,EAAE,SAAS,CAAC,cAAc;oBACxC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;oBAC3C,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;oBACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;oBAC7C,cAAc;iBACf,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC,cAAc,CAAC;YAClC,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE;YAC1D,KAAK,EAAE,0BAA0B,CAAC,SAAS;YAC3C,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,cAAc,EAAE,SAAS;YACzB,cAAc,EAAE,gBAAgB,CAAC,cAAc;SAChD,CAAC,CAAC;QACH,OAAO,OAAO,IAAI;YAChB,GAAG,OAAO;YACV,KAAK,EAAE,0BAA0B,CAAC,SAAS;YAC3C,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,cAAc,EAAE,SAAS;YACzB,cAAc,EAAE,gBAAgB,CAAC,cAAc;SAChD,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,6BAA6B;IAC7B,kCAAkC;IAE3B,KAAK,CAAC,YAAY,CAAC,EAAyB,EAAE,OAA8B;QACjF,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE;YAC/C,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;QAEH,IAAI,YAAoC,CAAC;QAEzC,mDAAmD;QACnD,sFAAsF;QACtF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACzD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,IAAI,CAAC,gCAAgC,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;gBAChH,CAAC;gBAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;gBAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,IAAI,CAAC,gCAAgC,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/G,CAAC;gBAED,IAAI,CAAC;oBACH,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,OAA8B,CAAC,CAAC;gBACrF,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM;YACR,CAAC;YAED,KAAK,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC1B,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,OAA8B,CAAC,CAAC;gBACnF,MAAM;YACR,CAAC;YAED,KAAK,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrB,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,OAA0B,CAAC,CAAC;gBAC3E,MAAM;YACR,CAAC;YAED,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;gBACxB,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,OAA6B,CAAC,CAAC;gBACjF,MAAM;YACR,CAAC;YAED,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;gBACxB,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,OAA4B,CAAC,CAAC;gBAC/E,MAAM;YACR,CAAC;YAED;gBACE,8CAA8C;gBAC9C,2FAA2F;gBAC3F,OAAO,IAAI,CAAC,gCAAgC,CAC1C,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,WAAW,IAAI,eAAe,CAAC,KAAK,EAC5C,EAAE,YAAY,EAAE,IAAI,EAAE,CACvB,CAAC;QACN,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE;YAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,YAAY,CAAC,OAAO;SAC9B,CAAC,CAAC;QAEH,4EAA4E;QAC5E,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,gCAAgC,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;YAChH,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAEhG,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC,QAAQ,CAAC,yCAAyC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;gBAE3F,yGAAyG;gBACzG,yEAAyE;gBACzE,4EAA4E;gBAC5E,+EAA+E;gBAC/E,6EAA6E;gBAC7E,yEAAyE;gBACzE,IAAI,WAAW,GAAgB,IAAI,CAAC;gBACpC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACnB,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;oBACrE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;wBAC7D,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,0BAA0B,CAAC,MAAM,EAAE,CAAC,CAAC;wBAC1F,IAAI,CAAC,kBAAkB,CAAC,WAAW,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,EAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;oBACpG,CAAC;oBAED,sGAAsG;oBACtG,IAAI,OAAO,CAAC,cAAc,IAAI,WAAW,EAAE,CAAC;wBAC1C,MAAM,SAAS,GAAI,WAA+C,CAAC,SAAS,IAAI,EAAE,CAAC;wBACnF,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;4BAChD,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,0BAA0B,CAAC,MAAM,EAAE,CAAC,CAAC;4BAC1F,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gCACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gCACrF,OAAO,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,EAAE,wBAAwB;6BAC9E,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,kEAAkE;gBAClE,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM;oBACtC,CAAC,CAAC,MAAM,IAAI,CAAC,kCAAkC,CAAC,EAAE,EAAE,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC;oBAC3F,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;gBAChD,MAAM,UAAU,GAAG,iBAAiB,CAAC,cAAc,EAAE,UAAU,IAAI,CAAC,CAAC;gBACrE,IAAI,UAAU,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;oBAC3F,IAAI,OAAO,EAAE,CAAC;wBACZ,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,0BAA0B,CAAC,gBAAgB,EAAE,CAAC,CAAC;wBACpG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;4BACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;4BACnF,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE;yBACtE,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE;oBACzD,mBAAmB,EAAE,IAAI;oBACzB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;iBACnD,CAAC,CAAC;gBAEH,8BAA8B;gBAC9B,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,0BAA0B,CAAC,SAAS,EAAE,CAAC,CAAC;gBAE7F,kCAAkC;gBAClC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAC9D,MAAM,gBAAgB,GAAG,YAAY,EAAE,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;gBAE1F,gDAAgD;gBAChD,MAAM,UAAU,GAAG,YAAY,EAAE,UAAU,CAAC;gBAC5C,IAAI,YAAY,EAAE,MAAM,EAAE,CAAC;oBACzB,kFAAkF;oBAClF,2EAA2E;oBAC3E,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;oBACrG,8EAA8E;oBAC9E,6EAA6E;oBAC7E,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC;wBACvC,MAAM,EAAE,YAAY,CAAC,MAAM;wBAC3B,KAAK,EAAE,YAAY,CAAC,KAAK,IAAI,SAAS;wBACtC,UAAU,EAAE,OAAO,CAAC,MAAM;wBAC1B,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;wBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;wBAC7C,SAAS,EAAE,OAAO,CAAC,SAAS;qBAC7B,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;gBACxB,CAAC;gBAED,mDAAmD;gBACnD,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAE5C,OAAO,IAAI,CAAC,iCAAiC,CAC3C,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,MAAM,EACd,MAAM,CAAC,WAAW,EAClB;oBACE,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,gBAAgB;oBAChB,IAAI,EAAE,WAAW,IAAI,SAAS;iBAC/B,CACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,OAAO,YAAY,CAAC;YACtB,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,kCAAkC;IAClC,4BAA4B;IAC5B,kCAAkC;IAElC;;;;;OAKG;IACI,KAAK,CAAC,6BAA6B,CAAC,EAAyB,EAAE,SAAiB;QACrF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,gDAAgD;QAChD,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,kCAAkC;IAClC,qCAAqC;IACrC,kCAAkC;IAElC;;;;;;;;OAQG;IACI,KAAK,CAAC,YAAY,CAAC,EAAyB,EAAE,SAAiB;QAMpE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;gBAClF,OAAO,EAAE,EAAE,SAAS,EAAE;aACvB,CAAC,CAAC;QACL,CAAC;QAED,8CAA8C;QAC9C,IAAI,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,sBAAsB;YACnE,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,YAAY,EAAE,CAAC;YAC9D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;aACzF,CAAC,CAAC;QACL,CAAC;QAED,gFAAgF;QAChF,EAAE;QACF,kGAAkG;QAClG,kGAAkG;QAClG,qGAAqG;QACrG,4FAA4F;QAC5F,oGAAoG;QACpG,sFAAsF;QACtF,EAAE;QACF,qGAAqG;QACrG,uGAAuG;QACvG,kGAAkG;QAClG,oGAAoG;QACpG,qGAAqG;QACrG,sFAAsF;QACtF,MAAM,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC;QACpE,IAAI,yBAAyB,IAAI,yBAAyB,CAAC,MAAM,GAAG,CAAC;eAC9D,CAAC,yBAAyB,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;gBACvF,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,2BAA2B,EAAE;aAC1F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;aACpF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;aACnF,CAAC,CAAC;QACL,CAAC;QAED,sEAAsE;QACtE,qEAAqE;QACrE,iEAAiE;QACjE,uEAAuE;QACvE,4DAA4D;QAC5D,qEAAqE;QACrE,+DAA+D;QAC/D,uEAAuE;QACvE,+DAA+D;QAC/D,oEAAoE;QACpE,YAAY;QACZ,EAAE;QACF,mEAAmE;QACnE,mEAAmE;QACnE,mEAAmE;QACnE,qEAAqE;QACrE,uEAAuE;QACvE,iEAAiE;QACjE,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,mEAAmE;QACnE,qEAAqE;QACrE,uDAAuD;QACvD,MAAM,YAAY,GAAG,GAAG,eAAe,CAAC,SAAS,GAAG,MAAM,YAAY,CAAC;QACvE,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CACxC,YAAY,EACZ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAC1C,EAAE,EACF,SAAS,EACT,oEAAoE,CACrE,CAAC;QAEF,4FAA4F;QAC5F,MAAM,IAAI,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,MAAM,EAAE,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAEtG,uDAAuD;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAE7C,2DAA2D;QAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC5D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;YACpE,SAAS,EAAE,wBAAwB,CAAC,SAAS;YAC7C,eAAe,EAAE,+BAA+B,CAAC,UAAU;YAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;YAC/D,MAAM,EAAE,MAAM;YACd,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;YAC1C,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE;gBACR,OAAO;gBACP,SAAS;gBACT,KAAK;aACN;SACF,CAAC,CAAC;QAEH,uCAAuC;QACvC,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;YAClC,KAAK,EAAE,0BAA0B,CAAC,YAAY;YAC9C,aAAa,EAAE,eAAe,CAAC,MAAM;SACtC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAEvE,OAAO;YACL,QAAQ,EAAE,OAAO;YACjB,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC;YACzC,KAAK;YACL,aAAa;SACd,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,oBAAoB,CAAC,EAAyB,EAAE,OAA4B;QACvF,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAErC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,uFAAuF;QACvF,kFAAkF;QAClF,oFAAoF;QACpF,IAAI,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,YAAY;YACzD,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,yBAAyB;YACtE,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,sBAAsB,EAAE,CAAC;YACxE,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE;gBAC9E,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE;gBAC9E,YAAY,EAAE,IAAI;gBAClB,UAAU,EAAE,UAAU,CAAC,SAAS;aACjC,CAAC,CAAC;QACL,CAAC;QAED,gCAAgC;QAChC,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;YAClC,KAAK,EAAE,0BAA0B,CAAC,yBAAyB;YAC3D,aAAa,EAAE,eAAe,CAAC,MAAM;SACtC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,+EAA+E;QAC/E,sDAAsD;QACtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAErE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAEtE,wBAAwB;YACxB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YACtC,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBAC7C,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS;gBACjC,UAAU,EAAE,UAAU,CAAC,SAAS;gBAChC,aAAa,EAAE,kBAAkB;gBACjC,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,iBAAiB,EAAE,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,QAAQ,GAAG,CAAC;gBAC7D,SAAS;aACV,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE;gBAC9E,UAAU,EAAE,UAAU,CAAC,SAAS;gBAChC,YAAY,EAAE,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;QAED,gCAAgC;QAChC,MAAM,IAAI,CAAC,iCAAiC,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QAE1F,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,iCAAiC,CAC3C,SAAS,EACT,eAAe,CAAC,MAAM,EACtB,UAAU,CAAC,SAAS,EACpB,EAAE,EAAE,yDAAyD;QAC7D,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,IAAI,EAAE,EAAE,CAC7D,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,SAAiB,EAAE,IAAY;QAC3E,IAAI,CAAC;YACH,iDAAiD;YACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,qBAAqB,CACpE,MAAM,EACN,wBAAwB,CAAC,SAAS,CACnC,CAAC;YAEF,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAA+C,CAAC;gBAC1E,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,SAAS;oBAAE,SAAS;gBAEzD,yEAAyE;gBACzE,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACjD,IAAI,UAAU,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;oBAAE,SAAS;gBAE7F,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrF,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;gBAEhG,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;oBAC9B,+BAA+B;oBAC/B,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;wBAC/D,OAAO,IAAI,CAAC;oBACd,CAAC;oBAAC,MAAM,CAAC;wBACP,+CAA+C;wBAC/C,SAAS;oBACX,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;gBAC9C,MAAM;gBACN,SAAS;gBACT,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,gCAAgC;IAChC,kCAAkC;IAElC;;;;;;OAMG;IACI,KAAK,CAAC,gBAAgB,CAAC,EAAyB,EAAE,OAAwB;QAC/E,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAErC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,6DAA6D;QAC7D,IAAI,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,YAAY;YACzD,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,yBAAyB;YACtE,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,sBAAsB,EAAE,CAAC;YACxE,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE;gBAC9E,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,gCAAgC;QAChC,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;YAClC,KAAK,EAAE,0BAA0B,CAAC,yBAAyB;YAC3D,aAAa,EAAE,eAAe,CAAC,MAAM;SACtC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,2FAA2F;QAC3F,6FAA6F;QAC7F,+FAA+F;QAC/F,+FAA+F;QAC/F,6FAA6F;QAC7F,4BAA4B;QAC5B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAE7F,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE;gBAC9E,UAAU,EAAE,UAAU,CAAC,IAAI;gBAC3B,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,YAAY,CAAC,cAAc,CAAC;QAEnD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAEtE,wBAAwB;YACxB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YACtC,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBAC7C,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS;gBACjC,UAAU,EAAE,UAAU,CAAC,IAAI;gBAC3B,aAAa,EAAE,mBAAmB;gBAClC,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,iBAAiB,EAAE,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,QAAQ,GAAG,CAAC;gBAC7D,SAAS;aACV,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE;gBAC9E,UAAU,EAAE,UAAU,CAAC,IAAI;gBAC3B,YAAY,EAAE,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;QAED,iCAAiC;QACjC,MAAM,IAAI,CAAC,iCAAiC,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QAErF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,iCAAiC,CAC3C,SAAS,EACT,eAAe,CAAC,MAAM,EACtB,UAAU,CAAC,IAAI,EACf,EAAE,EAAE,yDAAyD;QAC7D;YACE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,IAAI,EAAE;YACxD,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;SACrE,CACF,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,oCAAoC;IACpC,kCAAkC;IAElC;;;;;;OAMG;IACI,KAAK,CAAC,mBAAmB,CAAC,EAAyB,EAAE,OAA2B;QACrF,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAErD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,4DAA4D;QAC5D,MAAM,WAAW,GAAG,WAAW,KAAK,eAAe,CAAC,KAAK;YACvD,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,0BAA0B,CAAC,UAAU,EAAE,0BAA0B,CAAC,wBAAwB,CAAC,CAAC;YACvG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,0BAA0B,CAAC,YAAY,EAAE,0BAA0B,CAAC,yBAAyB,EAAE,0BAA0B,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAEhK,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,WAAW,EAAE;gBACnE,UAAU,EAAE,UAAU,CAAC,OAAO;gBAC9B,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,gCAAgC;QAChC,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;YAClC,KAAK,EAAE,WAAW,KAAK,eAAe,CAAC,KAAK;gBAC1C,CAAC,CAAC,0BAA0B,CAAC,wBAAwB;gBACrD,CAAC,CAAC,0BAA0B,CAAC,yBAAyB;YACxD,aAAa,EAAE,WAAW;SAC3B,CAAC,CAAC;QAEH,8DAA8D;QAC9D,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,YAAY,GAAG,QAAQ,CAAC,EAAE,CAAC;QAC/B,IAAI,cAAyE,CAAC;QAC9E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,4BAA4B,CAAC,EAAE,EAAE,MAAM,EAAE,QAAe,CAAC,CAAC;YACpG,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3B,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;YACnC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE;gBACvD,MAAM;gBACN,SAAS;gBACT,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAEtE,iCAAiC;YACjC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YACtC,MAAM,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;gBACpD,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS;gBACjC,2FAA2F;gBAC3F,gFAAgF;gBAChF,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,8BAA8B;gBACvG,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS;aACV,CAAC,CAAC;YAEH;;;;;;;eAOG;YACH,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,gBAAgB,CAAC,4BAA4B,CAAC;oBACvD,MAAM;oBACN,YAAY,EAAE,cAAc,CAAC,YAAY;oBACzC,aAAa,EAAE,cAAc,CAAC,aAAa;oBAC3C,eAAe,EAAE,cAAc,CAAC,eAAe;oBAC/C,oBAAoB,EAAE,cAAc,CAAC,oBAAoB;oBACzD,kBAAkB,EAAE,cAAc,CAAC,kBAAkB;oBACrD,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnE,QAAQ,EAAE,cAAc,CAAC,QAAQ;oBACjC,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;oBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;iBAC9C,CAAC,CAAC;YACL,CAAC;YAED,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,WAAW,EAAE;gBACnE,UAAU,EAAE,UAAU,CAAC,OAAO;gBAC9B,YAAY,EAAE,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;QAED,uCAAuC;QACvC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,8FAA8F;QAC9F,0FAA0F;QAC1F,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACxF,MAAM,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;YACpD,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS;YACjC,YAAY;YACZ,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;YAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;YAC7C,SAAS;SACV,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;QAEtB,oEAAoE;QACpE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QAED,uBAAuB;QACvB,MAAM,IAAI,CAAC,iCAAiC,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;QAExF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,iCAAiC,CAC3C,SAAS,EACT,WAAW,EACX,UAAU,CAAC,OAAO,EAClB,EAAE,EAAE,yDAAyD;QAC7D;YACE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,IAAI,EAAE;YACxD,WAAW,EAAE,cAAc,EAAE,WAAW,IAAI,KAAK;YACjD,mBAAmB,EAAE,cAAc,EAAE,4BAA4B,IAAI,EAAE;YACvE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB;SACvD,CACF,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,cAAc;IACd,kCAAkC;IAElC;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,iBAAiB,CAAC,EAAyB,EAAE,MAAc,EAAE,iBAA8B,EAAE,UAA+B;QACxI,MAAM,MAAM,GAAG,UAAU,IAAI,0CAAwC,CAAC,oBAAoB,CAAC;QAC3F,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,MAAM,YAAY,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,EAAkB,EAAE,CAAC;QAE9E,mGAAmG;QACnG,IAAI,iBAAiB,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;YAC7C,MAAM,oBAAoB,GAAG,SAAS,EAAE,oBAAoB,IAAI,IAAI,CAAC;YACrE,IAAI,oBAAoB,EAAE,CAAC;gBACzB,OAAO,YAAY,CAAC;YACtB,CAAC;QACH,CAAC;QAED,MAAM,iBAAiB,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC;QAElD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAE/D,MAAM,eAAe,GAAG,SAAS,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;YAEvE,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,qBAAqB,GAAG,eAAe,CAAC,IAAI,CAChD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,SAAS,CAClC,CAAC;gBAEF,IAAI,qBAAqB,EAAE,CAAC;oBAC1B,IAAI,IAAI,IAAI,IAAI,CAAC,kBAAkB,KAAK,kBAAkB,CAAC,QAAQ,EAAE,CAAC;wBACpE,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,QAAQ,EAA8B,CAAC,CAAC;oBACrI,CAAC;oBACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;gBAC7C,CAAC;gBAED,MAAM,SAAS,GAAG,SAAS,EAAE,yBAAyB,IAAI,CAAC,CAAC;gBAC5D,IAAI,SAAS,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;oBAC1B,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;wBAC3B,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,gBAAgB,EAAE,IAAI,IAAI,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,KAAK,EAA8B,CAAC,CAAC;oBAChK,CAAC;yBAAM,IAAI,IAAI,CAAC,kBAAkB,KAAK,kBAAkB,CAAC,KAAK,EAAE,CAAC;wBAChE,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,KAAK,EAA8B,CAAC,CAAC;oBAClI,CAAC;oBAED,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,IAAI,IAAI,IAAI,EAAE,CAAC;oBACvD,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,UAAU,CAAC,CAAC;oBACzE,IAAI,IAAI,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC;wBAC1B,OAAO,YAAY,CAAC;oBACtB,CAAC;oBAED,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,OAAO,EAA8B,CAAC,CAAC;gBACpI,CAAC;gBAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;YAC7C,CAAC;YAED,IAAI,IAAI,EAAE,YAAY,EAAE,CAAC;gBACvB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,iBAAiB,EAAE,CAAC;gBACtB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;YACjD,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,kCAAkC;IAClC,0BAA0B;IAC1B,kCAAkC;IAElC,kGAAkG;IAClG,gEAAgE;IAEhE,kCAAkC;IAClC,iCAAiC;IACjC,kCAAkC;IAElC,0HAA0H;IAE1H;;;;;;;;;;;;;;;;;;;OAmBG;IACK,KAAK,CAAC,yCAAyC,CACrD,EAAyB,EACzB,cAAsB;QAEtB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;YACnG,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,IAAI,CAAsC,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;YACpG,OAAO,OAAO,EAAE,QAAQ,IAAI,SAAS,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oFAAoF,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;YAC3H,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACK,KAAK,CAAC,0BAA0B,CACtC,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,MAAc,EACd,KAAc,EACd,UAAwE;QAExE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YACpF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;iBAChF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;YAClC,IAAI,CAAC,WAAW,CAAC,UAAU;gBAAE,OAAO;YAEpC;;;;eAIG;YACH,IAAI,mBAAmB,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC1D;;;;;;;;;mBASG;gBACH,KAAK,IAAI,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;oBACjD,MAAM;oBACN,KAAK,EAAE,KAAM;oBACb,SAAS;oBACT,GAAG,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;wBAC1C,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE;wBAC7B,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;oBAC/B,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,EAAE;oBACtC,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,EAAE;oBACtC,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,EAAE;iBACvC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;wBACvE,SAAS;wBACT,OAAO;wBACP,GAAG,2BAA2B,CAAC,KAAK,CAAC;qBACtC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC,WAAW,CAAC,qBAAqB,EAAE,CAAC;gBACvC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;iBAChF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,QAAQ,GAAG,WAAW,CAAC,kBAAkB,CAAC;YAChD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;iBAChF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;iBAChF,CAAC,CAAC;YACL,CAAC;YAED,qFAAqF;YACrF,oFAAoF;YACpF,sFAAsF;YACtF,gDAAgD;YAChD,qDAAqD;YACrD,MAAM,UAAU,GAAG,GAAG,eAAe,CAAC,gBAAgB,GAAG,SAAS,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YAC1F,IAAI,YAAoB,CAAC;YACzB,IAAI,CAAC;gBACH,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACvE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,QAAQ,CAAC,iDAAiD,EAAE;oBAC/D,SAAS;oBACT,OAAO;oBACP,MAAM;oBACN,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;iBAChF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;oBAC/E,OAAO,EAAE;wBACP,wBAAwB;wBACxB,eAAe,EAAE,YAAY;wBAC7B,cAAc,EAAE,QAAQ;qBACzB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,4CAA4C,EAAE;gBAC1D,SAAS;gBACT,OAAO;gBACP,MAAM;gBACN,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;aAChF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,4FAA4F;IACpF,MAAM,CAAU,qBAAqB,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAEnE;;;;OAIG;IACK,KAAK,CAAC,uBAAuB,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe,EAAE,MAAc;QACxH,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YACpF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;iBAChF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU;gBAAE,OAAO;YAE9C,MAAM,UAAU,GAAG,GAAG,eAAe,CAAC,gBAAgB,GAAG,SAAS,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YAC1F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CACzD,UAAU,EACV,0CAAwC,CAAC,qBAAqB,CAC/D,CAAC;YAEF,IAAI,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,kBAAkB,EAAE,CAAC;gBACxD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;oBAC/E,OAAO,EAAE;wBACP,wBAAwB;wBACxB,eAAe,EAAE,QAAQ;wBACzB,cAAc,EAAE,SAAS,CAAC,WAAW,CAAC,kBAAkB;qBACzD;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,qCAAqC,EAAE;gBACnD,SAAS;gBACT,OAAO;gBACP,MAAM;gBACN,eAAe,EAAE,QAAQ;gBACzB,cAAc,EAAE,SAAS,CAAC,WAAW,CAAC,kBAAkB;aACzD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,wDAAwD,EAAE;gBACtE,SAAS;gBACT,OAAO;gBACP,MAAM;gBACN,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;aAChF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,wBAAwB;IACxB,kCAAkC;IAElC;;;;OAIG;IACI,KAAK,CAAC,aAAa,CAAC,EAAyB,EAAE,OAA6B,EAAE,UAAuD,EAAE,yBAAyB,GAAG,KAAK;QAQ7K,gGAAgG;QAChG,kGAAkG;QAClG,mGAAmG;QACnG,mGAAmG;QACnG,kGAAkG;QAClG,6FAA6F;QAC7F,iGAAiG;QACjG,yFAAyF;QACzF,IAAI,CAAC,yBAAyB,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;aACvF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAE1B,2DAA2D;QAC3D,4DAA4D;QAC5D,gEAAgE;QAChE,kDAAkD;QAClD,8DAA8D;QAC9D,6DAA6D;QAC7D,+DAA+D;QAC/D,6DAA6D;QAC7D,8DAA8D;QAC9D,8DAA8D;QAC9D,4DAA4D;QAC5D,iEAAiE;QACjE,wBAAwB;QAExB,gDAAgD;QAChD,IAAI,IAAI,GAAgB,IAAI,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;QAED,6DAA6D;QAC7D,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;YAC3C,KAAK;YACL,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;YAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;SAC9C,CAAC,CAAC;QAEH,qFAAqF;QACrF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC;QAExB,sGAAsG;QACtG,wGAAwG;QACxG,mGAAmG;QACnG,wGAAwG;QACxG,wGAAwG;QACxG,+FAA+F;QAC/F,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC/B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3G,IAAI,UAAU,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,sDAAsD;QACtD,MAAM,IAAI,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,MAAM,EAAE,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAEvG,qFAAqF;QACrF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;YACjE,SAAS,EAAE,wBAAwB,CAAC,UAAU;YAC9C,eAAe,EAAE,+BAA+B,CAAC,UAAU;YAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,kBAAkB,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;YACzF,MAAM,EAAE,MAAM;YACd,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;YAC1C,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,EAAE,KAAK,EAAE;SACpB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAE7D,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC;YACtC,KAAK;YACL,MAAM;YACN,gBAAgB,EAAE,IAAI,CAAC,eAAe,CAAC,kBAAkB;SAC1D,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,eAAe,CAAC,EAAyB,EAAE,OAA+B,EAAE,UAAuD,EAAE,cAAuB;QACvK,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;aACvF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAE1B,8DAA8D;QAC9D,IAAI,cAAc,GAAiF,IAAI,CAAC;QACxG,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAC;QACjH,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBAC7C,aAAa,EAAE,qCAAqC;gBACpD,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;aAC9C,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,EAAE;gBACb,UAAU,EAAE,KAAK;gBACjB,WAAW,EAAE,eAAe,CAAC,KAAK;gBAClC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,KAAK,EAAE,+BAA+B;gBACtC,SAAS,EAAE,oBAAoB;gBAC/B,YAAY,EAAE,KAAK;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,WAAW,EAAE,KAAK;aACO,CAAC;QAC9B,CAAC;QAED,oFAAoF;QACpF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,oFAAoF;YACpF,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBAC7C,aAAa,EAAE,wDAAwD;gBACvE,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;aAC9C,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,EAAE;gBACb,UAAU,EAAE,KAAK;gBACjB,WAAW,EAAE,eAAe,CAAC,KAAK;gBAClC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,KAAK,EAAE,+BAA+B;gBACtC,SAAS,EAAE,oBAAoB;gBAC/B,YAAY,EAAE,KAAK;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,WAAW,EAAE,KAAK;aACO,CAAC;QAC9B,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBAC7C,aAAa,EAAE,yCAAyC;gBACxD,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;aAC9C,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,EAAE;gBACb,UAAU,EAAE,KAAK;gBACjB,WAAW,EAAE,eAAe,CAAC,KAAK;gBAClC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,KAAK,EAAE,0BAA0B;gBACjC,SAAS,EAAE,oBAAoB;gBAC/B,YAAY,EAAE,KAAK;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,WAAW,EAAE,KAAK;aACO,CAAC;QAC9B,CAAC;QACD,MAAM,aAAa,GAAG,cAAc,CAAC,QAA+C,CAAC;QACrF,MAAM,KAAK,GAAG,aAAa,EAAE,KAAe,CAAC;QAE7C,wEAAwE;QACxE,4EAA4E;QAC5E,iEAAiE;QACjE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iEAAiE,EAAE;gBAClF,MAAM;gBACN,SAAS,EAAE,wBAAwB,CAAC,UAAU;aAC/C,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBAC7C,aAAa,EAAE,qDAAqD;gBACpE,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;aAC9C,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,EAAE;gBACb,UAAU,EAAE,KAAK;gBACjB,WAAW,EAAE,eAAe,CAAC,KAAK;gBAClC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,KAAK,EAAE,+BAA+B;gBACtC,SAAS,EAAE,oBAAoB;gBAC/B,YAAY,EAAE,KAAK;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,WAAW,EAAE,KAAK;aACO,CAAC;QAC9B,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACvD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACjE,IAAI,aAAa,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;YAC/G,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mEAAmE,EAAE;gBACpF,MAAM;gBACN,YAAY,EAAE,OAAO,CAAC,KAAK;aAC5B,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBAC7C,aAAa,EAAE,0CAA0C;gBACzD,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;aAC9C,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,EAAE;gBACb,UAAU,EAAE,KAAK;gBACjB,WAAW,EAAE,eAAe,CAAC,KAAK;gBAClC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,KAAK,EAAE,+BAA+B;gBACtC,SAAS,EAAE,oBAAoB;gBAC/B,YAAY,EAAE,KAAK;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,WAAW,EAAE,KAAK;aACO,CAAC;QAC9B,CAAC;QAED,gBAAgB;QAChB,IAAI,IAAI,GAAgB,IAAI,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA6BG;QACH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBAC7C,aAAa,EAAE,0CAA0C;gBACzD,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;aAC9C,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,EAAE;gBACb,UAAU,EAAE,KAAK;gBACjB,WAAW,EAAE,eAAe,CAAC,KAAK;gBAClC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,KAAK,EAAE,+BAA+B;gBACtC,SAAS,EAAE,oBAAoB;gBAC/B,YAAY,EAAE,KAAK;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,WAAW,EAAE,KAAK;aACO,CAAC;QAC9B,CAAC;QAED,gEAAgE;QAChE,MAAM,UAAU,GAAI,IAAgC,CAAC,MAA4B,CAAC;QAClF,IAAI,UAAU,IAAI,UAAU,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YACnD,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBAC7C,aAAa,EAAE,kCAAkC,UAAU,GAAG;gBAC9D,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;aAC9C,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,EAAE;gBACb,UAAU,EAAE,KAAK;gBACjB,WAAW,EAAE,eAAe,CAAC,KAAK;gBAClC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,KAAK,EAAE,+BAA+B;gBACtC,SAAS,EAAE,oBAAoB;gBAC/B,YAAY,EAAE,KAAK;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,WAAW,EAAE,KAAK;aACO,CAAC;QAC9B,CAAC;QAED,+DAA+D;QAC/D,IAAI,iBAA4C,CAAC;QACjD,IAAI,eAAmC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YACvD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;oBACtF,iBAAiB,GAAG,eAAe,EAAE,SAAS,CAAC;oBAC/C,eAAe,GAAG,eAAe,EAAE,OAAO,CAAC;gBAC7C,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,QAAQ,CAAC,kEAAkE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;gBACrG,CAAC;YACH,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,EAAE,CAAC;QACxD,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,0BAA0B,CAAC,sBAAsB,EAAE;YACrF,UAAU;YACV,cAAc;SACf,CAAC,CAAC;QAEH,2EAA2E;QAC3E,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;YAClC,KAAK;YACL,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,MAAM;YACd,gBAAgB,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YACzC,aAAa,EAAE,eAAe,CAAC,KAAK;YACpC,SAAS,EAAE,iBAAiB;YAC5B,OAAO,EAAE,eAAe;SACzB,CAAC,CAAC;QAEH,gBAAgB;QAChB,8FAA8F;QAC9F,0EAA0E;QAC1E,MAAM,sBAAsB,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACjG,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;YAC/C,MAAM,EAAE,MAAM;YACd,KAAK;YACL,SAAS;YACT,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;YAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;SAC9C,EAAE,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAE/B,oFAAoF;QACpF,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QAED,+DAA+D;QAC/D,EAAE;QACF,0FAA0F;QAC1F,yDAAyD;QACzD,EAAE;QACF,uGAAuG;QACvG,uGAAuG;QACvG,qGAAqG;QACrG,oEAAoE;QACpE,mFAAmF;QACnF,wGAAwG;QACxG,6FAA6F;QAC7F,EAAE;QACF,yGAAyG;QACzG,oEAAoE;QACpE,oGAAoG;QACpG,sGAAsG;QACtG,wGAAwG;QACxG,yGAAyG;QACzG,yDAAyD;QACzD,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC;QAC/D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kCAAkC,CAAC,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACpG,qGAAqG;QACrG,sGAAsG;QACtG,wGAAwG;QACxG,iGAAiG;QACjG,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;gBACtF,OAAO,EAAE,EAAE,MAAM,EAAE,wCAAwC,EAAE;aAC9D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAElG,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;YAErG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;gBAClC,KAAK,EAAE,0BAA0B,CAAC,YAAY;gBAC9C,WAAW,EAAE,IAAI;gBACjB,gBAAgB,EAAE,aAAa,CAAC,gBAAgB;gBAChD,4BAA4B,EAAE,aAAa,CAAC,gBAAgB;gBAC5D,2BAA2B,EAAE,QAAQ,CAAC,eAAe;gBACrD,yBAAyB,EAAE,aAAa,CAAC,aAAa;aACvD,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS;gBACT,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,eAAe,CAAC,KAAK;gBAClC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,WAAW,EAAE,IAAI;gBACjB,mBAAmB,EAAE,aAAa,CAAC,gBAAgB;gBACnD,kBAAkB,EAAE,0CAAwC,CAAC,4BAA4B;gBACzF,2BAA2B,EAAE,QAAQ,CAAC,eAAe;gBACrD,yBAAyB,EAAE,aAAa,CAAC,aAAa;gBACtD,gBAAgB,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;gBACzC,YAAY,EAAE,IAAI;gBAClB,iBAAiB,EAAE,EAAE;aACI,CAAC;QAC9B,CAAC;QAED,yCAAyC;QACzC,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;YAClC,KAAK,EAAE,0BAA0B,CAAC,SAAS;SAC5C,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;aAChF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,cAAc,EAAE;YAChE,mBAAmB,EAAE,IAAI;YACzB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;SACnD,CAAC,CAAC;QAEH,cAAc;QACd,uGAAuG;QACvG,MAAM,kBAAkB,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QAC7F,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC;YACvC,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;YAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;YAC7C,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,KAAK;YACL,SAAS;SACV,EAAE,EAAE,EAAE,kBAAkB,CAAC,CAAC;QAE3B,mBAAmB;QACnB,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAEpC,+EAA+E;QAC/E,gFAAgF;QAChF,gFAAgF;QAChF,kFAAkF;QAClF,sFAAsF;QACtF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAErE,OAAO,IAAI,CAAC,iCAAiC,CAC3C,SAAS,EACT,eAAe,CAAC,KAAK,EACrB,UAAU,CAAC,UAAU,EACrB,MAAM,CAAC,WAAW,EAClB;YACE,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,gBAAgB,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YACzC,IAAI,EAAE,aAAa,IAAI,SAAS;SACjC,CACF,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,qBAAqB;IACrB,kCAAkC;IAElC;;;;OAIG;IACI,KAAK,CAAC,UAAU,CAAC,EAAyB,EAAE,SAAiB,EAAE,WAAoB;QACxF,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;aACpF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;gBAClF,OAAO,EAAE,EAAE,SAAS,EAAE;aACvB,CAAC,CAAC;QACL,CAAC;QAED,yFAAyF;QACzF,MAAM,eAAe,GAAG;YACtB,0BAA0B,CAAC,UAAU;YACrC,0BAA0B,CAAC,wBAAwB;YACnD,0BAA0B,CAAC,sBAAsB;YACjD,0BAA0B,CAAC,YAAY;SACxC,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAmC,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;aACnF,CAAC,CAAC;QACL,CAAC;QAED,iGAAiG;QACjG,8FAA8F;QAC9F,oFAAoF;QACpF,qGAAqG;QACrG,mGAAmG;QACnG,+FAA+F;QAC/F,gGAAgG;QAChG,cAAc;QACd,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;YACtH,IAAI,UAAU,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5F,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;iBACpF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,IAAI,WAAW,GAAG,WAAW,CAAC;QAE9B,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC9B,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBACtE,CAAC;gBAAC,MAAM,CAAC;oBACP,WAAW;gBACb,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,gCAAgC;aACrF,CAAC,CAAC;QACL,CAAC;QAED,2DAA2D;QAC3D,+DAA+D;QAC/D,+DAA+D;QAC/D,8DAA8D;QAC9D,iEAAiE;QACjE,4DAA4D;QAC5D,gEAAgE;QAChE,oEAAoE;QACpE,6DAA6D;QAC7D,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,yDAAyD;QACzD,4DAA4D;QAC5D,0DAA0D;QAC1D,EAAE;QACF,kEAAkE;QAClE,6DAA6D;QAC7D,yDAAyD;QACzD,gDAAgD;QAChD,8DAA8D;QAC9D,yDAAyD;QACzD,+BAA+B;QAC/B,8DAA8D;QAC9D,sDAAsD;QACtD,+DAA+D;QAC/D,6DAA6D;QAC7D,iDAAiD;QACjD,gEAAgE;QAChE,2DAA2D;QAC3D,gEAAgE;QAChE,qDAAqD;QACrD,+DAA+D;QAC/D,8DAA8D;QAC9D,6DAA6D;QAC7D,+DAA+D;QAC/D,4DAA4D;QAC5D,gEAAgE;QAChE,+DAA+D;QAC/D,iCAAiC;QACjC,EAAE;QACF,+DAA+D;QAC/D,+DAA+D;QAC/D,+DAA+D;QAC/D,6DAA6D;QAC7D,gEAAgE;QAChE,0DAA0D;QAC1D,gDAAgD;QAChD,EAAE;QACF,0DAA0D;QAC1D,6DAA6D;QAC7D,8DAA8D;QAC9D,0DAA0D;QAC1D,wDAAwD;QACxD,+DAA+D;QAC/D,gDAAgD;QAChD,EAAE;QACF,8DAA8D;QAC9D,wEAAwE;QACxE,yDAAyD;QACzD,6DAA6D;QAC7D,iEAAiE;QACjE,6DAA6D;QAC7D,8DAA8D;QAC9D,4DAA4D;QAC5D,6DAA6D;QAC7D,4DAA4D;QAC5D,+DAA+D;QAC/D,4DAA4D;QAC5D,MAAM,cAAc,GAAG,mBAAmB,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC;QAChF,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CACxC,GAAG,eAAe,CAAC,aAAa,GAAG,cAAc,QAAQ,EACzD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,EACpC,EAAE,CACH,CAAC;QACF,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CACxC,GAAG,eAAe,CAAC,aAAa,GAAG,cAAc,SAAS,EAC1D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,EACrC,IAAI,CACL,CAAC;QAEF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,MAAM,EAAE,CAAC;YACX,iCAAiC;YACjC,MAAM,IAAI,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,MAAM,EAAE,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACtG,CAAC;QAED,oBAAoB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEnE,4BAA4B;QAC5B,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;YAC5C,SAAS,EAAE,wBAAwB,CAAC,OAAO;YAC3C,eAAe,EAAE,+BAA+B,CAAC,UAAU;YAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;YACrF,MAAM,EAAE,MAAM;YACd,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;YAC1C,SAAS,EAAE,MAAM,IAAI,WAAW;YAChC,QAAQ,EAAE;gBACR,OAAO;gBACP,SAAS;gBACT,WAAW,EAAE,WAAW;aACzB;SACF,CAAC,CAAC;QAEH,QAAQ;QACR,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;YACxC,WAAW,EAAE,WAAW;YACxB,WAAW,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,KAAK;YAC3D,SAAS;YACT,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,IAAI,SAAS;YACrD,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,IAAI,SAAS;SACtD,CAAC,CAAC;QAEH,2DAA2D;QAC3D,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,sBAAsB;eACrF,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,YAAY,CAAC;QAC/D,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;YAClC,KAAK,EAAE,cAAc;gBACnB,CAAC,CAAC,0BAA0B,CAAC,YAAY;gBACzC,CAAC,CAAC,0BAA0B,CAAC,wBAAwB;YACvD,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK;SAC/E,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;QAE5E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,kBAAkB,CAAC,EAAyB,EAAE,OAA0B;QACnF,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;aACpF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;QAElD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,wFAAwF;QACxF,oFAAoF;QACpF,MAAM,iBAAiB,GAAG;YACxB,0BAA0B,CAAC,UAAU;YACrC,0BAA0B,CAAC,wBAAwB;YACnD,0BAA0B,CAAC,sBAAsB;YACjD,0BAA0B,CAAC,YAAY;YACvC,0BAA0B,CAAC,yBAAyB;SACrD,CAAC;QACF,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAmC,CAAC,EAAE,CAAC;YAC7E,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,WAAW,EAAE;gBACnE,YAAY,EAAE,KAAK;gBACnB,UAAU,EAAE,UAAU,CAAC,OAAO;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,WAAW,EAAE;gBACnE,YAAY,EAAE,IAAI;gBAClB,UAAU,EAAE,UAAU,CAAC,OAAO;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,gCAAgC;QAChC,MAAM,eAAe,GAAG,WAAW,KAAK,eAAe,CAAC,MAAM;YAC5D,CAAC,CAAC,0BAA0B,CAAC,yBAAyB;YACtD,CAAC,CAAC,0BAA0B,CAAC,wBAAwB,CAAC;QACxD,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;YAClC,KAAK,EAAE,eAAe;YACtB,aAAa,EAAE,WAAW;SAC3B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,uEAAuE;QACvE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAEnE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAEtE,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;gBAC1C,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,WAAW;gBACX,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,kBAAkB;gBACrF,SAAS;gBACT,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,IAAI,SAAS;gBACrD,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,IAAI,SAAS;aACtD,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,WAAW,EAAE;gBACnE,YAAY,EAAE,CAAC,MAAM;gBACrB,UAAU,EAAE,UAAU,CAAC,OAAO;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,gBAAgB;QAChB,iFAAiF;QACjF,iEAAiE;QACjE,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACxF,MAAM,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,CAAC;YAC5C,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,SAAS;YAC7C,WAAW;YACX,SAAS;YACT,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,IAAI,SAAS;YACrD,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,IAAI,SAAS;SACtD,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;QAEtB,wDAAwD;QACxD,MAAM,IAAI,CAAC,iCAAiC,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;QAExF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,iCAAiC,CAC3C,SAAS,EACT,WAAW,EACX,UAAU,CAAC,OAAO,EAClB,EAAE,EAAE,yDAAyD;QAC7D,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,IAAI,EAAE,EAAE,CAC7D,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,SAAiB,EAAE,aAAqB;QAClF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,qBAAqB,CACpE,MAAM,EACN,wBAAwB,CAAC,OAAO,CACjC,CAAC;YAEF,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAA+C,CAAC;gBAC1E,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,SAAS;oBAAE,SAAS;gBAEzD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACjD,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;oBAAE,SAAS;gBAEtG,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;gBAC9F,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;gBAEhG,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;oBAC9B,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;wBAC/D,OAAO,IAAI,CAAC;oBACd,CAAC;oBAAC,MAAM,CAAC;wBACP,SAAS;oBACX,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE;gBAC5C,MAAM;gBACN,SAAS;gBACT,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,MAAc;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,6DAA6D;QAC7D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;QAC7B,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,kCAAkC;IAClC,mBAAmB;IACnB,kCAAkC;IAE1B,yBAAyB,CAC/B,OAA8B,EAC9B,kBAAmC,EACnC,UAAsB;QAEtB,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;QAExD,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7F,MAAM,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QAE/F,QAAQ,kBAAkB,EAAE,CAAC;YAC3B,KAAK,eAAe,CAAC,KAAK;gBACxB,gFAAgF;gBAChF,6FAA6F;gBAC7F,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;oBACxB,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,sBAAsB,IAAI,cAAc,CAAC;YAC/F,KAAK,eAAe,CAAC,MAAM;gBACzB,OAAO,cAAc,IAAI,eAAe,IAAI,gBAAgB,CAAC,MAAM,IAAI,CAAC,CAAC;YAC3E;gBACE,OAAO,KAAK,CAAC;QACjB,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,oBAAoB;IACpB,kCAAkC;IAE1B,iCAAiC,CACvC,SAAiB,EACjB,WAA4B,EAC5B,eAAwB,IAAI,EAC5B,OAAsC;QAEtC,OAAO,4BAA4B,CAAC,KAAK,CAAC;YACxC,OAAO,EAAE,KAAK;YACd,SAAS;YACT,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,KAAK;YACxC,WAAW;YACX,YAAY;YACZ,iBAAiB,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAC/E,YAAY,EAAE,OAAO,EAAE,YAAY;YACnC,WAAW,EAAE,KAAK;YAClB,iBAAiB,EAAE,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,iCAAiC,CACvC,SAAiB,EACjB,WAA4B,EAC5B,UAAsB,EACtB,WAAmB,EACnB,UAqBI,EAAE;QAEN,MAAM,QAAQ,GAAG,4BAA4B,CAAC,KAAK,CAAC;YAClD,OAAO,EAAE,CAAC,OAAO,CAAC,WAAW;YAC7B,SAAS;YACT,UAAU,EAAE,IAAI;YAChB,WAAW;YACX,UAAU;YACV,WAAW;YACX,iEAAiE;YACjE,iEAAiE;YACjE,2DAA2D;YAC3D,iEAAiE;YACjE,oBAAoB;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE;YAClD,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,KAAK;YACzC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,2BAA2B,EAAE,OAAO,CAAC,2BAA2B,IAAI,EAAE;YACtE,yBAAyB,EAAE,OAAO,CAAC,yBAAyB,IAAI,EAAE;YAClE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,CAAC,UAAU,CAAC;YAC1D,YAAY,EAAE,IAAI;YAClB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,0BAA0B,EAAE,OAAO,CAAC,0BAA0B,IAAI,EAAE;SACrE,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;IAC7D,CAAC;IAEO,gCAAgC,CACtC,SAAiB,EACjB,WAA4B,EAC5B,UAWI,EAAE;QAEN,iGAAiG;QACjG,6DAA6D;QAC7D,OAAO,4BAA4B,CAAC,KAAK,CAAC;YACxC,OAAO,EAAE,KAAK;YACd,SAAS;YACT,UAAU,EAAE,KAAK;YACjB,WAAW;YACX,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;YAC1C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,KAAK;YACzC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,EAAE;YAChD,iBAAiB,EAAE,EAAE;YACrB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,2BAA2B,CACvC,EAAqC,EACrC,MAAkB,EAClB,eAA8C,EAC9C,UAA+B;QAE/B,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC;QACrD,MAAM,MAAM,GAAG,UAAU,IAAI,0CAAwC,CAAC,oBAAoB,CAAC;QAE3F,MAAM,SAAS,GAAG,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,gBAAgB,GAAG,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC5D,MAAM,iBAAiB,GAAG,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,sBAAsB,GAAG,SAAS,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,oBAAoB,GAAG,SAAS,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAEzE,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,iBAAiB,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;YACrD,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,IAAI,kBAAkB,GAAa,EAAE,CAAC;QACtC,IAAI,MAAM,GAAa,EAAE,CAAC;QAC1B,IAAI,qBAAqB,GAAa,EAAE,CAAC;QACzC,IAAI,MAAyC,CAAC;QAE9C,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;gBAChC,IAAI,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,IAAI,EAAE,CAAC;qBACzE,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,kCAAkC,CAAC,cAAc,CAAC,CAAC;qBAClF,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC;gBACvC,IAAI,eAAe,IAAI,EAAE,EAAE,CAAC;oBAC1B,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CACzD,EAAE,EACF,eAAe,CAAC,SAAS,EACzB,eAAe,CAAC,OAAO,EACvB,eAAe,CAChB,CAAC;gBACJ,CAAC;gBACD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAC9C,qBAAqB,GAAG,eAAe,CAAC;gBACxC,kBAAkB,GAAG,eAAe,CAAC;gBACrC,MAAM;YACR,CAAC;YACD,KAAK,UAAU,CAAC,UAAU,CAAC;YAC3B,KAAK,UAAU,CAAC,OAAO;gBACrB,MAAM;YACR,KAAK,UAAU,CAAC,OAAO;gBACrB,MAAM,GAAG,UAAU,CAAC,aAAa;oBAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,aAAa,CAAC,IAAI,EAAE;oBAClF,CAAC,CAAC,SAAS,CAAC;gBACd,MAAM;YACR,KAAK,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBACnC,IACE,CAAC,eAAe;uBACb,eAAe,CAAC,mBAAmB,KAAK,WAAW,CAAC,IAAI,EAC3D,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;gBAChF,IAAI,CAAC,YAAY;oBAAE,OAAO,IAAI,CAAC;gBAC/B,MAAM,GAAG,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;gBACrC,MAAM,GAAG;oBACP,WAAW,EAAE,YAAY,CAAC,WAAW;oBACrC,WAAW,EAAE,YAAY,CAAC,WAAW;oBACrC,YAAY,EAAE,YAAY,CAAC,YAAY;oBACvC,SAAS,EAAE,eAAe,CAAC,SAAS;oBACpC,OAAO,EAAE,eAAe,CAAC,OAAO;iBACjC,CAAC;gBACF,IAAI,eAAe,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC;oBAC5C,QAAQ,GAAG,IAAI,CAAC;gBAClB,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACzB,IACE,CAAC,eAAe;uBACb,eAAe,CAAC,mBAAmB,KAAK,WAAW,CAAC,IAAI,EAC3D,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;gBACpF,IAAI,CAAC,gBAAgB;oBAAE,OAAO,IAAI,CAAC;gBACnC,MAAM,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;gBACzC,MAAM,GAAG;oBACP,WAAW,EAAE,gBAAgB,CAAC,WAAW;oBACzC,WAAW,EAAE,gBAAgB,CAAC,WAAW;oBACzC,YAAY,EAAE,gBAAgB,CAAC,YAAY;oBAC3C,QAAQ,EAAE,oBAAoB,gBAAgB,CAAC,YAAY,EAAE;oBAC7D,SAAS,EAAE,eAAe,CAAC,SAAS;oBACpC,OAAO,EAAE,eAAe,CAAC,OAAO;iBACjC,CAAC;gBACF,IAAI,eAAe,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC;oBAC5C,QAAQ,GAAG,IAAI,CAAC;gBAClB,CAAC;gBACD,MAAM;YACR,CAAC;YACD;gBACE,MAAM;QACV,CAAC;QAED,OAAO;YACL,MAAM;YACN,UAAU;YACV,QAAQ;YACR,gBAAgB;YAChB,iBAAiB;YACjB,QAAQ;YACR,kBAAkB;YAClB,MAAM;YACN,sBAAsB;YACtB,oBAAoB;YACpB,qBAAqB;YACrB,MAAM;SACP,CAAC;IACJ,CAAC;;AAv4HU,wCAAwC;IADpD,UAAU,EAAE;IAiCR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAC7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAE3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAE1C,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,YAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,YAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAElD,YAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IAEnD,YAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAE/D,YAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAE1C,YAAA,MAAM,CAAC,kBAAkB,CAAC,+BAA+B,CAAC,CAAA;IAE1D,YAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAEhD,YAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IAGnD,YAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IACzC,YAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAK/D,YAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;qCAnCkB,aAAa;QACO,uBAAuB;QACxB,0BAA0B,YAEH,yCAAyC;QAC/D,uBAAuB;QAE3B,8BAA8B;QAClB,oCAAoC;QAClD,6BAA6B;QAEX,6BAA6B;QACjD,YAAY;QACG,uBAAuB;QAErB,+BAA+B;QAEpB,oCAAoC;QAE1D,sBAAsB;QAEP,sCAAsC;QAEpD,4BAA4B;QAEtB,+BAA+B,YAIxC,cAAc,YAMd,qBAAqB;GAnExF,wCAAwC,CAw4HpD","sourcesContent":["import 'reflect-metadata';\nimport { inject, injectable } from 'inversify';\nimport * as crypto from 'crypto';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport { resolveActiveMemberOrgIds } from '~wildo-backend-lib/security/authentications/services/resolve-active-member-orgs.backend.utils';\nimport { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport {\n AuthIdentificationRequest,\n AvailableMethod,\n AvailableMethodConfig,\n CoreConsumableTokenTypes,\n ConsumableToken_ConsumptionMode,\n ErrorCustomMessageReference,\n ErrorType,\n isWildoBackendError,\n PasswordAuthRequest,\n User,\n UserStatus,\n} from '@wildo-ai/saas-models';\nimport { CoreResourceType, getEnabledMethods, resolveTenantBrandPresentation } from '@wildo-ai/saas-models';\nimport { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport type { OrganizationBranding } from '@wildo-ai/saas-models';\nimport {\n AuthUtils,\n AuthIdentificationResponseSchema,\n AuthMethod,\n AuthFactorLevel,\n BrandAssetComposition,\n BrandAssetTheme,\n AuthenticationResponseSchema,\n AuthIdentificationResponse,\n AuthenticationRequest,\n AuthenticationResponse,\n AuthenticationSession,\n AuthenticationSessionSchema,\n AuthenticationSessionState,\n AuthNextStep,\n AuthScopeType,\n OrganizationNameSource,\n SsoProtocol,\n} from '@wildo-ai/saas-models';\nimport { AuthSessionPurpose, MfaEnrollmentState, AccountLockoutReason } from '@wildo-ai/saas-models';\nimport type { EmailOTPAuthRequest, TOTPAuthRequest, PasskeyAuthRequest, SMSOTPAuthRequest, UserCredentials, MagicLinkSendRequest, MagicLinkVerifyRequest, UserTypeAuthPolicy, UserTypesConfig } from '@wildo-ai/saas-models';\nimport {\n RegistrationAcquisitionChannel,\n RegistrationMode,\n EmailVerificationMode,\n evaluateUserTypeAcquisition,\n} from '@wildo-ai/saas-models';\nimport { DurationUnit } from '@wildo-ai/zod-decorators';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { createOrgOnRegistration } from '~wildo-backend-lib/organizations/services/org-creation-on-registration.backend.utils';\nimport { grantUserTypesOnOrgJoin } from '~wildo-backend-lib/organizations/services/user-org-type-grant.backend.utils';\nimport {\n executeDurableOrganizationOnboarding,\n readCompletedOrganizationOnboarding,\n} from '~wildo-backend-lib/organizations/services/organization-onboarding-operation.backend.utils';\nimport { MongoDBService } from '~wildo-backend-lib/databases/services/mongodb.service';\nimport type {\n ResourcePersistenceUnitOfWorkBackendService,\n} from '~wildo-backend-lib/databases/services/resource-persistence-unit-of-work.backend.service';\n\n// New decomposed services\nimport { AuthSessionStoreBackendService } from '~wildo-backend-lib/security/authentications/services/auth-session-store.backend.service';\nimport { AuthCredentialVerifierBackendService } from '~wildo-backend-lib/security/authentications/services/auth-credential-verifier.backend.service';\nimport { AuthTokenIssuerBackendService, type AuthTokens } from '~wildo-backend-lib/security/authentications/services/auth-token-issuer.backend.service';\nimport { WebAuthnBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/webauthn.backend.service';\nimport type { PasskeyAuthenticationVerificationResult } from '~wildo-backend-lib/security/authentications/services/auth-methods/webauthn.backend.service';\nimport type { OtpOperational, MagicLinkOperational, TotpOperational } from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport type { LockoutPolicyConfig } from '@wildo-ai/saas-models';\nimport { ConsumableTokenBackendService } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { RateLimitBackendService } from '~wildo-backend-lib/errors/services/rate-limit.backend.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { DomainToOrgLookupBackendService } from '~wildo-backend-lib/security/authentications/services/admin-config/domain-to-org-lookup.backend.service';\nimport type { DomainOrgLookupResult } from '~wildo-backend-lib/security/authentications/services/admin-config/domain-to-org-lookup.backend.service';\nimport { AuthOrganizationConfigurationService } from '~wildo-backend-lib/security/authentications/services/admin-config/auth-organization-configuration.service';\nimport { AUTH_REDIS_KEYS } from '~wildo-backend-lib/security/authentications/models/auth-constants.backend';\nimport { AuthMfaBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/auth-mfa.backend.service';\nimport { OAuth2ConnectionResolverBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/oauth2-connection-resolver.backend.service';\nimport { AuthUserLookupBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-user-lookup.backend.service';\nimport { AuthCredentialOpsBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-credential-ops.backend.service';\nimport { AuthControllerUtils } from '~wildo-backend-lib/security/authentications/services/utils/auth-controller.utils';\nimport {\n requiresEnterpriseSsoOnly,\n isBreakGlassAccount,\n restrictFirstFactorMethodsForEnterpriseSso,\n} from '~wildo-backend-lib/security/authentications/utils/enterprise-sso-enforcement.backend.utils';\nimport { isEnabledSocialOAuth2LoginProvider } from '~wildo-backend-lib/security/authentications/utils/social-oauth2-purpose.backend.utils';\n\n/**\n * Backend-internal authentication result type — extends the wire-shape\n * `AuthenticationResponse` (which post Auth-hardening Slice A Step 6\n * does NOT carry `refreshToken`) with the cookie-bound refresh token\n * value, so the controller can extract it and pass it explicitly to\n * `_jsonSuccessWithRefreshCookie(res, body, refreshToken)` at the\n * wire-leaving seam.\n *\n * Why a backend-only TS type rather than a Zod schema:\n * - This shape NEVER reaches the wire — the controller destructures\n * it (`const { refreshToken, ...wireBody } = result`) before\n * handing the body to `jsonSuccess`. There is no JSON schema to\n * enforce, only a TS contract between orchestrator and controller.\n * - Zod-isolating it would tempt callers to `.parse(...)` it and\n * accidentally re-export the cookie-only field as part of a wire\n * response — exactly the leak A-Step 6 closes.\n * - The wire schema (`AuthenticationResponseSchema`) intentionally\n * does NOT include `refreshToken`; this type augments locally so\n * orchestrator → controller plumbing stays type-safe without\n * widening the public schema surface.\n *\n * Pre A-Step 6 the orchestrator returned `AuthenticationResponse`\n * directly with `refreshToken` as a public schema field; A-Step 6\n * stripped the field from the schema and introduced this internal\n * type to keep the value reachable to the controller without\n * letting it leak onto the wire by accident.\n */\nexport type AuthenticationServiceResult = AuthenticationResponse & {\n /**\n * Refresh token value bound to the issued session. Threaded into the\n * `__wildo_refresh` cookie by `_jsonSuccessWithRefreshCookie` at the\n * controller's wire-leaving seam. NEVER serialised to the JSON body\n * (the body uses `AuthenticationResponseSchema`, which has no\n * `refreshToken` field).\n *\n * Optional because MFA-continuation responses (`requiresMFA: true`)\n * and other pre-completion shapes don't issue a refresh token.\n */\n refreshToken?: string;\n};\n\n/**\n * AuthenticationOrchestratorBackendService\n *\n * Orchestrates the authentication flow: identify → authenticate → tokens.\n *\n * Decomposed from the original AuthenticationBackendService (1900 lines → ~400 lines).\n * Session storage, credential verification, and token issuance are delegated to\n * focused sub-services (AuthSessionStore, AuthCredentialVerifier, AuthTokenIssuer).\n *\n * Public API preserved:\n * - identify(request) → AuthIdentificationResponse\n * - authenticate(request) → AuthenticationResponse\n * - authenticatePassword(request) → AuthenticationResponse\n * - getAuthenticationSessionState(sessionId) → AuthenticationSession | null\n *\n * TRAP 2: The controller calls exactly these methods. Signatures accept EC as the first parameter.\n * TRAP 9: Dependency arrows flow one way: Orchestrator → Services → Infrastructure.\n * TRAP 13: Audit logging stays here (not in sub-services).\n */\n@injectable()\nexport class AuthenticationOrchestratorBackendService {\n /** L11: Default session duration in minutes (absolute TTL). Overridden by userTypes[t].auth.sessionDurationMinutes. */\n private static readonly DEFAULT_SESSION_DURATION_MINUTES = 30;\n /** Idle timeout in minutes — session is deleted if lastActivity exceeds this. Must be < SESSION_DURATION_MINUTES. */\n private static readonly AUTH_SESSION_IDLE_TIMEOUT_MINUTES = 5;\n /** Default number of MFA methods required (for future MFA support). */\n private static readonly DEFAULT_MFA_METHODS_REQUIRED = 1;\n\n /**\n * R3 — coalescing window for the per-user `USER_ACCOUNT_LOCKED` audit emission.\n * Account lockout is the only attacker-TRIGGERABLE routed audit write (an attacker\n * hammering a victim's account forces it), and `incrementSessionAttempts` recomputes\n * `locked = attempts >= maxAttempts` with NO lock-transition guard — a repeated\n * post-threshold attempt would otherwise re-emit. Suppressing repeats inside this window\n * stops a lockout being used to amplify event volume into the victim's OWN org SIEM.\n */\n private static readonly ACCOUNT_LOCKED_AUDIT_DEDUP_WINDOW_MS = 5 * 60 * 1000;\n /** Max distinct users tracked in the lockout-dedup map (evict oldest-inserted when full) — bounds process-local growth. */\n private static readonly ACCOUNT_LOCKED_AUDIT_DEDUP_MAX_SIZE = 10_000;\n\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n /**\n * In-memory per-user dedup ledger for the `USER_ACCOUNT_LOCKED` audit (see\n * {@link ACCOUNT_LOCKED_AUDIT_DEDUP_WINDOW_MS}). Maps `userId → last-emitted epoch ms`.\n * Process-local + best-effort (a multi-instance deployment dedups per instance) — that is\n * sufficient: the goal is to blunt single-instance amplification, not exactly-once across\n * the fleet (the always-on DB store still records every lock unconditionally).\n */\n private readonly _accountLockedAuditDedup = new Map<string, number>();\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) private readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) private readonly auditLogsService: AuditLogsBackendService,\n // New decomposed services\n @inject(SAAS_SERVICE_TYPES.AuthSessionStore) private readonly sessionStore: AuthSessionStoreBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthCredentialVerifier) private readonly credentialVerifier: AuthCredentialVerifierBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthTokenIssuer) private readonly tokenIssuer: AuthTokenIssuerBackendService,\n // MFA services (Step 10-11)\n @inject(SAAS_SERVICE_TYPES.ConsumableTokenService) private readonly consumableTokenService: ConsumableTokenBackendService,\n @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,\n @inject(SAAS_SERVICE_TYPES.RateLimitBackendService) private readonly rateLimitService: RateLimitBackendService,\n // Domain-to-org lookup service (Step 14 — enterprise SSO domain routing)\n @inject(SAAS_SERVICE_TYPES.DomainToOrgLookupService) private readonly domainToOrgLookup: DomainToOrgLookupBackendService,\n // Organization configuration (M12 — org-level auth policy enforcement)\n @inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService) private readonly orgConfigService: AuthOrganizationConfigurationService,\n // WebAuthn/Passkey ceremony service (Phase G1)\n @inject(SAAS_SERVICE_TYPES.WebAuthnService) private readonly webAuthnService: WebAuthnBackendService,\n // G3: OAuth2 connection resolver — for filtering providers by org restrictions\n @inject(SAAS_SERVICE_TYPES.OAuth2ConnectionResolverService) private readonly oauth2Resolver: OAuth2ConnectionResolverBackendService,\n // AUTH-14: User lookup + effective auth policy resolution with org overrides\n @inject(SAAS_SERVICE_TYPES.AuthUserLookupService) private readonly userLookup: AuthUserLookupBackendService,\n // Centralized credential read/update operations via service registry\n @inject(SAAS_SERVICE_TYPES.AuthCredentialOpsService) private readonly credentialOps: AuthCredentialOpsBackendService,\n // Trusted system-write path for org-auto-create-on-registration (owner\n // membership FKs).\n @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n @inject(SAAS_SERVICE_TYPES.MongoDBService) private readonly mongoDBService: MongoDBService,\n @inject(SAAS_SERVICE_TYPES.ResourcePersistenceUnitOfWorkService)\n private readonly resourcePersistenceUnitOfWork:\n ResourcePersistenceUnitOfWorkBackendService,\n // Appended LAST on purpose: inserting a parameter mid-list silently re-binds every injection\n // after it. Owns the enrolled-second-factor verification this service used to inline.\n @inject(SAAS_SERVICE_TYPES.AuthMfaService) private readonly authMfaService: AuthMfaBackendService,\n ) {\n this.logDebug = this.logger.debugByType('AuthenticationOrchestrator');\n this.logger.setDebugTypeLogging('AuthenticationOrchestrator', false);\n }\n\n /**\n * Global lockout policy for email-scoped rate limiting (pre-authentication, user type unknown).\n * Computed as the most-restrictive lockout across all configured user types:\n * lowest maxLoginAttempts, longest lockoutDuration, progressive if any type uses it.\n */\n private get lockoutPolicy(): LockoutPolicyConfig {\n const userTypes = this.appConfigService.config.userTypes;\n const policies = Object.values(userTypes).map(ut => ut.auth.lockoutPolicy);\n if (policies.length === 0) {\n return { maxLoginAttempts: 5, lockoutDurationMinutes: 30, progressiveLockout: false, maxProgressiveLockoutHours: 24 };\n }\n return {\n maxLoginAttempts: Math.min(...policies.map(p => p.maxLoginAttempts)),\n lockoutDurationMinutes: Math.max(...policies.map(p => p.lockoutDurationMinutes)),\n progressiveLockout: policies.some(p => p.progressiveLockout),\n maxProgressiveLockoutHours: Math.max(...policies.map(p => p.maxProgressiveLockoutHours)),\n };\n }\n\n private get otpConfig(): OtpOperational {\n return this.appConfigService.config.auth.otpOperational;\n }\n\n private get magicLinkConfig(): MagicLinkOperational {\n return this.appConfigService.config.auth.magicLinkOperational;\n }\n\n // `totpConfig` was removed on 2026-08-06: its only reader was the inline TOTP verification that\n // moved to `AuthMfaBackendService.verifyEnrolledSecondFactor`, which reads the same config itself.\n // Keeping an unread accessor here would imply this service still owns a TOTP policy decision.\n\n // ===============================\n // PER-USER-TYPE AUTH CONFIG RESOLUTION (W3.1)\n // ===============================\n\n /**\n * Resolve the effective auth policy for a given user type.\n * If the user type exists in config.userTypes, returns its auth policy.\n * Falls back to FALLBACK_AUTH_POLICY when no user type is configured.\n */\n private _resolveAuthPolicy(activeUserType?: string | null): UserTypeAuthPolicy {\n if (activeUserType) {\n const policy = this.appConfigService.getUserTypeAuthPolicy(activeUserType);\n if (policy) return policy;\n }\n return AuthenticationOrchestratorBackendService.FALLBACK_AUTH_POLICY;\n }\n\n /**\n * W6.8: Safe default auth policy when no user type is resolved.\n * All values are restrictive-safe. Applications MUST configure userTypes for full control.\n */\n private static readonly FALLBACK_AUTH_POLICY: UserTypeAuthPolicy = {\n authMethodsEnabled: { [AuthMethod.PASSWORD]: true },\n mfaPolicy: {\n requireMFA: false,\n requireStrongMFA: false,\n enrollmentGracePeriodDays: 0,\n passkeyExemptFromMFA: true,\n },\n registration: {\n // This fallback supports authentication for legacy/unknown session context only. It must\n // never advertise or authorize acquisition when no concrete user type can be resolved.\n mode: RegistrationMode.DISABLED,\n allowedMethods: [],\n emailVerification: EmailVerificationMode.REQUIRED_BEFORE_ACCESS,\n blockForSSODomains: false,\n },\n passwordPolicy: {\n minLength: 8,\n maxLength: 128,\n requireUppercase: true,\n requireLowercase: true,\n requireNumbers: true,\n requireSpecialChars: false,\n expiryDays: 0,\n },\n sessionDurationMinutes: AuthenticationOrchestratorBackendService.DEFAULT_SESSION_DURATION_MINUTES,\n lockoutPolicy: {\n maxLoginAttempts: 5,\n lockoutDurationMinutes: 30,\n progressiveLockout: false,\n maxProgressiveLockoutHours: 24,\n },\n autoLinkByEmail: true,\n methodManagement: {\n allowUserMethodRemoval: true,\n requireReauthForMethodChanges: false,\n },\n };\n\n /**\n * AUTH-14: Resolve auth policy with org override merging for a known user.\n * Use this instead of _resolveAuthPolicy when userId is available.\n * Falls back to raw user-type policy if org resolution fails.\n */\n private async _resolveAuthPolicyWithOrgOverrides(\n ec: ExecutionContext<any>,\n activeUserType: string | null | undefined,\n userId: string,\n ): Promise<UserTypeAuthPolicy> {\n if (!activeUserType) return AuthenticationOrchestratorBackendService.FALLBACK_AUTH_POLICY;\n const effective = await this.userLookup.resolveEffectiveAuthPolicy(ec, userId, activeUserType);\n return effective ?? AuthenticationOrchestratorBackendService.FALLBACK_AUTH_POLICY;\n }\n\n /**\n * W6.8: Check if an auth method is enabled in ANY configured user type.\n * Used for pre-identification guards (sendMagicLink, sendSMSOTP) where\n * the user type is not yet known.\n */\n private _isMethodEnabledGlobally(method: AuthMethod): boolean {\n const userTypes: UserTypesConfig = this.appConfigService.config.userTypes ?? {};\n for (const [, typeDef] of Object.entries(userTypes)) {\n if (typeDef?.auth?.authMethodsEnabled?.[method]) return true;\n }\n return false;\n }\n\n /**\n * Resolve auth policy from a session's activeUserType. Convenience wrapper.\n */\n private _resolveAuthPolicyFromSession(session: AuthenticationSession): UserTypeAuthPolicy {\n return this._resolveAuthPolicy(session.activeUserType);\n }\n\n private _assertFrontendServiceAuthAllowed(frontendServiceName: string | undefined, userType: string | null | undefined): void {\n if (!frontendServiceName || !userType) {\n return;\n }\n\n const userManagement = this.appConfigService.getFrontendServiceUserManagementEntry(frontendServiceName, userType);\n if (!userManagement?.auth) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_METHOD_NOT_SUPPORTED,\n context: {\n // diagnostic (log-only)\n frontendServiceName,\n activeUserType: userType,\n },\n });\n }\n }\n\n // ===============================\n // SESSION HELPERS (delegate to AuthSessionStore)\n // ===============================\n\n private _getSessionTtlSeconds(activeUserType?: string | null): number {\n const policy = this._resolveAuthPolicy(activeUserType);\n return policy.sessionDurationMinutes * 60;\n }\n\n\n /**\n * Create a new authentication session in the store.\n */\n /** W4: Registration sessions get longer TTL (24h) to match email verification token expiry. */\n private static readonly REGISTRATION_SESSION_TTL_SECONDS = 24 * 60 * 60;\n\n private async createSession(\n sessionId: string,\n initialState: AuthenticationSessionState = AuthenticationSessionState.CREATED,\n options: {\n deviceInfo?: { userAgent?: string; ipAddress?: string };\n activeUserType?: string;\n purpose?: AuthSessionPurpose;\n email?: string;\n userId?: string;\n pendingOrgType?: string;\n } = {},\n ): Promise<AuthenticationSession> {\n const authPolicy = this._resolveAuthPolicy(options.activeUserType);\n const isRegistrationFlow = options.purpose === AuthSessionPurpose.REGISTRATION || options.purpose === AuthSessionPurpose.INVITATION;\n const ttlSeconds = isRegistrationFlow\n ? AuthenticationOrchestratorBackendService.REGISTRATION_SESSION_TTL_SECONDS\n : authPolicy.sessionDurationMinutes * 60;\n const now = new Date();\n const expiresAt = new Date(now.getTime() + ttlSeconds * 1000);\n\n const session: AuthenticationSession = {\n sessionId,\n state: initialState,\n activeUserType: options.activeUserType,\n purpose: options.purpose ?? AuthSessionPurpose.LOGIN,\n email: options.email,\n userId: options.userId,\n createdAt: now,\n expiresAt,\n lastActivity: now,\n completedFactors: [],\n availableFirstFactorMethods: [],\n availableSecondFactorMethods: [],\n availableEnrollmentMethods: [],\n enrolledSecondFactorMethods: [],\n usableSecondFactorMethods: [],\n requiresMFA: false,\n requireStrongMFA: false,\n mfaMethodsRequired: AuthenticationOrchestratorBackendService.DEFAULT_MFA_METHODS_REQUIRED,\n attempts: 0,\n maxAttempts: authPolicy.lockoutPolicy.maxLoginAttempts,\n requestedIntegrations: [],\n deviceInfo: options.deviceInfo,\n pendingOrgType: options.pendingOrgType,\n version: 0,\n };\n\n await this.sessionStore.set(sessionId, session, ttlSeconds);\n this.logDebug(`Created new authentication session: ${sessionId}`, { purpose: session.purpose });\n\n return session;\n }\n\n /**\n * Get and validate a session. Returns null if not found, expired, or idle-timed-out.\n */\n private async getSession(sessionId: string): Promise<AuthenticationSession | null> {\n const session = await this.sessionStore.get(sessionId);\n\n if (!session) {\n return null;\n }\n\n // Check expiry (Redis TTL handles this too, but defensive check)\n if (session.expiresAt < new Date()) {\n await this.sessionStore.delete(sessionId);\n this.logDebug(`Session expired and removed: ${sessionId}`);\n return null;\n }\n\n // M15 fix: Idle timeout — delete session if lastActivity is stale\n if (session.lastActivity) {\n const idleLimitMs = AuthenticationOrchestratorBackendService.AUTH_SESSION_IDLE_TIMEOUT_MINUTES * 60 * 1000;\n const idleDuration = Date.now() - session.lastActivity.getTime();\n if (idleDuration > idleLimitMs) {\n await this.sessionStore.delete(sessionId);\n this.logDebug(`Session idle-timed-out and removed: ${sessionId}`, {\n idleMinutes: Math.round(idleDuration / 60000),\n limitMinutes: AuthenticationOrchestratorBackendService.AUTH_SESSION_IDLE_TIMEOUT_MINUTES,\n });\n return null;\n }\n }\n\n return session;\n }\n\n /** Maximum retries for atomic session updates before falling back to non-atomic write. */\n private static readonly ATOMIC_UPDATE_MAX_RETRIES = 3;\n\n /**\n * Update a session in the store using atomic compare-and-swap (M1 fix).\n *\n * Uses the session `version` field for optimistic concurrency control.\n * On version mismatch (concurrent writer), re-reads and retries up to MAX_RETRIES.\n * Falls back to a non-atomic write only if all retries are exhausted.\n */\n private async updateSession(\n sessionId: string,\n updates: Partial<AuthenticationSession>,\n ): Promise<AuthenticationSession | null> {\n for (let attempt = 0; attempt <= AuthenticationOrchestratorBackendService.ATOMIC_UPDATE_MAX_RETRIES; attempt++) {\n const session = await this.getSession(sessionId);\n if (!session) {\n return null;\n }\n\n const expectedVersion = session.version ?? 0;\n const updatedSession = AuthenticationSessionSchema.parse({\n ...session,\n ...updates,\n lastActivity: new Date(),\n version: expectedVersion + 1,\n });\n\n // Try atomic update via Lua compare-and-swap\n const result = await this.sessionStore.atomicUpdate(\n sessionId,\n updatedSession,\n expectedVersion,\n this._getSessionTtlSeconds(updatedSession.activeUserType),\n );\n\n if (result) {\n this.logDebug(`Updated authentication session: ${sessionId}`, {\n state: updatedSession.state,\n version: updatedSession.version,\n });\n return result;\n }\n\n // Version mismatch — another writer beat us. Retry with fresh read.\n this.logDebug(`Session update version conflict (attempt ${attempt + 1}): ${sessionId}`);\n }\n\n // All retries exhausted — return null to signal failure rather than falling back\n // to a non-atomic write that could silently overwrite a concurrent writer's update.\n this.logger.warn?.('Session atomic update retries exhausted, returning failure', { sessionId });\n return null;\n }\n\n /**\n * Remove a session from the store.\n */\n private async removeSession(sessionId: string): Promise<void> {\n await this.sessionStore.delete(sessionId);\n this.logDebug(`Removed authentication session: ${sessionId}`);\n }\n\n /**\n * Increment session attempts and check for lockout.\n * W3.1: Uses per-user-type lockout policy from session's activeUserType.\n */\n private async incrementSessionAttempts(\n ec: ExecutionContext<any>,\n sessionId: string,\n ): Promise<{ session: AuthenticationSession | null; locked: boolean }> {\n const session = await this.getSession(sessionId);\n if (!session) {\n return { session: null, locked: false };\n }\n\n const sessionPolicy = this._resolveAuthPolicyFromSession(session);\n const sessionLockout = sessionPolicy.lockoutPolicy;\n const attempts = session.attempts + 1;\n const locked = attempts >= session.maxAttempts;\n\n let effectiveLockoutMinutes = sessionLockout.lockoutDurationMinutes;\n\n // W2.3: Progressive lockout — double duration for each consecutive lockout, capped at maxProgressiveLockoutHours\n if (locked && sessionLockout.progressiveLockout && session.userId) {\n try {\n const { previousCount } = await this.credentialOps.incrementLockout(ec, session.userId!);\n const maxMinutes = (sessionLockout.maxProgressiveLockoutHours ?? 24) * 60;\n effectiveLockoutMinutes = Math.min(\n sessionLockout.lockoutDurationMinutes * Math.pow(2, previousCount),\n maxMinutes,\n );\n } catch {\n // Fallback to base duration if credential lookup fails\n }\n }\n\n const updates: Partial<AuthenticationSession> = {\n attempts,\n state: locked ? AuthenticationSessionState.LOCKED : session.state,\n lockoutUntil: locked\n ? new Date(Date.now() + effectiveLockoutMinutes * 60 * 1000)\n : undefined,\n };\n\n const updatedSession = await this.updateSession(sessionId, updates);\n\n if (locked && updatedSession?.userId) {\n // Session/progressive lockout tripped — emit the coalesced USER_ACCOUNT_LOCKED audit\n // (SHARED with the per-email GLOBAL lockout path via {@link _emitAccountLockedAuditOnce}).\n await this._emitAccountLockedAuditOnce(\n ec,\n updatedSession.userId,\n updatedSession.email || 'unknown',\n effectiveLockoutMinutes,\n updatedSession.deviceInfo,\n sessionId,\n AccountLockoutReason.SESSION_ATTEMPT_LIMIT,\n );\n }\n\n return { session: updatedSession, locked };\n }\n\n /**\n * Emit the `USER_ACCOUNT_LOCKED` audit ONCE per user within\n * {@link ACCOUNT_LOCKED_AUDIT_DEDUP_WINDOW_MS}, routed to the user's VERIFIED ACTIVE member orgs.\n *\n * SHARED by BOTH lockout paths — the session/progressive lockout ({@link incrementSessionAttempts})\n * and the per-email GLOBAL lockout pre-flight (F-AUDIT-1, in {@link authenticatePassword}) — so the\n * two coalesce on ONE per-user ledger: a user tripping both within the window emits once, not twice.\n *\n * R3 — this is the only attacker-TRIGGERABLE routed audit write; the callers have no lock-transition\n * guard (`locked` stays true post-threshold), so without this coalescing a repeated post-threshold\n * attempt would re-emit and let an attacker amplify event volume into the victim's OWN org SIEM. The\n * always-on DB store is unaffected. The dedup map is bounded (evict oldest-inserted when full) so a\n * busy system cannot accumulate one entry per ever-locked user for the process lifetime.\n *\n * F4 per-org SIEM routing — route ONLY on the user's verified ACTIVE member orgs, NEVER a\n * session/request-derived org. NOTE the recorded ipAddress/userAgent belong to the ATTACKER (the\n * request that tripped the lock), not the victim — correct SOC telemetry by design.\n */\n private async _emitAccountLockedAuditOnce(\n ec: ExecutionContext<any>,\n lockedUserId: string,\n email: string,\n lockoutDurationMinutes: number,\n deviceInfo: AuthenticationSession['deviceInfo'],\n sessionId: string,\n reason: AccountLockoutReason,\n ): Promise<void> {\n const nowMs = Date.now();\n const lastEmittedMs = this._accountLockedAuditDedup.get(lockedUserId);\n if (\n lastEmittedMs !== undefined &&\n nowMs - lastEmittedMs < AuthenticationOrchestratorBackendService.ACCOUNT_LOCKED_AUDIT_DEDUP_WINDOW_MS\n ) {\n return; // within the coalescing window — already emitted for this user\n }\n if (this._accountLockedAuditDedup.size >= AuthenticationOrchestratorBackendService.ACCOUNT_LOCKED_AUDIT_DEDUP_MAX_SIZE) {\n const oldestKey = this._accountLockedAuditDedup.keys().next().value;\n if (oldestKey !== undefined) {\n this._accountLockedAuditDedup.delete(oldestKey);\n }\n }\n this._accountLockedAuditDedup.set(lockedUserId, nowMs);\n const routingOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, lockedUserId);\n await this.auditLogsService.logUserAccountLocked({\n userId: lockedUserId,\n email: email || 'unknown',\n authMethod: AuthMethod.PASSWORD,\n lockoutDuration: lockoutDurationMinutes,\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n sessionId,\n reason,\n }, ec, routingOrgIds);\n }\n\n // ===============================\n // GLOBAL LOCKOUT (C1 fix — per-email, Redis-based)\n // ===============================\n\n /**\n * Wipe the per-email global lockout counter on successful authentication.\n *\n * Q-2 = Reset-keep, preserved verbatim across the Step 3 migration:\n * under the new atomic `checkRateLimit(...)` model the lockout bucket\n * increments on EVERY password attempt (not just failed ones), so a\n * successful authentication must clear the counter to give the user a\n * fresh budget on their next session / next password attempt. The raw\n * `redisService.del('rate_limit:${key}')` shape is intentionally kept\n * as-is here; it matches the pre-migration behavior exactly and avoids\n * widening the Redis primitive surface in this tranche.\n */\n private async _resetGlobalAttempts(email: string): Promise<void> {\n const key = `${AUTH_REDIS_KEYS.GLOBAL_LOCKOUT}${email.toLowerCase()}`;\n await this.redisService.del(`rate_limit:${key}`);\n }\n\n // Step 3.5 tombstone (lockout-state-machine-modernization.md):\n // `_getGlobalAttempts`, `_incrementGlobalAttempts`, and\n // `_checkGlobalLockout` were deleted when the split-phase global\n // lockout flow collapsed into the canonical bridge-backed K-3\n // `checkRateLimit(...)` call inside `authenticatePassword()`.\n // See the multi-paragraph doc block above that call site for the\n // preserved rationale, timing shift, and deferred audit-gap note.\n\n // ===============================\n // INTERNAL HELPERS\n // ===============================\n\n /**\n * Resolve user for authentication by email.\n */\n private async _resolveUserForAuthentication(\n ec: ExecutionContext<any>,\n _session: AuthenticationSession,\n email: string,\n sessionId: string,\n ): Promise<User> {\n this.logDebug(`Resolving user for authentication: sessionId=${sessionId}, email=${email}`);\n\n const user = await this.userLookup.findAnyUserByEmail(ec, email);\n\n if (!user) {\n const { locked } = await this.incrementSessionAttempts(ec, sessionId);\n const authResponse = this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.FIRST, { retryAllowed: !locked });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_FOUND,\n context: { email, authResponse },\n });\n }\n\n this._enforceUserStatus(user, sessionId);\n return user;\n }\n\n private _enforceUserStatus(user: User, sessionId: string): void {\n if (user.status === UserStatus.ACTIVE) return;\n\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n context: { userStatus: user.status, sessionId },\n });\n }\n\n /**\n * Update session after successful method authentication.\n * Sets the correct session state based on whether this is a first or second factor completion.\n */\n private async _updateSessionAfterSuccessfulAuth(\n ec: ExecutionContext<any>,\n sessionId: string,\n userId: string,\n authMethod: AuthMethod,\n ): Promise<void> {\n const session = await this.getSession(sessionId);\n if (!session) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,\n context: { sessionId, operation: 'update' },\n });\n }\n\n const currentFactors = session.completedFactors || [];\n const newCompletedFactors = currentFactors.includes(authMethod)\n ? currentFactors\n : [...currentFactors, authMethod];\n\n // Determine correct session state: second-factor methods get COMPLETED (not FIRST_FACTOR_COMPLETED)\n const isSecondFactor = AuthUtils.canBeSecondFactor(authMethod) && currentFactors.length > 0;\n\n // Backend enforcement: reject second-factor methods not in usableSecondFactorMethods.\n // Prevents API-level bypass of requireStrongMFA (e.g. submitting EMAIL_OTP directly).\n if (isSecondFactor && session.usableSecondFactorMethods && session.usableSecondFactorMethods.length > 0) {\n if (!session.usableSecondFactorMethods.includes(authMethod)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_METHOD_NOT_SUPPORTED,\n context: { method: authMethod, reason: 'METHOD_NOT_IN_USABLE_LIST' },\n });\n }\n }\n\n const newState = isSecondFactor\n ? AuthenticationSessionState.COMPLETED\n : AuthenticationSessionState.FIRST_FACTOR_COMPLETED;\n\n // AUTH-14: Use org-override-aware policy when userId is known\n const sessionPolicy = userId\n ? await this._resolveAuthPolicyWithOrgOverrides(ec, session.activeUserType, userId)\n : this._resolveAuthPolicyFromSession(session);\n\n // AUTH-24 (login-side teeth for the posture derivation): a FIRST-factor method must be enabled in the\n // user's EFFECTIVE policy. For a directory-managed user, resolveEffectiveAuthPolicy derives the local\n // first-factor methods (PASSWORD / PASSKEY / MAGIC_LINK) OFF, so a credential that physically verified\n // still cannot complete a session. This is the uniform backstop covering PASSKEY (and redundantly\n // PASSWORD, also gated pre-verify in authenticatePassword); magic-link completes on a separate path and\n // is gated in verifyMagicLink. Second factors keep their own `usableSecondFactorMethods` gate above.\n if (!isSecondFactor && userId && !getEnabledMethods(sessionPolicy.authMethodsEnabled).has(authMethod)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_METHOD_NOT_SUPPORTED,\n context: { method: authMethod, reason: 'METHOD_NOT_ENABLED_IN_EFFECTIVE_POLICY' },\n });\n }\n\n const sessionUpdate: Partial<AuthenticationSession> = {\n state: newState,\n completedFactors: newCompletedFactors,\n attempts: 0, // Reset attempts on successful authentication\n userId: userId,\n };\n\n // After first-factor success, determine if MFA is required for this session.\n // W3.1: Resolve per-user-type auth policy from session's activeUserType.\n if (!isSecondFactor) {\n const mfaCheck = await this._shouldRequireMFA(ec, userId, authMethod, sessionPolicy);\n if (mfaCheck.required) {\n const hasEnrolledStrongFactor = mfaCheck.enrolledMethods.some(m => m !== AuthMethod.EMAIL_OTP);\n\n if (!hasEnrolledStrongFactor) {\n // W4.5: MFA required but no strong factor enrolled — route to enrollment\n const secondFactorMethods = AuthUtils.getSecondFactorMethods();\n const availableEnrollment = secondFactorMethods.filter(\n m => sessionPolicy.authMethodsEnabled?.[m],\n );\n\n sessionUpdate.state = AuthenticationSessionState.MFA_ENROLLMENT_REQUIRED;\n sessionUpdate.requiresMFA = true;\n sessionUpdate.requireStrongMFA = sessionPolicy.mfaPolicy?.requireStrongMFA ?? false;\n sessionUpdate.nextStep = AuthNextStep.MFA_ENROLLMENT;\n sessionUpdate.availableEnrollmentMethods = availableEnrollment;\n } else {\n const mfaResolution = await this._resolveUsableMfaMethods(mfaCheck.enrolledMethods, sessionPolicy);\n\n sessionUpdate.requiresMFA = true;\n sessionUpdate.requireStrongMFA = mfaResolution.requireStrongMFA;\n sessionUpdate.availableSecondFactorMethods = mfaResolution.availableMethods;\n sessionUpdate.enrolledSecondFactorMethods = mfaCheck.enrolledMethods;\n sessionUpdate.usableSecondFactorMethods = mfaResolution.usableMethods;\n }\n }\n }\n\n await this.updateSession(sessionId, sessionUpdate);\n\n // W2.3: Reset progressive lockout counter on successful auth\n if (sessionPolicy.lockoutPolicy.progressiveLockout && userId) {\n try {\n await this.credentialOps.resetLockout(ec, userId);\n } catch {\n // Non-critical: lockout counter reset failure should not block auth\n }\n }\n }\n\n // ===============================\n // AUTHENTICATION FLOW METHODS\n // ===============================\n\n public async identify(\n ec: ExecutionContext<any>,\n identificationRequest: AuthIdentificationRequest,\n activeUserType?: string,\n frontendServiceName?: string,\n ): Promise<AuthIdentificationResponse> {\n const { email, deviceInfo } = identificationRequest;\n\n this.logDebug(`User identification request: email=${email}`);\n\n // PR 8c (rate-limit unification, Step 5 — Option D, third\n // service-layer lift): the dual rate-limit (formerly H1 fix —\n // `${AUTH_REDIS_KEYS.IDENTIFY_IP}${ip}` 10/60 + `${AUTH_REDIS_KEYS.IDENTIFY_EMAIL}${email.toLowerCase()}`\n // 10/60, both raw `checkRateLimit`) moved UP to\n // `AuthenticationController.identify` as two declarative\n // `checkPolicy` companions. The `if (deviceInfo?.ipAddress)`\n // guard pattern was simultaneously closed at the lifted seam:\n // the new path uses `getClientIpFromRequest` which co-buckets\n // unknown-IP callers via the `'unknown'` sentinel (same\n // PR-7b net-upgrade pattern). Rationale for the lift: rate\n // limits are intrinsically HTTP concerns — bucket keys (IP,\n // email) live at the HTTP layer, 429 feedback is HTTP-only,\n // and service contracts must remain HTTP-type-free. See plan\n // body for the full Option D analysis.\n\n // Q-1 Option C / no-peek sub-decision (lockout-state-machine-modernization.md):\n // `identify()` deliberately does NOT read the global lockout counter.\n // The canonical enforcement seam is now `authenticatePassword()`'s\n // bridge-backed pre-flight `checkRateLimit(...)` call, which keeps the\n // lockout state machine atomic without introducing a read-only \"peek\"\n // primitive at the framework layer.\n\n const user = await this.userLookup.findAnyUserByEmail(ec, email);\n\n this.logDebug(`User lookup result: userExists=${!!user}, email=${email}`);\n\n // AUTH-10 FIX: When the user exists in DB, trust their stored userTypes over\n // the client-provided X-Frontend-Service-Name-derived hint. The header is only used as a\n // hint when the user is unknown (pre-registration UI).\n const dbUserTypes = user ? (user as User & { userTypes?: string[] }).userTypes : undefined;\n const resolvedUserType = (dbUserTypes?.length ? dbUserTypes[0] : undefined) ?? activeUserType;\n\n // ─── Step 14: Domain-based SSO routing ───\n // Extract email domain and check if an org claims it for SSO\n const emailDomain = email.split('@')[1]?.toLowerCase();\n let domainOrgLookup: DomainOrgLookupResult | null = null;\n\n if (emailDomain) {\n try {\n domainOrgLookup = await this.domainToOrgLookup.findOrgByDomain(ec, emailDomain);\n } catch {\n this.logDebug('Domain-to-org lookup failed (non-fatal)', { emailDomain });\n }\n }\n\n // Generate cryptographically secure session ID (Section 6.5 fix)\n const sessionId = this.sessionStore.generateSessionId();\n\n // AUTH-14: Use org-override-aware policy when user is known, raw policy for unknown users\n this._assertFrontendServiceAuthAllowed(frontendServiceName, resolvedUserType);\n\n const authPolicy = (user && resolvedUserType)\n ? await this._resolveAuthPolicyWithOrgOverrides(ec, resolvedUserType, user._id)\n : this._resolveAuthPolicy(resolvedUserType);\n const firstFactorMethods = await this._getAvailableFirstFactorMethods(ec, domainOrgLookup, authPolicy);\n\n /*\n * ─── The offered method set depends on POLICY ONLY ────────────────────────────────────────\n *\n * This is a PRE-AUTHENTICATION response to an email hint, and the whole point of the `userExists:\n * true` fix below is that it must be identical whether or not the address names an account. Two\n * per-account narrowings used to run here and defeated that, each in the same one-sided way:\n *\n * - PASSKEY was removed when an EXISTING user had none registered — so an absent PASSKEY\n * proved the account exists, because the branch is skipped entirely for an unknown address;\n * - the surviving PASSKEY entry was enriched with `registeredPasskeyCount`, disclosing how\n * many authenticators a named person has before anyone proved they are that person.\n *\n * Neither had a single consumer anywhere in the repository — no frontend read the count, and no\n * caller depended on the narrowing — so both were paying an enumeration oracle for nothing.\n *\n * PASSKEY is now offered whenever the policy enables it. A caller with no credential learns that\n * from their own authenticator: `navigator.credentials.get()` reports no discoverable credential\n * client-side, which is where that answer belongs. It is also what conditional UI (passkey\n * autofill) already does — the browser knows, and the server does not have to say.\n */\n\n // If org requires SSO and disallows password fallback, fail closed to\n // enterprise methods only. If none can be materialized, keep the list empty\n // instead of advertising social/password and failing after an IdP round-trip.\n if (requiresEnterpriseSsoOnly(domainOrgLookup)) {\n const ssoOnlyMethods = restrictFirstFactorMethodsForEnterpriseSso(\n firstFactorMethods,\n domainOrgLookup,\n );\n firstFactorMethods.length = 0;\n firstFactorMethods.push(...ssoOnlyMethods);\n }\n\n // Create session (W3.5: activeUserType stored on session, W3.1: per-user-type TTL + lockout)\n // AUTH-10: Store the DB-resolved user type, not the raw header value\n const session = await this.createSession(sessionId, AuthenticationSessionState.IDENTIFIED, {\n deviceInfo,\n activeUserType: resolvedUserType,\n });\n\n await this.updateSession(sessionId, {\n email: email.toLowerCase(),\n userExists: !!user,\n userId: user?._id,\n availableFirstFactorMethods: firstFactorMethods,\n scopeId: domainOrgLookup?.scopeId,\n scopeType: domainOrgLookup?.scopeType,\n });\n\n /*\n * Build organization branding if the domain matched an org — the TENANT's own branding first,\n * the application's brand assets second (#410).\n *\n * The comment here used to say the org \"has no per-org logo at identification time (we've only\n * matched a domain, not loaded an org profile)\". That was true of what the code did and false\n * as a constraint: the domain lookup resolves `scopeId`, which IS the organization id, so the\n * profile was always one read away. A tenant could upload a logo, see it on its settings screen,\n * and never see it on its own sign-in page.\n *\n * Discloses nothing new. `organizationName` — the tenant's display name — is already returned at\n * this step, to anyone, keyed only on the domain and never on whether the user exists (the H2\n * anti-enumeration invariant below). A login screen's branding is meant to be seen by the person\n * about to sign in; that is what it is for.\n *\n * Best-effort by construction: this is a PRE-AUTHENTICATION path, so a profile read that fails\n * must degrade to the application brand rather than refuse an identification.\n */\n const organizationBrandingRecord = domainOrgLookup?.scopeId\n ? await this.readOrganizationBrandingForIdentification(ec, domainOrgLookup.scopeId)\n : undefined;\n\n const organizationBranding = domainOrgLookup\n ? {\n organizationName: domainOrgLookup.matchedProvider?.displayName,\n ...resolveTenantBrandPresentation(organizationBrandingRecord, {\n // `resolveBrandLogoUrl` returns undefined when no brand asset was generated yet.\n logoUrl:\n this.appConfigService.resolveBrandLogoUrl({\n composition: BrandAssetComposition.LOCKUP,\n theme: BrandAssetTheme.DEFAULT,\n })\n ?? this.appConfigService.resolveBrandLogoUrl({\n composition: BrandAssetComposition.SYMBOL,\n theme: BrandAssetTheme.DEFAULT,\n }),\n // No application-level primary colour exists to fall back to: the only configured\n // `primaryColor` in the engine is an EMAIL brand token, which is a different palette for\n // a different medium. So this DTO field is populated from the tenant or not at all —\n // honestly absent rather than filled with a value from somewhere it does not belong.\n primaryColor: undefined,\n }),\n }\n : undefined;\n\n // H2 fix: Always return userExists: true to prevent email enumeration.\n // If no user was found, still advertise PASSWORD as available method so the\n // response shape is identical regardless of email existence.\n if (!user && firstFactorMethods.length === 0 && !requiresEnterpriseSsoOnly(domainOrgLookup)) {\n const passwordMethod = await this._buildAvailableMethodObject(undefined, AuthMethod.PASSWORD, undefined, authPolicy);\n if (passwordMethod) {\n firstFactorMethods.push(passwordMethod);\n }\n }\n\n /*\n * ─── `ssoMigrationRequired` is GONE, and its removal is the same fix as the block above ───────\n *\n * It was computed here as \"this user's domain enforces SSO and they have not linked an identity\n * yet\", which required BOTH an existing user and an identity-link read. `true` therefore proved\n * the address names an account — the third one-sided existence oracle in this response, sitting\n * two statements above the `userExists: true` line that exists to prevent exactly that.\n *\n * It could have been made enumeration-safe by deriving it from the DOMAIN alone, and that was\n * rejected: domain-derived, the flag is true for people who HAVE linked, so its name would\n * become a lie and the messaging a future reader wires from it would fire on the wrong half of\n * the tenant. The honest answer is that it has no consumer — no frontend, no test, nothing in\n * either dogfood application read it — so there is nothing to preserve. A flag that only a\n * post-authentication surface can answer honestly belongs on a post-authentication surface.\n */\n\n const payload = {\n sessionId,\n email: email.toLowerCase(),\n userExists: true, // H2 fix: always true to prevent enumeration\n firstFactorMethods,\n defaultFirstFactorMethod: firstFactorMethods.length > 0 ? firstFactorMethods[0].method : undefined,\n secondFactorMethods: [],\n requiresMFA: false,\n mfaMethodsRequired: AuthenticationOrchestratorBackendService.DEFAULT_MFA_METHODS_REQUIRED,\n organizationBranding,\n availableIntegrations: [],\n };\n return AuthIdentificationResponseSchema.parse(payload);\n }\n\n // ===============================\n // AVAILABLE METHODS LOGIC\n // ===============================\n\n /**\n * PUBLIC reuse wrapper — build the `AvailableMethod[]` first-factor set for an\n * already-RESOLVED auth policy, WITHOUT an email→domain lookup. Used by the\n * public invitation-info endpoint (`AuthRegistrationBackendService.getInvitationInfo`),\n * which knows the target org directly (not via email domain) and only needs the\n * policy-gated method set. SSO method entries are returned WITHOUT per-connection\n * enrichment (no domain lookup); the invitation endpoint derives `managementMode`\n * from the policy. Pass an optional `domainOrgLookup` (from `findOrgByDomain` OR the\n * scope-keyed `buildLookupForScope`) to enrich ORG_SAML/ORG_OPENID_CONNECT entries\n * with per-connection `ssoIds`/`config`; omit it to drop org-SSO methods. Reuses the\n * exact same per-method construction as `identify()` so the two surfaces never drift.\n */\n public async buildFirstFactorMethodsForPolicy(\n ec: ExecutionContext<any>,\n authPolicy: UserTypeAuthPolicy,\n domainOrgLookup?: DomainOrgLookupResult | null,\n ): Promise<AvailableMethod[]> {\n return this._getAvailableFirstFactorMethods(ec, domainOrgLookup, authPolicy);\n }\n\n private async _getAvailableFirstFactorMethods(ec: ExecutionContext<any>, domainOrgLookup?: DomainOrgLookupResult | null, authPolicy?: UserTypeAuthPolicy): Promise<AvailableMethod[]> {\n const policy = authPolicy ?? AuthenticationOrchestratorBackendService.FALLBACK_AUTH_POLICY;\n const methods: AvailableMethod[] = [];\n for (const method of AuthUtils.getFirstFactorMethods()) {\n const availableMethod = await this._buildAvailableMethodObject(ec, method, domainOrgLookup, policy);\n if (availableMethod) {\n methods.push(availableMethod);\n }\n }\n return methods;\n }\n\n private async _getAvailableSecondFactorMethods(authPolicy?: UserTypeAuthPolicy): Promise<AvailableMethod[]> {\n const policy = authPolicy ?? AuthenticationOrchestratorBackendService.FALLBACK_AUTH_POLICY;\n const methods: AvailableMethod[] = [];\n for (const method of AuthUtils.getSecondFactorMethods()) {\n const availableMethod = await this._buildAvailableMethodObject(undefined, method, undefined, policy);\n if (availableMethod) {\n methods.push(availableMethod);\n }\n }\n\n const acceptable = policy.mfaPolicy?.acceptableMFAMethods ?? [];\n if (acceptable.length > 0) {\n return methods.filter(m => acceptable.includes(m.method));\n }\n return methods;\n }\n\n /**\n * Intersects available methods with enrolled methods, applying requireStrongMFA filtering.\n * Returns { availableMethods, usableMethods, requireStrongMFA } for session population.\n */\n private async _resolveUsableMfaMethods(enrolledMethods: AuthMethod[], authPolicy?: UserTypeAuthPolicy): Promise<{\n availableMethods: AvailableMethod[];\n usableMethods: AuthMethod[];\n requireStrongMFA: boolean;\n }> {\n const policy = authPolicy ?? AuthenticationOrchestratorBackendService.FALLBACK_AUTH_POLICY;\n const availableMethods = await this._getAvailableSecondFactorMethods(policy);\n const enrolledSet = new Set<AuthMethod>(enrolledMethods);\n const requireStrongMFA = !!policy.mfaPolicy?.requireStrongMFA;\n let usableMethods: AuthMethod[] = availableMethods\n .filter(m => enrolledSet.has(m.method))\n .map(m => m.method);\n if (requireStrongMFA) {\n usableMethods = usableMethods.filter(m => m !== AuthMethod.EMAIL_OTP);\n }\n return { availableMethods, usableMethods, requireStrongMFA };\n }\n\n // ===============================\n // PASSWORD AUTHENTICATION\n // ===============================\n\n public async authenticatePassword(ec: ExecutionContext<any>, passwordAuthRequest: PasswordAuthRequest): Promise<AuthenticationServiceResult> {\n const { sessionId, password } = passwordAuthRequest;\n this.logDebug('Password authentication started', { sessionId, hasPassword: !!password });\n\n // Get and validate session\n const session = await this.getSession(sessionId);\n if (!session) {\n this.logDebug('Session not found', { sessionId });\n const authResponse = this._buildIdentificationErrorResponse(sessionId, passwordAuthRequest.factorLevel, false, session);\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,\n context: { sessionId, authResponse },\n });\n }\n\n // Check session-level lockout\n if (session.state === AuthenticationSessionState.LOCKED) {\n const authResponse = this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.FIRST, {\n retryAllowed: false,\n lockoutUntil: session.lockoutUntil,\n });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n context: { sessionId, authResponse },\n });\n }\n\n // M2 fix: State machine guard — only allow password auth from valid states\n const validPasswordStates = new Set([\n AuthenticationSessionState.IDENTIFIED,\n AuthenticationSessionState.FIRST_FACTOR_IN_PROGRESS,\n ]);\n if (!validPasswordStates.has(session.state)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,\n });\n }\n\n const { email } = session;\n\n // H1 fix: Rate limit authenticatePassword() — 5 req/min per email+IP.\n //\n // FRAMEWORK-CANONICAL K-3 ESCAPE-HATCH SITE — see PR 8e of the\n // rate-limit unification (Step 5, Option D — fifth and final\n // service-layer audit). This dual-bucket throttle was examined\n // for lifting to `AuthenticationController.authenticatePassword`\n // (direct path) + `AuthenticationController.authenticate` (generic\n // dispatch path) and EXPLICITLY KEPT at the service layer alongside\n // the SMS-OTP burst block (`sendSMSOTP`), the email-OTP send\n // cap (`sendEmailOTP`, migrated to `checkRateLimit` in Step 7\n // F-23 sub-PR a), and the global lockout counter below — together\n // those are the four canonical `checkRateLimit` callers in the\n // engine outside the WebSocket per-event surface (K-8 out-of-scope)\n // and `RateLimitBackendService` itself.\n //\n // Why kept at the service layer (PR 8e Option K rationale):\n // • Both bucket keys derive from SESSION-STORED state, NOT from\n // HTTP-layer artefacts.\n // - `email` is destructured from `session.email` on line above\n // (set at `identify` time and immutable for the session\n // lifetime); `passwordAuthRequest.email` from the body is\n // EXPLICITLY ignored — see the controller's `passwordRequest`\n // construction comment (\"Email should be available from\n // session, but included for compatibility\").\n // - `ipAddress` is `session.deviceInfo?.ipAddress` captured at\n // `identify` time, NOT the current request's IP — defends\n // against IP rotation WITHIN one session, which the\n // controller-level `getClientIpFromRequest(req)` could not.\n // • Lifting via `body.email` (only the direct path has it; the\n // generic `PasswordAuthRequestSchema` has no `email` field at\n // all) would let an attacker spoof a per-request email to dodge\n // the per-email cap entirely. The 10/min/email cap upstream at\n // `controller.identify` (PR 8c) is the floor — but that floor\n // governs identify only; without this in-session per-email cap,\n // a single established session could burn unlimited password\n // attempts against `session.email` by rotating `body.email` per\n // request (the orchestrator buckets on `session.email`, but a\n // controller-side `body.email` bucket would not).\n // • Lifting with `session.email` / `session.deviceInfo.ipAddress`\n // requires `await this.getSession(sessionId)` BEFORE rate-limit\n // fail-fast — defeats F-22, doubles Redis round-trips on every\n // request, and creates a non-trivial fail-open pathway when the\n // session lookup itself is rate-limited or fails.\n //\n // The K-3 contract reserves the raw `checkRateLimit` API for cases\n // where the bucket key is NOT cheaply derivable from HTTP-layer\n // inputs — `sendSMSOTP` (per-physical-phone, DB-resolved),\n // `authenticatePassword` (per-verified-session-email +\n // per-session-captured-IP), `sendEmailOTP`\n // (per-session-resolved-userId, migrated from\n // `redisService.incrementRateLimit` in Step 7 F-23 sub-PR a),\n // and the global lockout counter below are the four canonical\n // engine-side examples. Future authors hitting any of these\n // shapes should use this surface directly rather than threading\n // `req`/`res` into service signatures or weakening the bucket\n // dimension.\n //\n // D-4 baseline applied at the bucket-key seam: `email.toLowerCase()`\n // is a no-op since `AuthIdentificationRequestSchema` already\n // lowercases via `.email().toLowerCase()` (so `session.email` is\n // already lowercase by the time it reaches here), but the call is\n // PRESERVED verbatim to keep the intent-revealing call-site\n // invariant shared with every other email-keyed bucket in the\n // family (matches PR 7b / PR 8c convention).\n //\n // F-7 EXCEPTION at the per-IP bucket (M-2, post-PR-8 review): the\n // `if (ipAddress)` guard at the call site below DELIBERATELY\n // bypasses the F-7 unknown-IP closure pattern (PR 7b: co-bucket\n // via the `'unknown'` sentinel from `getClientIpFromRequest`).\n // The sentinel works at the controller layer because every\n // request goes through one express layer, so the sentinel\n // collides consistently. Here the bucket key is\n // `session.deviceInfo?.ipAddress` (captured at identify time);\n // a missing value means \"the session was created without an IP\"\n // — a different population from \"this request lacks an IP\" — and\n // co-bucketing them would incorrectly couple two distinct threat\n // surfaces. The companion controller-side `controller.identify`\n // per-IP cap (PR 8c) IS F-7-closed and catches IP-less session-\n // creation flooding upstream, so the only sessions that reach\n // here without an IP are those that legitimately bypassed\n // identify (none today; reserved for future first-factor flows).\n // See the `PASSWORD_IP` block in `auth-constants.backend.ts`\n // for the canonical doc; this paragraph is the call-site echo\n // so a future auditor doesn't have to chase the constants file.\n //\n // The complementary HTTP-layer companions live as `checkPolicy`\n // calls upstream at `controller.identify` (10/min per-email +\n // 10/min per-IP, PR 8c) — the two layers compose for full defense\n // in depth: identify caps catch session-creation flooding;\n // authenticatePassword caps catch in-session password-stuffing\n // against the verified email and originating IP regardless of\n // body manipulation.\n const ipAddress = session.deviceInfo?.ipAddress;\n await this.rateLimitService.checkRateLimit(`${AUTH_REDIS_KEYS.PASSWORD_EMAIL}${email.toLowerCase()}`, 5, 60);\n if (ipAddress) {\n await this.rateLimitService.checkRateLimit(`${AUTH_REDIS_KEYS.PASSWORD_IP}${ipAddress}`, 10, 60);\n }\n\n /*\n * ─── The SSO enforcement gate MOVED, and it moved for two reasons ────────────────────────────\n *\n * It used to run HERE, before the user was resolved and before the password was verified, and\n * it answers with a distinguishable `AUTHENTICATION_SSO_REQUIRED` that reaches the client\n * verbatim. So any per-account decision it took — and break-glass (#423) is one — was\n * observable to a caller who had proved nothing. It now runs after verification, immediately\n * beside `_incrementSSOGraceLogin`, which is the counter it gates.\n *\n * The second reason is the one that would matter even without break-glass: a caller who typed\n * the wrong password at an SSO-enforced tenant used to be told the tenant enforces SSO, before\n * anything about them was established. Now a wrong password fails as a wrong password.\n *\n * What this costs: an exhausted-grace account burns one password verification before being\n * refused. That is one bcrypt comparison against a caller who supplied a credential, on a path\n * already rate-limited per email and per IP two statements above.\n */\n\n // Resolve user\n const user = await this._resolveUserForAuthentication(ec, session, email, sessionId);\n const userId = (user as User)._id;\n\n // Q1 (AUTH-23 / .claude/plans/scim-vs-auth-authority-axis.md): the login-side complement\n // to the invite-accept credential block. Even when a `passwordHash` EXISTS, refuse\n // first-factor PASSWORD when the user's effective (org-merged, most-restrictive) policy\n // disables it. This closes the USER-GLOBAL stray-credential vector: a password minted at\n // an OPEN org must not authenticate a user who ALSO belongs to an IdP-managed org whose\n // policy disables PASSWORD (the multi-org intersection resolves PASSWORD off for that\n // user). Fail-closed with the SAME generic \"credentials not found\" envelope as the\n // password-less branch below, so it never reveals the org is SSO/SCIM-managed\n // (anti-enumeration). NB: teeth depend on the managed org's policy actually disabling\n // PASSWORD — until posture-derived policy (Option C / AUTH-24) lands, that means an\n // authored `authOverride`. A null `activeUserType` resolves to FALLBACK_AUTH_POLICY\n // (PASSWORD enabled), so untyped accounts are unaffected.\n const effectivePolicy = await this._resolveAuthPolicyWithOrgOverrides(ec, session.activeUserType, userId);\n if (!effectivePolicy.authMethodsEnabled?.[AuthMethod.PASSWORD]) {\n const { locked } = await this.incrementSessionAttempts(ec, sessionId);\n const authResponse = this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.FIRST, {\n authMethod: AuthMethod.PASSWORD,\n retryAllowed: !locked,\n });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_NOT_FOUND,\n context: { email, authResponse },\n });\n }\n\n // Resolve credentials via AuthCredentialVerifier\n const cred = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n // `passwordHash` is OPTIONAL on the credential document (password-less accounts whose\n // first factor is a passkey / magic link / SSO). A missing hash here means the account\n // simply has no password to verify, so PASSWORD auth must fail-closed with the SAME\n // \"credentials not found\" envelope rather than reaching `verifyPassword(undefined, …)`\n // (which would throw inside argon2). Treated identically to \"no credential row\" so the\n // response never distinguishes \"no account\" from \"account without a password\" (no\n // enumeration of which first factors an account has).\n if (!cred || !cred.passwordHash) {\n const { locked } = await this.incrementSessionAttempts(ec, sessionId);\n const authResponse = this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.FIRST, {\n authMethod: AuthMethod.PASSWORD,\n retryAllowed: !locked,\n });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_NOT_FOUND,\n context: { email, authResponse },\n });\n }\n\n // C1 / F-23 close (lockout-state-machine-modernization.md Step 3.2):\n // the per-email global lockout counter is now the FOURTH canonical\n // K-3 `checkRateLimit` site. It stays at the orchestrator seam because\n // the bucket key is `session.email`, NOT an HTTP-derived identifier —\n // same K-3 rationale as the adjacent `PASSWORD_EMAIL` / `PASSWORD_IP`\n // caps above. The upstream `controller.identify` companions (10/min\n // per-email + 10/min per-IP, lifted in PR 8c) remain the first line of\n // defense against session-creation flooding; this per-session seam\n // preserves the pre-existing \"global lockout survives session\n // recreation\" behavior for password attempts against the verified\n // session email.\n //\n // Placement is intentional: the bridge-backed pre-flight runs AFTER\n // org-policy gating (`_checkSSOGraceLoginAllowed`), user resolution,\n // and credential existence checks, but BEFORE `verifyPassword(...)`.\n // That preserves the old \"count real password checks, not earlier\n // orchestration/policy failures\" scope while still moving the counter\n // to one atomic pre-verify seam.\n //\n // Bridge rationale: this is semantically a rate-limit (per-email cap in\n // a time window) but user-facing as an AUTHENTICATION lockout, not a 429.\n // Step 3.1 added the `options` bridge on `checkRateLimit` specifically so\n // this site can preserve the existing\n // `ErrorType.AUTHENTICATION` +\n // `AUTHENTICATION_ACCOUNT_LOCKED` +\n // `{ lockoutDurationMinutes }`\n // envelope while consolidating the counter mechanics into the framework\n // primitive.\n //\n // Timing shift vs the old split-phase design:\n // - OLD: `_checkGlobalLockout(email)` READ before password verify, then\n // `_incrementGlobalAttempts(email)` only after a failed verify.\n // - NEW: atomic `checkRateLimit(...)` increments immediately before\n // `verifyPassword(...)` runs and throws at attempt N+1's pre-flight\n // when the cap is exceeded.\n // Success-path `_resetGlobalAttempts(email)` is intentionally preserved\n // (Q-2 = Reset-keep) so a successful auth wipes the budget, matching\n // today's UX contract.\n //\n // F-AUDIT-1 (fixed 2026-07-23): the per-email GLOBAL lockout now emits the same\n // `USER_ACCOUNT_LOCKED` audit as the session/progressive path. `checkRateLimit` THROWS the\n // AUTHENTICATION_ACCOUNT_LOCKED error when the per-email cap is exceeded, so the emission rides a\n // catch on exactly that error — best-effort (a routing/emit failure must never mask the lockout\n // error the caller expects) and coalesced on the SAME per-user ledger as the progressive path (a\n // user tripping both within the window emits once). `userId` + `session` are already resolved at\n // this seam (see the placement note above), so the SIEM routing has everything it needs.\n try {\n await this.rateLimitService.checkRateLimit(\n `${AUTH_REDIS_KEYS.GLOBAL_LOCKOUT}${email.toLowerCase()}`,\n this.lockoutPolicy.maxLoginAttempts,\n this.lockoutPolicy.lockoutDurationMinutes * 60,\n undefined,\n 'Account temporarily locked due to too many failed attempts. Please try again later.',\n {\n errorType: ErrorType.AUTHENTICATION,\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n contextExtra: { lockoutDurationMinutes: this.lockoutPolicy.lockoutDurationMinutes },\n },\n );\n } catch (globalLockoutError) {\n if (\n isWildoBackendError(globalLockoutError) &&\n globalLockoutError.customMessageReference === ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED\n ) {\n try {\n await this._emitAccountLockedAuditOnce(ec, userId, email, this.lockoutPolicy.lockoutDurationMinutes, session.deviceInfo, sessionId, AccountLockoutReason.GLOBAL_EMAIL_RATE_LIMIT);\n } catch {\n /* best-effort audit — never let an emit/routing failure mask the lockout error */\n }\n }\n throw globalLockoutError;\n }\n\n // Update session state\n await this.updateSession(sessionId, {\n state: AuthenticationSessionState.FIRST_FACTOR_IN_PROGRESS,\n currentFactor: AuthFactorLevel.FIRST,\n });\n\n // Verify password via AuthCredentialVerifier\n this.logDebug('Verifying password', { sessionId });\n const ok = await this.credentialVerifier.verifyPassword(cred.passwordHash, password);\n this.logDebug('Password verification result', { sessionId, passwordMatch: ok });\n\n if (!ok) {\n this.logDebug('Password verification failed', { sessionId });\n const { locked, session: updatedAttemptSession } = await this.incrementSessionAttempts(ec, sessionId);\n const lockoutUntil = locked ? updatedAttemptSession?.lockoutUntil : undefined;\n const retryAfterSeconds = lockoutUntil\n ? Math.max(1, Math.ceil((lockoutUntil.getTime() - Date.now()) / 1000))\n : this.lockoutPolicy.lockoutDurationMinutes * 60;\n const lockoutDurationMinutes = Math.ceil(retryAfterSeconds / 60);\n\n // Audit log authentication failure (TRAP 13: audit stays in orchestrator)\n const deviceInfo = session.deviceInfo;\n await this.auditLogsService.logUserLoginFailed({\n email,\n authMethod: AuthMethod.PASSWORD,\n failureReason: 'Invalid credentials',\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n attemptsRemaining: session.maxAttempts - session.attempts - 1,\n sessionId,\n });\n\n const authResponse = this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.FIRST, {\n authMethod: AuthMethod.PASSWORD,\n retryAllowed: !locked,\n ...(lockoutUntil && { lockoutUntil }),\n });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: locked\n ? ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED\n : ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,\n context: {\n email,\n authResponse,\n ...(locked && {\n lockoutDurationMinutes,\n retryAfterSeconds,\n message: 'Account temporarily locked due to too many failed attempts. Please try again later.',\n }),\n },\n });\n }\n\n // Password verified — update session\n this.logDebug('Password authentication successful', { sessionId, userId });\n\n // C1 fix: Reset global lockout counter on successful authentication\n await this._resetGlobalAttempts(email);\n\n /*\n * SSO enforcement, evaluated on a caller who has now PROVED the credential — see the note at\n * the top of this method for why it is here rather than in front of the verification.\n *\n * The check may refuse (the tenant requires SSO and this account is neither exempt nor within\n * its grace allowance), so it runs BEFORE the increment: a refused sign-in must not consume a\n * grace attempt it was never granted.\n */\n if (session.scopeType && session.scopeId) {\n await this._checkSSOGraceLoginAllowed(\n ec,\n session.scopeType,\n session.scopeId,\n userId,\n (user as User).email,\n { sessionId, ipAddress: ipAddress ?? '', userAgent: session.deviceInfo?.userAgent ?? '' },\n );\n\n await this._incrementSSOGraceLogin(\n ec,\n session.scopeType,\n session.scopeId,\n userId,\n );\n }\n\n await this._updateSessionAfterSuccessfulAuth(ec, sessionId, userId, AuthMethod.PASSWORD);\n\n const updatedSession = await this.getSession(sessionId);\n return this._buildAuthenticationSuccessMethod(\n sessionId,\n AuthFactorLevel.FIRST,\n AuthMethod.PASSWORD,\n '', // No access token yet — tokens issued after completion check in authenticate()\n {\n completedFactors: updatedSession?.completedFactors || [],\n requiresMFA: updatedSession?.requiresMFA || false,\n availableMFAMethods: updatedSession?.availableSecondFactorMethods || [],\n mfaMethodsRequired: updatedSession?.mfaMethodsRequired,\n enrolledSecondFactorMethods: updatedSession?.enrolledSecondFactorMethods || [],\n usableSecondFactorMethods: updatedSession?.usableSecondFactorMethods || [],\n nextStep: updatedSession?.nextStep,\n availableEnrollmentMethods: updatedSession?.availableEnrollmentMethods || [],\n },\n );\n }\n\n // ===============================\n // W4: REGISTRATION PIPELINE\n // ===============================\n\n /**\n * W4.1: Create a registration session after user account creation.\n * Called by `registerUser()` instead of returning a generic success message.\n * The session tracks the registration pipeline state (email verify → MFA enrollment → complete).\n */\n public async createRegistrationSession(\n userId: string,\n email: string,\n options: {\n activeUserType?: string;\n purpose?: AuthSessionPurpose;\n deviceInfo?: { userAgent?: string; ipAddress?: string };\n pendingOrgType?: string;\n } = {},\n ): Promise<AuthenticationSession> {\n const sessionId = this.sessionStore.generateSessionId();\n const session = await this.createSession(sessionId, AuthenticationSessionState.REGISTERED, {\n activeUserType: options.activeUserType,\n purpose: options.purpose ?? AuthSessionPurpose.REGISTRATION,\n email,\n userId,\n deviceInfo: options.deviceInfo,\n pendingOrgType: options.pendingOrgType,\n });\n return session;\n }\n\n /**\n * W4.1: Process email verification through the registration pipeline.\n * Instead of issuing tokens directly, transitions the session through:\n * EMAIL_VERIFIED → check MFA → MFA_ENROLLMENT_REQUIRED / MFA_ENROLLMENT_GRACE / COMPLETED.\n *\n * Returns the updated session with `nextStep` indicating what the frontend should do.\n */\n public async processEmailVerification(\n ec: ExecutionContext<any>,\n userId: string,\n email: string,\n activeUserType?: string,\n deviceInfo?: { userAgent?: string; ipAddress?: string },\n purpose?: AuthSessionPurpose,\n ): Promise<AuthenticationSession> {\n const authPolicy = activeUserType\n ? await this._resolveAuthPolicyWithOrgOverrides(ec, activeUserType, userId)\n : AuthenticationOrchestratorBackendService.FALLBACK_AUTH_POLICY;\n\n const sessionId = this.sessionStore.generateSessionId();\n const session = await this.createSession(sessionId, AuthenticationSessionState.EMAIL_VERIFIED, {\n activeUserType,\n purpose: purpose ?? AuthSessionPurpose.REGISTRATION,\n email,\n userId,\n deviceInfo,\n });\n\n return this._advanceRegistrationPipeline(ec, session, authPolicy, userId);\n }\n\n /**\n * W4: Advance a registration session through the pipeline after a state transition.\n * Checks MFA requirements, grace period, and onboarding to determine next state.\n */\n private async _advanceRegistrationPipeline(\n ec: ExecutionContext<any>,\n session: AuthenticationSession,\n authPolicy: UserTypeAuthPolicy,\n userId: string,\n ): Promise<AuthenticationSession> {\n if (session.state !== AuthenticationSessionState.EMAIL_VERIFIED) {\n return session;\n }\n\n const mfaResult = await this._shouldRequireMFA(ec, userId, undefined, authPolicy);\n\n const cred = await this.credentialOps.readByUserId(ec, userId);\n\n if (mfaResult.required) {\n const hasEnrolledStrongFactor = mfaResult.enrolledMethods.some(m => m !== AuthMethod.EMAIL_OTP);\n\n if (hasEnrolledStrongFactor) {\n if (cred && cred.mfaEnrollmentState !== MfaEnrollmentState.ENROLLED) {\n await this.credentialOps.updateById(ec, cred._id, { mfaEnrollmentState: MfaEnrollmentState.ENROLLED } as Partial<UserCredentials>);\n }\n return this._completeRegistrationSession(session);\n }\n\n const gracePeriodDays = authPolicy.mfaPolicy?.enrollmentGracePeriodDays ?? 0;\n if (gracePeriodDays > 0) {\n const graceExpiresAt = new Date();\n graceExpiresAt.setDate(graceExpiresAt.getDate() + gracePeriodDays);\n\n if (cred) {\n await this.credentialOps.updateById(ec, cred._id, {\n mfaEnrollmentState: MfaEnrollmentState.GRACE,\n firstMfaPromptAt: cred.firstMfaPromptAt ?? new Date(),\n } as Partial<UserCredentials>);\n }\n\n const updated = await this.updateSession(session.sessionId, {\n state: AuthenticationSessionState.MFA_ENROLLMENT_GRACE,\n nextStep: AuthNextStep.COMPLETE,\n mfaGraceExpiresAt: graceExpiresAt.toISOString(),\n requiresMFA: true,\n });\n return updated ?? session;\n }\n\n if (cred) {\n await this.credentialOps.updateById(ec, cred._id, { mfaEnrollmentState: MfaEnrollmentState.PENDING } as Partial<UserCredentials>);\n }\n\n const secondFactorMethods = AuthUtils.getSecondFactorMethods();\n const availableEnrollment = secondFactorMethods.filter(\n m => authPolicy.authMethodsEnabled?.[m],\n );\n\n const updated = await this.updateSession(session.sessionId, {\n state: AuthenticationSessionState.MFA_ENROLLMENT_REQUIRED,\n nextStep: AuthNextStep.MFA_ENROLLMENT,\n requiresMFA: true,\n requireStrongMFA: authPolicy.mfaPolicy?.requireStrongMFA ?? false,\n availableEnrollmentMethods: availableEnrollment,\n });\n return updated ?? session;\n }\n\n if (cred && cred.mfaEnrollmentState !== MfaEnrollmentState.NOT_REQUIRED && cred.mfaEnrollmentState !== MfaEnrollmentState.ENROLLED) {\n await this.credentialOps.updateById(ec, cred._id, { mfaEnrollmentState: MfaEnrollmentState.NOT_REQUIRED } as Partial<UserCredentials>);\n }\n return this._completeRegistrationSession(session);\n }\n\n /**\n * W4: Complete a registration session — transition to COMPLETED or ONBOARDING_PENDING state.\n * W5.7: When pendingOrgType is set, route to ONBOARDING_PENDING instead of COMPLETED.\n */\n private async _completeRegistrationSession(session: AuthenticationSession): Promise<AuthenticationSession> {\n if (session.pendingOrgType) {\n const updated = await this.updateSession(session.sessionId, {\n state: AuthenticationSessionState.ONBOARDING_PENDING,\n nextStep: AuthNextStep.ONBOARDING,\n });\n return updated ?? session;\n }\n\n const updated = await this.updateSession(session.sessionId, {\n state: AuthenticationSessionState.COMPLETED,\n nextStep: AuthNextStep.COMPLETE,\n });\n return updated ?? session;\n }\n\n /**\n * W4.3: Complete MFA enrollment during registration pipeline.\n * Called after the user successfully enrolls an MFA method during registration.\n * Transitions from MFA_ENROLLMENT_REQUIRED → COMPLETED and issues tokens.\n */\n public async completeRegistrationMfaEnrollment(\n ec: ExecutionContext<any>,\n sessionId: string,\n ): Promise<AuthenticationSession> {\n const session = await this.getSession(sessionId);\n if (!session) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_EXPIRED,\n });\n }\n\n if (session.state !== AuthenticationSessionState.MFA_ENROLLMENT_REQUIRED &&\n session.state !== AuthenticationSessionState.SECOND_FACTOR_IN_PROGRESS) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.MFA_ENROLLMENT_STATE_INVALID,\n context: { state: session.state }, // diagnostic (log-only)\n });\n }\n\n // W4.9 SEC FIX: Verify that a strong MFA method was actually enrolled before completing\n if (!session.userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.MFA_ENROLLMENT_STATE_INVALID,\n });\n }\n\n const cred = await this.credentialOps.readByUserId(ec, session.userId);\n const enrolledMethods = AuthUtils.getEnrolledSecondFactorMethods(cred);\n const hasStrongFactor = enrolledMethods.some(m => m !== AuthMethod.EMAIL_OTP);\n\n if (!hasStrongFactor) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.MFA_NOT_ENROLLED,\n });\n }\n\n if (cred && cred.mfaEnrollmentState !== MfaEnrollmentState.ENROLLED) {\n await this.credentialOps.updateById(ec, cred._id, { mfaEnrollmentState: MfaEnrollmentState.ENROLLED } as Partial<UserCredentials>);\n }\n\n return this._completeRegistrationSession(session);\n }\n\n /**\n * W5.7: Complete org onboarding — create the deferred organization and transition to COMPLETED.\n * Called by the guidance/onboarding flow after collecting the org name from the user.\n */\n public async completeOrgOnboarding(\n ec: ExecutionContext<any>,\n sessionId: string,\n organizationName: string,\n ): Promise<AuthenticationSession> {\n const session = await this.getSession(sessionId);\n if (!session) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_EXPIRED,\n });\n }\n\n // Mongo is authoritative for the side effect. Check it before Redis state or\n // policy so a crash after commit can always repair the session projection,\n // even if configuration changed before the retry.\n const completed = session.userId\n ? await readCompletedOrganizationOnboarding(\n this.mongoDBService,\n this.errorBuilder,\n session.sessionId,\n session.userId,\n )\n : null;\n if (completed) {\n const repaired = await this.updateSession(session.sessionId, {\n state: AuthenticationSessionState.COMPLETED,\n nextStep: AuthNextStep.COMPLETE,\n pendingOrgType: undefined,\n organizationId: completed.organizationId,\n });\n return repaired ?? {\n ...session,\n state: AuthenticationSessionState.COMPLETED,\n nextStep: AuthNextStep.COMPLETE,\n pendingOrgType: undefined,\n organizationId: completed.organizationId,\n };\n }\n\n if (session.state !== AuthenticationSessionState.ONBOARDING_PENDING) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ONBOARDING_STATE_INVALID,\n context: { state: session.state }, // diagnostic (log-only)\n });\n }\n\n if (!session.pendingOrgType || !session.userId || !session.email) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ONBOARDING_STATE_INVALID,\n });\n }\n\n const trimmedName = organizationName.trim();\n if (!trimmedName) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.ORG_NAME_REQUIRED,\n });\n }\n\n const config = this.appConfigService.isInitialized()\n ? this.appConfigService.config\n : undefined;\n const orgTypeDef = config?.organizationTypes?.[session.pendingOrgType];\n const policy = orgTypeDef?.creationPolicy;\n const activeUserType = session.activeUserType;\n if (\n !config\n || !orgTypeDef\n || !activeUserType\n || policy?.orgNameSource !== OrganizationNameSource.ONBOARDING\n || !policy.createOnUserTypeRegistration?.includes(activeUserType)\n ) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n context: {\n reason: 'onboarding_policy_no_longer_valid',\n pendingOrgType: session.pendingOrgType,\n activeUserType,\n },\n });\n }\n\n const currentUser = await this.servicesRegistryHandler.read<User>(\n CoreResourceType.USERS,\n ec,\n { _id: session.userId },\n );\n if (!currentUser) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n context: {\n reason: 'onboarding_user_no_longer_exists',\n pendingOrgType: session.pendingOrgType,\n },\n });\n }\n if (currentUser.status !== UserStatus.ACTIVE) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n context: {\n userStatus: currentUser.status,\n source: 'registration_onboarding',\n },\n });\n }\n if (!currentUser.userTypes?.includes(activeUserType)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n context: {\n reason: 'onboarding_trigger_user_type_no_longer_held',\n pendingOrgType: session.pendingOrgType,\n activeUserType,\n },\n });\n }\n const acquisition = evaluateUserTypeAcquisition(\n config?.userTypes,\n orgTypeDef.userTypes ?? [],\n currentUser.userTypes ?? [],\n RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n );\n if (!acquisition.allowed) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n context: {\n channel: RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n deniedUserTypes: acquisition.deniedUserTypes,\n pendingOrgType: session.pendingOrgType,\n },\n });\n }\n\n const onboardingResult = await executeDurableOrganizationOnboarding({\n mongoDBService: this.mongoDBService,\n resourcePersistenceUnitOfWork: this.resourcePersistenceUnitOfWork,\n errorBuilder: this.errorBuilder,\n sessionId: session.sessionId,\n userId: session.userId,\n createOrganization: async (serviceOptions) => {\n // Revalidate mutable user state from the transaction snapshot. The\n // earlier checks provide fast failure; these own authorization at commit.\n const transactionalUser = await this.servicesRegistryHandler.read<User>(\n CoreResourceType.USERS,\n ec,\n { _id: session.userId },\n serviceOptions,\n );\n if (\n !transactionalUser\n || transactionalUser.status !== UserStatus.ACTIVE\n || !transactionalUser.userTypes?.includes(activeUserType)\n ) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n context: {\n reason: 'onboarding_user_state_changed_before_commit',\n pendingOrgType: session.pendingOrgType,\n activeUserType,\n },\n });\n }\n const transactionalAcquisition = evaluateUserTypeAcquisition(\n config.userTypes,\n orgTypeDef.userTypes ?? [],\n transactionalUser.userTypes ?? [],\n RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n );\n if (!transactionalAcquisition.allowed) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n context: {\n channel: RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n deniedUserTypes: transactionalAcquisition.deniedUserTypes,\n pendingOrgType: session.pendingOrgType,\n },\n });\n }\n\n const orgResult = await createOrgOnRegistration(ec, {\n userId: session.userId,\n userEmail: session.email,\n activeUserType,\n organizationName: trimmedName,\n organizationTypes: {\n [session.pendingOrgType]: {\n creationPolicy: {\n createOnUserTypeRegistration: [activeUserType],\n orgNameSource: OrganizationNameSource.ASK,\n defaultOwnerRole: policy?.defaultOwnerRole,\n },\n },\n },\n servicesRegistryHandler: this.servicesRegistryHandler,\n systemAccessService: this.systemAccessService,\n serviceOptions,\n });\n if (!orgResult.created || !orgResult.organizationId) {\n throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {\n context: {\n reason: 'durable_onboarding_organization_not_created',\n sessionId: session.sessionId,\n pendingOrgType: session.pendingOrgType,\n },\n });\n }\n\n await grantUserTypesOnOrgJoin(ec, {\n userId: session.userId,\n organizationId: orgResult.organizationId,\n organizationTypes: config.organizationTypes,\n servicesRegistryHandler: this.servicesRegistryHandler,\n systemAccessService: this.systemAccessService,\n serviceOptions,\n });\n return orgResult.organizationId;\n },\n });\n\n const updated = await this.updateSession(session.sessionId, {\n state: AuthenticationSessionState.COMPLETED,\n nextStep: AuthNextStep.COMPLETE,\n pendingOrgType: undefined,\n organizationId: onboardingResult.organizationId,\n });\n return updated ?? {\n ...session,\n state: AuthenticationSessionState.COMPLETED,\n nextStep: AuthNextStep.COMPLETE,\n pendingOrgType: undefined,\n organizationId: onboardingResult.organizationId,\n };\n }\n\n // ===============================\n // MAIN AUTHENTICATE DISPATCH\n // ===============================\n\n public async authenticate(ec: ExecutionContext<any>, request: AuthenticationRequest): Promise<AuthenticationServiceResult> {\n this.logDebug('Main authenticate method called', {\n sessionId: request.sessionId,\n method: request.method,\n factorLevel: request.factorLevel,\n });\n\n let authResponse: AuthenticationResponse;\n\n // Step 1: Dispatch to the method-specific handler.\n // Capture discriminant before switch to preserve type information for error fallback.\n const method = request.method;\n switch (method) {\n case AuthMethod.PASSWORD: {\n const session = await this.getSession(request.sessionId);\n if (!session) {\n return this.__buildAuthenticationErrorMethod(request.sessionId, request.factorLevel, { retryAllowed: false });\n }\n\n const email = session.email;\n if (!email) {\n return this.__buildAuthenticationErrorMethod(request.sessionId, request.factorLevel, { retryAllowed: true });\n }\n\n try {\n authResponse = await this.authenticatePassword(ec, request as PasswordAuthRequest);\n } catch (error) {\n throw error;\n }\n break;\n }\n\n case AuthMethod.EMAIL_OTP: {\n authResponse = await this.authenticateEmailOTP(ec, request as EmailOTPAuthRequest);\n break;\n }\n\n case AuthMethod.TOTP: {\n authResponse = await this.authenticateTOTP(ec, request as TOTPAuthRequest);\n break;\n }\n\n case AuthMethod.PASSKEY: {\n authResponse = await this.authenticatePasskey(ec, request as PasskeyAuthRequest);\n break;\n }\n\n case AuthMethod.SMS_OTP: {\n authResponse = await this.authenticateSMSOTP(ec, request as SMSOTPAuthRequest);\n break;\n }\n\n default:\n // Unimplemented methods return a clean error.\n // sessionId and factorLevel exist on BaseAuthRequestSchema — shared by all union variants.\n return this.__buildAuthenticationErrorMethod(\n request.sessionId,\n request.factorLevel ?? AuthFactorLevel.FIRST,\n { retryAllowed: true },\n );\n }\n\n this.logDebug('Authentication method result', {\n sessionId: request.sessionId,\n method: request.method,\n success: authResponse.success,\n });\n\n // Step 2: If method succeeded, check if overall authentication is complete.\n if (authResponse.success) {\n const session = await this.getSession(request.sessionId);\n if (!session) {\n return this.__buildAuthenticationErrorMethod(request.sessionId, request.factorLevel, { retryAllowed: false });\n }\n\n const isComplete = this._isAuthenticationComplete(session, request.factorLevel, request.method);\n\n if (isComplete) {\n this.logDebug('Authentication complete, issuing tokens', { sessionId: request.sessionId });\n\n // S0.7 Layer 1: Re-check user status before token issuance (catches race conditions and all auth paths).\n // `currentUser` is hoisted so the resolved user can populate the success\n // response's `user` (W7.3a: consumed by the anonymous-session transposition\n // trigger `handleAnonymousTransposition`, which gated on `authResult.user._id`\n // — previously always undefined, making transposition a no-op on interactive\n // login; also surfaces the user's own context to the frontend on login).\n let currentUser: User | null = null;\n if (session.userId) {\n currentUser = await this.userLookup.findUserById(ec, session.userId);\n if (!currentUser || currentUser.status !== UserStatus.ACTIVE) {\n await this.updateSession(request.sessionId, { state: AuthenticationSessionState.FAILED });\n this._enforceUserStatus(currentUser || { status: UserStatus.DELETED } as User, request.sessionId);\n }\n\n // W3.1b: Validate user-type membership — user's userTypes[] must include the session's activeUserType\n if (session.activeUserType && currentUser) {\n const userTypes = (currentUser as User & { userTypes?: string[] }).userTypes ?? [];\n if (!userTypes.includes(session.activeUserType)) {\n await this.updateSession(request.sessionId, { state: AuthenticationSessionState.FAILED });\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_TYPE_MISMATCH,\n context: { activeUserType: session.activeUserType }, // diagnostic (log-only)\n });\n }\n }\n }\n\n // W2.2 + W3.1 + AUTH-14: Password expiry check with org overrides\n const sessionAuthPolicy = session.userId\n ? await this._resolveAuthPolicyWithOrgOverrides(ec, session.activeUserType, session.userId)\n : this._resolveAuthPolicyFromSession(session);\n const expiryDays = sessionAuthPolicy.passwordPolicy?.expiryDays ?? 0;\n if (expiryDays > 0 && session.userId) {\n const expired = await this.credentialOps.isPasswordExpired(ec, session.userId, expiryDays);\n if (expired) {\n await this.updateSession(request.sessionId, { state: AuthenticationSessionState.PASSWORD_EXPIRED });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_PASSWORD_EXPIRED,\n context: { sessionId: request.sessionId, reason: 'PASSWORD_EXPIRED' },\n });\n }\n }\n\n const tokens = await this.tokenIssuer.issueTokens(session, {\n includeRefreshToken: true,\n lastAuthenticatedAt: Math.floor(Date.now() / 1000),\n });\n\n // Update session to completed\n await this.updateSession(request.sessionId, { state: AuthenticationSessionState.COMPLETED });\n\n // Get final session for audit log\n const finalSession = await this.getSession(request.sessionId);\n const completedFactors = finalSession?.completedFactors || session.completedFactors || [];\n\n // Audit log successful authentication (TRAP 13)\n const deviceInfo = finalSession?.deviceInfo;\n if (finalSession?.userId) {\n // F4 per-org SIEM routing — route ONLY on the user's VERIFIED ACTIVE member orgs.\n // `finalSession.userId` is the post-credential-success server-resolved id.\n const routingOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, finalSession.userId);\n // Domain ownership is held separately in `scopeType` + `scopeId` and is never\n // forwarded as audit routing. Routing uses verified active memberships only.\n await this.auditLogsService.logUserLogin({\n userId: finalSession.userId,\n email: finalSession.email || 'unknown',\n authMethod: request.method,\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n sessionId: request.sessionId,\n }, ec, routingOrgIds);\n }\n\n // Clean up session after successful authentication\n await this.removeSession(request.sessionId);\n\n return this._buildAuthenticationSuccessMethod(\n request.sessionId,\n request.factorLevel,\n request.method,\n tokens.accessToken,\n {\n refreshToken: tokens.refreshToken,\n completedFactors,\n user: currentUser ?? undefined,\n },\n );\n } else {\n // Method succeeded but overall auth is not complete (e.g., MFA required)\n return authResponse;\n }\n }\n\n return authResponse;\n }\n\n // ===============================\n // PUBLIC API: SESSION STATE\n // ===============================\n\n /**\n * Get the current state of an authentication session.\n *\n * TRAP 2 (async change): This method is now async because Redis lookups are Promise-based.\n * The controller must add `await` to this call — this is the one allowed controller modification.\n */\n public async getAuthenticationSessionState(ec: ExecutionContext<any>, sessionId: string): Promise<AuthenticationSession | null> {\n const session = await this.getSession(sessionId);\n if (!session) {\n return null;\n }\n // Return a copy to avoid external modifications\n return { ...session };\n }\n\n // ===============================\n // EMAIL OTP AUTHENTICATION (Step 10)\n // ===============================\n\n /**\n * Send an Email OTP to the user's email address.\n *\n * Called from the auth controller (POST /auth/mfa/email-otp/send).\n * Generates a 6-digit OTP, stores it as a consumable token, and returns\n * the session state. The actual email sending is done by the controller.\n *\n * Rate limiting: Redis INCR with TTL. Values from config.auth.otpOperational.\n */\n public async sendEmailOTP(ec: ExecutionContext<any>, sessionId: string): Promise<{\n otpToken: string;\n submissionId: string;\n email: string;\n expiryMinutes: number;\n }> {\n const session = await this.getSession(sessionId);\n if (!session) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,\n context: { sessionId },\n });\n }\n\n // Must have completed first factor before MFA\n if (session.state !== AuthenticationSessionState.FIRST_FACTOR_COMPLETED &&\n session.state !== AuthenticationSessionState.MFA_REQUIRED) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_FIRST_FACTOR_REQUIRED,\n });\n }\n\n // Policy pre-flight: EMAIL_OTP must be a USABLE second factor for this session.\n //\n // The state check above is not sufficient on its own. `_updateSessionAfterSuccessfulAuth` already\n // refuses to COMPLETE a second factor outside `usableSecondFactorMethods` (the `requireStrongMFA`\n // backstop), so an OTP minted here for a strong-MFA-only user could never authenticate — but without\n // this gate the code was still generated, stored, AND EMAILED. That let any party holding a\n // first-factor-complete session push unsolicited OTP mail to the user (bounded only by the per-user\n // send cap below), and it advertised a second factor the session cannot actually use.\n //\n // The condition MIRRORS the completion guard exactly, including its fail-open-on-empty semantics: an\n // empty `usableSecondFactorMethods` means \"no second-factor policy resolved for this session\" (MFA not\n // required, or the session was routed to enrollment — a state this endpoint already rejects), not\n // \"nothing is allowed\". Keeping the two conditions identical is deliberate: a session that would be\n // refused at completion is now refused at send, with the SAME ErrorType + customMessageReference, so\n // the policy has one meaning across both seams rather than two subtly different ones.\n const usableSecondFactorMethods = session.usableSecondFactorMethods;\n if (usableSecondFactorMethods && usableSecondFactorMethods.length > 0\n && !usableSecondFactorMethods.includes(AuthMethod.EMAIL_OTP)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_METHOD_NOT_SUPPORTED,\n context: { method: AuthMethod.EMAIL_OTP, sessionId, reason: 'METHOD_NOT_IN_USABLE_LIST' },\n });\n }\n\n const email = session.email;\n if (!email) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_NO_EMAIL,\n });\n }\n\n const userId = session.userId;\n if (!userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_NO_USER,\n });\n }\n\n // Step 7 F-23 sub-PR a (rate-limit unification, 2026-04-20): MIGRATED\n // from `redisService.incrementRateLimit` + inline INCR-then-throw to\n // `RateLimitBackendService.checkRateLimit` (the K-3 escape-hatch\n // surface). The atomic-incr-then-throw shape is structurally identical\n // — same Redis primitive, same `ErrorType.RATE_LIMIT`, same\n // `retryAfterSeconds: 60`, same per-userId bucket key — so this is a\n // 1:1 mechanical migration with NO behavior change. The custom\n // user-facing message is preserved via the `messageOverride` parameter\n // added to `checkRateLimit` in this same step (existing OTP UX\n // depended on the OTP-specific phrasing, not the generic rate-limit\n // message).\n //\n // K-3 ESCAPE-HATCH JUSTIFICATION (matches PR 8d/8e reasoning): the\n // bucket key is the session-resolved `userId`, not an HTTP-derived\n // identifier — `controller.mfaEmailOTPSend` reads only the session\n // cookie and forwards to this orchestrator method, so no per-request\n // identity exists at the HTTP seam that would let `checkPolicy` derive\n // the bucket. Lifting to the controller would require either (a)\n // resolving the session in the controller pre-`checkPolicy` (defeats\n // F-22 fail-fast — session resolution is more expensive than the\n // rate-limit check), or (b) IP-keying the cap (semantically wrong:\n // the policy is \"5 OTP sends per minute per USER\", not per-IP — a\n // user behind a corporate NAT with multiple devices would share the\n // cap; an attacker on a botnet would bypass it). The later lockout\n // migration closed the final F-23 site, so this email-OTP cap is now\n // one of four deliberate K-3 `checkRateLimit` callers.\n const rateLimitKey = `${AUTH_REDIS_KEYS.EMAIL_OTP}${userId}:email_otp`;\n await this.rateLimitService.checkRateLimit(\n rateLimitKey,\n this.otpConfig.emailOtp.rateLimitPerMinute,\n 60,\n undefined,\n 'Too many OTP requests. Please wait before requesting another code.',\n );\n\n // Revoke any existing EMAIL_OTP tokens for this user to ensure only one valid OTP at a time\n await this.consumableTokenService.revokeTokensByRelatedId(userId, CoreConsumableTokenTypes.EMAIL_OTP);\n\n // Generate OTP — cryptographically random N-digit code\n const otpLength = this.otpConfig.emailOtp.otpLength;\n const otpCode = this._generateOTP(otpLength);\n\n // Store as consumable token (SINGLE_USE, configurable TTL)\n const expiryMinutes = this.otpConfig.emailOtp.expiryMinutes;\n const createdOtpToken = await this.consumableTokenService.createToken({\n tokenType: CoreConsumableTokenTypes.EMAIL_OTP,\n consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n expiresIn: { value: expiryMinutes, unit: DurationUnit.MINUTES },\n userId: userId,\n resourceIdentifier: CoreResourceType.USERS,\n relatedId: userId,\n metadata: {\n otpCode,\n sessionId,\n email,\n },\n });\n\n // Update session to MFA_REQUIRED state\n await this.updateSession(sessionId, {\n state: AuthenticationSessionState.MFA_REQUIRED,\n currentFactor: AuthFactorLevel.SECOND,\n });\n\n this.logDebug('Email OTP generated and stored', { sessionId, userId });\n\n return {\n otpToken: otpCode,\n submissionId: String(createdOtpToken._id),\n email,\n expiryMinutes,\n };\n }\n\n /**\n * Verify an Email OTP code submitted by the user.\n *\n * Called from authenticate() dispatch when method=EMAIL_OTP,\n * or directly from the auth controller (POST /auth/mfa/email-otp/verify).\n */\n public async authenticateEmailOTP(ec: ExecutionContext<any>, request: EmailOTPAuthRequest): Promise<AuthenticationServiceResult> {\n const { sessionId, token } = request;\n\n const session = await this.getSession(sessionId);\n if (!session) {\n return this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.SECOND, { retryAllowed: false });\n }\n\n // Must be in MFA_REQUIRED, SECOND_FACTOR_IN_PROGRESS, or FIRST_FACTOR_COMPLETED state.\n // FIRST_FACTOR_COMPLETED is accepted because the MFA flow may not have explicitly\n // transitioned to MFA_REQUIRED yet (consistent with TOTP which has no \"send\" step).\n if (session.state !== AuthenticationSessionState.MFA_REQUIRED &&\n session.state !== AuthenticationSessionState.SECOND_FACTOR_IN_PROGRESS &&\n session.state !== AuthenticationSessionState.FIRST_FACTOR_COMPLETED) {\n return this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.SECOND, {\n retryAllowed: true,\n });\n }\n\n if (!token) {\n return this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.SECOND, {\n retryAllowed: true,\n authMethod: AuthMethod.EMAIL_OTP,\n });\n }\n\n // Update session to in-progress\n await this.updateSession(sessionId, {\n state: AuthenticationSessionState.SECOND_FACTOR_IN_PROGRESS,\n currentFactor: AuthFactorLevel.SECOND,\n });\n\n const userId = session.userId;\n if (!userId) {\n return this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.SECOND, { retryAllowed: false });\n }\n\n // Find matching consumable token by looking up EMAIL_OTP tokens for this user.\n // We verify the OTP code matches the stored metadata.\n const isValid = await this._verifyEmailOTP(userId, sessionId, token);\n\n if (!isValid) {\n const { locked } = await this.incrementSessionAttempts(ec, sessionId);\n\n // Audit log MFA failure\n const deviceInfo = session.deviceInfo;\n await this.auditLogsService.logUserLoginFailed({\n email: session.email || 'unknown',\n authMethod: AuthMethod.EMAIL_OTP,\n failureReason: 'Invalid OTP code',\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n attemptsRemaining: session.maxAttempts - session.attempts - 1,\n sessionId,\n });\n\n return this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.SECOND, {\n authMethod: AuthMethod.EMAIL_OTP,\n retryAllowed: !locked,\n });\n }\n\n // OTP verified — update session\n await this._updateSessionAfterSuccessfulAuth(ec, sessionId, userId, AuthMethod.EMAIL_OTP);\n\n const updatedSession = await this.getSession(sessionId);\n return this._buildAuthenticationSuccessMethod(\n sessionId,\n AuthFactorLevel.SECOND,\n AuthMethod.EMAIL_OTP,\n '', // Tokens issued by authenticate() after completion check\n { completedFactors: updatedSession?.completedFactors || [] },\n );\n }\n\n /**\n * Verify the OTP code against stored consumable tokens for this user and session.\n * Attempts to consume the token atomically to prevent replay.\n */\n private async _verifyEmailOTP(userId: string, sessionId: string, code: string): Promise<boolean> {\n try {\n // Find unconsumed EMAIL_OTP tokens for this user\n const tokens = await this.consumableTokenService.findTokensByRelatedId(\n userId,\n CoreConsumableTokenTypes.EMAIL_OTP,\n );\n\n for (const tokenDoc of tokens) {\n const metadata = tokenDoc.metadata as Record<string, unknown> | undefined;\n if (!metadata?.otpCode || !metadata?.sessionId) continue;\n\n // L1 fix: constant-time comparison to prevent timing side-channel on OTP\n const storedCode = String(metadata.otpCode);\n const storedSession = String(metadata.sessionId);\n if (storedCode.length !== code.length || storedSession.length !== sessionId.length) continue;\n\n const codeMatch = crypto.timingSafeEqual(Buffer.from(storedCode), Buffer.from(code));\n const sessionMatch = crypto.timingSafeEqual(Buffer.from(storedSession), Buffer.from(sessionId));\n\n if (codeMatch && sessionMatch) {\n // Consume the token atomically\n try {\n await this.consumableTokenService.consumeToken(tokenDoc.token);\n return true;\n } catch {\n // Token already consumed or expired — try next\n continue;\n }\n }\n }\n\n return false;\n } catch (error) {\n if (isWildoBackendError(error)) {\n throw error;\n }\n this.logger.error('Failed to verify Email OTP', {\n userId,\n sessionId,\n ...projectCaughtErrorLogFields(error),\n });\n return false;\n }\n }\n\n // ===============================\n // TOTP AUTHENTICATION (Step 11)\n // ===============================\n\n /**\n * Verify a TOTP code submitted by the user.\n *\n * Called from authenticate() dispatch when method=TOTP.\n * Reads the user's verified TOTP secret from their credential record,\n * validates the code using the otpauth library.\n */\n public async authenticateTOTP(ec: ExecutionContext<any>, request: TOTPAuthRequest): Promise<AuthenticationServiceResult> {\n const { sessionId, token } = request;\n\n const session = await this.getSession(sessionId);\n if (!session) {\n return this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.SECOND, { retryAllowed: false });\n }\n\n // Must be in MFA_REQUIRED or SECOND_FACTOR_IN_PROGRESS state\n if (session.state !== AuthenticationSessionState.MFA_REQUIRED &&\n session.state !== AuthenticationSessionState.SECOND_FACTOR_IN_PROGRESS &&\n session.state !== AuthenticationSessionState.FIRST_FACTOR_COMPLETED) {\n return this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.SECOND, {\n retryAllowed: true,\n });\n }\n\n // Update session to in-progress\n await this.updateSession(sessionId, {\n state: AuthenticationSessionState.SECOND_FACTOR_IN_PROGRESS,\n currentFactor: AuthFactorLevel.SECOND,\n });\n\n const userId = session.userId;\n if (!userId) {\n return this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.SECOND, { retryAllowed: false });\n }\n\n // The TOTP / backup-code verification itself — including anti-replay and the constant-time\n // backup-code fallback — lives in `AuthMfaBackendService.verifyEnrolledSecondFactor`, shared\n // with step-up re-authentication. It was inlined here until 2026-08-06; duplicating it for the\n // second caller would have created a second, weaker door onto the same credential. This method\n // keeps everything that is genuinely login-specific: session state, attempt counting and the\n // login-failed audit event.\n const verification = await this.authMfaService.verifyEnrolledSecondFactor(ec, userId, token);\n\n if (verification.notEnrolled) {\n return this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.SECOND, {\n authMethod: AuthMethod.TOTP,\n retryAllowed: true,\n });\n }\n\n const usedBackupCode = verification.usedBackupCode;\n\n if (!verification.valid) {\n const { locked } = await this.incrementSessionAttempts(ec, sessionId);\n\n // Audit log MFA failure\n const deviceInfo = session.deviceInfo;\n await this.auditLogsService.logUserLoginFailed({\n email: session.email || 'unknown',\n authMethod: AuthMethod.TOTP,\n failureReason: 'Invalid TOTP code',\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n attemptsRemaining: session.maxAttempts - session.attempts - 1,\n sessionId,\n });\n\n return this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.SECOND, {\n authMethod: AuthMethod.TOTP,\n retryAllowed: !locked,\n });\n }\n\n // TOTP verified — update session\n await this._updateSessionAfterSuccessfulAuth(ec, sessionId, userId, AuthMethod.TOTP);\n\n const updatedSession = await this.getSession(sessionId);\n return this._buildAuthenticationSuccessMethod(\n sessionId,\n AuthFactorLevel.SECOND,\n AuthMethod.TOTP,\n '', // Tokens issued by authenticate() after completion check\n {\n completedFactors: updatedSession?.completedFactors || [],\n challengeData: usedBackupCode ? { usedBackupCode: true } : undefined,\n },\n );\n }\n\n // ===============================\n // PASSKEY AUTHENTICATION (Phase G1)\n // ===============================\n\n /**\n * Verify a WebAuthn/Passkey authentication response.\n *\n * Called from authenticate() dispatch when method=PASSKEY.\n * Supports both first factor (passwordless) and second factor (MFA) usage.\n * Delegates to WebAuthnBackendService for cryptographic verification.\n */\n public async authenticatePasskey(ec: ExecutionContext<any>, request: PasskeyAuthRequest): Promise<AuthenticationServiceResult> {\n const { sessionId, factorLevel, response } = request;\n\n const session = await this.getSession(sessionId);\n if (!session) {\n return this.__buildAuthenticationErrorMethod(sessionId, factorLevel, { retryAllowed: false });\n }\n\n // State machine guard — valid states depend on factor level\n const validStates = factorLevel === AuthFactorLevel.FIRST\n ? new Set([AuthenticationSessionState.IDENTIFIED, AuthenticationSessionState.FIRST_FACTOR_IN_PROGRESS])\n : new Set([AuthenticationSessionState.MFA_REQUIRED, AuthenticationSessionState.SECOND_FACTOR_IN_PROGRESS, AuthenticationSessionState.FIRST_FACTOR_COMPLETED]);\n\n if (!validStates.has(session.state)) {\n return this.__buildAuthenticationErrorMethod(sessionId, factorLevel, {\n authMethod: AuthMethod.PASSKEY,\n retryAllowed: true,\n });\n }\n\n const userId = session.userId;\n if (!userId) {\n return this.__buildAuthenticationErrorMethod(sessionId, factorLevel, { retryAllowed: false });\n }\n\n // Update session to in-progress\n await this.updateSession(sessionId, {\n state: factorLevel === AuthFactorLevel.FIRST\n ? AuthenticationSessionState.FIRST_FACTOR_IN_PROGRESS\n : AuthenticationSessionState.SECOND_FACTOR_IN_PROGRESS,\n currentFactor: factorLevel,\n });\n\n // Delegate to WebAuthn service for cryptographic verification\n let verified = false;\n let credentialId = response.id;\n let cloneSuspicion: PasskeyAuthenticationVerificationResult['cloneSuspicion'];\n try {\n const result = await this.webAuthnService.verifyAuthenticationResponse(ec, userId, response as any);\n verified = result.verified;\n credentialId = result.credentialId;\n cloneSuspicion = result.cloneSuspicion;\n } catch (error) {\n this.logger.warn('WebAuthn verification threw an error', {\n userId,\n sessionId,\n ...projectCaughtErrorLogFields(error),\n });\n verified = false;\n }\n\n if (!verified) {\n const { locked } = await this.incrementSessionAttempts(ec, sessionId);\n\n // Audit log passkey auth failure\n const deviceInfo = session.deviceInfo;\n await this.auditLogsService.logUserPasskeyAuthFailure({\n email: session.email || 'unknown',\n // Named, not generic. Every refusal used to record the same string, so the one cause worth\n // alerting on was byte-identical to a wrong credential or an expired challenge.\n failureReason: cloneSuspicion ? 'passkey_signature_counter_regression' : 'WebAuthn verification failed',\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n sessionId,\n });\n\n /*\n * A verified assertion whose counter did not advance gets its OWN CRITICAL row, in addition\n * to the ordinary failure above — the failure event is what the lockout and rate-limit story\n * reads and must keep its shape, while this one is what a SOC alerts on.\n *\n * Reachable only after signature verification (the service refuses to evaluate the counter\n * before it), so this row cannot be forged by someone who merely knows a credential id.\n */\n if (cloneSuspicion) {\n await this.auditLogsService.logUserPasskeyCloneSuspected({\n userId,\n credentialId: cloneSuspicion.credentialId,\n storedCounter: cloneSuspicion.storedCounter,\n receivedCounter: cloneSuspicion.receivedCounter,\n credentialDeviceType: cloneSuspicion.credentialDeviceType,\n credentialBackedUp: cloneSuspicion.credentialBackedUp,\n ...(cloneSuspicion.aaguid ? { aaguid: cloneSuspicion.aaguid } : {}),\n ceremony: cloneSuspicion.ceremony,\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n });\n }\n\n return this.__buildAuthenticationErrorMethod(sessionId, factorLevel, {\n authMethod: AuthMethod.PASSKEY,\n retryAllowed: !locked,\n });\n }\n\n // Passkey verified — audit log success\n const deviceInfo = session.deviceInfo;\n // F4 per-org SIEM routing — route ONLY on the user's VERIFIED ACTIVE member orgs. `userId` is\n // the WebAuthn-verified session userId (server-resolved), never a request-supplied value.\n const routingOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, userId);\n await this.auditLogsService.logUserPasskeyAuthSuccess({\n userId: userId,\n email: session.email || 'unknown',\n credentialId,\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n sessionId,\n }, ec, routingOrgIds);\n\n // C1 fix: Reset global lockout counter on successful authentication\n if (session.email) {\n await this._resetGlobalAttempts(session.email);\n }\n\n // Update session state\n await this._updateSessionAfterSuccessfulAuth(ec, sessionId, userId, AuthMethod.PASSKEY);\n\n const updatedSession = await this.getSession(sessionId);\n return this._buildAuthenticationSuccessMethod(\n sessionId,\n factorLevel,\n AuthMethod.PASSKEY,\n '', // Tokens issued by authenticate() after completion check\n {\n completedFactors: updatedSession?.completedFactors || [],\n requiresMFA: updatedSession?.requiresMFA || false,\n availableMFAMethods: updatedSession?.availableSecondFactorMethods || [],\n mfaMethodsRequired: updatedSession?.mfaMethodsRequired,\n },\n );\n }\n\n // ===============================\n // MFA HELPERS\n // ===============================\n\n /**\n * Determine if MFA is required for this user/session after first-factor success.\n *\n * M12+M13: the effective policy folds in org-level overrides — but that resolution happens in the\n * CALLER (`_resolveAuthPolicyWithOrgOverrides(ec, activeUserType, userId)`), keyed on the VERIFIED\n * `userId`, and arrives here pre-merged in `authPolicy`. This method therefore takes NO org id: the\n * decision is a pure function of `authPolicy` + the user's enrolled credentials. (A dead\n * Scope hints are intentionally excluded: an email-domain ownership match cannot authorize MFA.\n * See the `session-org-trust-sweep-audit` plan.)\n * Effective policy = max(app_policy, org_policy) — org can only tighten, never weaken.\n *\n * Returns true if:\n * - The effective policy requires MFA for all users, OR\n * - The effective policy requires MFA for admins, OR\n * - The effective policy's minimum auth level is 'mfa' or 'sso', OR\n * - The user has enrolled a verified TOTP secret (user opted in to MFA)\n */\n private async _shouldRequireMFA(ec: ExecutionContext<any>, userId: string, firstFactorMethod?: AuthMethod, authPolicy?: UserTypeAuthPolicy): Promise<{ required: boolean; enrolledMethods: AuthMethod[] }> {\n const policy = authPolicy ?? AuthenticationOrchestratorBackendService.FALLBACK_AUTH_POLICY;\n const mfaPolicy = policy.mfaPolicy;\n const NOT_REQUIRED = { required: false, enrolledMethods: [] as AuthMethod[] };\n\n // G1 + W2.5: Passkey exemption — passkeys are multi-factor by nature (possession + biometric/PIN).\n if (firstFactorMethod === AuthMethod.PASSKEY) {\n const passkeyExemptFromMFA = mfaPolicy?.passkeyExemptFromMFA ?? true;\n if (passkeyExemptFromMFA) {\n return NOT_REQUIRED;\n }\n }\n\n const policyRequiresMFA = !!mfaPolicy?.requireMFA;\n\n try {\n const cred = await this.credentialOps.readByUserId(ec, userId);\n\n const enrolledMethods = AuthUtils.getEnrolledSecondFactorMethods(cred);\n\n if (policyRequiresMFA) {\n const hasStrongSecondFactor = enrolledMethods.some(\n (m) => m !== AuthMethod.EMAIL_OTP,\n );\n\n if (hasStrongSecondFactor) {\n if (cred && cred.mfaEnrollmentState !== MfaEnrollmentState.ENROLLED) {\n await this.credentialOps.updateById(ec, cred._id, { mfaEnrollmentState: MfaEnrollmentState.ENROLLED } as Partial<UserCredentials>);\n }\n return { required: true, enrolledMethods };\n }\n\n const graceDays = mfaPolicy?.enrollmentGracePeriodDays ?? 0;\n if (graceDays > 0 && cred) {\n if (!cred.firstMfaPromptAt) {\n await this.credentialOps.updateById(ec, cred._id, { firstMfaPromptAt: new Date(), mfaEnrollmentState: MfaEnrollmentState.GRACE } as Partial<UserCredentials>);\n } else if (cred.mfaEnrollmentState !== MfaEnrollmentState.GRACE) {\n await this.credentialOps.updateById(ec, cred._id, { mfaEnrollmentState: MfaEnrollmentState.GRACE } as Partial<UserCredentials>);\n }\n\n const graceStart = cred.firstMfaPromptAt ?? new Date();\n const graceEnd = new Date(graceStart.getTime() + graceDays * 86_400_000);\n if (new Date() < graceEnd) {\n return NOT_REQUIRED;\n }\n\n await this.credentialOps.updateById(ec, cred._id, { mfaEnrollmentState: MfaEnrollmentState.PENDING } as Partial<UserCredentials>);\n }\n\n return { required: true, enrolledMethods };\n }\n\n if (cred?.totpVerified) {\n return { required: true, enrolledMethods };\n }\n } catch {\n if (policyRequiresMFA) {\n return { required: true, enrolledMethods: [] };\n }\n }\n\n return NOT_REQUIRED;\n }\n\n // ===============================\n // AUTH POLICY MERGE (M13)\n // ===============================\n\n // W2.10: _mergeAuthPolicies removed — the runtime AuthPolicyBase resource has since been removed.\n // All MFA requirements now come solely from config (mfaPolicy).\n\n // ===============================\n // SSO GRACE LOGIN TRACKING (M14)\n // ===============================\n\n /** Redis key prefix for SSO grace login counters — scope-aware format: sso_grace_logins:{scopeType}:{scopeId}:{userId} */\n\n /**\n * Read the tenant's branding for the sign-in screen (#410).\n *\n * NEVER throws. This runs on the pre-authentication identification path, so every failure mode —\n * no profile row, a profile with no branding block, a store that is momentarily unavailable —\n * resolves to `undefined` and the caller falls back to the application's brand. Letting a\n * cosmetic read refuse an identification would turn a missing logo into an outage.\n *\n * `ORGANIZATION_PROFILES` had no backend reader at all before this; the audit note on\n * `OrganizationBrandingSchema` records why, and why that reasoning was wrong.\n *\n * **Reads the REPOSITORY, not the service, and that is the difference between working and inert.**\n * `ORGANIZATION_PROFILES`'s default READ variant requires `ORG_MEMBER`, and an identification\n * request carries no roles at all — it is what happens BEFORE anyone is authenticated. Going\n * through `servicesRegistryHandler.read` would therefore be refused by the operation pipeline,\n * the refusal would be swallowed by the catch below, and the tenant's logo would silently never\n * appear while every test stayed green. This is a SYSTEM read on the system's own behalf, to\n * decorate a login screen; the repository is where a system read belongs. Same shape as the\n * notifications dispatcher reading a recipient's preferences.\n */\n private async readOrganizationBrandingForIdentification(\n ec: ExecutionContext<any>,\n organizationId: string,\n ): Promise<OrganizationBranding | undefined> {\n try {\n const repository = this.repositoriesRegistry.getRepository(CoreResourceType.ORGANIZATION_PROFILES);\n const profile = await repository?.read<{ branding?: OrganizationBranding }>(ec, { organizationId });\n return profile?.branding ?? undefined;\n } catch {\n this.logger.warn('Organization branding lookup failed (non-fatal, falling back to application brand)', { organizationId });\n return undefined;\n }\n }\n\n /**\n * M14: Check if password login is allowed under SSO grace policy.\n * If the scope requires SSO and grace logins are exhausted, throws AUTHENTICATION error.\n *\n * ## Runs AFTER the credential is verified\n *\n * See the note at the `authenticatePassword` call site. Two consequences for anyone editing this:\n * `email` is the address of a user whose password has been checked — never a caller-supplied\n * claim — and every refusal here is one a caller could only reach by knowing that password.\n *\n * ## The break-glass exemption (#423)\n *\n * A named account in `emergencyAccess.breakGlassAccounts` is exempt from this refusal, including\n * grace exhaustion, and from nothing else: same password, same lockout counters, same rate limits.\n * Every use emits `EMERGENCY_ACCESS_USED` at CRITICAL, which is the control that makes a standing\n * bypass acceptable at all — Microsoft Entra's emergency-access guidance asks for an alert on\n * every sign-in of such an account and a post-mortem after each one, and the alert is the half a\n * framework can provide.\n *\n * The emit is best-effort and never blocks the sign-in. That is deliberate and it is the same\n * trade every audit emission on this path makes: refusing a break-glass sign-in because the audit\n * store is unavailable would take the door away during exactly the outage it exists for.\n */\n private async _checkSSOGraceLoginAllowed(\n ec: ExecutionContext<any>,\n scopeType: AuthScopeType,\n scopeId: string,\n userId: string,\n email?: string,\n provenance?: { sessionId: string; ipAddress: string; userAgent: string },\n ): Promise<void> {\n try {\n const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n if (!ssoConfig) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SSO_REQUIRED,\n });\n }\n\n const { enforcement } = ssoConfig;\n if (!enforcement.requireSSO) return;\n\n /*\n * Checked before every refusal below, and before the grace counter — a break-glass account is\n * exempt from the whole policy, not merely from running out of attempts. Placed after the\n * `requireSSO` early return so an ordinary tenant emits nothing.\n */\n if (isBreakGlassAccount(ssoConfig.emergencyAccess, email)) {\n /*\n * Recorded under whichever scope the policy belongs to.\n *\n * `emergencyAccess` lives on the POLYMORPHIC SSO config, so an APPLICATION-scope policy\n * names break-glass accounts for the application itself. This branch REFUSED that case for\n * one release, because `EMERGENCY_ACCESS_USED` required an `organizationId` and admitting\n * an unrecordable bypass is the one outcome the mechanism exists to prevent. The event now\n * carries either scope and refuses anything but exactly one, so the refusal is gone and the\n * use is audited either way.\n */\n void this.auditLogsService?.logEmergencyAccessUsed({\n userId,\n email: email!,\n scopeType,\n ...(scopeType === AuthScopeType.ORGANIZATION\n ? { organizationId: scopeId }\n : { applicationId: scopeId }),\n ipAddress: provenance?.ipAddress ?? '',\n userAgent: provenance?.userAgent ?? '',\n sessionId: provenance?.sessionId ?? '',\n })?.catch((error: unknown) => {\n this.logger.warn('Emergency-access audit emit failed (sign-in allowed)', {\n scopeType,\n scopeId,\n ...projectCaughtErrorLogFields(error),\n });\n });\n return;\n }\n\n if (!enforcement.allowPasswordFallback) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SSO_REQUIRED,\n });\n }\n\n const maxGrace = enforcement.graceLoginAttempts;\n if (maxGrace <= 0) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SSO_REQUIRED,\n });\n }\n\n if (!userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SSO_REQUIRED,\n });\n }\n\n // rate-limit-relaxation: N/A — `graceLoginAttempts` is a TENANT POLICY, not an abuse\n // throttle. Relaxing it in DEVELOPMENT/TEST would make local runs disagree with the\n // configured product semantics (SSO enforcement would appear never to bite), which is\n // the opposite of the relaxation's purpose. See\n // `rate-limit-environment-relaxation.backend.utils`.\n const identifier = `${AUTH_REDIS_KEYS.SSO_GRACE_LOGINS}${scopeType}:${scopeId}:${userId}`;\n let currentCount: number;\n try {\n currentCount = await this.redisService.getRateLimitCount(identifier);\n } catch (error) {\n this.logDebug('SSO grace login count read failed (fail-closed)', {\n scopeType,\n scopeId,\n userId,\n ...projectCaughtErrorLogFields(error),\n });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SSO_REQUIRED,\n });\n }\n\n if (currentCount >= maxGrace) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SSO_REQUIRED,\n context: {\n // diagnostic (log-only)\n graceLoginsUsed: currentCount,\n graceLoginsMax: maxGrace,\n },\n });\n }\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n this.logDebug('SSO grace login check failed (fail-closed)', {\n scopeType,\n scopeId,\n userId,\n ...projectCaughtErrorLogFields(error),\n });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SSO_REQUIRED,\n });\n }\n }\n\n /** 1 year in seconds — effectively permanent for grace counter, but avoids orphaned keys */\n private static readonly SSO_GRACE_TTL_SECONDS = 365 * 24 * 60 * 60;\n\n /**\n * M14: Atomically increment SSO grace login counter after successful password auth.\n * Uses Redis INCR (via incrementRateLimit) for atomic increment — no TOCTOU race.\n * TTL is 1 year (effectively permanent but avoids orphaned keys if scope config changes).\n */\n private async _incrementSSOGraceLogin(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string, userId: string): Promise<void> {\n try {\n const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n if (!ssoConfig) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SSO_REQUIRED,\n });\n }\n if (!ssoConfig.enforcement.requireSSO) return;\n\n const identifier = `${AUTH_REDIS_KEYS.SSO_GRACE_LOGINS}${scopeType}:${scopeId}:${userId}`;\n const newCount = await this.redisService.incrementRateLimit(\n identifier,\n AuthenticationOrchestratorBackendService.SSO_GRACE_TTL_SECONDS,\n );\n\n if (newCount > ssoConfig.enforcement.graceLoginAttempts) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SSO_REQUIRED,\n context: {\n // diagnostic (log-only)\n graceLoginsUsed: newCount,\n graceLoginsMax: ssoConfig.enforcement.graceLoginAttempts,\n },\n });\n }\n\n this.logDebug('SSO grace login counter incremented', {\n scopeType,\n scopeId,\n userId,\n graceLoginsUsed: newCount,\n graceLoginsMax: ssoConfig.enforcement.graceLoginAttempts,\n });\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n this.logDebug('SSO grace login counter increment failed (fail-closed)', {\n scopeType,\n scopeId,\n userId,\n ...projectCaughtErrorLogFields(error),\n });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SSO_REQUIRED,\n });\n }\n }\n\n // ===============================\n // MAGIC LINK (Phase G2)\n // ===============================\n\n /**\n * Send a magic link email to the user.\n * Anti-enumeration: always returns success regardless of whether the user exists.\n * Rate limited per email.\n */\n public async sendMagicLink(ec: ExecutionContext<any>, request: MagicLinkSendRequest, deviceInfo?: { ipAddress?: string; userAgent?: string }, skipGlobalEnablementCheck = false): Promise<{\n success: true;\n token?: string;\n submissionId?: string;\n email?: string;\n userId?: string;\n expiresInMinutes?: number;\n }> {\n // The GLOBAL enablement check is a coarse PRE-identification guard for the login flow (the user\n // type is unknown there — it asks \"does ANY base user-type enable MAGIC_LINK\"). Callers that have\n // ALREADY authorized MAGIC_LINK against a precise, org-EXPANDED policy for a KNOWN user type — the\n // invitation accept — pass `skipGlobalEnablementCheck`. Otherwise an org that opts into MAGIC_LINK\n // only via `authOverrides` (EXPAND_WITHIN_SET / UNRESTRICTED, with no base user-type enabling it)\n // would pass the accept guard but be rejected HERE, AFTER the accept activated the invitee +\n // flipped the membership + consumed the token — stranding them (ACTIVE member, no credential, no\n // session, no retry). The org-expanded policy is the authoritative source for that path.\n if (!skipGlobalEnablementCheck && !this._isMethodEnabledGlobally(AuthMethod.MAGIC_LINK)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_MAGIC_LINK_DISABLED,\n });\n }\n\n const { email } = request;\n\n // PR 8b (rate-limit unification, Step 5 — Option D, second\n // service-layer lift): the dual-window per-email burst caps\n // (formerly `${AUTH_REDIS_KEYS.MAGIC_LINK_MIN}${email}:min` AND\n // `:hour`, both raw `checkRateLimit`) moved UP to\n // `AuthenticationController.magicLinkSend` as a single multi-\n // window declarative `checkPolicy` companion to the existing\n // per-IP cap. Bucket keys (email, IP) are HTTP-layer artefacts\n // (`request.email` is the raw body field, not session-stored\n // state) so the K-3 escape-hatch does NOT apply — the lift is\n // the framework-canonical outcome. See plan body for the full\n // Option D analysis. Net upgrade for clients: 429 responses\n // now emit `X-RateLimit-*` and `Retry-After` headers (previously\n // absent at this seam).\n\n // Look up the user (same pattern as identify())\n let user: User | null = null;\n try {\n user = await this.userLookup.findUserByEmail(ec, email);\n } catch {\n // Suppress — anti-enumeration (also covers non-active users)\n }\n\n // Audit the send (even if user doesn't exist or is inactive)\n await this.auditLogsService.logMagicLinkSent({\n email,\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n });\n\n // If user doesn't exist or is not active, return success silently (anti-enumeration)\n if (!user) {\n return { success: true };\n }\n\n const userId = user._id;\n\n // AUTH-24: refuse to ISSUE a login magic link to a directory-managed user — MAGIC_LINK is derived OFF\n // their effective policy (a local first-factor that bypasses the IdP). Silent success (no token issued)\n // keeps the response shape identical to the no-such-user branch above (anti-enumeration). Gated on\n // `!skipGlobalEnablementCheck` so the invitation-accept ESTABLISHMENT path is unaffected — that path is\n // already governed by the accept-time credential guard, and skipping here avoids stranding a legitimate\n // non-managed invitee. `verifyMagicLink` is the hard backstop for any link issued out-of-band.\n if (!skipGlobalEnablementCheck) {\n const sendPolicy = await this.userLookup.resolveEffectiveAuthPolicy(ec, userId, user.userTypes?.[0] ?? '');\n if (sendPolicy && !getEnabledMethods(sendPolicy.authMethodsEnabled).has(AuthMethod.MAGIC_LINK)) {\n return { success: true };\n }\n }\n\n // Revoke any existing MAGIC_LINK tokens for this user\n await this.consumableTokenService.revokeTokensByRelatedId(userId, CoreConsumableTokenTypes.MAGIC_LINK);\n\n // Store as consumable token (createToken auto-generates a crypto-random token value)\n const createdToken = await this.consumableTokenService.createToken({\n tokenType: CoreConsumableTokenTypes.MAGIC_LINK,\n consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n expiresIn: { value: this.magicLinkConfig.tokenExpiryMinutes, unit: DurationUnit.MINUTES },\n userId: userId,\n resourceIdentifier: CoreResourceType.USERS,\n relatedId: userId,\n metadata: { email },\n });\n\n this.logDebug('Magic link token created', { email, userId });\n\n return {\n success: true,\n token: createdToken.token,\n submissionId: String(createdToken._id),\n email,\n userId,\n expiresInMinutes: this.magicLinkConfig.tokenExpiryMinutes,\n };\n }\n\n /**\n * Verify a magic link token.\n * Returns an auth response with tokens on success.\n */\n public async verifyMagicLink(ec: ExecutionContext<any>, request: MagicLinkVerifyRequest, deviceInfo?: { ipAddress?: string; userAgent?: string }, activeUserType?: string): Promise<AuthenticationServiceResult> {\n if (!this._isMethodEnabledGlobally(AuthMethod.MAGIC_LINK)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_MAGIC_LINK_DISABLED,\n });\n }\n\n const { token } = request;\n\n // Validate the token (checks expiry, revocation, consumption)\n let validatedToken: Awaited<ReturnType<typeof this.consumableTokenService.validateToken>> | null = null;\n try {\n validatedToken = await this.consumableTokenService.validateToken(token, [CoreConsumableTokenTypes.MAGIC_LINK]);\n } catch {\n // Token invalid, expired, or already consumed\n }\n\n if (!validatedToken) {\n await this.auditLogsService.logMagicLinkFailed({\n failureReason: 'Invalid or expired magic link token',\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n });\n\n return {\n success: false,\n sessionId: '',\n userExists: false,\n factorLevel: AuthFactorLevel.FIRST,\n authMethod: AuthMethod.MAGIC_LINK,\n error: 'Invalid or expired magic link',\n errorCode: 'MAGIC_LINK_INVALID',\n retryAllowed: false,\n integrationTokens: [],\n requiresMFA: false,\n } as AuthenticationResponse;\n }\n\n // Consume the token atomically — wrap in try/catch for concurrent double-click race\n try {\n await this.consumableTokenService.consumeToken(token);\n } catch {\n // Token already consumed by concurrent request — return same error as invalid token\n await this.auditLogsService.logMagicLinkFailed({\n failureReason: 'Magic link token already consumed (concurrent request)',\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n });\n return {\n success: false,\n sessionId: '',\n userExists: false,\n factorLevel: AuthFactorLevel.FIRST,\n authMethod: AuthMethod.MAGIC_LINK,\n error: 'Invalid or expired magic link',\n errorCode: 'MAGIC_LINK_INVALID',\n retryAllowed: false,\n integrationTokens: [],\n requiresMFA: false,\n } as AuthenticationResponse;\n }\n\n const userId = validatedToken.relatedId;\n if (!userId) {\n await this.auditLogsService.logMagicLinkFailed({\n failureReason: 'Magic link token has no associated user',\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n });\n return {\n success: false,\n sessionId: '',\n userExists: false,\n factorLevel: AuthFactorLevel.FIRST,\n authMethod: AuthMethod.MAGIC_LINK,\n error: 'Invalid magic link token',\n errorCode: 'MAGIC_LINK_INVALID',\n retryAllowed: false,\n integrationTokens: [],\n requiresMFA: false,\n } as AuthenticationResponse;\n }\n const tokenMetadata = validatedToken.metadata as Record<string, unknown> | undefined;\n const email = tokenMetadata?.email as string;\n\n // Defense-in-depth: constant-time compare request email vs token email.\n // Prevents URL-tampering attacks where an attacker changes the email in the\n // magic link URL while keeping a stolen/intercepted token value.\n if (!email) {\n this.logger.warn('Magic link token metadata missing email — token integrity issue', {\n userId,\n tokenType: CoreConsumableTokenTypes.MAGIC_LINK,\n });\n await this.auditLogsService.logMagicLinkFailed({\n failureReason: 'Token metadata missing email (data integrity issue)',\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n });\n return {\n success: false,\n sessionId: '',\n userExists: false,\n factorLevel: AuthFactorLevel.FIRST,\n authMethod: AuthMethod.MAGIC_LINK,\n error: 'Invalid or expired magic link',\n errorCode: 'MAGIC_LINK_INVALID',\n retryAllowed: false,\n integrationTokens: [],\n requiresMFA: false,\n } as AuthenticationResponse;\n }\n\n const tokenEmailBuf = Buffer.from(email.toLowerCase());\n const requestEmailBuf = Buffer.from(request.email.toLowerCase());\n if (tokenEmailBuf.length !== requestEmailBuf.length || !crypto.timingSafeEqual(tokenEmailBuf, requestEmailBuf)) {\n this.logger.warn('Magic link email mismatch — possible URL tampering or token theft', {\n userId,\n requestEmail: request.email,\n });\n await this.auditLogsService.logMagicLinkFailed({\n failureReason: 'Email mismatch between request and token',\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n });\n return {\n success: false,\n sessionId: '',\n userExists: false,\n factorLevel: AuthFactorLevel.FIRST,\n authMethod: AuthMethod.MAGIC_LINK,\n error: 'Invalid or expired magic link',\n errorCode: 'MAGIC_LINK_INVALID',\n retryAllowed: false,\n integrationTokens: [],\n requiresMFA: false,\n } as AuthenticationResponse;\n }\n\n // Load the user\n let user: User | null = null;\n try {\n user = await this.userLookup.findUserById(ec, userId);\n } catch {\n // Suppress\n }\n\n /*\n * Both remaining failure arms answer with the SAME generic response every other arm of this\n * method already uses, and the reason each one refused is recorded in the audit trail instead.\n *\n * ## Why this changed\n *\n * They used to be distinguishable — `USER_NOT_FOUND` with `userExists: false`, and\n * `ACCOUNT_INACTIVE` with `userExists: true` — which told a caller holding a valid token whether\n * the account exists and whether it is usable. That contradicted the two nearest surfaces in the\n * same flow family, and the contradiction was the defect rather than the disclosure's size:\n *\n * - the magic-link SEND leg refuses silently for a non-ACTIVE user, so no fresh link can even\n * be obtained for one;\n * - `AuthPasswordResetBackendService.completePasswordReset` — the true peer, a one-off token\n * that reaches an account-state check — throws a single `AUTHENTICATION_INVALID_TOKEN` for\n * every arm, including \"no such user\";\n * - the password-reset REQUEST leg returns a generic success for a non-ACTIVE user, with the\n * reason written down in its own code as anti-enumeration.\n *\n * So three siblings had one posture and this method had another. The window it opened is narrow —\n * a link minted while the account was ACTIVE and clicked after it was suspended — but a narrow\n * window is a reason to close it cheaply, not a reason to keep it.\n *\n * ## What is NOT lost\n *\n * Nothing operational. `logMagicLinkFailed` already carries the exact status, and it did before\n * this change; the distinction moves from the client to the audit trail, which is where a\n * suspended-account signal belongs. No client branches on either code — the frontend's\n * `userExists` consumers read the IDENTIFY response, not this one.\n */\n if (!user) {\n await this.auditLogsService.logMagicLinkFailed({\n failureReason: 'Magic link token resolves to no user row',\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n });\n return {\n success: false,\n sessionId: '',\n userExists: false,\n factorLevel: AuthFactorLevel.FIRST,\n authMethod: AuthMethod.MAGIC_LINK,\n error: 'Invalid or expired magic link',\n errorCode: 'MAGIC_LINK_INVALID',\n retryAllowed: false,\n integrationTokens: [],\n requiresMFA: false,\n } as AuthenticationResponse;\n }\n\n // Verify user is active — reject suspended/locked/pending users\n const userStatus = (user as Record<string, unknown>).status as string | undefined;\n if (userStatus && userStatus !== UserStatus.ACTIVE) {\n await this.auditLogsService.logMagicLinkFailed({\n failureReason: `Account is not active (status: ${userStatus})`,\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n });\n return {\n success: false,\n sessionId: '',\n userExists: false,\n factorLevel: AuthFactorLevel.FIRST,\n authMethod: AuthMethod.MAGIC_LINK,\n error: 'Invalid or expired magic link',\n errorCode: 'MAGIC_LINK_INVALID',\n retryAllowed: false,\n integrationTokens: [],\n requiresMFA: false,\n } as AuthenticationResponse;\n }\n\n // Resolve scope via domain lookup (mirrors identify() pattern)\n let resolvedScopeType: AuthScopeType | undefined;\n let resolvedScopeId: string | undefined;\n if (email) {\n const emailDomain = email.split('@')[1]?.toLowerCase();\n if (emailDomain) {\n try {\n const domainOrgLookup = await this.domainToOrgLookup.findOrgByDomain(ec, emailDomain);\n resolvedScopeType = domainOrgLookup?.scopeType;\n resolvedScopeId = domainOrgLookup?.scopeId;\n } catch {\n this.logDebug('Domain-to-org lookup failed during magic link verify (non-fatal)', { emailDomain });\n }\n }\n }\n\n // Create a session for this auth flow\n const sessionId = this.sessionStore.generateSessionId();\n await this.createSession(sessionId, AuthenticationSessionState.FIRST_FACTOR_COMPLETED, {\n deviceInfo,\n activeUserType,\n });\n\n // Store the explicit domain-ownership scope hint for SSO enforcement only.\n await this.updateSession(sessionId, {\n email,\n userExists: true,\n userId: userId,\n completedFactors: [AuthMethod.MAGIC_LINK],\n currentFactor: AuthFactorLevel.FIRST,\n scopeType: resolvedScopeType,\n scopeId: resolvedScopeId,\n });\n\n // Audit success\n // F4 per-org SIEM routing — route ONLY on the user's VERIFIED ACTIVE member orgs. `userId` is\n // token-bound (validatedToken.relatedId), never a request-supplied value.\n const magicLinkRoutingOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, userId);\n await this.auditLogsService.logMagicLinkVerified({\n userId: userId,\n email,\n sessionId,\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n }, ec, magicLinkRoutingOrgIds);\n\n // Reset global lockout counter — magic link proves email ownership (high assurance)\n if (email) {\n await this._resetGlobalAttempts(email);\n }\n\n // AUTH-14: Use org-override-aware policy for magic link flows.\n //\n // The user type is resolved from the RESOLVED USER first, and only then from the caller's\n // `activeUserType` hint. Two reasons, both load-bearing:\n //\n // 1. AUTH-10 doctrine — `activeUserType` is a HINT derived from `X-Frontend-Service-Name`, meaningful\n // only for PRE-identification flows where the user is unknown. Here the token has already resolved\n // a concrete `user`, so the DB-stored `userTypes[0]` is the authority, exactly as the identify /\n // authenticate paths override the hint once they know the user.\n // 2. Send/verify symmetry — `sendMagicLink` decides whether to ISSUE a link using\n // `user.userTypes?.[0]`. Resolving verify from a DIFFERENT source let the two legs disagree: a link\n // the send leg was willing to mint could be refused at verify under an unrelated policy.\n //\n // This ordering is also what makes the method correct BY CONSTRUCTION rather than correct-if-the-caller-\n // remembers. It previously read the hint alone, and the sole caller\n // (`AuthenticationController.magicLinkVerify`) never passed it — so every magic-link login resolved\n // `FALLBACK_AUTH_POLICY` (`authMethodsEnabled: { PASSWORD: true }`), failed the gate below, and threw\n // `AUTHORIZATION` / `AUTHENTICATION_MAGIC_LINK_DISABLED`. Magic-link login was non-functional for every\n // app and every user, AFTER the mail had been sent and the token consumed. The controller now passes the\n // hint too, but this resolution no longer DEPENDS on it.\n const resolvedUserType = user.userTypes?.[0] ?? activeUserType;\n const magicLinkPolicy = await this._resolveAuthPolicyWithOrgOverrides(ec, resolvedUserType, userId);\n // AUTH-24: a directory-managed user's effective policy has MAGIC_LINK derived OFF (a magic link is a\n // local first-factor that bypasses the IdP). Reject here — magic-link completes on THIS path, not the\n // shared `_updateSessionAfterSuccessfulAuth` seam. The token was already consumed during validation, so\n // a rejected managed user cannot reuse the link (and `sendMagicLink` also refuses to ISSUE one).\n if (!getEnabledMethods(magicLinkPolicy.authMethodsEnabled).has(AuthMethod.MAGIC_LINK)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_MAGIC_LINK_DISABLED,\n context: { reason: 'METHOD_NOT_ENABLED_IN_EFFECTIVE_POLICY' },\n });\n }\n const mfaCheck = await this._shouldRequireMFA(ec, userId, AuthMethod.MAGIC_LINK, magicLinkPolicy);\n\n if (mfaCheck.required) {\n const mfaResolution = await this._resolveUsableMfaMethods(mfaCheck.enrolledMethods, magicLinkPolicy);\n\n await this.updateSession(sessionId, {\n state: AuthenticationSessionState.MFA_REQUIRED,\n requiresMFA: true,\n requireStrongMFA: mfaResolution.requireStrongMFA,\n availableSecondFactorMethods: mfaResolution.availableMethods,\n enrolledSecondFactorMethods: mfaCheck.enrolledMethods,\n usableSecondFactorMethods: mfaResolution.usableMethods,\n });\n\n return {\n success: false,\n sessionId,\n userExists: true,\n factorLevel: AuthFactorLevel.FIRST,\n authMethod: AuthMethod.MAGIC_LINK,\n requiresMFA: true,\n availableMFAMethods: mfaResolution.availableMethods,\n mfaMethodsRequired: AuthenticationOrchestratorBackendService.DEFAULT_MFA_METHODS_REQUIRED,\n enrolledSecondFactorMethods: mfaCheck.enrolledMethods,\n usableSecondFactorMethods: mfaResolution.usableMethods,\n completedFactors: [AuthMethod.MAGIC_LINK],\n retryAllowed: true,\n integrationTokens: [],\n } as AuthenticationResponse;\n }\n\n // Complete authentication — issue tokens\n await this.updateSession(sessionId, {\n state: AuthenticationSessionState.COMPLETED,\n });\n\n const updatedSession = await this.getSession(sessionId);\n if (!updatedSession) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_LOST,\n });\n }\n\n const tokens = await this.tokenIssuer.issueTokens(updatedSession, {\n includeRefreshToken: true,\n lastAuthenticatedAt: Math.floor(Date.now() / 1000),\n });\n\n // Audit login\n // F4 per-org SIEM routing — route ONLY on the user's VERIFIED ACTIVE member orgs (token-bound userId).\n const loginRoutingOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, userId);\n await this.auditLogsService.logUserLogin({\n userId: userId,\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n authMethod: AuthMethod.MAGIC_LINK,\n email,\n sessionId,\n }, ec, loginRoutingOrgIds);\n\n // Clean up session\n await this.removeSession(sessionId);\n\n // W7.3a: resolve the authenticated user so the success response carries `user`\n // (the anonymous-session transposition trigger gates on `authResult.user._id`).\n // Magic-link is its own token-issuing completion path (separate from the shared\n // `authenticate()` completion), so it must populate `user` here too. Best-effort:\n // a lookup miss leaves `user` undefined (transposition no-ops, login still succeeds).\n const magicLinkUser = await this.userLookup.findUserById(ec, userId);\n\n return this._buildAuthenticationSuccessMethod(\n sessionId,\n AuthFactorLevel.FIRST,\n AuthMethod.MAGIC_LINK,\n tokens.accessToken,\n {\n refreshToken: tokens.refreshToken,\n completedFactors: [AuthMethod.MAGIC_LINK],\n user: magicLinkUser ?? undefined,\n },\n );\n }\n\n // ===============================\n // SMS OTP (Phase G2)\n // ===============================\n\n /**\n * Send an SMS OTP code to the user's verified phone number.\n * Can be used as first factor or second factor depending on config.\n * Rate limited with dual-window (burst + hourly).\n */\n public async sendSMSOTP(ec: ExecutionContext<any>, sessionId: string, phoneNumber?: string): Promise<{ sent: true; otpCode: string; targetPhone: string }> {\n if (!this._isMethodEnabledGlobally(AuthMethod.SMS_OTP)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SMS_OTP_DISABLED,\n });\n }\n const session = await this.getSession(sessionId);\n if (!session) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,\n context: { sessionId },\n });\n }\n\n // Validate session state — allow states valid for first-factor or second-factor OTP send\n const validSendStates = [\n AuthenticationSessionState.IDENTIFIED,\n AuthenticationSessionState.FIRST_FACTOR_IN_PROGRESS,\n AuthenticationSessionState.FIRST_FACTOR_COMPLETED,\n AuthenticationSessionState.MFA_REQUIRED,\n ];\n if (!validSendStates.includes(session.state as AuthenticationSessionState)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,\n });\n }\n\n // AUTH-24: refuse to ISSUE an SMS OTP to a directory-managed user — SMS_OTP is derived OFF their\n // effective policy (a FIRST-factor-capable local method whose \"credential\", a user-controlled\n // phone, bypasses the IdP and survives deprovisioning). The first-factor login seam\n // (`_updateSessionAfterSuccessfulAuth`) and the second-factor availability filter already refuse the\n // VERIFY; this refuses the ISSUE too, mirroring `sendMagicLink`. Same error as the global-disabled\n // branch above (no new enumeration surface). No-ops when the session has no resolved user/type\n // (`resolveEffectiveAuthPolicy` returns null ⇒ nothing derived) so a pre-identification send is\n // unaffected.\n if (session.userId) {\n const sendPolicy = await this.userLookup.resolveEffectiveAuthPolicy(ec, session.userId, session.activeUserType ?? '');\n if (sendPolicy && !getEnabledMethods(sendPolicy.authMethodsEnabled).has(AuthMethod.SMS_OTP)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SMS_OTP_DISABLED,\n });\n }\n }\n\n // Determine the phone number to send to\n let targetPhone = phoneNumber;\n\n if (!targetPhone) {\n const userId = session.userId;\n if (userId) {\n try {\n targetPhone = await this.credentialOps.getVerifiedPhone(ec, userId);\n } catch {\n // Suppress\n }\n }\n }\n\n if (!targetPhone) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_NO_VERIFIED_PHONE,\n });\n }\n\n // PR 8d (rate-limit unification, Step 5 — Option D, fourth\n // service-layer audit): this seam is a FRAMEWORK-CANONICAL K-3\n // ESCAPE-HATCH EXAMPLE — the dual-window per-phone burst stays\n // here as raw `checkRateLimit`. After PR 8e (Option K outcome\n // on `authenticatePassword`) and Step 7 F-23 sub-PR a (migration\n // of `sendEmailOTP` from `redisService.incrementRateLimit`)\n // plus the lockout modernization, this is one of four canonical\n // `RateLimitBackendService.checkRateLimit` call sites in the engine\n // outside `RateLimitBackendService` itself and the WebSocket\n // per-event surface (K-8 out-of-scope) — the other three being the\n // password-auth dual-bucket (`PASSWORD_EMAIL` + `PASSWORD_IP`, see\n // the `authenticatePassword` paragraph above), the global lockout\n // counter (`GLOBAL_LOCKOUT`), and the email-OTP send cap\n // (`sendEmailOTP`, the `EMAIL_OTP` constant) — and all four\n // are deliberate K-3 escape-hatches, NOT unfinished work.\n //\n // Why this stays at the service layer (Option K within Option D):\n // The cost-bearing resource we're defending against is SMS\n // spend per *physical phone number*. The bucket key is\n // `targetPhone`, which is a *resolved* value:\n // - When the caller passes `body.phoneNumber` explicitly,\n // it's an HTTP-layer artefact (would qualify for a\n // controller-side lift).\n // - When the caller omits `phoneNumber` (the dominant MFA\n // second-factor path), `targetPhone` comes from\n // `credentialOps.getVerifiedPhone(ec, session.userId)` —\n // a DB lookup keyed on the verified userId attached to\n // the session. NOT an HTTP-layer artefact.\n // Switching to per-(sessionId+IP) at the controller would let\n // an attacker spin up sessions via `controller.identify`\n // (10/min/IP cap landed in PR 8c) and burst SMS sends against\n // one victim phone with each fresh session — a 10x\n // amplification of the SMS pump fraud defense per source IP.\n // Switching to per-userId at the controller would require a\n // `getSession(body.sessionId)` Redis hit BEFORE rate-limit\n // fail-fast (defeating F-22) AND would still need a fallback\n // when `session.userId` is null (first-factor SMS-OTP for\n // unauthenticated sessions). Neither is preferable to keeping\n // the per-target-phone defense at the layer that already has\n // the resolved phone in scope.\n //\n // K-3 contract reaffirmed: the raw `checkRateLimit` API is the\n // right tool when the bucket key is NOT cheaply derivable from\n // HTTP-layer inputs. `sendSMSOTP` is the canonical engine-side\n // example; future authors hitting the same shape (DB-derived\n // bucket key, no HTTP-layer equivalent) should use this surface\n // directly rather than threading `req`/`res` into service\n // signatures or weakening the bucket dimension.\n //\n // The complementary per-IP cap at `controller.smsOTPSend`\n // (5/hour/IP, scope `auth:sms-otp:send`, landed in PR 7a) is\n // the HTTP-layer companion that defends against single-source\n // SMS pumping across many victim numbers — the two layers\n // compose for full defense in depth (the controller cap\n // catches IP-pumping; the service cap catches per-victim-phone\n // amplification regardless of IP/session/user).\n //\n // F-14 PARITY APPLIED (security upgrade, this PR): the bucket\n // key is now `AuthControllerUtils.phoneRateLimitBucketKey(targetPhone)`\n // — strips leading `+` and `00` defensively so `+33...`,\n // `0033...`, and `33...` resolve to one bucket. Without this\n // normalization, the schema regex `/^\\+?[1-9]\\d{1,14}$/` accepts\n // `+33...` and `33...` as different bucket keys for the same\n // physical number, doubling the effective cap an attacker can\n // extract per victim (matches PR 7-D-3's phone-verify fix).\n // Bucket-identity ≠ display-identity: `targetPhone` is still\n // passed unchanged to `consumableTokenService.createToken`,\n // `auditLogsService.logSMSOTPSent`, and the SMS dispatch below\n // — only the rate-limit Redis key uses the normalized form.\n const phoneBucketKey = AuthControllerUtils.phoneRateLimitBucketKey(targetPhone);\n await this.rateLimitService.checkRateLimit(\n `${AUTH_REDIS_KEYS.SMS_OTP_BURST}${phoneBucketKey}:burst`,\n this.otpConfig.smsOtp.rateLimitBurst,\n 60\n );\n await this.rateLimitService.checkRateLimit(\n `${AUTH_REDIS_KEYS.SMS_OTP_BURST}${phoneBucketKey}:hourly`,\n this.otpConfig.smsOtp.rateLimitHourly,\n 3600\n );\n\n const userId = session.userId;\n if (userId) {\n // Revoke existing SMS_OTP tokens\n await this.consumableTokenService.revokeTokensByRelatedId(userId, CoreConsumableTokenTypes.SMS_OTP);\n }\n\n // Generate OTP code\n const otpCode = this._generateOTP(this.otpConfig.smsOtp.otpLength);\n\n // Store as consumable token\n await this.consumableTokenService.createToken({\n tokenType: CoreConsumableTokenTypes.SMS_OTP,\n consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n expiresIn: { value: this.otpConfig.smsOtp.expiryMinutes, unit: DurationUnit.MINUTES },\n userId: userId,\n resourceIdentifier: CoreResourceType.USERS,\n relatedId: userId || targetPhone,\n metadata: {\n otpCode,\n sessionId,\n phoneNumber: targetPhone,\n },\n });\n\n // Audit\n await this.auditLogsService.logSMSOTPSent({\n phoneNumber: targetPhone,\n factorLevel: session.currentFactor || AuthFactorLevel.FIRST,\n sessionId,\n ipAddress: session.deviceInfo?.ipAddress || 'unknown',\n userAgent: session.deviceInfo?.userAgent || 'unknown',\n });\n\n // Update session state to reflect pending OTP verification\n const isSecondFactor = session.state === AuthenticationSessionState.FIRST_FACTOR_COMPLETED\n || session.state === AuthenticationSessionState.MFA_REQUIRED;\n await this.updateSession(sessionId, {\n state: isSecondFactor\n ? AuthenticationSessionState.MFA_REQUIRED\n : AuthenticationSessionState.FIRST_FACTOR_IN_PROGRESS,\n currentFactor: isSecondFactor ? AuthFactorLevel.SECOND : AuthFactorLevel.FIRST,\n });\n\n this.logDebug('SMS OTP generated', { sessionId, phoneNumber: targetPhone });\n\n return { sent: true, otpCode, targetPhone };\n }\n\n /**\n * Verify an SMS OTP code. Supports both first and second factor.\n * Called from authenticate() dispatch — does NOT issue tokens (authenticate() handles completion).\n * Uses constant-time comparison for the OTP code.\n */\n public async authenticateSMSOTP(ec: ExecutionContext<any>, request: SMSOTPAuthRequest): Promise<AuthenticationServiceResult> {\n if (!this._isMethodEnabledGlobally(AuthMethod.SMS_OTP)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SMS_OTP_DISABLED,\n });\n }\n\n const { sessionId, token, factorLevel } = request;\n\n const session = await this.getSession(sessionId);\n if (!session) {\n return this.__buildAuthenticationErrorMethod(sessionId, factorLevel, { retryAllowed: false });\n }\n\n // Allow-list: SMS OTP can be first or second factor, so accept states valid for either.\n // Reject unexpected states (COMPLETED, LOCKED, CREATED) to prevent replay or abuse.\n const validSMSOTPStates = [\n AuthenticationSessionState.IDENTIFIED,\n AuthenticationSessionState.FIRST_FACTOR_IN_PROGRESS,\n AuthenticationSessionState.FIRST_FACTOR_COMPLETED,\n AuthenticationSessionState.MFA_REQUIRED,\n AuthenticationSessionState.SECOND_FACTOR_IN_PROGRESS,\n ];\n if (!validSMSOTPStates.includes(session.state as AuthenticationSessionState)) {\n return this.__buildAuthenticationErrorMethod(sessionId, factorLevel, {\n retryAllowed: false,\n authMethod: AuthMethod.SMS_OTP,\n });\n }\n\n if (!token) {\n return this.__buildAuthenticationErrorMethod(sessionId, factorLevel, {\n retryAllowed: true,\n authMethod: AuthMethod.SMS_OTP,\n });\n }\n\n // Update session to in-progress\n const inProgressState = factorLevel === AuthFactorLevel.SECOND\n ? AuthenticationSessionState.SECOND_FACTOR_IN_PROGRESS\n : AuthenticationSessionState.FIRST_FACTOR_IN_PROGRESS;\n await this.updateSession(sessionId, {\n state: inProgressState,\n currentFactor: factorLevel,\n });\n\n const userId = session.userId;\n if (!userId) {\n return this.__buildAuthenticationErrorMethod(sessionId, factorLevel, { retryAllowed: false });\n }\n\n // Find matching SMS_OTP token and verify with constant-time comparison\n const isValid = await this._verifySMSOTP(userId, sessionId, token);\n\n if (!isValid) {\n const { locked } = await this.incrementSessionAttempts(ec, sessionId);\n\n await this.auditLogsService.logSMSOTPFailed({\n phoneNumber: request.phoneNumber,\n factorLevel,\n failureReason: locked ? 'Account locked after too many attempts' : 'Invalid OTP code',\n sessionId,\n ipAddress: session.deviceInfo?.ipAddress || 'unknown',\n userAgent: session.deviceInfo?.userAgent || 'unknown',\n });\n\n return this.__buildAuthenticationErrorMethod(sessionId, factorLevel, {\n retryAllowed: !locked,\n authMethod: AuthMethod.SMS_OTP,\n });\n }\n\n // Audit success\n // F4 per-org SIEM routing — route ONLY on the user's VERIFIED ACTIVE member orgs\n // (OTP-verified session userId), never a request-supplied value.\n const routingOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, userId);\n await this.auditLogsService.logSMSOTPVerified({\n userId: userId,\n phoneNumber: request.phoneNumber || 'unknown',\n factorLevel,\n sessionId,\n ipAddress: session.deviceInfo?.ipAddress || 'unknown',\n userAgent: session.deviceInfo?.userAgent || 'unknown',\n }, ec, routingOrgIds);\n\n // Update session (mirrors authenticateEmailOTP pattern)\n await this._updateSessionAfterSuccessfulAuth(ec, sessionId, userId, AuthMethod.SMS_OTP);\n\n const updatedSession = await this.getSession(sessionId);\n return this._buildAuthenticationSuccessMethod(\n sessionId,\n factorLevel,\n AuthMethod.SMS_OTP,\n '', // Tokens issued by authenticate() after completion check\n { completedFactors: updatedSession?.completedFactors || [] },\n );\n }\n\n /**\n * Verify an SMS OTP code using constant-time comparison.\n * Mirrors the _verifyEmailOTP pattern.\n */\n private async _verifySMSOTP(userId: string, sessionId: string, submittedCode: string): Promise<boolean> {\n try {\n const tokens = await this.consumableTokenService.findTokensByRelatedId(\n userId,\n CoreConsumableTokenTypes.SMS_OTP,\n );\n\n for (const tokenDoc of tokens) {\n const metadata = tokenDoc.metadata as Record<string, unknown> | undefined;\n if (!metadata?.otpCode || !metadata?.sessionId) continue;\n\n const storedCode = String(metadata.otpCode);\n const storedSession = String(metadata.sessionId);\n if (storedCode.length !== submittedCode.length || storedSession.length !== sessionId.length) continue;\n\n const codeMatch = crypto.timingSafeEqual(Buffer.from(storedCode), Buffer.from(submittedCode));\n const sessionMatch = crypto.timingSafeEqual(Buffer.from(storedSession), Buffer.from(sessionId));\n\n if (codeMatch && sessionMatch) {\n try {\n await this.consumableTokenService.consumeToken(tokenDoc.token);\n return true;\n } catch {\n continue;\n }\n }\n }\n\n return false;\n } catch (error) {\n if (isWildoBackendError(error)) {\n throw error;\n }\n this.logger.error('Failed to verify SMS OTP', {\n userId,\n sessionId,\n ...projectCaughtErrorLogFields(error),\n });\n return false;\n }\n }\n\n /**\n * Generate a cryptographically random N-digit numeric OTP.\n */\n private _generateOTP(length: number): string {\n const max = Math.pow(10, length);\n const min = Math.pow(10, length - 1);\n // Use crypto.randomInt for unbiased random number generation\n const { randomInt } = crypto;\n return String(randomInt(min, max));\n }\n\n // ===============================\n // COMPLETION LOGIC\n // ===============================\n\n private _isAuthenticationComplete(\n session: AuthenticationSession,\n currentFactorLevel: AuthFactorLevel,\n authMethod: AuthMethod,\n ): boolean {\n const completedFactors = session.completedFactors || [];\n\n const hasFirstFactor = completedFactors.some((factor) => AuthUtils.canBeFirstFactor(factor));\n const hasSecondFactor = completedFactors.some((factor) => AuthUtils.canBeSecondFactor(factor));\n\n switch (currentFactorLevel) {\n case AuthFactorLevel.FIRST:\n // If MFA is required for this session (set during first-factor success based on\n // app MFA policy + user's enrolled second-factor methods), first factor alone is not enough.\n if (session.requiresMFA) {\n return false;\n }\n return session.state === AuthenticationSessionState.FIRST_FACTOR_COMPLETED && hasFirstFactor;\n case AuthFactorLevel.SECOND:\n return hasFirstFactor && hasSecondFactor && completedFactors.length >= 2;\n default:\n return false;\n }\n }\n\n // ===============================\n // RESPONSE BUILDERS\n // ===============================\n\n private _buildIdentificationErrorResponse(\n sessionId: string,\n factorLevel: AuthFactorLevel,\n retryAllowed: boolean = true,\n session?: AuthenticationSession | null,\n ): AuthenticationResponse {\n return AuthenticationResponseSchema.parse({\n success: false,\n sessionId,\n userExists: session?.userExists ?? false,\n factorLevel,\n retryAllowed,\n remainingAttempts: session ? session.maxAttempts - session.attempts : undefined,\n lockoutUntil: session?.lockoutUntil,\n requiresMFA: false,\n integrationTokens: [],\n });\n }\n\n /**\n * Build the orchestrator's success-path return shape.\n *\n * Returns `AuthenticationServiceResult` (= `AuthenticationResponse &\n * { refreshToken?: string }`) — the wire-shape `AuthenticationResponse`\n * (parsed from `AuthenticationResponseSchema`) augmented with the\n * cookie-bound `refreshToken` value. The schema parse intentionally\n * STRIPS `refreshToken` from the wire body (Auth-hardening Slice A\n * Step 6, 2026-04-13 — schema no longer carries the field); we then\n * re-attach it on the returned object so the controller can pull it\n * out and pass it to `_jsonSuccessWithRefreshCookie(res, body, refreshToken)`.\n *\n * Why parse-strip-then-reattach (instead of building the literal\n * directly): `AuthenticationResponseSchema.parse(...)` applies the\n * schema's defaults (e.g. `integrationTokens: []`, `requiresMFA:\n * false`, `retryAllowed: true`, `enrolledSecondFactorMethods: []`)\n * AND strips any unknown keys. Removing the parse step would\n * duplicate that default logic at every call site of the factory —\n * a maintenance burden + a subtle source of drift if the schema\n * defaults ever shift. Re-attach is one line and preserves the\n * single-source-of-truth contract.\n */\n private _buildAuthenticationSuccessMethod(\n sessionId: string,\n factorLevel: AuthFactorLevel,\n authMethod: AuthMethod,\n accessToken: string,\n options: {\n refreshToken?: string;\n expiresIn?: number;\n user?: any;\n integrationTokens?: Array<{\n integrationId: string;\n accessToken: string;\n refreshToken?: string;\n expiresIn?: number;\n scopes: string[];\n }>;\n requiresMFA?: boolean;\n availableMFAMethods?: AvailableMethod[];\n mfaMethodsRequired?: number;\n enrolledSecondFactorMethods?: AuthMethod[];\n usableSecondFactorMethods?: AuthMethod[];\n completedFactors?: AuthMethod[];\n challengeData?: Record<string, any>;\n redirectUrl?: string;\n nextStep?: string;\n availableEnrollmentMethods?: AuthMethod[];\n } = {},\n ): AuthenticationServiceResult {\n const wireBody = AuthenticationResponseSchema.parse({\n success: !options.requiresMFA,\n sessionId,\n userExists: true,\n factorLevel,\n authMethod,\n accessToken,\n // Auth-hardening Slice A Step 6: `refreshToken` is intentionally\n // NOT passed to `.parse(...)` — the schema no longer carries the\n // field, so passing it here would be silently stripped. We\n // re-attach it on the returned object below for the controller's\n // cookie-emit seam.\n expiresIn: options.expiresIn,\n user: options.user,\n integrationTokens: options.integrationTokens || [],\n requiresMFA: options.requiresMFA || false,\n availableMFAMethods: options.availableMFAMethods,\n mfaMethodsRequired: options.mfaMethodsRequired,\n enrolledSecondFactorMethods: options.enrolledSecondFactorMethods || [],\n usableSecondFactorMethods: options.usableSecondFactorMethods || [],\n completedFactors: options.completedFactors || [authMethod],\n retryAllowed: true,\n challengeData: options.challengeData,\n redirectUrl: options.redirectUrl,\n nextStep: options.nextStep,\n availableEnrollmentMethods: options.availableEnrollmentMethods || [],\n });\n return { ...wireBody, refreshToken: options.refreshToken };\n }\n\n private __buildAuthenticationErrorMethod(\n sessionId: string,\n factorLevel: AuthFactorLevel,\n options: {\n authMethod?: AuthMethod;\n retryAllowed?: boolean;\n remainingAttempts?: number;\n lockoutUntil?: Date;\n requiresMFA?: boolean;\n availableMFAMethods?: AvailableMethod[];\n mfaMethodsRequired?: number;\n completedFactors?: AuthMethod[];\n challengeData?: Record<string, any>;\n redirectUrl?: string;\n } = {},\n ): AuthenticationResponse {\n // Note: we don't call getSession here synchronously because this is used in sync error builders.\n // The session data is passed through options when available.\n return AuthenticationResponseSchema.parse({\n success: false,\n sessionId,\n userExists: false,\n factorLevel,\n authMethod: options.authMethod,\n retryAllowed: options.retryAllowed ?? true,\n remainingAttempts: options.remainingAttempts,\n lockoutUntil: options.lockoutUntil,\n requiresMFA: options.requiresMFA ?? false,\n availableMFAMethods: options.availableMFAMethods,\n mfaMethodsRequired: options.mfaMethodsRequired,\n completedFactors: options.completedFactors || [],\n integrationTokens: [],\n challengeData: options.challengeData,\n redirectUrl: options.redirectUrl,\n });\n }\n\n private async _buildAvailableMethodObject(\n ec: ExecutionContext<any> | undefined,\n method: AuthMethod,\n domainOrgLookup?: DomainOrgLookupResult | null,\n authPolicy?: UserTypeAuthPolicy,\n ): Promise<AvailableMethod | null> {\n const globalAuth = this.appConfigService.config.auth;\n const policy = authPolicy ?? AuthenticationOrchestratorBackendService.FALLBACK_AUTH_POLICY;\n\n const isEnabled = policy.authMethodsEnabled[method];\n if (!isEnabled) {\n return null;\n }\n\n const factorType = AuthUtils.getFactorType(method);\n const category = AuthUtils.getMethodCategory(method);\n const canBeFirstFactor = AuthUtils.canBeFirstFactor(method);\n const canBeSecondFactor = AuthUtils.canBeSecondFactor(method);\n const organizationRestricted = AuthUtils.isOrganizationRestricted(method);\n const supportsIntegrations = AuthUtils.supportsIntegrationAccess(method);\n\n let required = false;\n if (canBeSecondFactor && policy.mfaPolicy.requireMFA) {\n required = true;\n }\n let oauth2ProviderRefs: string[] = [];\n let ssoIds: string[] = [];\n let availableIntegrations: string[] = [];\n let config: AvailableMethodConfig | undefined;\n\n switch (method) {\n case AuthMethod.EXTERNAL_OAUTH2: {\n let oauth2Providers = Object.entries(globalAuth.socialOAuth2Providers || {})\n .filter(([, providerConfig]) => isEnabledSocialOAuth2LoginProvider(providerConfig))\n .map(([providerRef]) => providerRef);\n if (domainOrgLookup && ec) {\n oauth2Providers = await this.oauth2Resolver.filterProviders(\n ec,\n domainOrgLookup.scopeType,\n domainOrgLookup.scopeId,\n oauth2Providers,\n );\n }\n if (oauth2Providers.length === 0) return null;\n availableIntegrations = oauth2Providers;\n oauth2ProviderRefs = oauth2Providers;\n break;\n }\n case AuthMethod.MAGIC_LINK:\n case AuthMethod.SMS_OTP:\n break;\n case AuthMethod.PASSKEY:\n config = globalAuth.passkeyConfig\n ? { rpName: globalAuth.passkeyConfig.rpName, rpId: globalAuth.passkeyConfig.rpId }\n : undefined;\n break;\n case AuthMethod.ORG_OPENID_CONNECT: {\n if (\n !domainOrgLookup\n || domainOrgLookup.matchedProviderType !== SsoProtocol.OIDC\n ) {\n return null;\n }\n const providerInfo = this.domainToOrgLookup.getSSOProviderInfo(domainOrgLookup);\n if (!providerInfo) return null;\n ssoIds = [providerInfo.connectionId];\n config = {\n displayName: providerInfo.displayName,\n providerRef: providerInfo.providerRef,\n connectionId: providerInfo.connectionId,\n scopeType: domainOrgLookup.scopeType,\n scopeId: domainOrgLookup.scopeId,\n };\n if (domainOrgLookup.enforcement?.requireSSO) {\n required = true;\n }\n break;\n }\n case AuthMethod.ORG_SAML: {\n if (\n !domainOrgLookup\n || domainOrgLookup.matchedProviderType !== SsoProtocol.SAML\n ) {\n return null;\n }\n const samlProviderInfo = this.domainToOrgLookup.getSSOProviderInfo(domainOrgLookup);\n if (!samlProviderInfo) return null;\n ssoIds = [samlProviderInfo.connectionId];\n config = {\n displayName: samlProviderInfo.displayName,\n providerRef: samlProviderInfo.providerRef,\n connectionId: samlProviderInfo.connectionId,\n loginUrl: `/auth/saml/login/${samlProviderInfo.connectionId}`,\n scopeType: domainOrgLookup.scopeType,\n scopeId: domainOrgLookup.scopeId,\n };\n if (domainOrgLookup.enforcement?.requireSSO) {\n required = true;\n }\n break;\n }\n default:\n break;\n }\n\n return {\n method,\n factorType,\n category,\n canBeFirstFactor,\n canBeSecondFactor,\n required,\n oauth2ProviderRefs,\n ssoIds,\n organizationRestricted,\n supportsIntegrations,\n availableIntegrations,\n config,\n };\n }\n}\n"]}
1
+ {"version":3,"file":"authentication-orchestrator.backend.service.js","sourceRoot":"","sources":["../../../../../src/security/authentications/services/authentication-orchestrator.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAG9G,OAAO,EAAE,yBAAyB,EAAE,MAAM,+FAA+F,CAAC;AAE1I,OAAO,EAIL,wBAAwB,EACxB,+BAA+B,EAC/B,2BAA2B,EAC3B,SAAS,EACT,mBAAmB,EAGnB,UAAU,GACX,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAC5G,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAEhK,OAAO,EACL,SAAS,EACT,gCAAgC,EAChC,UAAU,EACV,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,4BAA4B,EAK5B,2BAA2B,EAC3B,0BAA0B,EAC1B,YAAY,EACZ,aAAa,EACb,sBAAsB,EACtB,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAErG,OAAO,EACL,8BAA8B,EAC9B,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,uBAAuB,EAAE,MAAM,sFAAsF,CAAC;AAC/H,OAAO,EAAE,uBAAuB,EAAE,MAAM,6EAA6E,CAAC;AACtH,OAAO,EACL,oCAAoC,EACpC,mCAAmC,GACpC,MAAM,2FAA2F,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AAKvF,0BAA0B;AAC1B,OAAO,EAAE,8BAA8B,EAAE,MAAM,yFAAyF,CAAC;AACzI,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,6BAA6B,EAAmB,MAAM,wFAAwF,CAAC;AACxJ,OAAO,EAAE,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AAIpI,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AACxG,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AAEzJ,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,eAAe,EAAE,MAAM,2EAA2E,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,MAAM,4FAA4F,CAAC;AACnI,OAAO,EAAE,sCAAsC,EAAE,MAAM,8GAA8G,CAAC;AACtK,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AACjJ,OAAO,EAAE,mBAAmB,EAAE,MAAM,kFAAkF,CAAC;AACvH,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,0CAA0C,GAC3C,MAAM,4FAA4F,CAAC;AACpG,OAAO,EAAE,kCAAkC,EAAE,MAAM,uFAAuF,CAAC;AA2C3I;;;;;;;;;;;;;;;;;;GAkBG;AAEI,IAAM,wCAAwC,GAA9C,MAAM,wCAAwC;;IAgCG;IACU;IACG;IACW;IACI;IAClB;IAEA;IACM;IACP;IAEO;IACV;IACW;IAEC;IAEY;IAErB;IAEgB;IAEV;IAEG;IAGL;IACL;IAE3C;IAI2C;IAlE9D,uHAAuH;IAC/G,MAAM,CAAU,gCAAgC,GAAG,EAAE,CAAC;IAC9D,qHAAqH;IAC7G,MAAM,CAAU,iCAAiC,GAAG,CAAC,CAAC;IAC9D,uEAAuE;IAC/D,MAAM,CAAU,4BAA4B,GAAG,CAAC,CAAC;IAEzD;;;;;;;OAOG;IACK,MAAM,CAAU,oCAAoC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAC7E,2HAA2H;IACnH,MAAM,CAAU,mCAAmC,GAAG,MAAM,CAAC;IAEpD,QAAQ,CAA+D;IAExF;;;;;;OAMG;IACc,wBAAwB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEtE,YACsD,MAAqB,EACX,gBAAyC,EACtC,YAAwC,EAC7B,uBAA8D,EAC1D,oBAA+D,EACjF,gBAAyC,EAEzC,YAA4C,EACtC,kBAAwD,EAC/D,WAA0C,EAEnC,sBAAqD,EAC/D,YAA0B,EACf,gBAAyC,EAExC,iBAAkD,EAEtC,gBAAsD,EAE3E,eAAuC,EAEvB,cAAsD,EAEhE,UAAwC,EAErC,aAA8C,EAGnD,mBAA+C,EACpD,cAA8B,EAEzE,6BAC4B,EAGe,cAAqC;QAnC7C,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QACtC,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC1D,yBAAoB,GAApB,oBAAoB,CAA2C;QACjF,qBAAgB,GAAhB,gBAAgB,CAAyB;QAEzC,iBAAY,GAAZ,YAAY,CAAgC;QACtC,uBAAkB,GAAlB,kBAAkB,CAAsC;QAC/D,gBAAW,GAAX,WAAW,CAA+B;QAEnC,2BAAsB,GAAtB,sBAAsB,CAA+B;QAC/D,iBAAY,GAAZ,YAAY,CAAc;QACf,qBAAgB,GAAhB,gBAAgB,CAAyB;QAExC,sBAAiB,GAAjB,iBAAiB,CAAiC;QAEtC,qBAAgB,GAAhB,gBAAgB,CAAsC;QAE3E,oBAAe,GAAf,eAAe,CAAwB;QAEvB,mBAAc,GAAd,cAAc,CAAwC;QAEhE,eAAU,GAAV,UAAU,CAA8B;QAErC,kBAAa,GAAb,aAAa,CAAiC;QAGnD,wBAAmB,GAAnB,mBAAmB,CAA4B;QACpD,mBAAc,GAAd,cAAc,CAAgB;QAEzE,kCAA6B,GAA7B,6BAA6B,CACD;QAGe,mBAAc,GAAd,cAAc,CAAuB;QAEjG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;IACvE,CAAC;IAED;;;;OAIG;IACH,IAAY,aAAa;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,gBAAgB,EAAE,CAAC,EAAE,sBAAsB,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,EAAE,CAAC;QACxH,CAAC;QACD,OAAO;YACL,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;YACpE,sBAAsB,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;YAChF,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;YAC5D,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;SACzF,CAAC;IACJ,CAAC;IAED,IAAY,SAAS;QACnB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;IAC1D,CAAC;IAED,IAAY,eAAe;QACzB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC;IAChE,CAAC;IAED,gGAAgG;IAChG,mGAAmG;IACnG,8FAA8F;IAE9F,kCAAkC;IAClC,8CAA8C;IAC9C,kCAAkC;IAElC;;;;OAIG;IACK,kBAAkB,CAAC,cAA8B;QACvD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAC;YAC3E,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QACD,OAAO,0CAAwC,CAAC,oBAAoB,CAAC;IACvE,CAAC;IAED;;;OAGG;IACK,MAAM,CAAU,oBAAoB,GAAuB;QACjE,kBAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE;QACnD,SAAS,EAAE;YACT,UAAU,EAAE,KAAK;YACjB,gBAAgB,EAAE,KAAK;YACvB,yBAAyB,EAAE,CAAC;YAC5B,oBAAoB,EAAE,IAAI;SAC3B;QACD,YAAY,EAAE;YACZ,yFAAyF;YACzF,uFAAuF;YACvF,IAAI,EAAE,gBAAgB,CAAC,QAAQ;YAC/B,cAAc,EAAE,EAAE;YAClB,iBAAiB,EAAE,qBAAqB,CAAC,sBAAsB;YAC/D,kBAAkB,EAAE,KAAK;SAC1B;QACD,cAAc,EAAE;YACd,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,GAAG;YACd,gBAAgB,EAAE,IAAI;YACtB,gBAAgB,EAAE,IAAI;YACtB,cAAc,EAAE,IAAI;YACpB,mBAAmB,EAAE,KAAK;YAC1B,UAAU,EAAE,CAAC;SACd;QACD,sBAAsB,EAAE,0CAAwC,CAAC,gCAAgC;QACjG,aAAa,EAAE;YACb,gBAAgB,EAAE,CAAC;YACnB,sBAAsB,EAAE,EAAE;YAC1B,kBAAkB,EAAE,KAAK;YACzB,0BAA0B,EAAE,EAAE;SAC/B;QACD,eAAe,EAAE,IAAI;QACrB,gBAAgB,EAAE;YAChB,sBAAsB,EAAE,IAAI;YAC5B,6BAA6B,EAAE,KAAK;SACrC;KACF,CAAC;IAEF;;;;OAIG;IACK,KAAK,CAAC,kCAAkC,CAC9C,EAAyB,EACzB,cAAyC,EACzC,MAAc;QAEd,IAAI,CAAC,cAAc;YAAE,OAAO,0CAAwC,CAAC,oBAAoB,CAAC;QAC1F,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;QAC/F,OAAO,SAAS,IAAI,0CAAwC,CAAC,oBAAoB,CAAC;IACpF,CAAC;IAED;;;;OAIG;IACK,wBAAwB,CAAC,MAAkB;QACjD,MAAM,SAAS,GAAoB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QAChF,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,IAAI,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,6BAA6B,CAAC,OAA8B;QAClE,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACzD,CAAC;IAEO,iCAAiC,CAAC,mBAAuC,EAAE,QAAmC;QACpH,IAAI,CAAC,mBAAmB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtC,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,CAAC,qCAAqC,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;QAClH,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;gBACvF,OAAO,EAAE;oBACP,wBAAwB;oBACxB,mBAAmB;oBACnB,cAAc,EAAE,QAAQ;iBACzB;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,iDAAiD;IACjD,kCAAkC;IAE1B,qBAAqB,CAAC,cAA8B;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,sBAAsB,GAAG,EAAE,CAAC;IAC5C,CAAC;IAGD;;OAEG;IACH,+FAA+F;IACvF,MAAM,CAAU,gCAAgC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAEhE,KAAK,CAAC,aAAa,CACzB,SAAiB,EACjB,eAA2C,0BAA0B,CAAC,OAAO,EAC7E,UAOI,EAAE;QAEN,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACnE,MAAM,kBAAkB,GAAG,OAAO,CAAC,OAAO,KAAK,kBAAkB,CAAC,YAAY,IAAI,OAAO,CAAC,OAAO,KAAK,kBAAkB,CAAC,UAAU,CAAC;QACpI,MAAM,UAAU,GAAG,kBAAkB;YACnC,CAAC,CAAC,0CAAwC,CAAC,gCAAgC;YAC3E,CAAC,CAAC,UAAU,CAAC,sBAAsB,GAAG,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;QAE9D,MAAM,OAAO,GAA0B;YACrC,SAAS;YACT,KAAK,EAAE,YAAY;YACnB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,kBAAkB,CAAC,KAAK;YACpD,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,GAAG;YACd,SAAS;YACT,YAAY,EAAE,GAAG;YACjB,gBAAgB,EAAE,EAAE;YACpB,2BAA2B,EAAE,EAAE;YAC/B,4BAA4B,EAAE,EAAE;YAChC,0BAA0B,EAAE,EAAE;YAC9B,2BAA2B,EAAE,EAAE;YAC/B,yBAAyB,EAAE,EAAE;YAC7B,WAAW,EAAE,KAAK;YAClB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,0CAAwC,CAAC,4BAA4B;YACzF,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,UAAU,CAAC,aAAa,CAAC,gBAAgB;YACtD,qBAAqB,EAAE,EAAE;YACzB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,OAAO,EAAE,CAAC;SACX,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,uCAAuC,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAEhG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,UAAU,CAAC,SAAiB;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEvD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,iEAAiE;QACjE,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,gCAAgC,SAAS,EAAE,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,kEAAkE;QAClE,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,0CAAwC,CAAC,iCAAiC,GAAG,EAAE,GAAG,IAAI,CAAC;YAC3G,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YACjE,IAAI,YAAY,GAAG,WAAW,EAAE,CAAC;gBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC1C,IAAI,CAAC,QAAQ,CAAC,uCAAuC,SAAS,EAAE,EAAE;oBAChE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC;oBAC7C,YAAY,EAAE,0CAAwC,CAAC,iCAAiC;iBACzF,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,0FAA0F;IAClF,MAAM,CAAU,yBAAyB,GAAG,CAAC,CAAC;IAEtD;;;;;;OAMG;IACK,KAAK,CAAC,aAAa,CACzB,SAAiB,EACjB,OAAuC;QAEvC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,0CAAwC,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,CAAC;YAC/G,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;YAC7C,MAAM,cAAc,GAAG,2BAA2B,CAAC,KAAK,CAAC;gBACvD,GAAG,OAAO;gBACV,GAAG,OAAO;gBACV,YAAY,EAAE,IAAI,IAAI,EAAE;gBACxB,OAAO,EAAE,eAAe,GAAG,CAAC;aAC7B,CAAC,CAAC;YAEH,6CAA6C;YAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CACjD,SAAS,EACT,cAAc,EACd,eAAe,EACf,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC,cAAc,CAAC,CAC1D,CAAC;YAEF,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,QAAQ,CAAC,mCAAmC,SAAS,EAAE,EAAE;oBAC5D,KAAK,EAAE,cAAc,CAAC,KAAK;oBAC3B,OAAO,EAAE,cAAc,CAAC,OAAO;iBAChC,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,oEAAoE;YACpE,IAAI,CAAC,QAAQ,CAAC,4CAA4C,OAAO,GAAG,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,iFAAiF;QACjF,oFAAoF;QACpF,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,4DAA4D,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAChG,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa,CAAC,SAAiB;QAC3C,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,mCAAmC,SAAS,EAAE,CAAC,CAAC;IAChE,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,wBAAwB,CACpC,EAAyB,EACzB,SAAiB;QAEjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QAClE,MAAM,cAAc,GAAG,aAAa,CAAC,aAAa,CAAC;QACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC;QAE/C,IAAI,uBAAuB,GAAG,cAAc,CAAC,sBAAsB,CAAC;QAEpE,iHAAiH;QACjH,IAAI,MAAM,IAAI,cAAc,CAAC,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAClE,IAAI,CAAC;gBACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,EAAE,OAAO,CAAC,MAAO,CAAC,CAAC;gBACzF,MAAM,UAAU,GAAG,CAAC,cAAc,CAAC,0BAA0B,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC;gBAC1E,uBAAuB,GAAG,IAAI,CAAC,GAAG,CAChC,cAAc,CAAC,sBAAsB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,EAClE,UAAU,CACX,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;YACzD,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAmC;YAC9C,QAAQ;YACR,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK;YACjE,YAAY,EAAE,MAAM;gBAClB,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;gBAC5D,CAAC,CAAC,SAAS;SACd,CAAC;QAEF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEpE,IAAI,MAAM,IAAI,cAAc,EAAE,MAAM,EAAE,CAAC;YACrC,qFAAqF;YACrF,2FAA2F;YAC3F,MAAM,IAAI,CAAC,2BAA2B,CACpC,EAAE,EACF,cAAc,CAAC,MAAM,EACrB,cAAc,CAAC,KAAK,IAAI,SAAS,EACjC,uBAAuB,EACvB,cAAc,CAAC,UAAU,EACzB,SAAS,EACT,oBAAoB,CAAC,qBAAqB,CAC3C,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,2BAA2B,CACvC,EAAyB,EACzB,YAAoB,EACpB,KAAa,EACb,sBAA8B,EAC9B,UAA+C,EAC/C,SAAiB,EACjB,MAA4B;QAE5B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtE,IACE,aAAa,KAAK,SAAS;YAC3B,KAAK,GAAG,aAAa,GAAG,0CAAwC,CAAC,oCAAoC,EACrG,CAAC;YACD,OAAO,CAAC,+DAA+D;QACzE,CAAC;QACD,IAAI,IAAI,CAAC,wBAAwB,CAAC,IAAI,IAAI,0CAAwC,CAAC,mCAAmC,EAAE,CAAC;YACvH,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACpE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACvD,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;QAC9F,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;YAC/C,MAAM,EAAE,YAAY;YACpB,KAAK,EAAE,KAAK,IAAI,SAAS;YACzB,UAAU,EAAE,UAAU,CAAC,QAAQ;YAC/B,eAAe,EAAE,sBAAsB;YACvC,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;YAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;YAC7C,SAAS;YACT,MAAM;SACP,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;IACxB,CAAC;IAED,kCAAkC;IAClC,mDAAmD;IACnD,kCAAkC;IAElC;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,oBAAoB,CAAC,KAAa;QAC9C,MAAM,GAAG,GAAG,GAAG,eAAe,CAAC,cAAc,GAAG,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACtE,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,GAAG,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,+DAA+D;IAC/D,wDAAwD;IACxD,iEAAiE;IACjE,8DAA8D;IAC9D,8DAA8D;IAC9D,iEAAiE;IACjE,kEAAkE;IAElE,kCAAkC;IAClC,mBAAmB;IACnB,kCAAkC;IAElC;;OAEG;IACK,KAAK,CAAC,6BAA6B,CACzC,EAAyB,EACzB,QAA+B,EAC/B,KAAa,EACb,SAAiB;QAEjB,IAAI,CAAC,QAAQ,CAAC,gDAAgD,SAAS,WAAW,KAAK,EAAE,CAAC,CAAC;QAE3F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAEjE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACtE,MAAM,YAAY,GAAG,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;YACxH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;aACjC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,kBAAkB,CAAC,IAAU,EAAE,SAAiB;QACtD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;YAAE,OAAO;QAE9C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;YACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;YACjF,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,iCAAiC,CAC7C,EAAyB,EACzB,SAAiB,EACjB,MAAc,EACd,UAAsB;QAEtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;gBAClF,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACtD,MAAM,mBAAmB,GAAG,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC7D,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,CAAC,GAAG,cAAc,EAAE,UAAU,CAAC,CAAC;QAEpC,oGAAoG;QACpG,MAAM,cAAc,GAAG,SAAS,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;QAE5F,sFAAsF;QACtF,sFAAsF;QACtF,IAAI,cAAc,IAAI,OAAO,CAAC,yBAAyB,IAAI,OAAO,CAAC,yBAAyB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxG,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;oBACvF,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,2BAA2B,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,cAAc;YAC7B,CAAC,CAAC,0BAA0B,CAAC,SAAS;YACtC,CAAC,CAAC,0BAA0B,CAAC,sBAAsB,CAAC;QAEtD,8DAA8D;QAC9D,MAAM,aAAa,GAAG,MAAM;YAC1B,CAAC,CAAC,MAAM,IAAI,CAAC,kCAAkC,CAAC,EAAE,EAAE,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC;YACnF,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QAEhD,sGAAsG;QACtG,sGAAsG;QACtG,uGAAuG;QACvG,kGAAkG;QAClG,wGAAwG;QACxG,qGAAqG;QACrG,IAAI,CAAC,cAAc,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACtG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;gBACvF,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,wCAAwC,EAAE;aAClF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAmC;YACpD,KAAK,EAAE,QAAQ;YACf,gBAAgB,EAAE,mBAAmB;YACrC,QAAQ,EAAE,CAAC,EAAE,8CAA8C;YAC3D,MAAM,EAAE,MAAM;SACf,CAAC;QAEF,6EAA6E;QAC7E,yEAAyE;QACzE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;YACrF,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACtB,MAAM,uBAAuB,GAAG,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,SAAS,CAAC,CAAC;gBAE/F,IAAI,CAAC,uBAAuB,EAAE,CAAC;oBAC7B,yEAAyE;oBACzE,MAAM,mBAAmB,GAAG,SAAS,CAAC,sBAAsB,EAAE,CAAC;oBAC/D,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,MAAM,CACpD,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAC3C,CAAC;oBAEF,aAAa,CAAC,KAAK,GAAG,0BAA0B,CAAC,uBAAuB,CAAC;oBACzE,aAAa,CAAC,WAAW,GAAG,IAAI,CAAC;oBACjC,aAAa,CAAC,gBAAgB,GAAG,aAAa,CAAC,SAAS,EAAE,gBAAgB,IAAI,KAAK,CAAC;oBACpF,aAAa,CAAC,QAAQ,GAAG,YAAY,CAAC,cAAc,CAAC;oBACrD,aAAa,CAAC,0BAA0B,GAAG,mBAAmB,CAAC;gBACjE,CAAC;qBAAM,CAAC;oBACN,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;oBAEnG,aAAa,CAAC,WAAW,GAAG,IAAI,CAAC;oBACjC,aAAa,CAAC,gBAAgB,GAAG,aAAa,CAAC,gBAAgB,CAAC;oBAChE,aAAa,CAAC,4BAA4B,GAAG,aAAa,CAAC,gBAAgB,CAAC;oBAC5E,aAAa,CAAC,2BAA2B,GAAG,QAAQ,CAAC,eAAe,CAAC;oBACrE,aAAa,CAAC,yBAAyB,GAAG,aAAa,CAAC,aAAa,CAAC;gBACxE,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAEnD,6DAA6D;QAC7D,IAAI,aAAa,CAAC,aAAa,CAAC,kBAAkB,IAAI,MAAM,EAAE,CAAC;YAC7D,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;QACH,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,8BAA8B;IAC9B,kCAAkC;IAE3B,KAAK,CAAC,QAAQ,CACnB,EAAyB,EACzB,qBAAgD,EAChD,cAAuB,EACvB,mBAA4B;QAE5B,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAAC;QAEpD,IAAI,CAAC,QAAQ,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;QAE7D,0DAA0D;QAC1D,8DAA8D;QAC9D,0GAA0G;QAC1G,gDAAgD;QAChD,yDAAyD;QACzD,6DAA6D;QAC7D,8DAA8D;QAC9D,8DAA8D;QAC9D,wDAAwD;QACxD,2DAA2D;QAC3D,4DAA4D;QAC5D,4DAA4D;QAC5D,6DAA6D;QAC7D,uCAAuC;QAEvC,gFAAgF;QAChF,sEAAsE;QACtE,mEAAmE;QACnE,uEAAuE;QACvE,sEAAsE;QACtE,oCAAoC;QAEpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAEjE,IAAI,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAC,IAAI,WAAW,KAAK,EAAE,CAAC,CAAC;QAE1E,6EAA6E;QAC7E,yFAAyF;QACzF,uDAAuD;QACvD,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAE,IAAwC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3F,MAAM,gBAAgB,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,cAAc,CAAC;QAE9F,4CAA4C;QAC5C,6DAA6D;QAC7D,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACvD,IAAI,eAAe,GAAiC,IAAI,CAAC;QAEzD,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,eAAe,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;YAClF,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,QAAQ,CAAC,yCAAyC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,iEAAiE;QACjE,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,EAAE,CAAC;QAExD,0FAA0F;QAC1F,IAAI,CAAC,iCAAiC,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;QAE9E,MAAM,UAAU,GAAG,CAAC,IAAI,IAAI,gBAAgB,CAAC;YAC3C,CAAC,CAAC,MAAM,IAAI,CAAC,kCAAkC,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC;YAC/E,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QAC9C,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,EAAE,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QAEvG;;;;;;;;;;;;;;;;;;;WAmBG;QAEH,sEAAsE;QACtE,4EAA4E;QAC5E,8EAA8E;QAC9E,IAAI,yBAAyB,CAAC,eAAe,CAAC,EAAE,CAAC;YAC/C,MAAM,cAAc,GAAG,0CAA0C,CAC/D,kBAAkB,EAClB,eAAe,CAChB,CAAC;YACF,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC;YAC9B,kBAAkB,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;QAC7C,CAAC;QAED,6FAA6F;QAC7F,qEAAqE;QACrE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,0BAA0B,CAAC,UAAU,EAAE;YACzF,UAAU;YACV,cAAc,EAAE,gBAAgB;SACjC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;YAClC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;YAC1B,UAAU,EAAE,CAAC,CAAC,IAAI;YAClB,MAAM,EAAE,IAAI,EAAE,GAAG;YACjB,2BAA2B,EAAE,kBAAkB;YAC/C,OAAO,EAAE,eAAe,EAAE,OAAO;YACjC,SAAS,EAAE,eAAe,EAAE,SAAS;SACtC,CAAC,CAAC;QAEH;;;;;;;;;;;;;;;;;WAiBG;QACH,MAAM,0BAA0B,GAAG,eAAe,EAAE,OAAO;YACzD,CAAC,CAAC,MAAM,IAAI,CAAC,yCAAyC,CAAC,EAAE,EAAE,eAAe,CAAC,OAAO,CAAC;YACnF,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,oBAAoB,GAAG,eAAe;YAC1C,CAAC,CAAC;gBACE,gBAAgB,EAAE,eAAe,CAAC,eAAe,EAAE,WAAW;gBAC9D,GAAG,8BAA8B,CAAC,0BAA0B,EAAE;oBAC5D,iFAAiF;oBACjF,OAAO,EACL,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;wBACxC,WAAW,EAAE,qBAAqB,CAAC,MAAM;wBACzC,KAAK,EAAE,eAAe,CAAC,OAAO;qBAC/B,CAAC;2BACC,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;4BAC3C,WAAW,EAAE,qBAAqB,CAAC,MAAM;4BACzC,KAAK,EAAE,eAAe,CAAC,OAAO;yBAC/B,CAAC;oBACJ,kFAAkF;oBAClF,yFAAyF;oBACzF,qFAAqF;oBACrF,qFAAqF;oBACrF,YAAY,EAAE,SAAS;iBACxB,CAAC;aACH;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,uEAAuE;QACvE,4EAA4E;QAC5E,6DAA6D;QAC7D,IAAI,CAAC,IAAI,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5F,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YACrH,IAAI,cAAc,EAAE,CAAC;gBACnB,kBAAkB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED;;;;;;;;;;;;;;WAcG;QAEH,MAAM,OAAO,GAAG;YACd,SAAS;YACT,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;YAC1B,UAAU,EAAE,IAAI,EAAE,6CAA6C;YAC/D,kBAAkB;YAClB,wBAAwB,EAAE,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YAClG,mBAAmB,EAAE,EAAE;YACvB,WAAW,EAAE,KAAK;YAClB,kBAAkB,EAAE,0CAAwC,CAAC,4BAA4B;YACzF,oBAAoB;YACpB,qBAAqB,EAAE,EAAE;SAC1B,CAAC;QACF,OAAO,gCAAgC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,kCAAkC;IAClC,0BAA0B;IAC1B,kCAAkC;IAElC;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,gCAAgC,CAC3C,EAAyB,EACzB,UAA8B,EAC9B,eAA8C;QAE9C,OAAO,IAAI,CAAC,+BAA+B,CAAC,EAAE,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;IAC/E,CAAC;IAEO,KAAK,CAAC,+BAA+B,CAAC,EAAyB,EAAE,eAA8C,EAAE,UAA+B;QACtJ,MAAM,MAAM,GAAG,UAAU,IAAI,0CAAwC,CAAC,oBAAoB,CAAC;QAC3F,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE,EAAE,CAAC;YACvD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;YACpG,IAAI,eAAe,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,gCAAgC,CAAC,UAA+B;QAC5E,MAAM,MAAM,GAAG,UAAU,IAAI,0CAAwC,CAAC,oBAAoB,CAAC;QAC3F,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,sBAAsB,EAAE,EAAE,CAAC;YACxD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YACrG,IAAI,eAAe,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,EAAE,oBAAoB,IAAI,EAAE,CAAC;QAChE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,wBAAwB,CAAC,eAA6B,EAAE,UAA+B;QAKnG,MAAM,MAAM,GAAG,UAAU,IAAI,0CAAwC,CAAC,oBAAoB,CAAC;QAC3F,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC,CAAC;QAC7E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAa,eAAe,CAAC,CAAC;QACzD,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,gBAAgB,CAAC;QAC9D,IAAI,aAAa,GAAiB,gBAAgB;aAC/C,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACtB,IAAI,gBAAgB,EAAE,CAAC;YACrB,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,SAAS,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC;IAC/D,CAAC;IAED,kCAAkC;IAClC,0BAA0B;IAC1B,kCAAkC;IAE3B,KAAK,CAAC,oBAAoB,CAAC,EAAyB,EAAE,mBAAwC;QACnG,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEzF,2BAA2B;QAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAClD,MAAM,YAAY,GAAG,IAAI,CAAC,iCAAiC,CAAC,SAAS,EAAE,mBAAmB,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACxH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;gBAClF,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE;aACrC,CAAC,CAAC;QACL,CAAC;QAED,8BAA8B;QAC9B,IAAI,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,MAAM,EAAE,CAAC;YACxD,MAAM,YAAY,GAAG,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,KAAK,EAAE;gBAC3F,YAAY,EAAE,KAAK;gBACnB,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE;aACrC,CAAC,CAAC;QACL,CAAC;QAED,2EAA2E;QAC3E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;YAClC,0BAA0B,CAAC,UAAU;YACrC,0BAA0B,CAAC,wBAAwB;SACpD,CAAC,CAAC;QACH,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;aACnF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAE1B,sEAAsE;QACtE,EAAE;QACF,+DAA+D;QAC/D,6DAA6D;QAC7D,+DAA+D;QAC/D,iEAAiE;QACjE,mEAAmE;QACnE,oEAAoE;QACpE,6DAA6D;QAC7D,8DAA8D;QAC9D,kEAAkE;QAClE,+DAA+D;QAC/D,oEAAoE;QACpE,wCAAwC;QACxC,EAAE;QACF,4DAA4D;QAC5D,iEAAiE;QACjE,2BAA2B;QAC3B,kEAAkE;QAClE,6DAA6D;QAC7D,+DAA+D;QAC/D,mEAAmE;QACnE,6DAA6D;QAC7D,kDAAkD;QAClD,kEAAkE;QAClE,+DAA+D;QAC/D,yDAAyD;QACzD,iEAAiE;QACjE,gEAAgE;QAChE,iEAAiE;QACjE,mEAAmE;QACnE,kEAAkE;QAClE,iEAAiE;QACjE,mEAAmE;QACnE,gEAAgE;QAChE,mEAAmE;QACnE,iEAAiE;QACjE,qDAAqD;QACrD,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,mEAAmE;QACnE,qDAAqD;QACrD,EAAE;QACF,mEAAmE;QACnE,gEAAgE;QAChE,2DAA2D;QAC3D,uDAAuD;QACvD,2CAA2C;QAC3C,8CAA8C;QAC9C,8DAA8D;QAC9D,8DAA8D;QAC9D,4DAA4D;QAC5D,gEAAgE;QAChE,8DAA8D;QAC9D,aAAa;QACb,EAAE;QACF,qEAAqE;QACrE,6DAA6D;QAC7D,iEAAiE;QACjE,kEAAkE;QAClE,4DAA4D;QAC5D,8DAA8D;QAC9D,6CAA6C;QAC7C,EAAE;QACF,kEAAkE;QAClE,6DAA6D;QAC7D,gEAAgE;QAChE,+DAA+D;QAC/D,2DAA2D;QAC3D,0DAA0D;QAC1D,gDAAgD;QAChD,+DAA+D;QAC/D,gEAAgE;QAChE,iEAAiE;QACjE,iEAAiE;QACjE,gEAAgE;QAChE,gEAAgE;QAChE,8DAA8D;QAC9D,0DAA0D;QAC1D,iEAAiE;QACjE,6DAA6D;QAC7D,8DAA8D;QAC9D,gEAAgE;QAChE,EAAE;QACF,gEAAgE;QAChE,8DAA8D;QAC9D,kEAAkE;QAClE,2DAA2D;QAC3D,+DAA+D;QAC/D,8DAA8D;QAC9D,qBAAqB;QACrB,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC;QAChD,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,GAAG,eAAe,CAAC,cAAc,GAAG,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7G,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,GAAG,eAAe,CAAC,WAAW,GAAG,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACnG,CAAC;QAED;;;;;;;;;;;;;;;;WAgBG;QAEH,eAAe;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACrF,MAAM,MAAM,GAAI,IAAa,CAAC,GAAG,CAAC;QAElC,yFAAyF;QACzF,mFAAmF;QACnF,wFAAwF;QACxF,yFAAyF;QACzF,wFAAwF;QACxF,sFAAsF;QACtF,mFAAmF;QACnF,8EAA8E;QAC9E,sFAAsF;QACtF,oFAAoF;QACpF,oFAAoF;QACpF,0DAA0D;QAC1D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kCAAkC,CAAC,EAAE,EAAE,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QAC1G,IAAI,CAAC,eAAe,CAAC,kBAAkB,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACtE,MAAM,YAAY,GAAG,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,KAAK,EAAE;gBAC3F,UAAU,EAAE,UAAU,CAAC,QAAQ;gBAC/B,YAAY,EAAE,CAAC,MAAM;aACtB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;gBAC7F,OAAO,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;aACjC,CAAC,CAAC;QACL,CAAC;QAED,iDAAiD;QACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAE1E,sFAAsF;QACtF,uFAAuF;QACvF,oFAAoF;QACpF,uFAAuF;QACvF,uFAAuF;QACvF,kFAAkF;QAClF,sDAAsD;QACtD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAChC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACtE,MAAM,YAAY,GAAG,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,KAAK,EAAE;gBAC3F,UAAU,EAAE,UAAU,CAAC,QAAQ;gBAC/B,YAAY,EAAE,CAAC,MAAM;aACtB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;gBAC7F,OAAO,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;aACjC,CAAC,CAAC;QACL,CAAC;QAED,qEAAqE;QACrE,mEAAmE;QACnE,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,mEAAmE;QACnE,8DAA8D;QAC9D,kEAAkE;QAClE,iBAAiB;QACjB,EAAE;QACF,oEAAoE;QACpE,qEAAqE;QACrE,qEAAqE;QACrE,kEAAkE;QAClE,sEAAsE;QACtE,iCAAiC;QACjC,EAAE;QACF,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,sCAAsC;QACtC,+BAA+B;QAC/B,oCAAoC;QACpC,+BAA+B;QAC/B,wEAAwE;QACxE,aAAa;QACb,EAAE;QACF,8CAA8C;QAC9C,0EAA0E;QAC1E,oEAAoE;QACpE,sEAAsE;QACtE,wEAAwE;QACxE,gCAAgC;QAChC,wEAAwE;QACxE,qEAAqE;QACrE,uBAAuB;QACvB,EAAE;QACF,gFAAgF;QAChF,2FAA2F;QAC3F,kGAAkG;QAClG,gGAAgG;QAChG,iGAAiG;QACjG,iGAAiG;QACjG,yFAAyF;QACzF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CACxC,GAAG,eAAe,CAAC,cAAc,GAAG,KAAK,CAAC,WAAW,EAAE,EAAE,EACzD,IAAI,CAAC,aAAa,CAAC,gBAAgB,EACnC,IAAI,CAAC,aAAa,CAAC,sBAAsB,GAAG,EAAE,EAC9C,SAAS,EACT,qFAAqF,EACrF;gBACE,SAAS,EAAE,SAAS,CAAC,cAAc;gBACnC,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,YAAY,EAAE,EAAE,sBAAsB,EAAE,IAAI,CAAC,aAAa,CAAC,sBAAsB,EAAE;aACpF,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,kBAAkB,EAAE,CAAC;YAC5B,IACE,mBAAmB,CAAC,kBAAkB,CAAC;gBACvC,kBAAkB,CAAC,sBAAsB,KAAK,2BAA2B,CAAC,6BAA6B,EACvG,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,2BAA2B,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,sBAAsB,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,oBAAoB,CAAC,uBAAuB,CAAC,CAAC;gBACpL,CAAC;gBAAC,MAAM,CAAC;oBACP,kFAAkF;gBACpF,CAAC;YACH,CAAC;YACD,MAAM,kBAAkB,CAAC;QAC3B,CAAC;QAED,uBAAuB;QACvB,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;YAClC,KAAK,EAAE,0BAA0B,CAAC,wBAAwB;YAC1D,aAAa,EAAE,eAAe,CAAC,KAAK;SACrC,CAAC,CAAC;QAEH,6CAA6C;QAC7C,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACnD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACrF,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;QAEhF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAC7D,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACtG,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,MAAM,iBAAiB,GAAG,YAAY;gBACpC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;gBACtE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,sBAAsB,GAAG,EAAE,CAAC;YACnD,MAAM,sBAAsB,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,GAAG,EAAE,CAAC,CAAC;YAEjE,0EAA0E;YAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YACtC,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBAC7C,KAAK;gBACL,UAAU,EAAE,UAAU,CAAC,QAAQ;gBAC/B,aAAa,EAAE,qBAAqB;gBACpC,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,iBAAiB,EAAE,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,QAAQ,GAAG,CAAC;gBAC7D,SAAS;aACV,CAAC,CAAC;YAEH,MAAM,YAAY,GAAG,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,KAAK,EAAE;gBAC3F,UAAU,EAAE,UAAU,CAAC,QAAQ;gBAC/B,YAAY,EAAE,CAAC,MAAM;gBACrB,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;aACtC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,MAAM;oBAC5B,CAAC,CAAC,2BAA2B,CAAC,6BAA6B;oBAC3D,CAAC,CAAC,2BAA2B,CAAC,uCAAuC;gBACvE,OAAO,EAAE;oBACP,KAAK;oBACL,YAAY;oBACZ,GAAG,CAAC,MAAM,IAAI;wBACZ,sBAAsB;wBACtB,iBAAiB;wBACjB,OAAO,EAAE,qFAAqF;qBAC/F,CAAC;iBACH;aACF,CAAC,CAAC;QACL,CAAC;QAED,qCAAqC;QACrC,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAE3E,oEAAoE;QACpE,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAEvC;;;;;;;WAOG;QACH,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,IAAI,CAAC,0BAA0B,CACnC,EAAE,EACF,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,OAAO,EACf,MAAM,EACL,IAAa,CAAC,KAAK,EACpB,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,IAAI,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,IAAI,EAAE,EAAE,CAC1F,CAAC;YAEF,MAAM,IAAI,CAAC,uBAAuB,CAChC,EAAE,EACF,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,OAAO,EACf,MAAM,CACP,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,iCAAiC,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEzF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,iCAAiC,CAC3C,SAAS,EACT,eAAe,CAAC,KAAK,EACrB,UAAU,CAAC,QAAQ,EACnB,EAAE,EAAE,+EAA+E;QACnF;YACE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,IAAI,EAAE;YACxD,WAAW,EAAE,cAAc,EAAE,WAAW,IAAI,KAAK;YACjD,mBAAmB,EAAE,cAAc,EAAE,4BAA4B,IAAI,EAAE;YACvE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB;YACtD,2BAA2B,EAAE,cAAc,EAAE,2BAA2B,IAAI,EAAE;YAC9E,yBAAyB,EAAE,cAAc,EAAE,yBAAyB,IAAI,EAAE;YAC1E,QAAQ,EAAE,cAAc,EAAE,QAAQ;YAClC,0BAA0B,EAAE,cAAc,EAAE,0BAA0B,IAAI,EAAE;SAC7E,CACF,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,4BAA4B;IAC5B,kCAAkC;IAElC;;;;OAIG;IACI,KAAK,CAAC,yBAAyB,CACpC,MAAc,EACd,KAAa,EACb,UAKI,EAAE;QAEN,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,0BAA0B,CAAC,UAAU,EAAE;YACzF,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,kBAAkB,CAAC,YAAY;YAC3D,KAAK;YACL,MAAM;YACN,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,wBAAwB,CACnC,EAAyB,EACzB,MAAc,EACd,KAAa,EACb,cAAuB,EACvB,UAAuD,EACvD,OAA4B;QAE5B,MAAM,UAAU,GAAG,cAAc;YAC/B,CAAC,CAAC,MAAM,IAAI,CAAC,kCAAkC,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC;YAC3E,CAAC,CAAC,0CAAwC,CAAC,oBAAoB,CAAC;QAElE,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,0BAA0B,CAAC,cAAc,EAAE;YAC7F,cAAc;YACd,OAAO,EAAE,OAAO,IAAI,kBAAkB,CAAC,YAAY;YACnD,KAAK;YACL,MAAM;YACN,UAAU;SACX,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,4BAA4B,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,4BAA4B,CACxC,EAAyB,EACzB,OAA8B,EAC9B,UAA8B,EAC9B,MAAc;QAEd,IAAI,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,cAAc,EAAE,CAAC;YAChE,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAElF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAE/D,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,uBAAuB,GAAG,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,SAAS,CAAC,CAAC;YAEhG,IAAI,uBAAuB,EAAE,CAAC;gBAC5B,IAAI,IAAI,IAAI,IAAI,CAAC,kBAAkB,KAAK,kBAAkB,CAAC,QAAQ,EAAE,CAAC;oBACpE,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,QAAQ,EAA8B,CAAC,CAAC;gBACrI,CAAC;gBACD,OAAO,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,eAAe,GAAG,UAAU,CAAC,SAAS,EAAE,yBAAyB,IAAI,CAAC,CAAC;YAC7E,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC;gBAClC,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC,CAAC;gBAEnE,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;wBAChD,kBAAkB,EAAE,kBAAkB,CAAC,KAAK;wBAC5C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,IAAI,IAAI,EAAE;qBAC1B,CAAC,CAAC;gBACjC,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE;oBAC1D,KAAK,EAAE,0BAA0B,CAAC,oBAAoB;oBACtD,QAAQ,EAAE,YAAY,CAAC,QAAQ;oBAC/B,iBAAiB,EAAE,cAAc,CAAC,WAAW,EAAE;oBAC/C,WAAW,EAAE,IAAI;iBAClB,CAAC,CAAC;gBACH,OAAO,OAAO,IAAI,OAAO,CAAC;YAC5B,CAAC;YAED,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,OAAO,EAA8B,CAAC,CAAC;YACpI,CAAC;YAED,MAAM,mBAAmB,GAAG,SAAS,CAAC,sBAAsB,EAAE,CAAC;YAC/D,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,MAAM,CACpD,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,CACxC,CAAC;YAEF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE;gBAC1D,KAAK,EAAE,0BAA0B,CAAC,uBAAuB;gBACzD,QAAQ,EAAE,YAAY,CAAC,cAAc;gBACrC,WAAW,EAAE,IAAI;gBACjB,gBAAgB,EAAE,UAAU,CAAC,SAAS,EAAE,gBAAgB,IAAI,KAAK;gBACjE,0BAA0B,EAAE,mBAAmB;aAChD,CAAC,CAAC;YACH,OAAO,OAAO,IAAI,OAAO,CAAC;QAC5B,CAAC;QAED,IAAI,IAAI,IAAI,IAAI,CAAC,kBAAkB,KAAK,kBAAkB,CAAC,YAAY,IAAI,IAAI,CAAC,kBAAkB,KAAK,kBAAkB,CAAC,QAAQ,EAAE,CAAC;YACnI,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,YAAY,EAA8B,CAAC,CAAC;QACzI,CAAC;QACD,OAAO,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,4BAA4B,CAAC,OAA8B;QACvE,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE;gBAC1D,KAAK,EAAE,0BAA0B,CAAC,kBAAkB;gBACpD,QAAQ,EAAE,YAAY,CAAC,UAAU;aAClC,CAAC,CAAC;YACH,OAAO,OAAO,IAAI,OAAO,CAAC;QAC5B,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE;YAC1D,KAAK,EAAE,0BAA0B,CAAC,SAAS;YAC3C,QAAQ,EAAE,YAAY,CAAC,QAAQ;SAChC,CAAC,CAAC;QACH,OAAO,OAAO,IAAI,OAAO,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,iCAAiC,CAC5C,EAAyB,EACzB,SAAiB;QAEjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;aACnF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,uBAAuB;YACpE,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,yBAAyB,EAAE,CAAC;YAC3E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,wBAAwB;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,wFAAwF;QACxF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACvE,MAAM,eAAe,GAAG,SAAS,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,eAAe,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,SAAS,CAAC,CAAC;QAE9E,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,gBAAgB;aACrE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,IAAI,IAAI,CAAC,kBAAkB,KAAK,kBAAkB,CAAC,QAAQ,EAAE,CAAC;YACpE,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,QAAQ,EAA8B,CAAC,CAAC;QACrI,CAAC;QAED,OAAO,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,qBAAqB,CAChC,EAAyB,EACzB,SAAiB,EACjB,gBAAwB;QAExB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;aACnF,CAAC,CAAC;QACL,CAAC;QAED,6EAA6E;QAC7E,2EAA2E;QAC3E,kDAAkD;QAClD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM;YAC9B,CAAC,CAAC,MAAM,mCAAmC,CACzC,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,YAAY,EACjB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,CACf;YACD,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE;gBAC3D,KAAK,EAAE,0BAA0B,CAAC,SAAS;gBAC3C,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,cAAc,EAAE,SAAS;gBACzB,cAAc,EAAE,SAAS,CAAC,cAAc;aACzC,CAAC,CAAC;YACH,OAAO,QAAQ,IAAI;gBACjB,GAAG,OAAO;gBACV,KAAK,EAAE,0BAA0B,CAAC,SAAS;gBAC3C,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,cAAc,EAAE,SAAS;gBACzB,cAAc,EAAE,SAAS,CAAC,cAAc;aACzC,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,kBAAkB,EAAE,CAAC;YACpE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,wBAAwB;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;aAC5F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,iBAAiB;aACtE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE;YAClD,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM;YAC9B,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,UAAU,GAAG,MAAM,EAAE,iBAAiB,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,UAAU,EAAE,cAAc,CAAC;QAC1C,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC9C,IACE,CAAC,MAAM;eACJ,CAAC,UAAU;eACX,CAAC,cAAc;eACf,MAAM,EAAE,aAAa,KAAK,sBAAsB,CAAC,UAAU;eAC3D,CAAC,MAAM,CAAC,4BAA4B,EAAE,QAAQ,CAAC,cAAc,CAAC,EACjE,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;gBACzE,OAAO,EAAE;oBACP,MAAM,EAAE,mCAAmC;oBAC3C,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,cAAc;iBACf;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACzD,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,CACxB,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;gBACzE,OAAO,EAAE;oBACP,MAAM,EAAE,kCAAkC;oBAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;iBACvC;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE;oBACP,UAAU,EAAE,WAAW,CAAC,MAAM;oBAC9B,MAAM,EAAE,yBAAyB;iBAClC;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;gBACzE,OAAO,EAAE;oBACP,MAAM,EAAE,6CAA6C;oBACrD,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,cAAc;iBACf;aACF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,WAAW,GAAG,2BAA2B,CAC7C,MAAM,EAAE,SAAS,EACjB,UAAU,CAAC,SAAS,IAAI,EAAE,EAC1B,WAAW,CAAC,SAAS,IAAI,EAAE,EAC3B,8BAA8B,CAAC,mBAAmB,CACnD,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;gBACzE,OAAO,EAAE;oBACP,OAAO,EAAE,8BAA8B,CAAC,mBAAmB;oBAC3D,eAAe,EAAE,WAAW,CAAC,eAAe;oBAC5C,cAAc,EAAE,OAAO,CAAC,cAAc;iBACvC;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;YAClE,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;YACjE,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,kBAAkB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;gBAC3C,mEAAmE;gBACnE,0EAA0E;gBAC1E,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC/D,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,EACvB,cAAc,CACf,CAAC;gBACF,IACE,CAAC,iBAAiB;uBACf,iBAAiB,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;uBAC9C,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,cAAc,CAAC,EACzD,CAAC;oBACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;wBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;wBACzE,OAAO,EAAE;4BACP,MAAM,EAAE,6CAA6C;4BACrD,cAAc,EAAE,OAAO,CAAC,cAAc;4BACtC,cAAc;yBACf;qBACF,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,wBAAwB,GAAG,2BAA2B,CAC1D,MAAM,CAAC,SAAS,EAChB,UAAU,CAAC,SAAS,IAAI,EAAE,EAC1B,iBAAiB,CAAC,SAAS,IAAI,EAAE,EACjC,8BAA8B,CAAC,mBAAmB,CACnD,CAAC;gBACF,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,CAAC;oBACtC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;wBACrE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;wBACzE,OAAO,EAAE;4BACP,OAAO,EAAE,8BAA8B,CAAC,mBAAmB;4BAC3D,eAAe,EAAE,wBAAwB,CAAC,eAAe;4BACzD,cAAc,EAAE,OAAO,CAAC,cAAc;yBACvC;qBACF,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,EAAE,EAAE;oBAClD,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,SAAS,EAAE,OAAO,CAAC,KAAK;oBACxB,cAAc;oBACd,gBAAgB,EAAE,WAAW;oBAC7B,iBAAiB,EAAE;wBACjB,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE;4BACxB,cAAc,EAAE;gCACd,4BAA4B,EAAE,CAAC,cAAc,CAAC;gCAC9C,aAAa,EAAE,sBAAsB,CAAC,GAAG;gCACzC,gBAAgB,EAAE,MAAM,EAAE,gBAAgB;6BAC3C;yBACF;qBACF;oBACD,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;oBACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;oBAC7C,cAAc;iBACf,CAAC,CAAC;gBACH,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC;oBACpD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;wBAChE,OAAO,EAAE;4BACP,MAAM,EAAE,6CAA6C;4BACrD,SAAS,EAAE,OAAO,CAAC,SAAS;4BAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;yBACvC;qBACF,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,uBAAuB,CAAC,EAAE,EAAE;oBAChC,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,cAAc,EAAE,SAAS,CAAC,cAAc;oBACxC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;oBAC3C,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;oBACrD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;oBAC7C,cAAc;iBACf,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC,cAAc,CAAC;YAClC,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE;YAC1D,KAAK,EAAE,0BAA0B,CAAC,SAAS;YAC3C,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,cAAc,EAAE,SAAS;YACzB,cAAc,EAAE,gBAAgB,CAAC,cAAc;SAChD,CAAC,CAAC;QACH,OAAO,OAAO,IAAI;YAChB,GAAG,OAAO;YACV,KAAK,EAAE,0BAA0B,CAAC,SAAS;YAC3C,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,cAAc,EAAE,SAAS;YACzB,cAAc,EAAE,gBAAgB,CAAC,cAAc;SAChD,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,6BAA6B;IAC7B,kCAAkC;IAE3B,KAAK,CAAC,YAAY,CAAC,EAAyB,EAAE,OAA8B;QACjF,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE;YAC/C,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;QAEH,IAAI,YAAoC,CAAC;QAEzC,mDAAmD;QACnD,sFAAsF;QACtF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACzD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,IAAI,CAAC,gCAAgC,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;gBAChH,CAAC;gBAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;gBAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,IAAI,CAAC,gCAAgC,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/G,CAAC;gBAED,IAAI,CAAC;oBACH,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,OAA8B,CAAC,CAAC;gBACrF,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM;YACR,CAAC;YAED,KAAK,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC1B,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,OAA8B,CAAC,CAAC;gBACnF,MAAM;YACR,CAAC;YAED,KAAK,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrB,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,OAA0B,CAAC,CAAC;gBAC3E,MAAM;YACR,CAAC;YAED,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;gBACxB,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,OAA6B,CAAC,CAAC;gBACjF,MAAM;YACR,CAAC;YAED,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;gBACxB,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,OAA4B,CAAC,CAAC;gBAC/E,MAAM;YACR,CAAC;YAED;gBACE,8CAA8C;gBAC9C,2FAA2F;gBAC3F,OAAO,IAAI,CAAC,gCAAgC,CAC1C,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,WAAW,IAAI,eAAe,CAAC,KAAK,EAC5C,EAAE,YAAY,EAAE,IAAI,EAAE,CACvB,CAAC;QACN,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE;YAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,YAAY,CAAC,OAAO;SAC9B,CAAC,CAAC;QAEH,4EAA4E;QAC5E,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,gCAAgC,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;YAChH,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAEhG,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC,QAAQ,CAAC,yCAAyC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;gBAE3F,yGAAyG;gBACzG,yEAAyE;gBACzE,4EAA4E;gBAC5E,+EAA+E;gBAC/E,6EAA6E;gBAC7E,yEAAyE;gBACzE,IAAI,WAAW,GAAgB,IAAI,CAAC;gBACpC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACnB,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;oBACrE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;wBAC7D,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,0BAA0B,CAAC,MAAM,EAAE,CAAC,CAAC;wBAC1F,IAAI,CAAC,kBAAkB,CAAC,WAAW,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,EAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;oBACpG,CAAC;oBAED,sGAAsG;oBACtG,IAAI,OAAO,CAAC,cAAc,IAAI,WAAW,EAAE,CAAC;wBAC1C,MAAM,SAAS,GAAI,WAA+C,CAAC,SAAS,IAAI,EAAE,CAAC;wBACnF,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;4BAChD,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,0BAA0B,CAAC,MAAM,EAAE,CAAC,CAAC;4BAC1F,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gCACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gCACrF,OAAO,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,EAAE,wBAAwB;6BAC9E,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,kEAAkE;gBAClE,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM;oBACtC,CAAC,CAAC,MAAM,IAAI,CAAC,kCAAkC,CAAC,EAAE,EAAE,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC;oBAC3F,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;gBAChD,MAAM,UAAU,GAAG,iBAAiB,CAAC,cAAc,EAAE,UAAU,IAAI,CAAC,CAAC;gBACrE,IAAI,UAAU,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;oBAC3F,IAAI,OAAO,EAAE,CAAC;wBACZ,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,0BAA0B,CAAC,gBAAgB,EAAE,CAAC,CAAC;wBACpG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;4BACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;4BACnF,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE;yBACtE,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE;oBACzD,mBAAmB,EAAE,IAAI;oBACzB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;iBACnD,CAAC,CAAC;gBAEH,8BAA8B;gBAC9B,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,0BAA0B,CAAC,SAAS,EAAE,CAAC,CAAC;gBAE7F,kCAAkC;gBAClC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAC9D,MAAM,gBAAgB,GAAG,YAAY,EAAE,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;gBAE1F,gDAAgD;gBAChD,MAAM,UAAU,GAAG,YAAY,EAAE,UAAU,CAAC;gBAC5C,IAAI,YAAY,EAAE,MAAM,EAAE,CAAC;oBACzB,kFAAkF;oBAClF,2EAA2E;oBAC3E,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;oBACrG,8EAA8E;oBAC9E,6EAA6E;oBAC7E,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC;wBACvC,MAAM,EAAE,YAAY,CAAC,MAAM;wBAC3B,KAAK,EAAE,YAAY,CAAC,KAAK,IAAI,SAAS;wBACtC,UAAU,EAAE,OAAO,CAAC,MAAM;wBAC1B,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;wBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;wBAC7C,SAAS,EAAE,OAAO,CAAC,SAAS;qBAC7B,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;gBACxB,CAAC;gBAED,mDAAmD;gBACnD,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAE5C,OAAO,IAAI,CAAC,iCAAiC,CAC3C,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,MAAM,EACd,MAAM,CAAC,WAAW,EAClB;oBACE,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,gBAAgB;oBAChB,IAAI,EAAE,WAAW,IAAI,SAAS;iBAC/B,CACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,OAAO,YAAY,CAAC;YACtB,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,kCAAkC;IAClC,4BAA4B;IAC5B,kCAAkC;IAElC;;;;;OAKG;IACI,KAAK,CAAC,6BAA6B,CAAC,EAAyB,EAAE,SAAiB;QACrF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,gDAAgD;QAChD,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,kCAAkC;IAClC,qCAAqC;IACrC,kCAAkC;IAElC;;;;;;;;OAQG;IACI,KAAK,CAAC,YAAY,CAAC,EAAyB,EAAE,SAAiB;QAMpE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;gBAClF,OAAO,EAAE,EAAE,SAAS,EAAE;aACvB,CAAC,CAAC;QACL,CAAC;QAED,8CAA8C;QAC9C,IAAI,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,sBAAsB;YACnE,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,YAAY,EAAE,CAAC;YAC9D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;aACzF,CAAC,CAAC;QACL,CAAC;QAED,gFAAgF;QAChF,EAAE;QACF,kGAAkG;QAClG,kGAAkG;QAClG,qGAAqG;QACrG,4FAA4F;QAC5F,oGAAoG;QACpG,sFAAsF;QACtF,EAAE;QACF,qGAAqG;QACrG,uGAAuG;QACvG,kGAAkG;QAClG,oGAAoG;QACpG,qGAAqG;QACrG,sFAAsF;QACtF,MAAM,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC;QACpE,IAAI,yBAAyB,IAAI,yBAAyB,CAAC,MAAM,GAAG,CAAC;eAC9D,CAAC,yBAAyB,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,mCAAmC;gBACvF,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,2BAA2B,EAAE;aAC1F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;aACpF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;aACnF,CAAC,CAAC;QACL,CAAC;QAED,sEAAsE;QACtE,qEAAqE;QACrE,iEAAiE;QACjE,uEAAuE;QACvE,4DAA4D;QAC5D,qEAAqE;QACrE,+DAA+D;QAC/D,uEAAuE;QACvE,+DAA+D;QAC/D,oEAAoE;QACpE,YAAY;QACZ,EAAE;QACF,mEAAmE;QACnE,mEAAmE;QACnE,mEAAmE;QACnE,qEAAqE;QACrE,uEAAuE;QACvE,iEAAiE;QACjE,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,mEAAmE;QACnE,qEAAqE;QACrE,uDAAuD;QACvD,MAAM,YAAY,GAAG,GAAG,eAAe,CAAC,SAAS,GAAG,MAAM,YAAY,CAAC;QACvE,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CACxC,YAAY,EACZ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAC1C,EAAE,EACF,SAAS,EACT,oEAAoE,CACrE,CAAC;QAEF,4FAA4F;QAC5F,MAAM,IAAI,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,MAAM,EAAE,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAEtG,uDAAuD;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAE7C,2DAA2D;QAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC5D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;YACpE,SAAS,EAAE,wBAAwB,CAAC,SAAS;YAC7C,eAAe,EAAE,+BAA+B,CAAC,UAAU;YAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;YAC/D,MAAM,EAAE,MAAM;YACd,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;YAC1C,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE;gBACR,OAAO;gBACP,SAAS;gBACT,KAAK;aACN;SACF,CAAC,CAAC;QAEH,uCAAuC;QACvC,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;YAClC,KAAK,EAAE,0BAA0B,CAAC,YAAY;YAC9C,aAAa,EAAE,eAAe,CAAC,MAAM;SACtC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAEvE,OAAO;YACL,QAAQ,EAAE,OAAO;YACjB,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC;YACzC,KAAK;YACL,aAAa;SACd,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,oBAAoB,CAAC,EAAyB,EAAE,OAA4B;QACvF,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAErC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,uFAAuF;QACvF,kFAAkF;QAClF,oFAAoF;QACpF,IAAI,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,YAAY;YACzD,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,yBAAyB;YACtE,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,sBAAsB,EAAE,CAAC;YACxE,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE;gBAC9E,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE;gBAC9E,YAAY,EAAE,IAAI;gBAClB,UAAU,EAAE,UAAU,CAAC,SAAS;aACjC,CAAC,CAAC;QACL,CAAC;QAED,gCAAgC;QAChC,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;YAClC,KAAK,EAAE,0BAA0B,CAAC,yBAAyB;YAC3D,aAAa,EAAE,eAAe,CAAC,MAAM;SACtC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,+EAA+E;QAC/E,sDAAsD;QACtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAErE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAEtE,wBAAwB;YACxB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YACtC,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBAC7C,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS;gBACjC,UAAU,EAAE,UAAU,CAAC,SAAS;gBAChC,aAAa,EAAE,kBAAkB;gBACjC,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,iBAAiB,EAAE,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,QAAQ,GAAG,CAAC;gBAC7D,SAAS;aACV,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE;gBAC9E,UAAU,EAAE,UAAU,CAAC,SAAS;gBAChC,YAAY,EAAE,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;QAED,gCAAgC;QAChC,MAAM,IAAI,CAAC,iCAAiC,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QAE1F,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,iCAAiC,CAC3C,SAAS,EACT,eAAe,CAAC,MAAM,EACtB,UAAU,CAAC,SAAS,EACpB,EAAE,EAAE,yDAAyD;QAC7D,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,IAAI,EAAE,EAAE,CAC7D,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,SAAiB,EAAE,IAAY;QAC3E,IAAI,CAAC;YACH,iDAAiD;YACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,qBAAqB,CACpE,MAAM,EACN,wBAAwB,CAAC,SAAS,CACnC,CAAC;YAEF,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAA+C,CAAC;gBAC1E,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,SAAS;oBAAE,SAAS;gBAEzD,yEAAyE;gBACzE,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACjD,IAAI,UAAU,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;oBAAE,SAAS;gBAE7F,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrF,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;gBAEhG,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;oBAC9B,+BAA+B;oBAC/B,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;wBAC/D,OAAO,IAAI,CAAC;oBACd,CAAC;oBAAC,MAAM,CAAC;wBACP,+CAA+C;wBAC/C,SAAS;oBACX,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;gBAC9C,MAAM;gBACN,SAAS;gBACT,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,gCAAgC;IAChC,kCAAkC;IAElC;;;;;;OAMG;IACI,KAAK,CAAC,gBAAgB,CAAC,EAAyB,EAAE,OAAwB;QAC/E,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAErC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,6DAA6D;QAC7D,IAAI,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,YAAY;YACzD,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,yBAAyB;YACtE,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,sBAAsB,EAAE,CAAC;YACxE,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE;gBAC9E,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,gCAAgC;QAChC,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;YAClC,KAAK,EAAE,0BAA0B,CAAC,yBAAyB;YAC3D,aAAa,EAAE,eAAe,CAAC,MAAM;SACtC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,2FAA2F;QAC3F,6FAA6F;QAC7F,+FAA+F;QAC/F,+FAA+F;QAC/F,6FAA6F;QAC7F,4BAA4B;QAC5B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAE7F,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE;gBAC9E,UAAU,EAAE,UAAU,CAAC,IAAI;gBAC3B,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,YAAY,CAAC,cAAc,CAAC;QAEnD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAEtE,wBAAwB;YACxB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YACtC,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBAC7C,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS;gBACjC,UAAU,EAAE,UAAU,CAAC,IAAI;gBAC3B,aAAa,EAAE,mBAAmB;gBAClC,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,iBAAiB,EAAE,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,QAAQ,GAAG,CAAC;gBAC7D,SAAS;aACV,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE;gBAC9E,UAAU,EAAE,UAAU,CAAC,IAAI;gBAC3B,YAAY,EAAE,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;QAED,iCAAiC;QACjC,MAAM,IAAI,CAAC,iCAAiC,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QAErF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,iCAAiC,CAC3C,SAAS,EACT,eAAe,CAAC,MAAM,EACtB,UAAU,CAAC,IAAI,EACf,EAAE,EAAE,yDAAyD;QAC7D;YACE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,IAAI,EAAE;YACxD,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;SACrE,CACF,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,oCAAoC;IACpC,kCAAkC;IAElC;;;;;;OAMG;IACI,KAAK,CAAC,mBAAmB,CAAC,EAAyB,EAAE,OAA2B;QACrF,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAErD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,4DAA4D;QAC5D,MAAM,WAAW,GAAG,WAAW,KAAK,eAAe,CAAC,KAAK;YACvD,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,0BAA0B,CAAC,UAAU,EAAE,0BAA0B,CAAC,wBAAwB,CAAC,CAAC;YACvG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,0BAA0B,CAAC,YAAY,EAAE,0BAA0B,CAAC,yBAAyB,EAAE,0BAA0B,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAEhK,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,WAAW,EAAE;gBACnE,UAAU,EAAE,UAAU,CAAC,OAAO;gBAC9B,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,gCAAgC;QAChC,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;YAClC,KAAK,EAAE,WAAW,KAAK,eAAe,CAAC,KAAK;gBAC1C,CAAC,CAAC,0BAA0B,CAAC,wBAAwB;gBACrD,CAAC,CAAC,0BAA0B,CAAC,yBAAyB;YACxD,aAAa,EAAE,WAAW;SAC3B,CAAC,CAAC;QAEH,8DAA8D;QAC9D,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,YAAY,GAAG,QAAQ,CAAC,EAAE,CAAC;QAC/B,IAAI,cAAyE,CAAC;QAC9E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,4BAA4B,CAAC,EAAE,EAAE,MAAM,EAAE,QAAe,CAAC,CAAC;YACpG,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3B,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;YACnC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE;gBACvD,MAAM;gBACN,SAAS;gBACT,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAEtE,iCAAiC;YACjC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YACtC,MAAM,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;gBACpD,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS;gBACjC,2FAA2F;gBAC3F,gFAAgF;gBAChF,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,8BAA8B;gBACvG,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS;aACV,CAAC,CAAC;YAEH;;;;;;;eAOG;YACH,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,gBAAgB,CAAC,4BAA4B,CAAC;oBACvD,MAAM;oBACN,YAAY,EAAE,cAAc,CAAC,YAAY;oBACzC,aAAa,EAAE,cAAc,CAAC,aAAa;oBAC3C,eAAe,EAAE,cAAc,CAAC,eAAe;oBAC/C,oBAAoB,EAAE,cAAc,CAAC,oBAAoB;oBACzD,kBAAkB,EAAE,cAAc,CAAC,kBAAkB;oBACrD,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnE,QAAQ,EAAE,cAAc,CAAC,QAAQ;oBACjC,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;oBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;iBAC9C,CAAC,CAAC;YACL,CAAC;YAED,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,WAAW,EAAE;gBACnE,UAAU,EAAE,UAAU,CAAC,OAAO;gBAC9B,YAAY,EAAE,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;QAED,uCAAuC;QACvC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,8FAA8F;QAC9F,0FAA0F;QAC1F,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACxF,MAAM,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;YACpD,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS;YACjC,YAAY;YACZ,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;YAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;YAC7C,SAAS;SACV,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;QAEtB,oEAAoE;QACpE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QAED,uBAAuB;QACvB,MAAM,IAAI,CAAC,iCAAiC,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;QAExF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,iCAAiC,CAC3C,SAAS,EACT,WAAW,EACX,UAAU,CAAC,OAAO,EAClB,EAAE,EAAE,yDAAyD;QAC7D;YACE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,IAAI,EAAE;YACxD,WAAW,EAAE,cAAc,EAAE,WAAW,IAAI,KAAK;YACjD,mBAAmB,EAAE,cAAc,EAAE,4BAA4B,IAAI,EAAE;YACvE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB;SACvD,CACF,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,cAAc;IACd,kCAAkC;IAElC;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,iBAAiB,CAAC,EAAyB,EAAE,MAAc,EAAE,iBAA8B,EAAE,UAA+B;QACxI,MAAM,MAAM,GAAG,UAAU,IAAI,0CAAwC,CAAC,oBAAoB,CAAC;QAC3F,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,MAAM,YAAY,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,EAAkB,EAAE,CAAC;QAE9E,mGAAmG;QACnG,IAAI,iBAAiB,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;YAC7C,MAAM,oBAAoB,GAAG,SAAS,EAAE,oBAAoB,IAAI,IAAI,CAAC;YACrE,IAAI,oBAAoB,EAAE,CAAC;gBACzB,OAAO,YAAY,CAAC;YACtB,CAAC;QACH,CAAC;QAED,MAAM,iBAAiB,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC;QAElD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAE/D,MAAM,eAAe,GAAG,SAAS,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;YAEvE,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,qBAAqB,GAAG,eAAe,CAAC,IAAI,CAChD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,SAAS,CAClC,CAAC;gBAEF,IAAI,qBAAqB,EAAE,CAAC;oBAC1B,IAAI,IAAI,IAAI,IAAI,CAAC,kBAAkB,KAAK,kBAAkB,CAAC,QAAQ,EAAE,CAAC;wBACpE,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,QAAQ,EAA8B,CAAC,CAAC;oBACrI,CAAC;oBACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;gBAC7C,CAAC;gBAED,MAAM,SAAS,GAAG,SAAS,EAAE,yBAAyB,IAAI,CAAC,CAAC;gBAC5D,IAAI,SAAS,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;oBAC1B,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;wBAC3B,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,gBAAgB,EAAE,IAAI,IAAI,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,KAAK,EAA8B,CAAC,CAAC;oBAChK,CAAC;yBAAM,IAAI,IAAI,CAAC,kBAAkB,KAAK,kBAAkB,CAAC,KAAK,EAAE,CAAC;wBAChE,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,KAAK,EAA8B,CAAC,CAAC;oBAClI,CAAC;oBAED,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,IAAI,IAAI,IAAI,EAAE,CAAC;oBACvD,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,UAAU,CAAC,CAAC;oBACzE,IAAI,IAAI,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC;wBAC1B,OAAO,YAAY,CAAC;oBACtB,CAAC;oBAED,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,OAAO,EAA8B,CAAC,CAAC;gBACpI,CAAC;gBAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;YAC7C,CAAC;YAED,IAAI,IAAI,EAAE,YAAY,EAAE,CAAC;gBACvB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,iBAAiB,EAAE,CAAC;gBACtB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;YACjD,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,kCAAkC;IAClC,0BAA0B;IAC1B,kCAAkC;IAElC,kGAAkG;IAClG,gEAAgE;IAEhE,kCAAkC;IAClC,iCAAiC;IACjC,kCAAkC;IAElC,0HAA0H;IAE1H;;;;;;;;;;;;;;;;;;;OAmBG;IACK,KAAK,CAAC,yCAAyC,CACrD,EAAyB,EACzB,cAAsB;QAEtB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;YACnG,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,IAAI,CAAsC,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;YACpG,OAAO,OAAO,EAAE,QAAQ,IAAI,SAAS,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oFAAoF,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;YAC3H,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACK,KAAK,CAAC,0BAA0B,CACtC,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,MAAc,EACd,KAAc,EACd,UAAwE;QAExE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YACpF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;iBAChF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;YAClC,IAAI,CAAC,WAAW,CAAC,UAAU;gBAAE,OAAO;YAEpC;;;;eAIG;YACH,IAAI,mBAAmB,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC1D;;;;;;;;;mBASG;gBACH,KAAK,IAAI,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;oBACjD,MAAM;oBACN,KAAK,EAAE,KAAM;oBACb,SAAS;oBACT,GAAG,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY;wBAC1C,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE;wBAC7B,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;oBAC/B,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,EAAE;oBACtC,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,EAAE;oBACtC,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,EAAE;iBACvC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;wBACvE,SAAS;wBACT,OAAO;wBACP,GAAG,2BAA2B,CAAC,KAAK,CAAC;qBACtC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC,WAAW,CAAC,qBAAqB,EAAE,CAAC;gBACvC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;iBAChF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,QAAQ,GAAG,WAAW,CAAC,kBAAkB,CAAC;YAChD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;iBAChF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;iBAChF,CAAC,CAAC;YACL,CAAC;YAED,qFAAqF;YACrF,oFAAoF;YACpF,sFAAsF;YACtF,gDAAgD;YAChD,qDAAqD;YACrD,MAAM,UAAU,GAAG,GAAG,eAAe,CAAC,gBAAgB,GAAG,SAAS,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YAC1F,IAAI,YAAoB,CAAC;YACzB,IAAI,CAAC;gBACH,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACvE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,QAAQ,CAAC,iDAAiD,EAAE;oBAC/D,SAAS;oBACT,OAAO;oBACP,MAAM;oBACN,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;iBAChF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;oBAC/E,OAAO,EAAE;wBACP,wBAAwB;wBACxB,eAAe,EAAE,YAAY;wBAC7B,cAAc,EAAE,QAAQ;qBACzB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,4CAA4C,EAAE;gBAC1D,SAAS;gBACT,OAAO;gBACP,MAAM;gBACN,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;aAChF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,4FAA4F;IACpF,MAAM,CAAU,qBAAqB,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAEnE;;;;OAIG;IACK,KAAK,CAAC,uBAAuB,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe,EAAE,MAAc;QACxH,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YACpF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;iBAChF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU;gBAAE,OAAO;YAE9C,MAAM,UAAU,GAAG,GAAG,eAAe,CAAC,gBAAgB,GAAG,SAAS,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YAC1F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CACzD,UAAU,EACV,0CAAwC,CAAC,qBAAqB,CAC/D,CAAC;YAEF,IAAI,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,kBAAkB,EAAE,CAAC;gBACxD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;oBAC/E,OAAO,EAAE;wBACP,wBAAwB;wBACxB,eAAe,EAAE,QAAQ;wBACzB,cAAc,EAAE,SAAS,CAAC,WAAW,CAAC,kBAAkB;qBACzD;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,qCAAqC,EAAE;gBACnD,SAAS;gBACT,OAAO;gBACP,MAAM;gBACN,eAAe,EAAE,QAAQ;gBACzB,cAAc,EAAE,SAAS,CAAC,WAAW,CAAC,kBAAkB;aACzD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,wDAAwD,EAAE;gBACtE,SAAS;gBACT,OAAO;gBACP,MAAM;gBACN,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;aAChF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,wBAAwB;IACxB,kCAAkC;IAElC;;;;OAIG;IACI,KAAK,CAAC,aAAa,CAAC,EAAyB,EAAE,OAA6B,EAAE,UAAuD,EAAE,yBAAyB,GAAG,KAAK;QAQ7K,gGAAgG;QAChG,kGAAkG;QAClG,mGAAmG;QACnG,mGAAmG;QACnG,kGAAkG;QAClG,6FAA6F;QAC7F,iGAAiG;QACjG,yFAAyF;QACzF,IAAI,CAAC,yBAAyB,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;aACvF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAE1B,2DAA2D;QAC3D,4DAA4D;QAC5D,gEAAgE;QAChE,kDAAkD;QAClD,8DAA8D;QAC9D,6DAA6D;QAC7D,+DAA+D;QAC/D,6DAA6D;QAC7D,8DAA8D;QAC9D,8DAA8D;QAC9D,4DAA4D;QAC5D,iEAAiE;QACjE,wBAAwB;QAExB,gDAAgD;QAChD,IAAI,IAAI,GAAgB,IAAI,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;QAED,6DAA6D;QAC7D,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;YAC3C,KAAK;YACL,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;YAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;SAC9C,CAAC,CAAC;QAEH,qFAAqF;QACrF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC;QAExB,sGAAsG;QACtG,wGAAwG;QACxG,mGAAmG;QACnG,wGAAwG;QACxG,wGAAwG;QACxG,+FAA+F;QAC/F,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC/B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3G,IAAI,UAAU,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,sDAAsD;QACtD,MAAM,IAAI,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,MAAM,EAAE,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAEvG,qFAAqF;QACrF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;YACjE,SAAS,EAAE,wBAAwB,CAAC,UAAU;YAC9C,eAAe,EAAE,+BAA+B,CAAC,UAAU;YAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,kBAAkB,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;YACzF,MAAM,EAAE,MAAM;YACd,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;YAC1C,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,EAAE,KAAK,EAAE;SACpB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAE7D,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC;YACtC,KAAK;YACL,MAAM;YACN,gBAAgB,EAAE,IAAI,CAAC,eAAe,CAAC,kBAAkB;SAC1D,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,eAAe,CAAC,EAAyB,EAAE,OAA+B,EAAE,UAAuD,EAAE,cAAuB;QACvK,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;aACvF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAE1B,8DAA8D;QAC9D,IAAI,cAAc,GAAiF,IAAI,CAAC;QACxG,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAC;QACjH,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBAC7C,aAAa,EAAE,qCAAqC;gBACpD,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;aAC9C,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,EAAE;gBACb,UAAU,EAAE,KAAK;gBACjB,WAAW,EAAE,eAAe,CAAC,KAAK;gBAClC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,KAAK,EAAE,+BAA+B;gBACtC,SAAS,EAAE,oBAAoB;gBAC/B,YAAY,EAAE,KAAK;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,WAAW,EAAE,KAAK;aACO,CAAC;QAC9B,CAAC;QAED,oFAAoF;QACpF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,oFAAoF;YACpF,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBAC7C,aAAa,EAAE,wDAAwD;gBACvE,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;aAC9C,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,EAAE;gBACb,UAAU,EAAE,KAAK;gBACjB,WAAW,EAAE,eAAe,CAAC,KAAK;gBAClC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,KAAK,EAAE,+BAA+B;gBACtC,SAAS,EAAE,oBAAoB;gBAC/B,YAAY,EAAE,KAAK;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,WAAW,EAAE,KAAK;aACO,CAAC;QAC9B,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBAC7C,aAAa,EAAE,yCAAyC;gBACxD,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;aAC9C,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,EAAE;gBACb,UAAU,EAAE,KAAK;gBACjB,WAAW,EAAE,eAAe,CAAC,KAAK;gBAClC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,KAAK,EAAE,0BAA0B;gBACjC,SAAS,EAAE,oBAAoB;gBAC/B,YAAY,EAAE,KAAK;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,WAAW,EAAE,KAAK;aACO,CAAC;QAC9B,CAAC;QACD,MAAM,aAAa,GAAG,cAAc,CAAC,QAA+C,CAAC;QACrF,MAAM,KAAK,GAAG,aAAa,EAAE,KAAe,CAAC;QAE7C,wEAAwE;QACxE,4EAA4E;QAC5E,iEAAiE;QACjE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iEAAiE,EAAE;gBAClF,MAAM;gBACN,SAAS,EAAE,wBAAwB,CAAC,UAAU;aAC/C,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBAC7C,aAAa,EAAE,qDAAqD;gBACpE,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;aAC9C,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,EAAE;gBACb,UAAU,EAAE,KAAK;gBACjB,WAAW,EAAE,eAAe,CAAC,KAAK;gBAClC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,KAAK,EAAE,+BAA+B;gBACtC,SAAS,EAAE,oBAAoB;gBAC/B,YAAY,EAAE,KAAK;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,WAAW,EAAE,KAAK;aACO,CAAC;QAC9B,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACvD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACjE,IAAI,aAAa,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;YAC/G,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mEAAmE,EAAE;gBACpF,MAAM;gBACN,YAAY,EAAE,OAAO,CAAC,KAAK;aAC5B,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBAC7C,aAAa,EAAE,0CAA0C;gBACzD,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;aAC9C,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,EAAE;gBACb,UAAU,EAAE,KAAK;gBACjB,WAAW,EAAE,eAAe,CAAC,KAAK;gBAClC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,KAAK,EAAE,+BAA+B;gBACtC,SAAS,EAAE,oBAAoB;gBAC/B,YAAY,EAAE,KAAK;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,WAAW,EAAE,KAAK;aACO,CAAC;QAC9B,CAAC;QAED,gBAAgB;QAChB,IAAI,IAAI,GAAgB,IAAI,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA6BG;QACH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBAC7C,aAAa,EAAE,0CAA0C;gBACzD,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;aAC9C,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,EAAE;gBACb,UAAU,EAAE,KAAK;gBACjB,WAAW,EAAE,eAAe,CAAC,KAAK;gBAClC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,KAAK,EAAE,+BAA+B;gBACtC,SAAS,EAAE,oBAAoB;gBAC/B,YAAY,EAAE,KAAK;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,WAAW,EAAE,KAAK;aACO,CAAC;QAC9B,CAAC;QAED,gEAAgE;QAChE,MAAM,UAAU,GAAI,IAAgC,CAAC,MAA4B,CAAC;QAClF,IAAI,UAAU,IAAI,UAAU,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YACnD,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;gBAC7C,aAAa,EAAE,kCAAkC,UAAU,GAAG;gBAC9D,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;gBAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;aAC9C,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,EAAE;gBACb,UAAU,EAAE,KAAK;gBACjB,WAAW,EAAE,eAAe,CAAC,KAAK;gBAClC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,KAAK,EAAE,+BAA+B;gBACtC,SAAS,EAAE,oBAAoB;gBAC/B,YAAY,EAAE,KAAK;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,WAAW,EAAE,KAAK;aACO,CAAC;QAC9B,CAAC;QAED,+DAA+D;QAC/D,IAAI,iBAA4C,CAAC;QACjD,IAAI,eAAmC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YACvD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;oBACtF,iBAAiB,GAAG,eAAe,EAAE,SAAS,CAAC;oBAC/C,eAAe,GAAG,eAAe,EAAE,OAAO,CAAC;gBAC7C,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,QAAQ,CAAC,kEAAkE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;gBACrG,CAAC;YACH,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,EAAE,CAAC;QACxD,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,0BAA0B,CAAC,sBAAsB,EAAE;YACrF,UAAU;YACV,cAAc;SACf,CAAC,CAAC;QAEH,2EAA2E;QAC3E,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;YAClC,KAAK;YACL,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,MAAM;YACd,gBAAgB,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YACzC,aAAa,EAAE,eAAe,CAAC,KAAK;YACpC,SAAS,EAAE,iBAAiB;YAC5B,OAAO,EAAE,eAAe;SACzB,CAAC,CAAC;QAEH,gBAAgB;QAChB,8FAA8F;QAC9F,0EAA0E;QAC1E,MAAM,sBAAsB,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACjG,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;YAC/C,MAAM,EAAE,MAAM;YACd,KAAK;YACL,SAAS;YACT,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;YAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;SAC9C,EAAE,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAE/B,oFAAoF;QACpF,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QAED,+DAA+D;QAC/D,EAAE;QACF,0FAA0F;QAC1F,yDAAyD;QACzD,EAAE;QACF,uGAAuG;QACvG,uGAAuG;QACvG,qGAAqG;QACrG,oEAAoE;QACpE,mFAAmF;QACnF,wGAAwG;QACxG,6FAA6F;QAC7F,EAAE;QACF,yGAAyG;QACzG,oEAAoE;QACpE,oGAAoG;QACpG,sGAAsG;QACtG,wGAAwG;QACxG,yGAAyG;QACzG,yDAAyD;QACzD,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC;QAC/D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kCAAkC,CAAC,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACpG,qGAAqG;QACrG,sGAAsG;QACtG,wGAAwG;QACxG,iGAAiG;QACjG,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;gBACtF,OAAO,EAAE,EAAE,MAAM,EAAE,wCAAwC,EAAE;aAC9D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAElG,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;YAErG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;gBAClC,KAAK,EAAE,0BAA0B,CAAC,YAAY;gBAC9C,WAAW,EAAE,IAAI;gBACjB,gBAAgB,EAAE,aAAa,CAAC,gBAAgB;gBAChD,4BAA4B,EAAE,aAAa,CAAC,gBAAgB;gBAC5D,2BAA2B,EAAE,QAAQ,CAAC,eAAe;gBACrD,yBAAyB,EAAE,aAAa,CAAC,aAAa;aACvD,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS;gBACT,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,eAAe,CAAC,KAAK;gBAClC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,WAAW,EAAE,IAAI;gBACjB,mBAAmB,EAAE,aAAa,CAAC,gBAAgB;gBACnD,kBAAkB,EAAE,0CAAwC,CAAC,4BAA4B;gBACzF,2BAA2B,EAAE,QAAQ,CAAC,eAAe;gBACrD,yBAAyB,EAAE,aAAa,CAAC,aAAa;gBACtD,gBAAgB,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;gBACzC,YAAY,EAAE,IAAI;gBAClB,iBAAiB,EAAE,EAAE;aACI,CAAC;QAC9B,CAAC;QAED,yCAAyC;QACzC,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;YAClC,KAAK,EAAE,0BAA0B,CAAC,SAAS;SAC5C,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;aAChF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,cAAc,EAAE;YAChE,mBAAmB,EAAE,IAAI;YACzB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;SACnD,CAAC,CAAC;QAEH,cAAc;QACd,uGAAuG;QACvG,MAAM,kBAAkB,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QAC7F,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC;YACvC,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;YAC7C,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;YAC7C,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,KAAK;YACL,SAAS;SACV,EAAE,EAAE,EAAE,kBAAkB,CAAC,CAAC;QAE3B,mBAAmB;QACnB,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAEpC,+EAA+E;QAC/E,gFAAgF;QAChF,gFAAgF;QAChF,kFAAkF;QAClF,sFAAsF;QACtF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAErE,OAAO,IAAI,CAAC,iCAAiC,CAC3C,SAAS,EACT,eAAe,CAAC,KAAK,EACrB,UAAU,CAAC,UAAU,EACrB,MAAM,CAAC,WAAW,EAClB;YACE,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,gBAAgB,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YACzC,IAAI,EAAE,aAAa,IAAI,SAAS;SACjC,CACF,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,qBAAqB;IACrB,kCAAkC;IAElC;;;;OAIG;IACI,KAAK,CAAC,UAAU,CAAC,EAAyB,EAAE,SAAiB,EAAE,WAAoB;QACxF,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;aACpF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;gBAClF,OAAO,EAAE,EAAE,SAAS,EAAE;aACvB,CAAC,CAAC;QACL,CAAC;QAED,yFAAyF;QACzF,MAAM,eAAe,GAAG;YACtB,0BAA0B,CAAC,UAAU;YACrC,0BAA0B,CAAC,wBAAwB;YACnD,0BAA0B,CAAC,sBAAsB;YACjD,0BAA0B,CAAC,YAAY;SACxC,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAmC,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;aACnF,CAAC,CAAC;QACL,CAAC;QAED,iGAAiG;QACjG,8FAA8F;QAC9F,oFAAoF;QACpF,qGAAqG;QACrG,mGAAmG;QACnG,+FAA+F;QAC/F,gGAAgG;QAChG,cAAc;QACd,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;YACtH,IAAI,UAAU,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5F,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;iBACpF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,IAAI,WAAW,GAAG,WAAW,CAAC;QAE9B,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC9B,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBACtE,CAAC;gBAAC,MAAM,CAAC;oBACP,WAAW;gBACb,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,gCAAgC;aACrF,CAAC,CAAC;QACL,CAAC;QAED,2DAA2D;QAC3D,+DAA+D;QAC/D,+DAA+D;QAC/D,8DAA8D;QAC9D,iEAAiE;QACjE,4DAA4D;QAC5D,gEAAgE;QAChE,oEAAoE;QACpE,6DAA6D;QAC7D,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,yDAAyD;QACzD,4DAA4D;QAC5D,0DAA0D;QAC1D,EAAE;QACF,kEAAkE;QAClE,6DAA6D;QAC7D,yDAAyD;QACzD,gDAAgD;QAChD,8DAA8D;QAC9D,yDAAyD;QACzD,+BAA+B;QAC/B,8DAA8D;QAC9D,sDAAsD;QACtD,+DAA+D;QAC/D,6DAA6D;QAC7D,iDAAiD;QACjD,gEAAgE;QAChE,2DAA2D;QAC3D,gEAAgE;QAChE,qDAAqD;QACrD,+DAA+D;QAC/D,8DAA8D;QAC9D,6DAA6D;QAC7D,+DAA+D;QAC/D,4DAA4D;QAC5D,gEAAgE;QAChE,+DAA+D;QAC/D,iCAAiC;QACjC,EAAE;QACF,+DAA+D;QAC/D,+DAA+D;QAC/D,+DAA+D;QAC/D,6DAA6D;QAC7D,gEAAgE;QAChE,0DAA0D;QAC1D,gDAAgD;QAChD,EAAE;QACF,0DAA0D;QAC1D,6DAA6D;QAC7D,8DAA8D;QAC9D,0DAA0D;QAC1D,wDAAwD;QACxD,+DAA+D;QAC/D,gDAAgD;QAChD,EAAE;QACF,8DAA8D;QAC9D,wEAAwE;QACxE,yDAAyD;QACzD,6DAA6D;QAC7D,iEAAiE;QACjE,6DAA6D;QAC7D,8DAA8D;QAC9D,4DAA4D;QAC5D,6DAA6D;QAC7D,4DAA4D;QAC5D,+DAA+D;QAC/D,4DAA4D;QAC5D,MAAM,cAAc,GAAG,mBAAmB,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC;QAChF,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CACxC,GAAG,eAAe,CAAC,aAAa,GAAG,cAAc,QAAQ,EACzD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,EACpC,EAAE,CACH,CAAC;QACF,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CACxC,GAAG,eAAe,CAAC,aAAa,GAAG,cAAc,SAAS,EAC1D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,EACrC,IAAI,CACL,CAAC;QAEF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,MAAM,EAAE,CAAC;YACX,iCAAiC;YACjC,MAAM,IAAI,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,MAAM,EAAE,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACtG,CAAC;QAED,oBAAoB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEnE,4BAA4B;QAC5B,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;YAC5C,SAAS,EAAE,wBAAwB,CAAC,OAAO;YAC3C,eAAe,EAAE,+BAA+B,CAAC,UAAU;YAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;YACrF,MAAM,EAAE,MAAM;YACd,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;YAC1C,SAAS,EAAE,MAAM,IAAI,WAAW;YAChC,QAAQ,EAAE;gBACR,OAAO;gBACP,SAAS;gBACT,WAAW,EAAE,WAAW;aACzB;SACF,CAAC,CAAC;QAEH,QAAQ;QACR,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;YACxC,WAAW,EAAE,WAAW;YACxB,WAAW,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,KAAK;YAC3D,SAAS;YACT,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,IAAI,SAAS;YACrD,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,IAAI,SAAS;SACtD,CAAC,CAAC;QAEH,2DAA2D;QAC3D,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,sBAAsB;eACrF,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,YAAY,CAAC;QAC/D,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;YAClC,KAAK,EAAE,cAAc;gBACnB,CAAC,CAAC,0BAA0B,CAAC,YAAY;gBACzC,CAAC,CAAC,0BAA0B,CAAC,wBAAwB;YACvD,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK;SAC/E,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;QAE5E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,kBAAkB,CAAC,EAAyB,EAAE,OAA0B;QACnF,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,+BAA+B;aACpF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;QAElD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,wFAAwF;QACxF,oFAAoF;QACpF,MAAM,iBAAiB,GAAG;YACxB,0BAA0B,CAAC,UAAU;YACrC,0BAA0B,CAAC,wBAAwB;YACnD,0BAA0B,CAAC,sBAAsB;YACjD,0BAA0B,CAAC,YAAY;YACvC,0BAA0B,CAAC,yBAAyB;SACrD,CAAC;QACF,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAmC,CAAC,EAAE,CAAC;YAC7E,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,WAAW,EAAE;gBACnE,YAAY,EAAE,KAAK;gBACnB,UAAU,EAAE,UAAU,CAAC,OAAO;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,WAAW,EAAE;gBACnE,YAAY,EAAE,IAAI;gBAClB,UAAU,EAAE,UAAU,CAAC,OAAO;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,gCAAgC;QAChC,MAAM,eAAe,GAAG,WAAW,KAAK,eAAe,CAAC,MAAM;YAC5D,CAAC,CAAC,0BAA0B,CAAC,yBAAyB;YACtD,CAAC,CAAC,0BAA0B,CAAC,wBAAwB,CAAC;QACxD,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE;YAClC,KAAK,EAAE,eAAe;YACtB,aAAa,EAAE,WAAW;SAC3B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,uEAAuE;QACvE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAEnE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAEtE,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;gBAC1C,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,WAAW;gBACX,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,kBAAkB;gBACrF,SAAS;gBACT,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,IAAI,SAAS;gBACrD,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,IAAI,SAAS;aACtD,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,WAAW,EAAE;gBACnE,YAAY,EAAE,CAAC,MAAM;gBACrB,UAAU,EAAE,UAAU,CAAC,OAAO;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,gBAAgB;QAChB,iFAAiF;QACjF,iEAAiE;QACjE,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACxF,MAAM,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,CAAC;YAC5C,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,SAAS;YAC7C,WAAW;YACX,SAAS;YACT,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,IAAI,SAAS;YACrD,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,IAAI,SAAS;SACtD,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;QAEtB,wDAAwD;QACxD,MAAM,IAAI,CAAC,iCAAiC,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;QAExF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,iCAAiC,CAC3C,SAAS,EACT,WAAW,EACX,UAAU,CAAC,OAAO,EAClB,EAAE,EAAE,yDAAyD;QAC7D,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,IAAI,EAAE,EAAE,CAC7D,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,SAAiB,EAAE,aAAqB;QAClF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,qBAAqB,CACpE,MAAM,EACN,wBAAwB,CAAC,OAAO,CACjC,CAAC;YAEF,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAA+C,CAAC;gBAC1E,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,SAAS;oBAAE,SAAS;gBAEzD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACjD,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;oBAAE,SAAS;gBAEtG,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;gBAC9F,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;gBAEhG,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;oBAC9B,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;wBAC/D,OAAO,IAAI,CAAC;oBACd,CAAC;oBAAC,MAAM,CAAC;wBACP,SAAS;oBACX,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE;gBAC5C,MAAM;gBACN,SAAS;gBACT,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,MAAc;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,6DAA6D;QAC7D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;QAC7B,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,kCAAkC;IAClC,mBAAmB;IACnB,kCAAkC;IAE1B,yBAAyB,CAC/B,OAA8B,EAC9B,kBAAmC,EACnC,UAAsB;QAEtB,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;QAExD,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7F,MAAM,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QAE/F,QAAQ,kBAAkB,EAAE,CAAC;YAC3B,KAAK,eAAe,CAAC,KAAK;gBACxB,gFAAgF;gBAChF,6FAA6F;gBAC7F,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;oBACxB,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,OAAO,CAAC,KAAK,KAAK,0BAA0B,CAAC,sBAAsB,IAAI,cAAc,CAAC;YAC/F,KAAK,eAAe,CAAC,MAAM;gBACzB,OAAO,cAAc,IAAI,eAAe,IAAI,gBAAgB,CAAC,MAAM,IAAI,CAAC,CAAC;YAC3E;gBACE,OAAO,KAAK,CAAC;QACjB,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,oBAAoB;IACpB,kCAAkC;IAE1B,iCAAiC,CACvC,SAAiB,EACjB,WAA4B,EAC5B,eAAwB,IAAI,EAC5B,OAAsC;QAEtC,OAAO,4BAA4B,CAAC,KAAK,CAAC;YACxC,OAAO,EAAE,KAAK;YACd,SAAS;YACT,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,KAAK;YACxC,WAAW;YACX,YAAY;YACZ,iBAAiB,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAC/E,YAAY,EAAE,OAAO,EAAE,YAAY;YACnC,WAAW,EAAE,KAAK;YAClB,iBAAiB,EAAE,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,iCAAiC,CACvC,SAAiB,EACjB,WAA4B,EAC5B,UAAsB,EACtB,WAAmB,EACnB,UAqBI,EAAE;QAEN,MAAM,QAAQ,GAAG,4BAA4B,CAAC,KAAK,CAAC;YAClD,OAAO,EAAE,CAAC,OAAO,CAAC,WAAW;YAC7B,SAAS;YACT,UAAU,EAAE,IAAI;YAChB,WAAW;YACX,UAAU;YACV,WAAW;YACX,iEAAiE;YACjE,iEAAiE;YACjE,2DAA2D;YAC3D,iEAAiE;YACjE,oBAAoB;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE;YAClD,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,KAAK;YACzC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,2BAA2B,EAAE,OAAO,CAAC,2BAA2B,IAAI,EAAE;YACtE,yBAAyB,EAAE,OAAO,CAAC,yBAAyB,IAAI,EAAE;YAClE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,CAAC,UAAU,CAAC;YAC1D,YAAY,EAAE,IAAI;YAClB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,0BAA0B,EAAE,OAAO,CAAC,0BAA0B,IAAI,EAAE;SACrE,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;IAC7D,CAAC;IAEO,gCAAgC,CACtC,SAAiB,EACjB,WAA4B,EAC5B,UAWI,EAAE;QAEN,iGAAiG;QACjG,6DAA6D;QAC7D,OAAO,4BAA4B,CAAC,KAAK,CAAC;YACxC,OAAO,EAAE,KAAK;YACd,SAAS;YACT,UAAU,EAAE,KAAK;YACjB,WAAW;YACX,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;YAC1C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,KAAK;YACzC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,EAAE;YAChD,iBAAiB,EAAE,EAAE;YACrB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,2BAA2B,CACvC,EAAqC,EACrC,MAAkB,EAClB,eAA8C,EAC9C,UAA+B;QAE/B,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC;QACrD,MAAM,MAAM,GAAG,UAAU,IAAI,0CAAwC,CAAC,oBAAoB,CAAC;QAE3F,MAAM,SAAS,GAAG,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,gBAAgB,GAAG,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC5D,MAAM,iBAAiB,GAAG,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,sBAAsB,GAAG,SAAS,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,oBAAoB,GAAG,SAAS,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAEzE,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,iBAAiB,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;YACrD,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,IAAI,kBAAkB,GAAa,EAAE,CAAC;QACtC,IAAI,MAAM,GAAa,EAAE,CAAC;QAC1B,IAAI,qBAAqB,GAAa,EAAE,CAAC;QACzC,IAAI,MAAyC,CAAC;QAE9C,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;gBAChC,IAAI,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,IAAI,EAAE,CAAC;qBACzE,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,kCAAkC,CAAC,cAAc,CAAC,CAAC;qBAClF,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC;gBACvC,IAAI,eAAe,IAAI,EAAE,EAAE,CAAC;oBAC1B,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CACzD,EAAE,EACF,eAAe,CAAC,SAAS,EACzB,eAAe,CAAC,OAAO,EACvB,eAAe,CAChB,CAAC;gBACJ,CAAC;gBACD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAC9C,qBAAqB,GAAG,eAAe,CAAC;gBACxC,kBAAkB,GAAG,eAAe,CAAC;gBACrC,MAAM;YACR,CAAC;YACD,KAAK,UAAU,CAAC,UAAU,CAAC;YAC3B,KAAK,UAAU,CAAC,OAAO;gBACrB,MAAM;YACR,KAAK,UAAU,CAAC,OAAO;gBACrB,MAAM,GAAG,UAAU,CAAC,aAAa;oBAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,aAAa,CAAC,IAAI,EAAE;oBAClF,CAAC,CAAC,SAAS,CAAC;gBACd,MAAM;YACR,KAAK,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBACnC,IACE,CAAC,eAAe;uBACb,eAAe,CAAC,mBAAmB,KAAK,WAAW,CAAC,IAAI,EAC3D,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;gBAChF,IAAI,CAAC,YAAY;oBAAE,OAAO,IAAI,CAAC;gBAC/B,MAAM,GAAG,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;gBACrC,MAAM,GAAG;oBACP,WAAW,EAAE,YAAY,CAAC,WAAW;oBACrC,WAAW,EAAE,YAAY,CAAC,WAAW;oBACrC,YAAY,EAAE,YAAY,CAAC,YAAY;oBACvC,SAAS,EAAE,eAAe,CAAC,SAAS;oBACpC,OAAO,EAAE,eAAe,CAAC,OAAO;iBACjC,CAAC;gBACF,IAAI,eAAe,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC;oBAC5C,QAAQ,GAAG,IAAI,CAAC;gBAClB,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACzB,IACE,CAAC,eAAe;uBACb,eAAe,CAAC,mBAAmB,KAAK,WAAW,CAAC,IAAI,EAC3D,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;gBACpF,IAAI,CAAC,gBAAgB;oBAAE,OAAO,IAAI,CAAC;gBACnC,MAAM,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;gBACzC,MAAM,GAAG;oBACP,WAAW,EAAE,gBAAgB,CAAC,WAAW;oBACzC,WAAW,EAAE,gBAAgB,CAAC,WAAW;oBACzC,YAAY,EAAE,gBAAgB,CAAC,YAAY;oBAC3C,QAAQ,EAAE,oBAAoB,gBAAgB,CAAC,YAAY,EAAE;oBAC7D,SAAS,EAAE,eAAe,CAAC,SAAS;oBACpC,OAAO,EAAE,eAAe,CAAC,OAAO;iBACjC,CAAC;gBACF,IAAI,eAAe,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC;oBAC5C,QAAQ,GAAG,IAAI,CAAC;gBAClB,CAAC;gBACD,MAAM;YACR,CAAC;YACD;gBACE,MAAM;QACV,CAAC;QAED,OAAO;YACL,MAAM;YACN,UAAU;YACV,QAAQ;YACR,gBAAgB;YAChB,iBAAiB;YACjB,QAAQ;YACR,kBAAkB;YAClB,MAAM;YACN,sBAAsB;YACtB,oBAAoB;YACpB,qBAAqB;YACrB,MAAM;SACP,CAAC;IACJ,CAAC;;AAv4HU,wCAAwC;IADpD,UAAU,EAAE;IAiCR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAC7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAE3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAE1C,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,YAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,YAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAElD,YAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IAEnD,YAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAE/D,YAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAE1C,YAAA,MAAM,CAAC,kBAAkB,CAAC,+BAA+B,CAAC,CAAA;IAE1D,YAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAEhD,YAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IAGnD,YAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IACzC,YAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAK/D,YAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;qCAnCkB,aAAa;QACO,uBAAuB;QACxB,0BAA0B,YAEH,yCAAyC;QAC/D,uBAAuB;QAE3B,8BAA8B;QAClB,oCAAoC;QAClD,6BAA6B;QAEX,6BAA6B;QACjD,YAAY;QACG,uBAAuB;QAErB,+BAA+B;QAEpB,oCAAoC;QAE1D,sBAAsB;QAEP,sCAAsC;QAEpD,4BAA4B;QAEtB,+BAA+B,YAIxC,cAAc,YAMd,qBAAqB;GAnExF,wCAAwC,CAw4HpD","sourcesContent":["import 'reflect-metadata';\nimport { inject, injectable } from 'inversify';\nimport * as crypto from 'crypto';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport { resolveActiveMemberOrgIds } from '~wildo-backend-lib/security/authentications/services/resolve-active-member-orgs.backend.utils';\nimport { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport {\n AuthIdentificationRequest,\n AvailableMethod,\n AvailableMethodConfig,\n CoreConsumableTokenTypes,\n ConsumableToken_ConsumptionMode,\n ErrorCustomMessageReference,\n ErrorType,\n isWildoBackendError,\n PasswordAuthRequest,\n User,\n UserStatus,\n} from '@wildo-ai/saas-models';\nimport { CoreResourceType, getEnabledMethods, resolveTenantBrandPresentation } from '@wildo-ai/saas-models';\nimport { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport type { OrganizationBranding } from '@wildo-ai/saas-models';\nimport {\n AuthUtils,\n AuthIdentificationResponseSchema,\n AuthMethod,\n AuthFactorLevel,\n BrandAssetComposition,\n BrandAssetTheme,\n AuthenticationResponseSchema,\n AuthIdentificationResponse,\n AuthenticationRequest,\n AuthenticationResponse,\n AuthenticationSession,\n AuthenticationSessionSchema,\n AuthenticationSessionState,\n AuthNextStep,\n AuthScopeType,\n OrganizationNameSource,\n SsoProtocol,\n} from '@wildo-ai/saas-models';\nimport { AuthSessionPurpose, MfaEnrollmentState, AccountLockoutReason } from '@wildo-ai/saas-models';\nimport type { EmailOTPAuthRequest, TOTPAuthRequest, PasskeyAuthRequest, SMSOTPAuthRequest, UserCredentials, MagicLinkSendRequest, MagicLinkVerifyRequest, UserTypeAuthPolicy, UserTypesConfig } from '@wildo-ai/saas-models';\nimport {\n RegistrationAcquisitionChannel,\n RegistrationMode,\n EmailVerificationMode,\n evaluateUserTypeAcquisition,\n} from '@wildo-ai/saas-models';\nimport { DurationUnit } from '@wildo-ai/zod-decorators';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { createOrgOnRegistration } from '~wildo-backend-lib/organizations/services/org-creation-on-registration.backend.utils';\nimport { grantUserTypesOnOrgJoin } from '~wildo-backend-lib/organizations/services/user-org-type-grant.backend.utils';\nimport {\n executeDurableOrganizationOnboarding,\n readCompletedOrganizationOnboarding,\n} from '~wildo-backend-lib/organizations/services/organization-onboarding-operation.backend.utils';\nimport { MongoDBService } from '~wildo-backend-lib/databases/services/mongodb.service';\nimport type {\n ResourcePersistenceUnitOfWorkBackendService,\n} from '~wildo-backend-lib/databases/services/resource-persistence-unit-of-work.backend.service';\n\n// New decomposed services\nimport { AuthSessionStoreBackendService } from '~wildo-backend-lib/security/authentications/services/auth-session-store.backend.service';\nimport { AuthCredentialVerifierBackendService } from '~wildo-backend-lib/security/authentications/services/auth-credential-verifier.backend.service';\nimport { AuthTokenIssuerBackendService, type AuthTokens } from '~wildo-backend-lib/security/authentications/services/auth-token-issuer.backend.service';\nimport { WebAuthnBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/webauthn.backend.service';\nimport type { PasskeyAuthenticationVerificationResult } from '~wildo-backend-lib/security/authentications/services/auth-methods/webauthn.backend.service';\nimport type { OtpOperational, MagicLinkOperational, TotpOperational } from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport type { LockoutPolicyConfig } from '@wildo-ai/saas-models';\nimport { ConsumableTokenBackendService } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { RateLimitBackendService } from '~wildo-backend-lib/errors/services/rate-limit.backend.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { DomainToOrgLookupBackendService } from '~wildo-backend-lib/security/authentications/services/admin-config/domain-to-org-lookup.backend.service';\nimport type { DomainOrgLookupResult } from '~wildo-backend-lib/security/authentications/services/admin-config/domain-to-org-lookup.backend.service';\nimport { AuthOrganizationConfigurationService } from '~wildo-backend-lib/security/authentications/services/admin-config/auth-organization-configuration.service';\nimport { AUTH_REDIS_KEYS } from '~wildo-backend-lib/security/authentications/models/auth-constants.backend';\nimport { AuthMfaBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/auth-mfa.backend.service';\nimport { OAuth2ConnectionResolverBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/oauth2-connection-resolver.backend.service';\nimport { AuthUserLookupBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-user-lookup.backend.service';\nimport { AuthCredentialOpsBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-credential-ops.backend.service';\nimport { AuthControllerUtils } from '~wildo-backend-lib/security/authentications/services/utils/auth-controller.utils';\nimport {\n requiresEnterpriseSsoOnly,\n isBreakGlassAccount,\n restrictFirstFactorMethodsForEnterpriseSso,\n} from '~wildo-backend-lib/security/authentications/utils/enterprise-sso-enforcement.backend.utils';\nimport { isEnabledSocialOAuth2LoginProvider } from '~wildo-backend-lib/security/authentications/utils/social-oauth2-purpose.backend.utils';\n\n/**\n * Backend-internal authentication result type — extends the wire-shape\n * `AuthenticationResponse` (which post Auth-hardening Slice A Step 6\n * does NOT carry `refreshToken`) with the cookie-bound refresh token\n * value, so the controller can extract it and pass it explicitly to\n * `_jsonSuccessWithRefreshCookie(res, body, refreshToken)` at the\n * wire-leaving seam.\n *\n * Why a backend-only TS type rather than a Zod schema:\n * - This shape NEVER reaches the wire — the controller destructures\n * it (`const { refreshToken, ...wireBody } = result`) before\n * handing the body to `jsonSuccess`. There is no JSON schema to\n * enforce, only a TS contract between orchestrator and controller.\n * - Zod-isolating it would tempt callers to `.parse(...)` it and\n * accidentally re-export the cookie-only field as part of a wire\n * response — exactly the leak A-Step 6 closes.\n * - The wire schema (`AuthenticationResponseSchema`) intentionally\n * does NOT include `refreshToken`; this type augments locally so\n * orchestrator → controller plumbing stays type-safe without\n * widening the public schema surface.\n *\n * Pre A-Step 6 the orchestrator returned `AuthenticationResponse`\n * directly with `refreshToken` as a public schema field; A-Step 6\n * stripped the field from the schema and introduced this internal\n * type to keep the value reachable to the controller without\n * letting it leak onto the wire by accident.\n */\nexport type AuthenticationServiceResult = AuthenticationResponse & {\n /**\n * Refresh token value bound to the issued session. Threaded into the\n * `__wildo_refresh` cookie by `_jsonSuccessWithRefreshCookie` at the\n * controller's wire-leaving seam. NEVER serialised to the JSON body\n * (the body uses `AuthenticationResponseSchema`, which has no\n * `refreshToken` field).\n *\n * Optional because MFA-continuation responses (`requiresMFA: true`)\n * and other pre-completion shapes don't issue a refresh token.\n */\n refreshToken?: string;\n};\n\n/**\n * AuthenticationOrchestratorBackendService\n *\n * Orchestrates the authentication flow: identify → authenticate → tokens.\n *\n * Decomposed from the original AuthenticationBackendService (1900 lines → ~400 lines).\n * Session storage, credential verification, and token issuance are delegated to\n * focused sub-services (AuthSessionStore, AuthCredentialVerifier, AuthTokenIssuer).\n *\n * Public API preserved:\n * - identify(request) → AuthIdentificationResponse\n * - authenticate(request) → AuthenticationResponse\n * - authenticatePassword(request) → AuthenticationResponse\n * - getAuthenticationSessionState(sessionId) → AuthenticationSession | null\n *\n * TRAP 2: The controller calls exactly these methods. Signatures accept EC as the first parameter.\n * TRAP 9: Dependency arrows flow one way: Orchestrator → Services → Infrastructure.\n * TRAP 13: Audit logging stays here (not in sub-services).\n */\n@injectable()\nexport class AuthenticationOrchestratorBackendService {\n /** L11: Default session duration in minutes (absolute TTL). Overridden by userTypes[t].auth.sessionDurationMinutes. */\n private static readonly DEFAULT_SESSION_DURATION_MINUTES = 30;\n /** Idle timeout in minutes — session is deleted if lastActivity exceeds this. Must be < SESSION_DURATION_MINUTES. */\n private static readonly AUTH_SESSION_IDLE_TIMEOUT_MINUTES = 5;\n /** Default number of MFA methods required (for future MFA support). */\n private static readonly DEFAULT_MFA_METHODS_REQUIRED = 1;\n\n /**\n * R3 — coalescing window for the per-user `USER_ACCOUNT_LOCKED` audit emission.\n * Account lockout is the only attacker-TRIGGERABLE routed audit write (an attacker\n * hammering a victim's account forces it), and `incrementSessionAttempts` recomputes\n * `locked = attempts >= maxAttempts` with NO lock-transition guard — a repeated\n * post-threshold attempt would otherwise re-emit. Suppressing repeats inside this window\n * stops a lockout being used to amplify event volume into the victim's OWN org SIEM.\n */\n private static readonly ACCOUNT_LOCKED_AUDIT_DEDUP_WINDOW_MS = 5 * 60 * 1000;\n /** Max distinct users tracked in the lockout-dedup map (evict oldest-inserted when full) — bounds process-local growth. */\n private static readonly ACCOUNT_LOCKED_AUDIT_DEDUP_MAX_SIZE = 10_000;\n\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n /**\n * In-memory per-user dedup ledger for the `USER_ACCOUNT_LOCKED` audit (see\n * {@link ACCOUNT_LOCKED_AUDIT_DEDUP_WINDOW_MS}). Maps `userId → last-emitted epoch ms`.\n * Process-local + best-effort (a multi-instance deployment dedups per instance) — that is\n * sufficient: the goal is to blunt single-instance amplification, not exactly-once across\n * the fleet (the always-on DB store still records every lock unconditionally).\n */\n private readonly _accountLockedAuditDedup = new Map<string, number>();\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) private readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) private readonly auditLogsService: AuditLogsBackendService,\n // New decomposed services\n @inject(SAAS_SERVICE_TYPES.AuthSessionStore) private readonly sessionStore: AuthSessionStoreBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthCredentialVerifier) private readonly credentialVerifier: AuthCredentialVerifierBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthTokenIssuer) private readonly tokenIssuer: AuthTokenIssuerBackendService,\n // MFA services (Step 10-11)\n @inject(SAAS_SERVICE_TYPES.ConsumableTokenService) private readonly consumableTokenService: ConsumableTokenBackendService,\n @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,\n @inject(SAAS_SERVICE_TYPES.RateLimitBackendService) private readonly rateLimitService: RateLimitBackendService,\n // Domain-to-org lookup service (Step 14 — enterprise SSO domain routing)\n @inject(SAAS_SERVICE_TYPES.DomainToOrgLookupService) private readonly domainToOrgLookup: DomainToOrgLookupBackendService,\n // Organization configuration (M12 — org-level auth policy enforcement)\n @inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService) private readonly orgConfigService: AuthOrganizationConfigurationService,\n // WebAuthn/Passkey ceremony service (Phase G1)\n @inject(SAAS_SERVICE_TYPES.WebAuthnService) private readonly webAuthnService: WebAuthnBackendService,\n // G3: OAuth2 connection resolver — for filtering providers by org restrictions\n @inject(SAAS_SERVICE_TYPES.OAuth2ConnectionResolverService) private readonly oauth2Resolver: OAuth2ConnectionResolverBackendService,\n // AUTH-14: User lookup + effective auth policy resolution with org overrides\n @inject(SAAS_SERVICE_TYPES.AuthUserLookupService) private readonly userLookup: AuthUserLookupBackendService,\n // Centralized credential read/update operations via service registry\n @inject(SAAS_SERVICE_TYPES.AuthCredentialOpsService) private readonly credentialOps: AuthCredentialOpsBackendService,\n // Trusted system-write path for org-auto-create-on-registration (owner\n // membership FKs).\n @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n @inject(SAAS_SERVICE_TYPES.MongoDBService) private readonly mongoDBService: MongoDBService,\n @inject(SAAS_SERVICE_TYPES.ResourcePersistenceUnitOfWorkService)\n private readonly resourcePersistenceUnitOfWork:\n ResourcePersistenceUnitOfWorkBackendService,\n // Appended LAST on purpose: inserting a parameter mid-list silently re-binds every injection\n // after it. Owns the enrolled-second-factor verification this service used to inline.\n @inject(SAAS_SERVICE_TYPES.AuthMfaService) private readonly authMfaService: AuthMfaBackendService,\n ) {\n this.logDebug = this.logger.debugByType('AuthenticationOrchestrator');\n this.logger.setDebugTypeLogging('AuthenticationOrchestrator', false);\n }\n\n /**\n * Global lockout policy for email-scoped rate limiting (pre-authentication, user type unknown).\n * Computed as the most-restrictive lockout across all configured user types:\n * lowest maxLoginAttempts, longest lockoutDuration, progressive if any type uses it.\n */\n private get lockoutPolicy(): LockoutPolicyConfig {\n const userTypes = this.appConfigService.config.userTypes;\n const policies = Object.values(userTypes).map(ut => ut.auth.lockoutPolicy);\n if (policies.length === 0) {\n return { maxLoginAttempts: 5, lockoutDurationMinutes: 30, progressiveLockout: false, maxProgressiveLockoutHours: 24 };\n }\n return {\n maxLoginAttempts: Math.min(...policies.map(p => p.maxLoginAttempts)),\n lockoutDurationMinutes: Math.max(...policies.map(p => p.lockoutDurationMinutes)),\n progressiveLockout: policies.some(p => p.progressiveLockout),\n maxProgressiveLockoutHours: Math.max(...policies.map(p => p.maxProgressiveLockoutHours)),\n };\n }\n\n private get otpConfig(): OtpOperational {\n return this.appConfigService.config.auth.otpOperational;\n }\n\n private get magicLinkConfig(): MagicLinkOperational {\n return this.appConfigService.config.auth.magicLinkOperational;\n }\n\n // `totpConfig` was removed on 2026-08-06: its only reader was the inline TOTP verification that\n // moved to `AuthMfaBackendService.verifyEnrolledSecondFactor`, which reads the same config itself.\n // Keeping an unread accessor here would imply this service still owns a TOTP policy decision.\n\n // ===============================\n // PER-USER-TYPE AUTH CONFIG RESOLUTION (W3.1)\n // ===============================\n\n /**\n * Resolve the effective auth policy for a given user type.\n * If the user type exists in config.userTypes, returns its auth policy.\n * Falls back to FALLBACK_AUTH_POLICY when no user type is configured.\n */\n private _resolveAuthPolicy(activeUserType?: string | null): UserTypeAuthPolicy {\n if (activeUserType) {\n const policy = this.appConfigService.getUserTypeAuthPolicy(activeUserType);\n if (policy) return policy;\n }\n return AuthenticationOrchestratorBackendService.FALLBACK_AUTH_POLICY;\n }\n\n /**\n * W6.8: Safe default auth policy when no user type is resolved.\n * All values are restrictive-safe. Applications MUST configure userTypes for full control.\n */\n private static readonly FALLBACK_AUTH_POLICY: UserTypeAuthPolicy = {\n authMethodsEnabled: { [AuthMethod.PASSWORD]: true },\n mfaPolicy: {\n requireMFA: false,\n requireStrongMFA: false,\n enrollmentGracePeriodDays: 0,\n passkeyExemptFromMFA: true,\n },\n registration: {\n // This fallback supports authentication for legacy/unknown session context only. It must\n // never advertise or authorize acquisition when no concrete user type can be resolved.\n mode: RegistrationMode.DISABLED,\n allowedMethods: [],\n emailVerification: EmailVerificationMode.REQUIRED_BEFORE_ACCESS,\n blockForSSODomains: false,\n },\n passwordPolicy: {\n minLength: 8,\n maxLength: 128,\n requireUppercase: true,\n requireLowercase: true,\n requireNumbers: true,\n requireSpecialChars: false,\n expiryDays: 0,\n },\n sessionDurationMinutes: AuthenticationOrchestratorBackendService.DEFAULT_SESSION_DURATION_MINUTES,\n lockoutPolicy: {\n maxLoginAttempts: 5,\n lockoutDurationMinutes: 30,\n progressiveLockout: false,\n maxProgressiveLockoutHours: 24,\n },\n autoLinkByEmail: true,\n methodManagement: {\n allowUserMethodRemoval: true,\n requireReauthForMethodChanges: false,\n },\n };\n\n /**\n * AUTH-14: Resolve auth policy with org override merging for a known user.\n * Use this instead of _resolveAuthPolicy when userId is available.\n * Falls back to raw user-type policy if org resolution fails.\n */\n private async _resolveAuthPolicyWithOrgOverrides(\n ec: ExecutionContext<any>,\n activeUserType: string | null | undefined,\n userId: string,\n ): Promise<UserTypeAuthPolicy> {\n if (!activeUserType) return AuthenticationOrchestratorBackendService.FALLBACK_AUTH_POLICY;\n const effective = await this.userLookup.resolveEffectiveAuthPolicy(ec, userId, activeUserType);\n return effective ?? AuthenticationOrchestratorBackendService.FALLBACK_AUTH_POLICY;\n }\n\n /**\n * W6.8: Check if an auth method is enabled in ANY configured user type.\n * Used for pre-identification guards (sendMagicLink, sendSMSOTP) where\n * the user type is not yet known.\n */\n private _isMethodEnabledGlobally(method: AuthMethod): boolean {\n const userTypes: UserTypesConfig = this.appConfigService.config.userTypes ?? {};\n for (const [, typeDef] of Object.entries(userTypes)) {\n if (typeDef?.auth?.authMethodsEnabled?.[method]) return true;\n }\n return false;\n }\n\n /**\n * Resolve auth policy from a session's activeUserType. Convenience wrapper.\n */\n private _resolveAuthPolicyFromSession(session: AuthenticationSession): UserTypeAuthPolicy {\n return this._resolveAuthPolicy(session.activeUserType);\n }\n\n private _assertFrontendServiceAuthAllowed(frontendServiceName: string | undefined, userType: string | null | undefined): void {\n if (!frontendServiceName || !userType) {\n return;\n }\n\n const userManagement = this.appConfigService.getFrontendServiceUserManagementEntry(frontendServiceName, userType);\n if (!userManagement?.auth) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_METHOD_NOT_SUPPORTED,\n context: {\n // diagnostic (log-only)\n frontendServiceName,\n activeUserType: userType,\n },\n });\n }\n }\n\n // ===============================\n // SESSION HELPERS (delegate to AuthSessionStore)\n // ===============================\n\n private _getSessionTtlSeconds(activeUserType?: string | null): number {\n const policy = this._resolveAuthPolicy(activeUserType);\n return policy.sessionDurationMinutes * 60;\n }\n\n\n /**\n * Create a new authentication session in the store.\n */\n /** W4: Registration sessions get longer TTL (24h) to match email verification token expiry. */\n private static readonly REGISTRATION_SESSION_TTL_SECONDS = 24 * 60 * 60;\n\n private async createSession(\n sessionId: string,\n initialState: AuthenticationSessionState = AuthenticationSessionState.CREATED,\n options: {\n deviceInfo?: { userAgent?: string; ipAddress?: string };\n activeUserType?: string;\n purpose?: AuthSessionPurpose;\n email?: string;\n userId?: string;\n pendingOrgType?: string;\n } = {},\n ): Promise<AuthenticationSession> {\n const authPolicy = this._resolveAuthPolicy(options.activeUserType);\n const isRegistrationFlow = options.purpose === AuthSessionPurpose.REGISTRATION || options.purpose === AuthSessionPurpose.INVITATION;\n const ttlSeconds = isRegistrationFlow\n ? AuthenticationOrchestratorBackendService.REGISTRATION_SESSION_TTL_SECONDS\n : authPolicy.sessionDurationMinutes * 60;\n const now = new Date();\n const expiresAt = new Date(now.getTime() + ttlSeconds * 1000);\n\n const session: AuthenticationSession = {\n sessionId,\n state: initialState,\n activeUserType: options.activeUserType,\n purpose: options.purpose ?? AuthSessionPurpose.LOGIN,\n email: options.email,\n userId: options.userId,\n createdAt: now,\n expiresAt,\n lastActivity: now,\n completedFactors: [],\n availableFirstFactorMethods: [],\n availableSecondFactorMethods: [],\n availableEnrollmentMethods: [],\n enrolledSecondFactorMethods: [],\n usableSecondFactorMethods: [],\n requiresMFA: false,\n requireStrongMFA: false,\n mfaMethodsRequired: AuthenticationOrchestratorBackendService.DEFAULT_MFA_METHODS_REQUIRED,\n attempts: 0,\n maxAttempts: authPolicy.lockoutPolicy.maxLoginAttempts,\n requestedIntegrations: [],\n deviceInfo: options.deviceInfo,\n pendingOrgType: options.pendingOrgType,\n version: 0,\n };\n\n await this.sessionStore.set(sessionId, session, ttlSeconds);\n this.logDebug(`Created new authentication session: ${sessionId}`, { purpose: session.purpose });\n\n return session;\n }\n\n /**\n * Get and validate a session. Returns null if not found, expired, or idle-timed-out.\n */\n private async getSession(sessionId: string): Promise<AuthenticationSession | null> {\n const session = await this.sessionStore.get(sessionId);\n\n if (!session) {\n return null;\n }\n\n // Check expiry (Redis TTL handles this too, but defensive check)\n if (session.expiresAt < new Date()) {\n await this.sessionStore.delete(sessionId);\n this.logDebug(`Session expired and removed: ${sessionId}`);\n return null;\n }\n\n // M15 fix: Idle timeout — delete session if lastActivity is stale\n if (session.lastActivity) {\n const idleLimitMs = AuthenticationOrchestratorBackendService.AUTH_SESSION_IDLE_TIMEOUT_MINUTES * 60 * 1000;\n const idleDuration = Date.now() - session.lastActivity.getTime();\n if (idleDuration > idleLimitMs) {\n await this.sessionStore.delete(sessionId);\n this.logDebug(`Session idle-timed-out and removed: ${sessionId}`, {\n idleMinutes: Math.round(idleDuration / 60000),\n limitMinutes: AuthenticationOrchestratorBackendService.AUTH_SESSION_IDLE_TIMEOUT_MINUTES,\n });\n return null;\n }\n }\n\n return session;\n }\n\n /** Maximum retries for atomic session updates before falling back to non-atomic write. */\n private static readonly ATOMIC_UPDATE_MAX_RETRIES = 3;\n\n /**\n * Update a session in the store using atomic compare-and-swap (M1 fix).\n *\n * Uses the session `version` field for optimistic concurrency control.\n * On version mismatch (concurrent writer), re-reads and retries up to MAX_RETRIES.\n * Falls back to a non-atomic write only if all retries are exhausted.\n */\n private async updateSession(\n sessionId: string,\n updates: Partial<AuthenticationSession>,\n ): Promise<AuthenticationSession | null> {\n for (let attempt = 0; attempt <= AuthenticationOrchestratorBackendService.ATOMIC_UPDATE_MAX_RETRIES; attempt++) {\n const session = await this.getSession(sessionId);\n if (!session) {\n return null;\n }\n\n const expectedVersion = session.version ?? 0;\n const updatedSession = AuthenticationSessionSchema.parse({\n ...session,\n ...updates,\n lastActivity: new Date(),\n version: expectedVersion + 1,\n });\n\n // Try atomic update via Lua compare-and-swap\n const result = await this.sessionStore.atomicUpdate(\n sessionId,\n updatedSession,\n expectedVersion,\n this._getSessionTtlSeconds(updatedSession.activeUserType),\n );\n\n if (result) {\n this.logDebug(`Updated authentication session: ${sessionId}`, {\n state: updatedSession.state,\n version: updatedSession.version,\n });\n return result;\n }\n\n // Version mismatch — another writer beat us. Retry with fresh read.\n this.logDebug(`Session update version conflict (attempt ${attempt + 1}): ${sessionId}`);\n }\n\n // All retries exhausted — return null to signal failure rather than falling back\n // to a non-atomic write that could silently overwrite a concurrent writer's update.\n this.logger.warn?.('Session atomic update retries exhausted, returning failure', { sessionId });\n return null;\n }\n\n /**\n * Remove a session from the store.\n */\n private async removeSession(sessionId: string): Promise<void> {\n await this.sessionStore.delete(sessionId);\n this.logDebug(`Removed authentication session: ${sessionId}`);\n }\n\n /**\n * Increment session attempts and check for lockout.\n * W3.1: Uses per-user-type lockout policy from session's activeUserType.\n */\n private async incrementSessionAttempts(\n ec: ExecutionContext<any>,\n sessionId: string,\n ): Promise<{ session: AuthenticationSession | null; locked: boolean }> {\n const session = await this.getSession(sessionId);\n if (!session) {\n return { session: null, locked: false };\n }\n\n const sessionPolicy = this._resolveAuthPolicyFromSession(session);\n const sessionLockout = sessionPolicy.lockoutPolicy;\n const attempts = session.attempts + 1;\n const locked = attempts >= session.maxAttempts;\n\n let effectiveLockoutMinutes = sessionLockout.lockoutDurationMinutes;\n\n // W2.3: Progressive lockout — double duration for each consecutive lockout, capped at maxProgressiveLockoutHours\n if (locked && sessionLockout.progressiveLockout && session.userId) {\n try {\n const { previousCount } = await this.credentialOps.incrementLockout(ec, session.userId!);\n const maxMinutes = (sessionLockout.maxProgressiveLockoutHours ?? 24) * 60;\n effectiveLockoutMinutes = Math.min(\n sessionLockout.lockoutDurationMinutes * Math.pow(2, previousCount),\n maxMinutes,\n );\n } catch {\n // Fallback to base duration if credential lookup fails\n }\n }\n\n const updates: Partial<AuthenticationSession> = {\n attempts,\n state: locked ? AuthenticationSessionState.LOCKED : session.state,\n lockoutUntil: locked\n ? new Date(Date.now() + effectiveLockoutMinutes * 60 * 1000)\n : undefined,\n };\n\n const updatedSession = await this.updateSession(sessionId, updates);\n\n if (locked && updatedSession?.userId) {\n // Session/progressive lockout tripped — emit the coalesced USER_ACCOUNT_LOCKED audit\n // (SHARED with the per-email GLOBAL lockout path via {@link _emitAccountLockedAuditOnce}).\n await this._emitAccountLockedAuditOnce(\n ec,\n updatedSession.userId,\n updatedSession.email || 'unknown',\n effectiveLockoutMinutes,\n updatedSession.deviceInfo,\n sessionId,\n AccountLockoutReason.SESSION_ATTEMPT_LIMIT,\n );\n }\n\n return { session: updatedSession, locked };\n }\n\n /**\n * Emit the `USER_ACCOUNT_LOCKED` audit ONCE per user within\n * {@link ACCOUNT_LOCKED_AUDIT_DEDUP_WINDOW_MS}, routed to the user's VERIFIED ACTIVE member orgs.\n *\n * SHARED by BOTH lockout paths — the session/progressive lockout ({@link incrementSessionAttempts})\n * and the per-email GLOBAL lockout pre-flight (F-AUDIT-1, in {@link authenticatePassword}) — so the\n * two coalesce on ONE per-user ledger: a user tripping both within the window emits once, not twice.\n *\n * R3 — this is the only attacker-TRIGGERABLE routed audit write; the callers have no lock-transition\n * guard (`locked` stays true post-threshold), so without this coalescing a repeated post-threshold\n * attempt would re-emit and let an attacker amplify event volume into the victim's OWN org SIEM. The\n * always-on DB store is unaffected. The dedup map is bounded (evict oldest-inserted when full) so a\n * busy system cannot accumulate one entry per ever-locked user for the process lifetime.\n *\n * F4 per-org SIEM routing — route ONLY on the user's verified ACTIVE member orgs, NEVER a\n * session/request-derived org. NOTE the recorded ipAddress/userAgent belong to the ATTACKER (the\n * request that tripped the lock), not the victim — correct SOC telemetry by design.\n */\n private async _emitAccountLockedAuditOnce(\n ec: ExecutionContext<any>,\n lockedUserId: string,\n email: string,\n lockoutDurationMinutes: number,\n deviceInfo: AuthenticationSession['deviceInfo'],\n sessionId: string,\n reason: AccountLockoutReason,\n ): Promise<void> {\n const nowMs = Date.now();\n const lastEmittedMs = this._accountLockedAuditDedup.get(lockedUserId);\n if (\n lastEmittedMs !== undefined &&\n nowMs - lastEmittedMs < AuthenticationOrchestratorBackendService.ACCOUNT_LOCKED_AUDIT_DEDUP_WINDOW_MS\n ) {\n return; // within the coalescing window — already emitted for this user\n }\n if (this._accountLockedAuditDedup.size >= AuthenticationOrchestratorBackendService.ACCOUNT_LOCKED_AUDIT_DEDUP_MAX_SIZE) {\n const oldestKey = this._accountLockedAuditDedup.keys().next().value;\n if (oldestKey !== undefined) {\n this._accountLockedAuditDedup.delete(oldestKey);\n }\n }\n this._accountLockedAuditDedup.set(lockedUserId, nowMs);\n const routingOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, lockedUserId);\n await this.auditLogsService.logUserAccountLocked({\n userId: lockedUserId,\n email: email || 'unknown',\n authMethod: AuthMethod.PASSWORD,\n lockoutDuration: lockoutDurationMinutes,\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n sessionId,\n reason,\n }, ec, routingOrgIds);\n }\n\n // ===============================\n // GLOBAL LOCKOUT (C1 fix — per-email, Redis-based)\n // ===============================\n\n /**\n * Wipe the per-email global lockout counter on successful authentication.\n *\n * Q-2 = Reset-keep, preserved verbatim across the Step 3 migration:\n * under the new atomic `checkRateLimit(...)` model the lockout bucket\n * increments on EVERY password attempt (not just failed ones), so a\n * successful authentication must clear the counter to give the user a\n * fresh budget on their next session / next password attempt. The raw\n * `redisService.del('rate_limit:${key}')` shape is intentionally kept\n * as-is here; it matches the pre-migration behavior exactly and avoids\n * widening the Redis primitive surface in this tranche.\n */\n private async _resetGlobalAttempts(email: string): Promise<void> {\n const key = `${AUTH_REDIS_KEYS.GLOBAL_LOCKOUT}${email.toLowerCase()}`;\n await this.redisService.del(`rate_limit:${key}`);\n }\n\n // Step 3.5 tombstone (lockout-state-machine-modernization.md):\n // `_getGlobalAttempts`, `_incrementGlobalAttempts`, and\n // `_checkGlobalLockout` were deleted when the split-phase global\n // lockout flow collapsed into the canonical bridge-backed K-3\n // `checkRateLimit(...)` call inside `authenticatePassword()`.\n // See the multi-paragraph doc block above that call site for the\n // preserved rationale, timing shift, and deferred audit-gap note.\n\n // ===============================\n // INTERNAL HELPERS\n // ===============================\n\n /**\n * Resolve user for authentication by email.\n */\n private async _resolveUserForAuthentication(\n ec: ExecutionContext<any>,\n _session: AuthenticationSession,\n email: string,\n sessionId: string,\n ): Promise<User> {\n this.logDebug(`Resolving user for authentication: sessionId=${sessionId}, email=${email}`);\n\n const user = await this.userLookup.findAnyUserByEmail(ec, email);\n\n if (!user) {\n const { locked } = await this.incrementSessionAttempts(ec, sessionId);\n const authResponse = this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.FIRST, { retryAllowed: !locked });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_FOUND,\n context: { email, authResponse },\n });\n }\n\n this._enforceUserStatus(user, sessionId);\n return user;\n }\n\n private _enforceUserStatus(user: User, sessionId: string): void {\n if (user.status === UserStatus.ACTIVE) return;\n\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n context: { userStatus: user.status, sessionId },\n });\n }\n\n /**\n * Update session after successful method authentication.\n * Sets the correct session state based on whether this is a first or second factor completion.\n */\n private async _updateSessionAfterSuccessfulAuth(\n ec: ExecutionContext<any>,\n sessionId: string,\n userId: string,\n authMethod: AuthMethod,\n ): Promise<void> {\n const session = await this.getSession(sessionId);\n if (!session) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,\n context: { sessionId, operation: 'update' },\n });\n }\n\n const currentFactors = session.completedFactors || [];\n const newCompletedFactors = currentFactors.includes(authMethod)\n ? currentFactors\n : [...currentFactors, authMethod];\n\n // Determine correct session state: second-factor methods get COMPLETED (not FIRST_FACTOR_COMPLETED)\n const isSecondFactor = AuthUtils.canBeSecondFactor(authMethod) && currentFactors.length > 0;\n\n // Backend enforcement: reject second-factor methods not in usableSecondFactorMethods.\n // Prevents API-level bypass of requireStrongMFA (e.g. submitting EMAIL_OTP directly).\n if (isSecondFactor && session.usableSecondFactorMethods && session.usableSecondFactorMethods.length > 0) {\n if (!session.usableSecondFactorMethods.includes(authMethod)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_METHOD_NOT_SUPPORTED,\n context: { method: authMethod, reason: 'METHOD_NOT_IN_USABLE_LIST' },\n });\n }\n }\n\n const newState = isSecondFactor\n ? AuthenticationSessionState.COMPLETED\n : AuthenticationSessionState.FIRST_FACTOR_COMPLETED;\n\n // AUTH-14: Use org-override-aware policy when userId is known\n const sessionPolicy = userId\n ? await this._resolveAuthPolicyWithOrgOverrides(ec, session.activeUserType, userId)\n : this._resolveAuthPolicyFromSession(session);\n\n // AUTH-24 (login-side teeth for the posture derivation): a FIRST-factor method must be enabled in the\n // user's EFFECTIVE policy. For a directory-managed user, resolveEffectiveAuthPolicy derives the local\n // first-factor methods (PASSWORD / PASSKEY / MAGIC_LINK) OFF, so a credential that physically verified\n // still cannot complete a session. This is the uniform backstop covering PASSKEY (and redundantly\n // PASSWORD, also gated pre-verify in authenticatePassword); magic-link completes on a separate path and\n // is gated in verifyMagicLink. Second factors keep their own `usableSecondFactorMethods` gate above.\n if (!isSecondFactor && userId && !getEnabledMethods(sessionPolicy.authMethodsEnabled).has(authMethod)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_METHOD_NOT_SUPPORTED,\n context: { method: authMethod, reason: 'METHOD_NOT_ENABLED_IN_EFFECTIVE_POLICY' },\n });\n }\n\n const sessionUpdate: Partial<AuthenticationSession> = {\n state: newState,\n completedFactors: newCompletedFactors,\n attempts: 0, // Reset attempts on successful authentication\n userId: userId,\n };\n\n // After first-factor success, determine if MFA is required for this session.\n // W3.1: Resolve per-user-type auth policy from session's activeUserType.\n if (!isSecondFactor) {\n const mfaCheck = await this._shouldRequireMFA(ec, userId, authMethod, sessionPolicy);\n if (mfaCheck.required) {\n const hasEnrolledStrongFactor = mfaCheck.enrolledMethods.some(m => m !== AuthMethod.EMAIL_OTP);\n\n if (!hasEnrolledStrongFactor) {\n // W4.5: MFA required but no strong factor enrolled — route to enrollment\n const secondFactorMethods = AuthUtils.getSecondFactorMethods();\n const availableEnrollment = secondFactorMethods.filter(\n m => sessionPolicy.authMethodsEnabled?.[m],\n );\n\n sessionUpdate.state = AuthenticationSessionState.MFA_ENROLLMENT_REQUIRED;\n sessionUpdate.requiresMFA = true;\n sessionUpdate.requireStrongMFA = sessionPolicy.mfaPolicy?.requireStrongMFA ?? false;\n sessionUpdate.nextStep = AuthNextStep.MFA_ENROLLMENT;\n sessionUpdate.availableEnrollmentMethods = availableEnrollment;\n } else {\n const mfaResolution = await this._resolveUsableMfaMethods(mfaCheck.enrolledMethods, sessionPolicy);\n\n sessionUpdate.requiresMFA = true;\n sessionUpdate.requireStrongMFA = mfaResolution.requireStrongMFA;\n sessionUpdate.availableSecondFactorMethods = mfaResolution.availableMethods;\n sessionUpdate.enrolledSecondFactorMethods = mfaCheck.enrolledMethods;\n sessionUpdate.usableSecondFactorMethods = mfaResolution.usableMethods;\n }\n }\n }\n\n await this.updateSession(sessionId, sessionUpdate);\n\n // W2.3: Reset progressive lockout counter on successful auth\n if (sessionPolicy.lockoutPolicy.progressiveLockout && userId) {\n try {\n await this.credentialOps.resetLockout(ec, userId);\n } catch {\n // Non-critical: lockout counter reset failure should not block auth\n }\n }\n }\n\n // ===============================\n // AUTHENTICATION FLOW METHODS\n // ===============================\n\n public async identify(\n ec: ExecutionContext<any>,\n identificationRequest: AuthIdentificationRequest,\n activeUserType?: string,\n frontendServiceName?: string,\n ): Promise<AuthIdentificationResponse> {\n const { email, deviceInfo } = identificationRequest;\n\n this.logDebug(`User identification request: email=${email}`);\n\n // PR 8c (rate-limit unification, Step 5 — Option D, third\n // service-layer lift): the dual rate-limit (formerly H1 fix —\n // `${AUTH_REDIS_KEYS.IDENTIFY_IP}${ip}` 10/60 + `${AUTH_REDIS_KEYS.IDENTIFY_EMAIL}${email.toLowerCase()}`\n // 10/60, both raw `checkRateLimit`) moved UP to\n // `AuthenticationController.identify` as two declarative\n // `checkPolicy` companions. The `if (deviceInfo?.ipAddress)`\n // guard pattern was simultaneously closed at the lifted seam:\n // the new path uses `getClientIpFromRequest` which co-buckets\n // unknown-IP callers via the `'unknown'` sentinel (same\n // PR-7b net-upgrade pattern). Rationale for the lift: rate\n // limits are intrinsically HTTP concerns — bucket keys (IP,\n // email) live at the HTTP layer, 429 feedback is HTTP-only,\n // and service contracts must remain HTTP-type-free. See plan\n // body for the full Option D analysis.\n\n // Q-1 Option C / no-peek sub-decision (lockout-state-machine-modernization.md):\n // `identify()` deliberately does NOT read the global lockout counter.\n // The canonical enforcement seam is now `authenticatePassword()`'s\n // bridge-backed pre-flight `checkRateLimit(...)` call, which keeps the\n // lockout state machine atomic without introducing a read-only \"peek\"\n // primitive at the framework layer.\n\n const user = await this.userLookup.findAnyUserByEmail(ec, email);\n\n this.logDebug(`User lookup result: userExists=${!!user}, email=${email}`);\n\n // AUTH-10 FIX: When the user exists in DB, trust their stored userTypes over\n // the client-provided X-Frontend-Service-Name-derived hint. The header is only used as a\n // hint when the user is unknown (pre-registration UI).\n const dbUserTypes = user ? (user as User & { userTypes?: string[] }).userTypes : undefined;\n const resolvedUserType = (dbUserTypes?.length ? dbUserTypes[0] : undefined) ?? activeUserType;\n\n // ─── Step 14: Domain-based SSO routing ───\n // Extract email domain and check if an org claims it for SSO\n const emailDomain = email.split('@')[1]?.toLowerCase();\n let domainOrgLookup: DomainOrgLookupResult | null = null;\n\n if (emailDomain) {\n try {\n domainOrgLookup = await this.domainToOrgLookup.findOrgByDomain(ec, emailDomain);\n } catch {\n this.logDebug('Domain-to-org lookup failed (non-fatal)', { emailDomain });\n }\n }\n\n // Generate cryptographically secure session ID (Section 6.5 fix)\n const sessionId = this.sessionStore.generateSessionId();\n\n // AUTH-14: Use org-override-aware policy when user is known, raw policy for unknown users\n this._assertFrontendServiceAuthAllowed(frontendServiceName, resolvedUserType);\n\n const authPolicy = (user && resolvedUserType)\n ? await this._resolveAuthPolicyWithOrgOverrides(ec, resolvedUserType, user._id)\n : this._resolveAuthPolicy(resolvedUserType);\n const firstFactorMethods = await this._getAvailableFirstFactorMethods(ec, domainOrgLookup, authPolicy);\n\n /*\n * ─── The offered method set depends on POLICY ONLY ────────────────────────────────────────\n *\n * This is a PRE-AUTHENTICATION response to an email hint, and the whole point of the `userExists:\n * true` fix below is that it must be identical whether or not the address names an account. Two\n * per-account narrowings used to run here and defeated that, each in the same one-sided way:\n *\n * - PASSKEY was removed when an EXISTING user had none registered — so an absent PASSKEY\n * proved the account exists, because the branch is skipped entirely for an unknown address;\n * - the surviving PASSKEY entry was enriched with `registeredPasskeyCount`, disclosing how\n * many authenticators a named person has before anyone proved they are that person.\n *\n * Neither had a single consumer anywhere in the repository — no frontend read the count, and no\n * caller depended on the narrowing — so both were paying an enumeration oracle for nothing.\n *\n * PASSKEY is now offered whenever the policy enables it. A caller with no credential learns that\n * from their own authenticator: `navigator.credentials.get()` reports no discoverable credential\n * client-side, which is where that answer belongs. It is also what conditional UI (passkey\n * autofill) already does — the browser knows, and the server does not have to say.\n */\n\n // If org requires SSO and disallows password fallback, fail closed to\n // enterprise methods only. If none can be materialized, keep the list empty\n // instead of advertising social/password and failing after an IdP round-trip.\n if (requiresEnterpriseSsoOnly(domainOrgLookup)) {\n const ssoOnlyMethods = restrictFirstFactorMethodsForEnterpriseSso(\n firstFactorMethods,\n domainOrgLookup,\n );\n firstFactorMethods.length = 0;\n firstFactorMethods.push(...ssoOnlyMethods);\n }\n\n // Create session (W3.5: activeUserType stored on session, W3.1: per-user-type TTL + lockout)\n // AUTH-10: Store the DB-resolved user type, not the raw header value\n const session = await this.createSession(sessionId, AuthenticationSessionState.IDENTIFIED, {\n deviceInfo,\n activeUserType: resolvedUserType,\n });\n\n await this.updateSession(sessionId, {\n email: email.toLowerCase(),\n userExists: !!user,\n userId: user?._id,\n availableFirstFactorMethods: firstFactorMethods,\n scopeId: domainOrgLookup?.scopeId,\n scopeType: domainOrgLookup?.scopeType,\n });\n\n /*\n * Build organization branding if the domain matched an org — the TENANT's own branding first,\n * the application's brand assets second (#410).\n *\n * The comment here used to say the org \"has no per-org logo at identification time (we've only\n * matched a domain, not loaded an org profile)\". That was true of what the code did and false\n * as a constraint: the domain lookup resolves `scopeId`, which IS the organization id, so the\n * profile was always one read away. A tenant could upload a logo, see it on its settings screen,\n * and never see it on its own sign-in page.\n *\n * Discloses nothing new. `organizationName` — the tenant's display name — is already returned at\n * this step, to anyone, keyed only on the domain and never on whether the user exists (the H2\n * anti-enumeration invariant below). A login screen's branding is meant to be seen by the person\n * about to sign in; that is what it is for.\n *\n * Best-effort by construction: this is a PRE-AUTHENTICATION path, so a profile read that fails\n * must degrade to the application brand rather than refuse an identification.\n */\n const organizationBrandingRecord = domainOrgLookup?.scopeId\n ? await this.readOrganizationBrandingForIdentification(ec, domainOrgLookup.scopeId)\n : undefined;\n\n const organizationBranding = domainOrgLookup\n ? {\n organizationName: domainOrgLookup.matchedProvider?.displayName,\n ...resolveTenantBrandPresentation(organizationBrandingRecord, {\n // `resolveBrandLogoUrl` returns undefined when no brand asset was generated yet.\n logoUrl:\n this.appConfigService.resolveBrandLogoUrl({\n composition: BrandAssetComposition.LOCKUP,\n theme: BrandAssetTheme.DEFAULT,\n })\n ?? this.appConfigService.resolveBrandLogoUrl({\n composition: BrandAssetComposition.SYMBOL,\n theme: BrandAssetTheme.DEFAULT,\n }),\n // No application-level primary colour exists to fall back to: the only configured\n // `primaryColor` in the engine is an EMAIL brand token, which is a different palette for\n // a different medium. So this DTO field is populated from the tenant or not at all —\n // honestly absent rather than filled with a value from somewhere it does not belong.\n primaryColor: undefined,\n }),\n }\n : undefined;\n\n // H2 fix: Always return userExists: true to prevent email enumeration.\n // If no user was found, still advertise PASSWORD as available method so the\n // response shape is identical regardless of email existence.\n if (!user && firstFactorMethods.length === 0 && !requiresEnterpriseSsoOnly(domainOrgLookup)) {\n const passwordMethod = await this._buildAvailableMethodObject(undefined, AuthMethod.PASSWORD, undefined, authPolicy);\n if (passwordMethod) {\n firstFactorMethods.push(passwordMethod);\n }\n }\n\n /*\n * ─── `ssoMigrationRequired` is GONE, and its removal is the same fix as the block above ───────\n *\n * It was computed here as \"this user's domain enforces SSO and they have not linked an identity\n * yet\", which required BOTH an existing user and an identity-link read. `true` therefore proved\n * the address names an account — the third one-sided existence oracle in this response, sitting\n * two statements above the `userExists: true` line that exists to prevent exactly that.\n *\n * It could have been made enumeration-safe by deriving it from the DOMAIN alone, and that was\n * rejected: domain-derived, the flag is true for people who HAVE linked, so its name would\n * become a lie and the messaging a future reader wires from it would fire on the wrong half of\n * the tenant. The honest answer is that it has no consumer — no frontend, no test, nothing in\n * either dogfood application read it — so there is nothing to preserve. A flag that only a\n * post-authentication surface can answer honestly belongs on a post-authentication surface.\n */\n\n const payload = {\n sessionId,\n email: email.toLowerCase(),\n userExists: true, // H2 fix: always true to prevent enumeration\n firstFactorMethods,\n defaultFirstFactorMethod: firstFactorMethods.length > 0 ? firstFactorMethods[0].method : undefined,\n secondFactorMethods: [],\n requiresMFA: false,\n mfaMethodsRequired: AuthenticationOrchestratorBackendService.DEFAULT_MFA_METHODS_REQUIRED,\n organizationBranding,\n availableIntegrations: [],\n };\n return AuthIdentificationResponseSchema.parse(payload);\n }\n\n // ===============================\n // AVAILABLE METHODS LOGIC\n // ===============================\n\n /**\n * PUBLIC reuse wrapper — build the `AvailableMethod[]` first-factor set for an\n * already-RESOLVED auth policy, WITHOUT an email→domain lookup. Used by the\n * public invitation-info endpoint (`AuthRegistrationBackendService.getInvitationInfo`),\n * which knows the target org directly (not via email domain) and only needs the\n * policy-gated method set. SSO method entries are returned WITHOUT per-connection\n * enrichment (no domain lookup); the invitation endpoint derives `managementMode`\n * from the policy. Pass an optional `domainOrgLookup` (from `findOrgByDomain` OR the\n * scope-keyed `buildLookupForScope`) to enrich ORG_SAML/ORG_OPENID_CONNECT entries\n * with per-connection `ssoIds`/`config`; omit it to drop org-SSO methods. Reuses the\n * exact same per-method construction as `identify()` so the two surfaces never drift.\n */\n public async buildFirstFactorMethodsForPolicy(\n ec: ExecutionContext<any>,\n authPolicy: UserTypeAuthPolicy,\n domainOrgLookup?: DomainOrgLookupResult | null,\n ): Promise<AvailableMethod[]> {\n return this._getAvailableFirstFactorMethods(ec, domainOrgLookup, authPolicy);\n }\n\n private async _getAvailableFirstFactorMethods(ec: ExecutionContext<any>, domainOrgLookup?: DomainOrgLookupResult | null, authPolicy?: UserTypeAuthPolicy): Promise<AvailableMethod[]> {\n const policy = authPolicy ?? AuthenticationOrchestratorBackendService.FALLBACK_AUTH_POLICY;\n const methods: AvailableMethod[] = [];\n for (const method of AuthUtils.getFirstFactorMethods()) {\n const availableMethod = await this._buildAvailableMethodObject(ec, method, domainOrgLookup, policy);\n if (availableMethod) {\n methods.push(availableMethod);\n }\n }\n return methods;\n }\n\n private async _getAvailableSecondFactorMethods(authPolicy?: UserTypeAuthPolicy): Promise<AvailableMethod[]> {\n const policy = authPolicy ?? AuthenticationOrchestratorBackendService.FALLBACK_AUTH_POLICY;\n const methods: AvailableMethod[] = [];\n for (const method of AuthUtils.getSecondFactorMethods()) {\n const availableMethod = await this._buildAvailableMethodObject(undefined, method, undefined, policy);\n if (availableMethod) {\n methods.push(availableMethod);\n }\n }\n\n const acceptable = policy.mfaPolicy?.acceptableMFAMethods ?? [];\n if (acceptable.length > 0) {\n return methods.filter(m => acceptable.includes(m.method));\n }\n return methods;\n }\n\n /**\n * Intersects available methods with enrolled methods, applying requireStrongMFA filtering.\n * Returns { availableMethods, usableMethods, requireStrongMFA } for session population.\n */\n private async _resolveUsableMfaMethods(enrolledMethods: AuthMethod[], authPolicy?: UserTypeAuthPolicy): Promise<{\n availableMethods: AvailableMethod[];\n usableMethods: AuthMethod[];\n requireStrongMFA: boolean;\n }> {\n const policy = authPolicy ?? AuthenticationOrchestratorBackendService.FALLBACK_AUTH_POLICY;\n const availableMethods = await this._getAvailableSecondFactorMethods(policy);\n const enrolledSet = new Set<AuthMethod>(enrolledMethods);\n const requireStrongMFA = !!policy.mfaPolicy?.requireStrongMFA;\n let usableMethods: AuthMethod[] = availableMethods\n .filter(m => enrolledSet.has(m.method))\n .map(m => m.method);\n if (requireStrongMFA) {\n usableMethods = usableMethods.filter(m => m !== AuthMethod.EMAIL_OTP);\n }\n return { availableMethods, usableMethods, requireStrongMFA };\n }\n\n // ===============================\n // PASSWORD AUTHENTICATION\n // ===============================\n\n public async authenticatePassword(ec: ExecutionContext<any>, passwordAuthRequest: PasswordAuthRequest): Promise<AuthenticationServiceResult> {\n const { sessionId, password } = passwordAuthRequest;\n this.logDebug('Password authentication started', { sessionId, hasPassword: !!password });\n\n // Get and validate session\n const session = await this.getSession(sessionId);\n if (!session) {\n this.logDebug('Session not found', { sessionId });\n const authResponse = this._buildIdentificationErrorResponse(sessionId, passwordAuthRequest.factorLevel, false, session);\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,\n context: { sessionId, authResponse },\n });\n }\n\n // Check session-level lockout\n if (session.state === AuthenticationSessionState.LOCKED) {\n const authResponse = this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.FIRST, {\n retryAllowed: false,\n lockoutUntil: session.lockoutUntil,\n });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n context: { sessionId, authResponse },\n });\n }\n\n // M2 fix: State machine guard — only allow password auth from valid states\n const validPasswordStates = new Set([\n AuthenticationSessionState.IDENTIFIED,\n AuthenticationSessionState.FIRST_FACTOR_IN_PROGRESS,\n ]);\n if (!validPasswordStates.has(session.state)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,\n });\n }\n\n const { email } = session;\n\n // H1 fix: Rate limit authenticatePassword() — 5 req/min per email+IP.\n //\n // FRAMEWORK-CANONICAL K-3 ESCAPE-HATCH SITE — see PR 8e of the\n // rate-limit unification (Step 5, Option D — fifth and final\n // service-layer audit). This dual-bucket throttle was examined\n // for lifting to `AuthenticationController.authenticatePassword`\n // (direct path) + `AuthenticationController.authenticate` (generic\n // dispatch path) and EXPLICITLY KEPT at the service layer alongside\n // the SMS-OTP burst block (`sendSMSOTP`), the email-OTP send\n // cap (`sendEmailOTP`, migrated to `checkRateLimit` in Step 7\n // F-23 sub-PR a), and the global lockout counter below — together\n // those are the four canonical `checkRateLimit` callers in the\n // engine outside the WebSocket per-event surface (K-8 out-of-scope)\n // and `RateLimitBackendService` itself.\n //\n // Why kept at the service layer (PR 8e Option K rationale):\n // • Both bucket keys derive from SESSION-STORED state, NOT from\n // HTTP-layer artefacts.\n // - `email` is destructured from `session.email` on line above\n // (set at `identify` time and immutable for the session\n // lifetime); `passwordAuthRequest.email` from the body is\n // EXPLICITLY ignored — see the controller's `passwordRequest`\n // construction comment (\"Email should be available from\n // session, but included for compatibility\").\n // - `ipAddress` is `session.deviceInfo?.ipAddress` captured at\n // `identify` time, NOT the current request's IP — defends\n // against IP rotation WITHIN one session, which the\n // controller-level `getClientIpFromRequest(req)` could not.\n // • Lifting via `body.email` (only the direct path has it; the\n // generic `PasswordAuthRequestSchema` has no `email` field at\n // all) would let an attacker spoof a per-request email to dodge\n // the per-email cap entirely. The 10/min/email cap upstream at\n // `controller.identify` (PR 8c) is the floor — but that floor\n // governs identify only; without this in-session per-email cap,\n // a single established session could burn unlimited password\n // attempts against `session.email` by rotating `body.email` per\n // request (the orchestrator buckets on `session.email`, but a\n // controller-side `body.email` bucket would not).\n // • Lifting with `session.email` / `session.deviceInfo.ipAddress`\n // requires `await this.getSession(sessionId)` BEFORE rate-limit\n // fail-fast — defeats F-22, doubles Redis round-trips on every\n // request, and creates a non-trivial fail-open pathway when the\n // session lookup itself is rate-limited or fails.\n //\n // The K-3 contract reserves the raw `checkRateLimit` API for cases\n // where the bucket key is NOT cheaply derivable from HTTP-layer\n // inputs — `sendSMSOTP` (per-physical-phone, DB-resolved),\n // `authenticatePassword` (per-verified-session-email +\n // per-session-captured-IP), `sendEmailOTP`\n // (per-session-resolved-userId, migrated from\n // `redisService.incrementRateLimit` in Step 7 F-23 sub-PR a),\n // and the global lockout counter below are the four canonical\n // engine-side examples. Future authors hitting any of these\n // shapes should use this surface directly rather than threading\n // `req`/`res` into service signatures or weakening the bucket\n // dimension.\n //\n // D-4 baseline applied at the bucket-key seam: `email.toLowerCase()`\n // is a no-op since `AuthIdentificationRequestSchema` already\n // lowercases via `.email().toLowerCase()` (so `session.email` is\n // already lowercase by the time it reaches here), but the call is\n // PRESERVED verbatim to keep the intent-revealing call-site\n // invariant shared with every other email-keyed bucket in the\n // family (matches PR 7b / PR 8c convention).\n //\n // F-7 EXCEPTION at the per-IP bucket (M-2, post-PR-8 review): the\n // `if (ipAddress)` guard at the call site below DELIBERATELY\n // bypasses the F-7 unknown-IP closure pattern (PR 7b: co-bucket\n // via the `'unknown'` sentinel from `getClientIpFromRequest`).\n // The sentinel works at the controller layer because every\n // request goes through one express layer, so the sentinel\n // collides consistently. Here the bucket key is\n // `session.deviceInfo?.ipAddress` (captured at identify time);\n // a missing value means \"the session was created without an IP\"\n // — a different population from \"this request lacks an IP\" — and\n // co-bucketing them would incorrectly couple two distinct threat\n // surfaces. The companion controller-side `controller.identify`\n // per-IP cap (PR 8c) IS F-7-closed and catches IP-less session-\n // creation flooding upstream, so the only sessions that reach\n // here without an IP are those that legitimately bypassed\n // identify (none today; reserved for future first-factor flows).\n // See the `PASSWORD_IP` block in `auth-constants.backend.ts`\n // for the canonical doc; this paragraph is the call-site echo\n // so a future auditor doesn't have to chase the constants file.\n //\n // The complementary HTTP-layer companions live as `checkPolicy`\n // calls upstream at `controller.identify` (10/min per-email +\n // 10/min per-IP, PR 8c) — the two layers compose for full defense\n // in depth: identify caps catch session-creation flooding;\n // authenticatePassword caps catch in-session password-stuffing\n // against the verified email and originating IP regardless of\n // body manipulation.\n const ipAddress = session.deviceInfo?.ipAddress;\n await this.rateLimitService.checkRateLimit(`${AUTH_REDIS_KEYS.PASSWORD_EMAIL}${email.toLowerCase()}`, 5, 60);\n if (ipAddress) {\n await this.rateLimitService.checkRateLimit(`${AUTH_REDIS_KEYS.PASSWORD_IP}${ipAddress}`, 10, 60);\n }\n\n /*\n * ─── The SSO enforcement gate MOVED, and it moved for two reasons ────────────────────────────\n *\n * It used to run HERE, before the user was resolved and before the password was verified, and\n * it answers with a distinguishable `AUTHENTICATION_SSO_REQUIRED` that reaches the client\n * verbatim. So any per-account decision it took — and break-glass (#423) is one — was\n * observable to a caller who had proved nothing. It now runs after verification, immediately\n * beside `_incrementSSOGraceLogin`, which is the counter it gates.\n *\n * The second reason is the one that would matter even without break-glass: a caller who typed\n * the wrong password at an SSO-enforced tenant used to be told the tenant enforces SSO, before\n * anything about them was established. Now a wrong password fails as a wrong password.\n *\n * What this costs: an exhausted-grace account burns one password verification before being\n * refused. That is one bcrypt comparison against a caller who supplied a credential, on a path\n * already rate-limited per email and per IP two statements above.\n */\n\n // Resolve user\n const user = await this._resolveUserForAuthentication(ec, session, email, sessionId);\n const userId = (user as User)._id;\n\n // Q1 (AUTH-23 / .claude/plans/scim-vs-auth-authority-axis.md): the login-side complement\n // to the invite-accept credential block. Even when a `passwordHash` EXISTS, refuse\n // first-factor PASSWORD when the user's effective (org-merged, most-restrictive) policy\n // disables it. This closes the USER-GLOBAL stray-credential vector: a password minted at\n // an OPEN org must not authenticate a user who ALSO belongs to an IdP-managed org whose\n // policy disables PASSWORD (the multi-org intersection resolves PASSWORD off for that\n // user). Fail-closed with the SAME generic \"credentials not found\" envelope as the\n // password-less branch below, so it never reveals the org is SSO/SCIM-managed\n // (anti-enumeration). NB: teeth depend on the managed org's policy actually disabling\n // PASSWORD — until posture-derived policy (Option C / AUTH-24) lands, that means an\n // authored `authOverride`. A null `activeUserType` resolves to FALLBACK_AUTH_POLICY\n // (PASSWORD enabled), so untyped accounts are unaffected.\n const effectivePolicy = await this._resolveAuthPolicyWithOrgOverrides(ec, session.activeUserType, userId);\n if (!effectivePolicy.authMethodsEnabled?.[AuthMethod.PASSWORD]) {\n const { locked } = await this.incrementSessionAttempts(ec, sessionId);\n const authResponse = this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.FIRST, {\n authMethod: AuthMethod.PASSWORD,\n retryAllowed: !locked,\n });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_NOT_FOUND,\n context: { email, authResponse },\n });\n }\n\n // Resolve credentials via AuthCredentialVerifier\n const cred = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n // `passwordHash` is OPTIONAL on the credential document (password-less accounts whose\n // first factor is a passkey / magic link / SSO). A missing hash here means the account\n // simply has no password to verify, so PASSWORD auth must fail-closed with the SAME\n // \"credentials not found\" envelope rather than reaching `verifyPassword(undefined, …)`\n // (which would throw inside argon2). Treated identically to \"no credential row\" so the\n // response never distinguishes \"no account\" from \"account without a password\" (no\n // enumeration of which first factors an account has).\n if (!cred || !cred.passwordHash) {\n const { locked } = await this.incrementSessionAttempts(ec, sessionId);\n const authResponse = this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.FIRST, {\n authMethod: AuthMethod.PASSWORD,\n retryAllowed: !locked,\n });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_NOT_FOUND,\n context: { email, authResponse },\n });\n }\n\n // C1 / F-23 close (lockout-state-machine-modernization.md Step 3.2):\n // the per-email global lockout counter is now the FOURTH canonical\n // K-3 `checkRateLimit` site. It stays at the orchestrator seam because\n // the bucket key is `session.email`, NOT an HTTP-derived identifier —\n // same K-3 rationale as the adjacent `PASSWORD_EMAIL` / `PASSWORD_IP`\n // caps above. The upstream `controller.identify` companions (10/min\n // per-email + 10/min per-IP, lifted in PR 8c) remain the first line of\n // defense against session-creation flooding; this per-session seam\n // preserves the pre-existing \"global lockout survives session\n // recreation\" behavior for password attempts against the verified\n // session email.\n //\n // Placement is intentional: the bridge-backed pre-flight runs AFTER\n // org-policy gating (`_checkSSOGraceLoginAllowed`), user resolution,\n // and credential existence checks, but BEFORE `verifyPassword(...)`.\n // That preserves the old \"count real password checks, not earlier\n // orchestration/policy failures\" scope while still moving the counter\n // to one atomic pre-verify seam.\n //\n // Bridge rationale: this is semantically a rate-limit (per-email cap in\n // a time window) but user-facing as an AUTHENTICATION lockout, not a 429.\n // Step 3.1 added the `options` bridge on `checkRateLimit` specifically so\n // this site can preserve the existing\n // `ErrorType.AUTHENTICATION` +\n // `AUTHENTICATION_ACCOUNT_LOCKED` +\n // `{ lockoutDurationMinutes }`\n // envelope while consolidating the counter mechanics into the framework\n // primitive.\n //\n // Timing shift vs the old split-phase design:\n // - OLD: `_checkGlobalLockout(email)` READ before password verify, then\n // `_incrementGlobalAttempts(email)` only after a failed verify.\n // - NEW: atomic `checkRateLimit(...)` increments immediately before\n // `verifyPassword(...)` runs and throws at attempt N+1's pre-flight\n // when the cap is exceeded.\n // Success-path `_resetGlobalAttempts(email)` is intentionally preserved\n // (Q-2 = Reset-keep) so a successful auth wipes the budget, matching\n // today's UX contract.\n //\n // F-AUDIT-1 (fixed 2026-07-23): the per-email GLOBAL lockout now emits the same\n // `USER_ACCOUNT_LOCKED` audit as the session/progressive path. `checkRateLimit` THROWS the\n // AUTHENTICATION_ACCOUNT_LOCKED error when the per-email cap is exceeded, so the emission rides a\n // catch on exactly that error — best-effort (a routing/emit failure must never mask the lockout\n // error the caller expects) and coalesced on the SAME per-user ledger as the progressive path (a\n // user tripping both within the window emits once). `userId` + `session` are already resolved at\n // this seam (see the placement note above), so the SIEM routing has everything it needs.\n try {\n await this.rateLimitService.checkRateLimit(\n `${AUTH_REDIS_KEYS.GLOBAL_LOCKOUT}${email.toLowerCase()}`,\n this.lockoutPolicy.maxLoginAttempts,\n this.lockoutPolicy.lockoutDurationMinutes * 60,\n undefined,\n 'Account temporarily locked due to too many failed attempts. Please try again later.',\n {\n errorType: ErrorType.AUTHENTICATION,\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n contextExtra: { lockoutDurationMinutes: this.lockoutPolicy.lockoutDurationMinutes },\n },\n );\n } catch (globalLockoutError) {\n if (\n isWildoBackendError(globalLockoutError) &&\n globalLockoutError.customMessageReference === ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED\n ) {\n try {\n await this._emitAccountLockedAuditOnce(ec, userId, email, this.lockoutPolicy.lockoutDurationMinutes, session.deviceInfo, sessionId, AccountLockoutReason.GLOBAL_EMAIL_RATE_LIMIT);\n } catch {\n /* best-effort audit — never let an emit/routing failure mask the lockout error */\n }\n }\n throw globalLockoutError;\n }\n\n // Update session state\n await this.updateSession(sessionId, {\n state: AuthenticationSessionState.FIRST_FACTOR_IN_PROGRESS,\n currentFactor: AuthFactorLevel.FIRST,\n });\n\n // Verify password via AuthCredentialVerifier\n this.logDebug('Verifying password', { sessionId });\n const ok = await this.credentialVerifier.verifyPassword(cred.passwordHash, password);\n this.logDebug('Password verification result', { sessionId, passwordMatch: ok });\n\n if (!ok) {\n this.logDebug('Password verification failed', { sessionId });\n const { locked, session: updatedAttemptSession } = await this.incrementSessionAttempts(ec, sessionId);\n const lockoutUntil = locked ? updatedAttemptSession?.lockoutUntil : undefined;\n const retryAfterSeconds = lockoutUntil\n ? Math.max(1, Math.ceil((lockoutUntil.getTime() - Date.now()) / 1000))\n : this.lockoutPolicy.lockoutDurationMinutes * 60;\n const lockoutDurationMinutes = Math.ceil(retryAfterSeconds / 60);\n\n // Audit log authentication failure (TRAP 13: audit stays in orchestrator)\n const deviceInfo = session.deviceInfo;\n await this.auditLogsService.logUserLoginFailed({\n email,\n authMethod: AuthMethod.PASSWORD,\n failureReason: 'Invalid credentials',\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n attemptsRemaining: session.maxAttempts - session.attempts - 1,\n sessionId,\n });\n\n const authResponse = this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.FIRST, {\n authMethod: AuthMethod.PASSWORD,\n retryAllowed: !locked,\n ...(lockoutUntil && { lockoutUntil }),\n });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: locked\n ? ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED\n : ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,\n context: {\n email,\n authResponse,\n ...(locked && {\n lockoutDurationMinutes,\n retryAfterSeconds,\n message: 'Account temporarily locked due to too many failed attempts. Please try again later.',\n }),\n },\n });\n }\n\n // Password verified — update session\n this.logDebug('Password authentication successful', { sessionId, userId });\n\n // C1 fix: Reset global lockout counter on successful authentication\n await this._resetGlobalAttempts(email);\n\n /*\n * SSO enforcement, evaluated on a caller who has now PROVED the credential — see the note at\n * the top of this method for why it is here rather than in front of the verification.\n *\n * The check may refuse (the tenant requires SSO and this account is neither exempt nor within\n * its grace allowance), so it runs BEFORE the increment: a refused sign-in must not consume a\n * grace attempt it was never granted.\n */\n if (session.scopeType && session.scopeId) {\n await this._checkSSOGraceLoginAllowed(\n ec,\n session.scopeType,\n session.scopeId,\n userId,\n (user as User).email,\n { sessionId, ipAddress: ipAddress ?? '', userAgent: session.deviceInfo?.userAgent ?? '' },\n );\n\n await this._incrementSSOGraceLogin(\n ec,\n session.scopeType,\n session.scopeId,\n userId,\n );\n }\n\n await this._updateSessionAfterSuccessfulAuth(ec, sessionId, userId, AuthMethod.PASSWORD);\n\n const updatedSession = await this.getSession(sessionId);\n return this._buildAuthenticationSuccessMethod(\n sessionId,\n AuthFactorLevel.FIRST,\n AuthMethod.PASSWORD,\n '', // No access token yet — tokens issued after completion check in authenticate()\n {\n completedFactors: updatedSession?.completedFactors || [],\n requiresMFA: updatedSession?.requiresMFA || false,\n availableMFAMethods: updatedSession?.availableSecondFactorMethods || [],\n mfaMethodsRequired: updatedSession?.mfaMethodsRequired,\n enrolledSecondFactorMethods: updatedSession?.enrolledSecondFactorMethods || [],\n usableSecondFactorMethods: updatedSession?.usableSecondFactorMethods || [],\n nextStep: updatedSession?.nextStep,\n availableEnrollmentMethods: updatedSession?.availableEnrollmentMethods || [],\n },\n );\n }\n\n // ===============================\n // W4: REGISTRATION PIPELINE\n // ===============================\n\n /**\n * W4.1: Create a registration session after user account creation.\n * Called by `registerUser()` instead of returning a generic success message.\n * The session tracks the registration pipeline state (email verify → MFA enrollment → complete).\n */\n public async createRegistrationSession(\n userId: string,\n email: string,\n options: {\n activeUserType?: string;\n purpose?: AuthSessionPurpose;\n deviceInfo?: { userAgent?: string; ipAddress?: string };\n pendingOrgType?: string;\n } = {},\n ): Promise<AuthenticationSession> {\n const sessionId = this.sessionStore.generateSessionId();\n const session = await this.createSession(sessionId, AuthenticationSessionState.REGISTERED, {\n activeUserType: options.activeUserType,\n purpose: options.purpose ?? AuthSessionPurpose.REGISTRATION,\n email,\n userId,\n deviceInfo: options.deviceInfo,\n pendingOrgType: options.pendingOrgType,\n });\n return session;\n }\n\n /**\n * W4.1: Process email verification through the registration pipeline.\n * Instead of issuing tokens directly, transitions the session through:\n * EMAIL_VERIFIED → check MFA → MFA_ENROLLMENT_REQUIRED / MFA_ENROLLMENT_GRACE / COMPLETED.\n *\n * Returns the updated session with `nextStep` indicating what the frontend should do.\n */\n public async processEmailVerification(\n ec: ExecutionContext<any>,\n userId: string,\n email: string,\n activeUserType?: string,\n deviceInfo?: { userAgent?: string; ipAddress?: string },\n purpose?: AuthSessionPurpose,\n ): Promise<AuthenticationSession> {\n const authPolicy = activeUserType\n ? await this._resolveAuthPolicyWithOrgOverrides(ec, activeUserType, userId)\n : AuthenticationOrchestratorBackendService.FALLBACK_AUTH_POLICY;\n\n const sessionId = this.sessionStore.generateSessionId();\n const session = await this.createSession(sessionId, AuthenticationSessionState.EMAIL_VERIFIED, {\n activeUserType,\n purpose: purpose ?? AuthSessionPurpose.REGISTRATION,\n email,\n userId,\n deviceInfo,\n });\n\n return this._advanceRegistrationPipeline(ec, session, authPolicy, userId);\n }\n\n /**\n * W4: Advance a registration session through the pipeline after a state transition.\n * Checks MFA requirements, grace period, and onboarding to determine next state.\n */\n private async _advanceRegistrationPipeline(\n ec: ExecutionContext<any>,\n session: AuthenticationSession,\n authPolicy: UserTypeAuthPolicy,\n userId: string,\n ): Promise<AuthenticationSession> {\n if (session.state !== AuthenticationSessionState.EMAIL_VERIFIED) {\n return session;\n }\n\n const mfaResult = await this._shouldRequireMFA(ec, userId, undefined, authPolicy);\n\n const cred = await this.credentialOps.readByUserId(ec, userId);\n\n if (mfaResult.required) {\n const hasEnrolledStrongFactor = mfaResult.enrolledMethods.some(m => m !== AuthMethod.EMAIL_OTP);\n\n if (hasEnrolledStrongFactor) {\n if (cred && cred.mfaEnrollmentState !== MfaEnrollmentState.ENROLLED) {\n await this.credentialOps.updateById(ec, cred._id, { mfaEnrollmentState: MfaEnrollmentState.ENROLLED } as Partial<UserCredentials>);\n }\n return this._completeRegistrationSession(session);\n }\n\n const gracePeriodDays = authPolicy.mfaPolicy?.enrollmentGracePeriodDays ?? 0;\n if (gracePeriodDays > 0) {\n const graceExpiresAt = new Date();\n graceExpiresAt.setDate(graceExpiresAt.getDate() + gracePeriodDays);\n\n if (cred) {\n await this.credentialOps.updateById(ec, cred._id, {\n mfaEnrollmentState: MfaEnrollmentState.GRACE,\n firstMfaPromptAt: cred.firstMfaPromptAt ?? new Date(),\n } as Partial<UserCredentials>);\n }\n\n const updated = await this.updateSession(session.sessionId, {\n state: AuthenticationSessionState.MFA_ENROLLMENT_GRACE,\n nextStep: AuthNextStep.COMPLETE,\n mfaGraceExpiresAt: graceExpiresAt.toISOString(),\n requiresMFA: true,\n });\n return updated ?? session;\n }\n\n if (cred) {\n await this.credentialOps.updateById(ec, cred._id, { mfaEnrollmentState: MfaEnrollmentState.PENDING } as Partial<UserCredentials>);\n }\n\n const secondFactorMethods = AuthUtils.getSecondFactorMethods();\n const availableEnrollment = secondFactorMethods.filter(\n m => authPolicy.authMethodsEnabled?.[m],\n );\n\n const updated = await this.updateSession(session.sessionId, {\n state: AuthenticationSessionState.MFA_ENROLLMENT_REQUIRED,\n nextStep: AuthNextStep.MFA_ENROLLMENT,\n requiresMFA: true,\n requireStrongMFA: authPolicy.mfaPolicy?.requireStrongMFA ?? false,\n availableEnrollmentMethods: availableEnrollment,\n });\n return updated ?? session;\n }\n\n if (cred && cred.mfaEnrollmentState !== MfaEnrollmentState.NOT_REQUIRED && cred.mfaEnrollmentState !== MfaEnrollmentState.ENROLLED) {\n await this.credentialOps.updateById(ec, cred._id, { mfaEnrollmentState: MfaEnrollmentState.NOT_REQUIRED } as Partial<UserCredentials>);\n }\n return this._completeRegistrationSession(session);\n }\n\n /**\n * W4: Complete a registration session — transition to COMPLETED or ONBOARDING_PENDING state.\n * W5.7: When pendingOrgType is set, route to ONBOARDING_PENDING instead of COMPLETED.\n */\n private async _completeRegistrationSession(session: AuthenticationSession): Promise<AuthenticationSession> {\n if (session.pendingOrgType) {\n const updated = await this.updateSession(session.sessionId, {\n state: AuthenticationSessionState.ONBOARDING_PENDING,\n nextStep: AuthNextStep.ONBOARDING,\n });\n return updated ?? session;\n }\n\n const updated = await this.updateSession(session.sessionId, {\n state: AuthenticationSessionState.COMPLETED,\n nextStep: AuthNextStep.COMPLETE,\n });\n return updated ?? session;\n }\n\n /**\n * W4.3: Complete MFA enrollment during registration pipeline.\n * Called after the user successfully enrolls an MFA method during registration.\n * Transitions from MFA_ENROLLMENT_REQUIRED → COMPLETED and issues tokens.\n */\n public async completeRegistrationMfaEnrollment(\n ec: ExecutionContext<any>,\n sessionId: string,\n ): Promise<AuthenticationSession> {\n const session = await this.getSession(sessionId);\n if (!session) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_EXPIRED,\n });\n }\n\n if (session.state !== AuthenticationSessionState.MFA_ENROLLMENT_REQUIRED &&\n session.state !== AuthenticationSessionState.SECOND_FACTOR_IN_PROGRESS) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.MFA_ENROLLMENT_STATE_INVALID,\n context: { state: session.state }, // diagnostic (log-only)\n });\n }\n\n // W4.9 SEC FIX: Verify that a strong MFA method was actually enrolled before completing\n if (!session.userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.MFA_ENROLLMENT_STATE_INVALID,\n });\n }\n\n const cred = await this.credentialOps.readByUserId(ec, session.userId);\n const enrolledMethods = AuthUtils.getEnrolledSecondFactorMethods(cred);\n const hasStrongFactor = enrolledMethods.some(m => m !== AuthMethod.EMAIL_OTP);\n\n if (!hasStrongFactor) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.MFA_NOT_ENROLLED,\n });\n }\n\n if (cred && cred.mfaEnrollmentState !== MfaEnrollmentState.ENROLLED) {\n await this.credentialOps.updateById(ec, cred._id, { mfaEnrollmentState: MfaEnrollmentState.ENROLLED } as Partial<UserCredentials>);\n }\n\n return this._completeRegistrationSession(session);\n }\n\n /**\n * W5.7: Complete org onboarding — create the deferred organization and transition to COMPLETED.\n * Called by the guidance/onboarding flow after collecting the org name from the user.\n */\n public async completeOrgOnboarding(\n ec: ExecutionContext<any>,\n sessionId: string,\n organizationName: string,\n ): Promise<AuthenticationSession> {\n const session = await this.getSession(sessionId);\n if (!session) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_EXPIRED,\n });\n }\n\n // Mongo is authoritative for the side effect. Check it before Redis state or\n // policy so a crash after commit can always repair the session projection,\n // even if configuration changed before the retry.\n const completed = session.userId\n ? await readCompletedOrganizationOnboarding(\n this.mongoDBService,\n this.errorBuilder,\n session.sessionId,\n session.userId,\n )\n : null;\n if (completed) {\n const repaired = await this.updateSession(session.sessionId, {\n state: AuthenticationSessionState.COMPLETED,\n nextStep: AuthNextStep.COMPLETE,\n pendingOrgType: undefined,\n organizationId: completed.organizationId,\n });\n return repaired ?? {\n ...session,\n state: AuthenticationSessionState.COMPLETED,\n nextStep: AuthNextStep.COMPLETE,\n pendingOrgType: undefined,\n organizationId: completed.organizationId,\n };\n }\n\n if (session.state !== AuthenticationSessionState.ONBOARDING_PENDING) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ONBOARDING_STATE_INVALID,\n context: { state: session.state }, // diagnostic (log-only)\n });\n }\n\n if (!session.pendingOrgType || !session.userId || !session.email) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ONBOARDING_STATE_INVALID,\n });\n }\n\n const trimmedName = organizationName.trim();\n if (!trimmedName) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.ORG_NAME_REQUIRED,\n });\n }\n\n const config = this.appConfigService.isInitialized()\n ? this.appConfigService.config\n : undefined;\n const orgTypeDef = config?.organizationTypes?.[session.pendingOrgType];\n const policy = orgTypeDef?.creationPolicy;\n const activeUserType = session.activeUserType;\n if (\n !config\n || !orgTypeDef\n || !activeUserType\n || policy?.orgNameSource !== OrganizationNameSource.ONBOARDING\n || !policy.createOnUserTypeRegistration?.includes(activeUserType)\n ) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n context: {\n reason: 'onboarding_policy_no_longer_valid',\n pendingOrgType: session.pendingOrgType,\n activeUserType,\n },\n });\n }\n\n const currentUser = await this.servicesRegistryHandler.read<User>(\n CoreResourceType.USERS,\n ec,\n { _id: session.userId },\n );\n if (!currentUser) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n context: {\n reason: 'onboarding_user_no_longer_exists',\n pendingOrgType: session.pendingOrgType,\n },\n });\n }\n if (currentUser.status !== UserStatus.ACTIVE) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,\n context: {\n userStatus: currentUser.status,\n source: 'registration_onboarding',\n },\n });\n }\n if (!currentUser.userTypes?.includes(activeUserType)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n context: {\n reason: 'onboarding_trigger_user_type_no_longer_held',\n pendingOrgType: session.pendingOrgType,\n activeUserType,\n },\n });\n }\n const acquisition = evaluateUserTypeAcquisition(\n config?.userTypes,\n orgTypeDef.userTypes ?? [],\n currentUser.userTypes ?? [],\n RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n );\n if (!acquisition.allowed) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n context: {\n channel: RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n deniedUserTypes: acquisition.deniedUserTypes,\n pendingOrgType: session.pendingOrgType,\n },\n });\n }\n\n const onboardingResult = await executeDurableOrganizationOnboarding({\n mongoDBService: this.mongoDBService,\n resourcePersistenceUnitOfWork: this.resourcePersistenceUnitOfWork,\n errorBuilder: this.errorBuilder,\n sessionId: session.sessionId,\n userId: session.userId,\n createOrganization: async (serviceOptions) => {\n // Revalidate mutable user state from the transaction snapshot. The\n // earlier checks provide fast failure; these own authorization at commit.\n const transactionalUser = await this.servicesRegistryHandler.read<User>(\n CoreResourceType.USERS,\n ec,\n { _id: session.userId },\n serviceOptions,\n );\n if (\n !transactionalUser\n || transactionalUser.status !== UserStatus.ACTIVE\n || !transactionalUser.userTypes?.includes(activeUserType)\n ) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n context: {\n reason: 'onboarding_user_state_changed_before_commit',\n pendingOrgType: session.pendingOrgType,\n activeUserType,\n },\n });\n }\n const transactionalAcquisition = evaluateUserTypeAcquisition(\n config.userTypes,\n orgTypeDef.userTypes ?? [],\n transactionalUser.userTypes ?? [],\n RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n );\n if (!transactionalAcquisition.allowed) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.REGISTRATION_DISABLED,\n context: {\n channel: RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n deniedUserTypes: transactionalAcquisition.deniedUserTypes,\n pendingOrgType: session.pendingOrgType,\n },\n });\n }\n\n const orgResult = await createOrgOnRegistration(ec, {\n userId: session.userId,\n userEmail: session.email,\n activeUserType,\n organizationName: trimmedName,\n organizationTypes: {\n [session.pendingOrgType]: {\n creationPolicy: {\n createOnUserTypeRegistration: [activeUserType],\n orgNameSource: OrganizationNameSource.ASK,\n defaultOwnerRole: policy?.defaultOwnerRole,\n },\n },\n },\n servicesRegistryHandler: this.servicesRegistryHandler,\n systemAccessService: this.systemAccessService,\n serviceOptions,\n });\n if (!orgResult.created || !orgResult.organizationId) {\n throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {\n context: {\n reason: 'durable_onboarding_organization_not_created',\n sessionId: session.sessionId,\n pendingOrgType: session.pendingOrgType,\n },\n });\n }\n\n await grantUserTypesOnOrgJoin(ec, {\n userId: session.userId,\n organizationId: orgResult.organizationId,\n organizationTypes: config.organizationTypes,\n servicesRegistryHandler: this.servicesRegistryHandler,\n systemAccessService: this.systemAccessService,\n serviceOptions,\n });\n return orgResult.organizationId;\n },\n });\n\n const updated = await this.updateSession(session.sessionId, {\n state: AuthenticationSessionState.COMPLETED,\n nextStep: AuthNextStep.COMPLETE,\n pendingOrgType: undefined,\n organizationId: onboardingResult.organizationId,\n });\n return updated ?? {\n ...session,\n state: AuthenticationSessionState.COMPLETED,\n nextStep: AuthNextStep.COMPLETE,\n pendingOrgType: undefined,\n organizationId: onboardingResult.organizationId,\n };\n }\n\n // ===============================\n // MAIN AUTHENTICATE DISPATCH\n // ===============================\n\n public async authenticate(ec: ExecutionContext<any>, request: AuthenticationRequest): Promise<AuthenticationServiceResult> {\n this.logDebug('Main authenticate method called', {\n sessionId: request.sessionId,\n method: request.method,\n factorLevel: request.factorLevel,\n });\n\n let authResponse: AuthenticationResponse;\n\n // Step 1: Dispatch to the method-specific handler.\n // Capture discriminant before switch to preserve type information for error fallback.\n const method = request.method;\n switch (method) {\n case AuthMethod.PASSWORD: {\n const session = await this.getSession(request.sessionId);\n if (!session) {\n return this.__buildAuthenticationErrorMethod(request.sessionId, request.factorLevel, { retryAllowed: false });\n }\n\n const email = session.email;\n if (!email) {\n return this.__buildAuthenticationErrorMethod(request.sessionId, request.factorLevel, { retryAllowed: true });\n }\n\n try {\n authResponse = await this.authenticatePassword(ec, request as PasswordAuthRequest);\n } catch (error) {\n throw error;\n }\n break;\n }\n\n case AuthMethod.EMAIL_OTP: {\n authResponse = await this.authenticateEmailOTP(ec, request as EmailOTPAuthRequest);\n break;\n }\n\n case AuthMethod.TOTP: {\n authResponse = await this.authenticateTOTP(ec, request as TOTPAuthRequest);\n break;\n }\n\n case AuthMethod.PASSKEY: {\n authResponse = await this.authenticatePasskey(ec, request as PasskeyAuthRequest);\n break;\n }\n\n case AuthMethod.SMS_OTP: {\n authResponse = await this.authenticateSMSOTP(ec, request as SMSOTPAuthRequest);\n break;\n }\n\n default:\n // Unimplemented methods return a clean error.\n // sessionId and factorLevel exist on BaseAuthRequestSchema — shared by all union variants.\n return this.__buildAuthenticationErrorMethod(\n request.sessionId,\n request.factorLevel ?? AuthFactorLevel.FIRST,\n { retryAllowed: true },\n );\n }\n\n this.logDebug('Authentication method result', {\n sessionId: request.sessionId,\n method: request.method,\n success: authResponse.success,\n });\n\n // Step 2: If method succeeded, check if overall authentication is complete.\n if (authResponse.success) {\n const session = await this.getSession(request.sessionId);\n if (!session) {\n return this.__buildAuthenticationErrorMethod(request.sessionId, request.factorLevel, { retryAllowed: false });\n }\n\n const isComplete = this._isAuthenticationComplete(session, request.factorLevel, request.method);\n\n if (isComplete) {\n this.logDebug('Authentication complete, issuing tokens', { sessionId: request.sessionId });\n\n // S0.7 Layer 1: Re-check user status before token issuance (catches race conditions and all auth paths).\n // `currentUser` is hoisted so the resolved user can populate the success\n // response's `user` (W7.3a: consumed by the anonymous-session transposition\n // trigger `handleAnonymousTransposition`, which gated on `authResult.user._id`\n // — previously always undefined, making transposition a no-op on interactive\n // login; also surfaces the user's own context to the frontend on login).\n let currentUser: User | null = null;\n if (session.userId) {\n currentUser = await this.userLookup.findUserById(ec, session.userId);\n if (!currentUser || currentUser.status !== UserStatus.ACTIVE) {\n await this.updateSession(request.sessionId, { state: AuthenticationSessionState.FAILED });\n this._enforceUserStatus(currentUser || { status: UserStatus.DELETED } as User, request.sessionId);\n }\n\n // W3.1b: Validate user-type membership — user's userTypes[] must include the session's activeUserType\n if (session.activeUserType && currentUser) {\n const userTypes = (currentUser as User & { userTypes?: string[] }).userTypes ?? [];\n if (!userTypes.includes(session.activeUserType)) {\n await this.updateSession(request.sessionId, { state: AuthenticationSessionState.FAILED });\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_TYPE_MISMATCH,\n context: { activeUserType: session.activeUserType }, // diagnostic (log-only)\n });\n }\n }\n }\n\n // W2.2 + W3.1 + AUTH-14: Password expiry check with org overrides\n const sessionAuthPolicy = session.userId\n ? await this._resolveAuthPolicyWithOrgOverrides(ec, session.activeUserType, session.userId)\n : this._resolveAuthPolicyFromSession(session);\n const expiryDays = sessionAuthPolicy.passwordPolicy?.expiryDays ?? 0;\n if (expiryDays > 0 && session.userId) {\n const expired = await this.credentialOps.isPasswordExpired(ec, session.userId, expiryDays);\n if (expired) {\n await this.updateSession(request.sessionId, { state: AuthenticationSessionState.PASSWORD_EXPIRED });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_PASSWORD_EXPIRED,\n context: { sessionId: request.sessionId, reason: 'PASSWORD_EXPIRED' },\n });\n }\n }\n\n const tokens = await this.tokenIssuer.issueTokens(session, {\n includeRefreshToken: true,\n lastAuthenticatedAt: Math.floor(Date.now() / 1000),\n });\n\n // Update session to completed\n await this.updateSession(request.sessionId, { state: AuthenticationSessionState.COMPLETED });\n\n // Get final session for audit log\n const finalSession = await this.getSession(request.sessionId);\n const completedFactors = finalSession?.completedFactors || session.completedFactors || [];\n\n // Audit log successful authentication (TRAP 13)\n const deviceInfo = finalSession?.deviceInfo;\n if (finalSession?.userId) {\n // F4 per-org SIEM routing — route ONLY on the user's VERIFIED ACTIVE member orgs.\n // `finalSession.userId` is the post-credential-success server-resolved id.\n const routingOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, finalSession.userId);\n // Domain ownership is held separately in `scopeType` + `scopeId` and is never\n // forwarded as audit routing. Routing uses verified active memberships only.\n await this.auditLogsService.logUserLogin({\n userId: finalSession.userId,\n email: finalSession.email || 'unknown',\n authMethod: request.method,\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n sessionId: request.sessionId,\n }, ec, routingOrgIds);\n }\n\n // Clean up session after successful authentication\n await this.removeSession(request.sessionId);\n\n return this._buildAuthenticationSuccessMethod(\n request.sessionId,\n request.factorLevel,\n request.method,\n tokens.accessToken,\n {\n refreshToken: tokens.refreshToken,\n completedFactors,\n user: currentUser ?? undefined,\n },\n );\n } else {\n // Method succeeded but overall auth is not complete (e.g., MFA required)\n return authResponse;\n }\n }\n\n return authResponse;\n }\n\n // ===============================\n // PUBLIC API: SESSION STATE\n // ===============================\n\n /**\n * Get the current state of an authentication session.\n *\n * TRAP 2 (async change): This method is now async because Redis lookups are Promise-based.\n * The controller must add `await` to this call — this is the one allowed controller modification.\n */\n public async getAuthenticationSessionState(ec: ExecutionContext<any>, sessionId: string): Promise<AuthenticationSession | null> {\n const session = await this.getSession(sessionId);\n if (!session) {\n return null;\n }\n // Return a copy to avoid external modifications\n return { ...session };\n }\n\n // ===============================\n // EMAIL OTP AUTHENTICATION (Step 10)\n // ===============================\n\n /**\n * Send an Email OTP to the user's email address.\n *\n * Called from the auth controller (POST /auth/mfa/email-otp/send).\n * Generates a 6-digit OTP, stores it as a consumable token, and returns\n * the session state. The actual email sending is done by the controller.\n *\n * Rate limiting: Redis INCR with TTL. Values from config.auth.otpOperational.\n */\n public async sendEmailOTP(ec: ExecutionContext<any>, sessionId: string): Promise<{\n otpToken: string;\n submissionId: string;\n email: string;\n expiryMinutes: number;\n }> {\n const session = await this.getSession(sessionId);\n if (!session) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,\n context: { sessionId },\n });\n }\n\n // Must have completed first factor before MFA\n if (session.state !== AuthenticationSessionState.FIRST_FACTOR_COMPLETED &&\n session.state !== AuthenticationSessionState.MFA_REQUIRED) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_FIRST_FACTOR_REQUIRED,\n });\n }\n\n // Policy pre-flight: EMAIL_OTP must be a USABLE second factor for this session.\n //\n // The state check above is not sufficient on its own. `_updateSessionAfterSuccessfulAuth` already\n // refuses to COMPLETE a second factor outside `usableSecondFactorMethods` (the `requireStrongMFA`\n // backstop), so an OTP minted here for a strong-MFA-only user could never authenticate — but without\n // this gate the code was still generated, stored, AND EMAILED. That let any party holding a\n // first-factor-complete session push unsolicited OTP mail to the user (bounded only by the per-user\n // send cap below), and it advertised a second factor the session cannot actually use.\n //\n // The condition MIRRORS the completion guard exactly, including its fail-open-on-empty semantics: an\n // empty `usableSecondFactorMethods` means \"no second-factor policy resolved for this session\" (MFA not\n // required, or the session was routed to enrollment — a state this endpoint already rejects), not\n // \"nothing is allowed\". Keeping the two conditions identical is deliberate: a session that would be\n // refused at completion is now refused at send, with the SAME ErrorType + customMessageReference, so\n // the policy has one meaning across both seams rather than two subtly different ones.\n const usableSecondFactorMethods = session.usableSecondFactorMethods;\n if (usableSecondFactorMethods && usableSecondFactorMethods.length > 0\n && !usableSecondFactorMethods.includes(AuthMethod.EMAIL_OTP)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_METHOD_NOT_SUPPORTED,\n context: { method: AuthMethod.EMAIL_OTP, sessionId, reason: 'METHOD_NOT_IN_USABLE_LIST' },\n });\n }\n\n const email = session.email;\n if (!email) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_NO_EMAIL,\n });\n }\n\n const userId = session.userId;\n if (!userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_NO_USER,\n });\n }\n\n // Step 7 F-23 sub-PR a (rate-limit unification, 2026-04-20): MIGRATED\n // from `redisService.incrementRateLimit` + inline INCR-then-throw to\n // `RateLimitBackendService.checkRateLimit` (the K-3 escape-hatch\n // surface). The atomic-incr-then-throw shape is structurally identical\n // — same Redis primitive, same `ErrorType.RATE_LIMIT`, same\n // `retryAfterSeconds: 60`, same per-userId bucket key — so this is a\n // 1:1 mechanical migration with NO behavior change. The custom\n // user-facing message is preserved via the `messageOverride` parameter\n // added to `checkRateLimit` in this same step (existing OTP UX\n // depended on the OTP-specific phrasing, not the generic rate-limit\n // message).\n //\n // K-3 ESCAPE-HATCH JUSTIFICATION (matches PR 8d/8e reasoning): the\n // bucket key is the session-resolved `userId`, not an HTTP-derived\n // identifier — `controller.mfaEmailOTPSend` reads only the session\n // cookie and forwards to this orchestrator method, so no per-request\n // identity exists at the HTTP seam that would let `checkPolicy` derive\n // the bucket. Lifting to the controller would require either (a)\n // resolving the session in the controller pre-`checkPolicy` (defeats\n // F-22 fail-fast — session resolution is more expensive than the\n // rate-limit check), or (b) IP-keying the cap (semantically wrong:\n // the policy is \"5 OTP sends per minute per USER\", not per-IP — a\n // user behind a corporate NAT with multiple devices would share the\n // cap; an attacker on a botnet would bypass it). The later lockout\n // migration closed the final F-23 site, so this email-OTP cap is now\n // one of four deliberate K-3 `checkRateLimit` callers.\n const rateLimitKey = `${AUTH_REDIS_KEYS.EMAIL_OTP}${userId}:email_otp`;\n await this.rateLimitService.checkRateLimit(\n rateLimitKey,\n this.otpConfig.emailOtp.rateLimitPerMinute,\n 60,\n undefined,\n 'Too many OTP requests. Please wait before requesting another code.',\n );\n\n // Revoke any existing EMAIL_OTP tokens for this user to ensure only one valid OTP at a time\n await this.consumableTokenService.revokeTokensByRelatedId(userId, CoreConsumableTokenTypes.EMAIL_OTP);\n\n // Generate OTP — cryptographically random N-digit code\n const otpLength = this.otpConfig.emailOtp.otpLength;\n const otpCode = this._generateOTP(otpLength);\n\n // Store as consumable token (SINGLE_USE, configurable TTL)\n const expiryMinutes = this.otpConfig.emailOtp.expiryMinutes;\n const createdOtpToken = await this.consumableTokenService.createToken({\n tokenType: CoreConsumableTokenTypes.EMAIL_OTP,\n consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n expiresIn: { value: expiryMinutes, unit: DurationUnit.MINUTES },\n userId: userId,\n resourceIdentifier: CoreResourceType.USERS,\n relatedId: userId,\n metadata: {\n otpCode,\n sessionId,\n email,\n },\n });\n\n // Update session to MFA_REQUIRED state\n await this.updateSession(sessionId, {\n state: AuthenticationSessionState.MFA_REQUIRED,\n currentFactor: AuthFactorLevel.SECOND,\n });\n\n this.logDebug('Email OTP generated and stored', { sessionId, userId });\n\n return {\n otpToken: otpCode,\n submissionId: String(createdOtpToken._id),\n email,\n expiryMinutes,\n };\n }\n\n /**\n * Verify an Email OTP code submitted by the user.\n *\n * Called from authenticate() dispatch when method=EMAIL_OTP,\n * or directly from the auth controller (POST /auth/mfa/email-otp/verify).\n */\n public async authenticateEmailOTP(ec: ExecutionContext<any>, request: EmailOTPAuthRequest): Promise<AuthenticationServiceResult> {\n const { sessionId, token } = request;\n\n const session = await this.getSession(sessionId);\n if (!session) {\n return this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.SECOND, { retryAllowed: false });\n }\n\n // Must be in MFA_REQUIRED, SECOND_FACTOR_IN_PROGRESS, or FIRST_FACTOR_COMPLETED state.\n // FIRST_FACTOR_COMPLETED is accepted because the MFA flow may not have explicitly\n // transitioned to MFA_REQUIRED yet (consistent with TOTP which has no \"send\" step).\n if (session.state !== AuthenticationSessionState.MFA_REQUIRED &&\n session.state !== AuthenticationSessionState.SECOND_FACTOR_IN_PROGRESS &&\n session.state !== AuthenticationSessionState.FIRST_FACTOR_COMPLETED) {\n return this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.SECOND, {\n retryAllowed: true,\n });\n }\n\n if (!token) {\n return this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.SECOND, {\n retryAllowed: true,\n authMethod: AuthMethod.EMAIL_OTP,\n });\n }\n\n // Update session to in-progress\n await this.updateSession(sessionId, {\n state: AuthenticationSessionState.SECOND_FACTOR_IN_PROGRESS,\n currentFactor: AuthFactorLevel.SECOND,\n });\n\n const userId = session.userId;\n if (!userId) {\n return this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.SECOND, { retryAllowed: false });\n }\n\n // Find matching consumable token by looking up EMAIL_OTP tokens for this user.\n // We verify the OTP code matches the stored metadata.\n const isValid = await this._verifyEmailOTP(userId, sessionId, token);\n\n if (!isValid) {\n const { locked } = await this.incrementSessionAttempts(ec, sessionId);\n\n // Audit log MFA failure\n const deviceInfo = session.deviceInfo;\n await this.auditLogsService.logUserLoginFailed({\n email: session.email || 'unknown',\n authMethod: AuthMethod.EMAIL_OTP,\n failureReason: 'Invalid OTP code',\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n attemptsRemaining: session.maxAttempts - session.attempts - 1,\n sessionId,\n });\n\n return this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.SECOND, {\n authMethod: AuthMethod.EMAIL_OTP,\n retryAllowed: !locked,\n });\n }\n\n // OTP verified — update session\n await this._updateSessionAfterSuccessfulAuth(ec, sessionId, userId, AuthMethod.EMAIL_OTP);\n\n const updatedSession = await this.getSession(sessionId);\n return this._buildAuthenticationSuccessMethod(\n sessionId,\n AuthFactorLevel.SECOND,\n AuthMethod.EMAIL_OTP,\n '', // Tokens issued by authenticate() after completion check\n { completedFactors: updatedSession?.completedFactors || [] },\n );\n }\n\n /**\n * Verify the OTP code against stored consumable tokens for this user and session.\n * Attempts to consume the token atomically to prevent replay.\n */\n private async _verifyEmailOTP(userId: string, sessionId: string, code: string): Promise<boolean> {\n try {\n // Find unconsumed EMAIL_OTP tokens for this user\n const tokens = await this.consumableTokenService.findTokensByRelatedId(\n userId,\n CoreConsumableTokenTypes.EMAIL_OTP,\n );\n\n for (const tokenDoc of tokens) {\n const metadata = tokenDoc.metadata as Record<string, unknown> | undefined;\n if (!metadata?.otpCode || !metadata?.sessionId) continue;\n\n // L1 fix: constant-time comparison to prevent timing side-channel on OTP\n const storedCode = String(metadata.otpCode);\n const storedSession = String(metadata.sessionId);\n if (storedCode.length !== code.length || storedSession.length !== sessionId.length) continue;\n\n const codeMatch = crypto.timingSafeEqual(Buffer.from(storedCode), Buffer.from(code));\n const sessionMatch = crypto.timingSafeEqual(Buffer.from(storedSession), Buffer.from(sessionId));\n\n if (codeMatch && sessionMatch) {\n // Consume the token atomically\n try {\n await this.consumableTokenService.consumeToken(tokenDoc.token);\n return true;\n } catch {\n // Token already consumed or expired — try next\n continue;\n }\n }\n }\n\n return false;\n } catch (error) {\n if (isWildoBackendError(error)) {\n throw error;\n }\n this.logger.error('Failed to verify Email OTP', {\n userId,\n sessionId,\n ...projectCaughtErrorLogFields(error),\n });\n return false;\n }\n }\n\n // ===============================\n // TOTP AUTHENTICATION (Step 11)\n // ===============================\n\n /**\n * Verify a TOTP code submitted by the user.\n *\n * Called from authenticate() dispatch when method=TOTP.\n * Reads the user's verified TOTP secret from their credential record,\n * validates the code using the otpauth library.\n */\n public async authenticateTOTP(ec: ExecutionContext<any>, request: TOTPAuthRequest): Promise<AuthenticationServiceResult> {\n const { sessionId, token } = request;\n\n const session = await this.getSession(sessionId);\n if (!session) {\n return this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.SECOND, { retryAllowed: false });\n }\n\n // Must be in MFA_REQUIRED or SECOND_FACTOR_IN_PROGRESS state\n if (session.state !== AuthenticationSessionState.MFA_REQUIRED &&\n session.state !== AuthenticationSessionState.SECOND_FACTOR_IN_PROGRESS &&\n session.state !== AuthenticationSessionState.FIRST_FACTOR_COMPLETED) {\n return this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.SECOND, {\n retryAllowed: true,\n });\n }\n\n // Update session to in-progress\n await this.updateSession(sessionId, {\n state: AuthenticationSessionState.SECOND_FACTOR_IN_PROGRESS,\n currentFactor: AuthFactorLevel.SECOND,\n });\n\n const userId = session.userId;\n if (!userId) {\n return this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.SECOND, { retryAllowed: false });\n }\n\n // The TOTP / backup-code verification itself — including anti-replay and the constant-time\n // backup-code fallback — lives in `AuthMfaBackendService.verifyEnrolledSecondFactor`, shared\n // with step-up re-authentication. It was inlined here until 2026-08-06; duplicating it for the\n // second caller would have created a second, weaker door onto the same credential. This method\n // keeps everything that is genuinely login-specific: session state, attempt counting and the\n // login-failed audit event.\n const verification = await this.authMfaService.verifyEnrolledSecondFactor(ec, userId, token);\n\n if (verification.notEnrolled) {\n return this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.SECOND, {\n authMethod: AuthMethod.TOTP,\n retryAllowed: true,\n });\n }\n\n const usedBackupCode = verification.usedBackupCode;\n\n if (!verification.valid) {\n const { locked } = await this.incrementSessionAttempts(ec, sessionId);\n\n // Audit log MFA failure\n const deviceInfo = session.deviceInfo;\n await this.auditLogsService.logUserLoginFailed({\n email: session.email || 'unknown',\n authMethod: AuthMethod.TOTP,\n failureReason: 'Invalid TOTP code',\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n attemptsRemaining: session.maxAttempts - session.attempts - 1,\n sessionId,\n });\n\n return this.__buildAuthenticationErrorMethod(sessionId, AuthFactorLevel.SECOND, {\n authMethod: AuthMethod.TOTP,\n retryAllowed: !locked,\n });\n }\n\n // TOTP verified — update session\n await this._updateSessionAfterSuccessfulAuth(ec, sessionId, userId, AuthMethod.TOTP);\n\n const updatedSession = await this.getSession(sessionId);\n return this._buildAuthenticationSuccessMethod(\n sessionId,\n AuthFactorLevel.SECOND,\n AuthMethod.TOTP,\n '', // Tokens issued by authenticate() after completion check\n {\n completedFactors: updatedSession?.completedFactors || [],\n challengeData: usedBackupCode ? { usedBackupCode: true } : undefined,\n },\n );\n }\n\n // ===============================\n // PASSKEY AUTHENTICATION (Phase G1)\n // ===============================\n\n /**\n * Verify a WebAuthn/Passkey authentication response.\n *\n * Called from authenticate() dispatch when method=PASSKEY.\n * Supports both first factor (passwordless) and second factor (MFA) usage.\n * Delegates to WebAuthnBackendService for cryptographic verification.\n */\n public async authenticatePasskey(ec: ExecutionContext<any>, request: PasskeyAuthRequest): Promise<AuthenticationServiceResult> {\n const { sessionId, factorLevel, response } = request;\n\n const session = await this.getSession(sessionId);\n if (!session) {\n return this.__buildAuthenticationErrorMethod(sessionId, factorLevel, { retryAllowed: false });\n }\n\n // State machine guard — valid states depend on factor level\n const validStates = factorLevel === AuthFactorLevel.FIRST\n ? new Set([AuthenticationSessionState.IDENTIFIED, AuthenticationSessionState.FIRST_FACTOR_IN_PROGRESS])\n : new Set([AuthenticationSessionState.MFA_REQUIRED, AuthenticationSessionState.SECOND_FACTOR_IN_PROGRESS, AuthenticationSessionState.FIRST_FACTOR_COMPLETED]);\n\n if (!validStates.has(session.state)) {\n return this.__buildAuthenticationErrorMethod(sessionId, factorLevel, {\n authMethod: AuthMethod.PASSKEY,\n retryAllowed: true,\n });\n }\n\n const userId = session.userId;\n if (!userId) {\n return this.__buildAuthenticationErrorMethod(sessionId, factorLevel, { retryAllowed: false });\n }\n\n // Update session to in-progress\n await this.updateSession(sessionId, {\n state: factorLevel === AuthFactorLevel.FIRST\n ? AuthenticationSessionState.FIRST_FACTOR_IN_PROGRESS\n : AuthenticationSessionState.SECOND_FACTOR_IN_PROGRESS,\n currentFactor: factorLevel,\n });\n\n // Delegate to WebAuthn service for cryptographic verification\n let verified = false;\n let credentialId = response.id;\n let cloneSuspicion: PasskeyAuthenticationVerificationResult['cloneSuspicion'];\n try {\n const result = await this.webAuthnService.verifyAuthenticationResponse(ec, userId, response as any);\n verified = result.verified;\n credentialId = result.credentialId;\n cloneSuspicion = result.cloneSuspicion;\n } catch (error) {\n this.logger.warn('WebAuthn verification threw an error', {\n userId,\n sessionId,\n ...projectCaughtErrorLogFields(error),\n });\n verified = false;\n }\n\n if (!verified) {\n const { locked } = await this.incrementSessionAttempts(ec, sessionId);\n\n // Audit log passkey auth failure\n const deviceInfo = session.deviceInfo;\n await this.auditLogsService.logUserPasskeyAuthFailure({\n email: session.email || 'unknown',\n // Named, not generic. Every refusal used to record the same string, so the one cause worth\n // alerting on was byte-identical to a wrong credential or an expired challenge.\n failureReason: cloneSuspicion ? 'passkey_signature_counter_regression' : 'WebAuthn verification failed',\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n sessionId,\n });\n\n /*\n * A verified assertion whose counter did not advance gets its OWN CRITICAL row, in addition\n * to the ordinary failure above — the failure event is what the lockout and rate-limit story\n * reads and must keep its shape, while this one is what a SOC alerts on.\n *\n * Reachable only after signature verification (the service refuses to evaluate the counter\n * before it), so this row cannot be forged by someone who merely knows a credential id.\n */\n if (cloneSuspicion) {\n await this.auditLogsService.logUserPasskeyCloneSuspected({\n userId,\n credentialId: cloneSuspicion.credentialId,\n storedCounter: cloneSuspicion.storedCounter,\n receivedCounter: cloneSuspicion.receivedCounter,\n credentialDeviceType: cloneSuspicion.credentialDeviceType,\n credentialBackedUp: cloneSuspicion.credentialBackedUp,\n ...(cloneSuspicion.aaguid ? { aaguid: cloneSuspicion.aaguid } : {}),\n ceremony: cloneSuspicion.ceremony,\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n });\n }\n\n return this.__buildAuthenticationErrorMethod(sessionId, factorLevel, {\n authMethod: AuthMethod.PASSKEY,\n retryAllowed: !locked,\n });\n }\n\n // Passkey verified — audit log success\n const deviceInfo = session.deviceInfo;\n // F4 per-org SIEM routing — route ONLY on the user's VERIFIED ACTIVE member orgs. `userId` is\n // the WebAuthn-verified session userId (server-resolved), never a request-supplied value.\n const routingOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, userId);\n await this.auditLogsService.logUserPasskeyAuthSuccess({\n userId: userId,\n email: session.email || 'unknown',\n credentialId,\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n sessionId,\n }, ec, routingOrgIds);\n\n // C1 fix: Reset global lockout counter on successful authentication\n if (session.email) {\n await this._resetGlobalAttempts(session.email);\n }\n\n // Update session state\n await this._updateSessionAfterSuccessfulAuth(ec, sessionId, userId, AuthMethod.PASSKEY);\n\n const updatedSession = await this.getSession(sessionId);\n return this._buildAuthenticationSuccessMethod(\n sessionId,\n factorLevel,\n AuthMethod.PASSKEY,\n '', // Tokens issued by authenticate() after completion check\n {\n completedFactors: updatedSession?.completedFactors || [],\n requiresMFA: updatedSession?.requiresMFA || false,\n availableMFAMethods: updatedSession?.availableSecondFactorMethods || [],\n mfaMethodsRequired: updatedSession?.mfaMethodsRequired,\n },\n );\n }\n\n // ===============================\n // MFA HELPERS\n // ===============================\n\n /**\n * Determine if MFA is required for this user/session after first-factor success.\n *\n * M12+M13: the effective policy folds in org-level overrides — but that resolution happens in the\n * CALLER (`_resolveAuthPolicyWithOrgOverrides(ec, activeUserType, userId)`), keyed on the VERIFIED\n * `userId`, and arrives here pre-merged in `authPolicy`. This method therefore takes NO org id: the\n * decision is a pure function of `authPolicy` + the user's enrolled credentials. (A dead\n * Scope hints are intentionally excluded: an email-domain ownership match cannot authorize MFA.\n * See the `session-org-trust-sweep-audit` plan.)\n * Effective policy = max(app_policy, org_policy) — org can only tighten, never weaken.\n *\n * Returns true if:\n * - The effective policy requires MFA for all users, OR\n * - The effective policy requires MFA for admins, OR\n * - The effective policy's minimum auth level is 'mfa' or 'sso', OR\n * - The user has enrolled a verified TOTP secret (user opted in to MFA)\n */\n private async _shouldRequireMFA(ec: ExecutionContext<any>, userId: string, firstFactorMethod?: AuthMethod, authPolicy?: UserTypeAuthPolicy): Promise<{ required: boolean; enrolledMethods: AuthMethod[] }> {\n const policy = authPolicy ?? AuthenticationOrchestratorBackendService.FALLBACK_AUTH_POLICY;\n const mfaPolicy = policy.mfaPolicy;\n const NOT_REQUIRED = { required: false, enrolledMethods: [] as AuthMethod[] };\n\n // G1 + W2.5: Passkey exemption — passkeys are multi-factor by nature (possession + biometric/PIN).\n if (firstFactorMethod === AuthMethod.PASSKEY) {\n const passkeyExemptFromMFA = mfaPolicy?.passkeyExemptFromMFA ?? true;\n if (passkeyExemptFromMFA) {\n return NOT_REQUIRED;\n }\n }\n\n const policyRequiresMFA = !!mfaPolicy?.requireMFA;\n\n try {\n const cred = await this.credentialOps.readByUserId(ec, userId);\n\n const enrolledMethods = AuthUtils.getEnrolledSecondFactorMethods(cred);\n\n if (policyRequiresMFA) {\n const hasStrongSecondFactor = enrolledMethods.some(\n (m) => m !== AuthMethod.EMAIL_OTP,\n );\n\n if (hasStrongSecondFactor) {\n if (cred && cred.mfaEnrollmentState !== MfaEnrollmentState.ENROLLED) {\n await this.credentialOps.updateById(ec, cred._id, { mfaEnrollmentState: MfaEnrollmentState.ENROLLED } as Partial<UserCredentials>);\n }\n return { required: true, enrolledMethods };\n }\n\n const graceDays = mfaPolicy?.enrollmentGracePeriodDays ?? 0;\n if (graceDays > 0 && cred) {\n if (!cred.firstMfaPromptAt) {\n await this.credentialOps.updateById(ec, cred._id, { firstMfaPromptAt: new Date(), mfaEnrollmentState: MfaEnrollmentState.GRACE } as Partial<UserCredentials>);\n } else if (cred.mfaEnrollmentState !== MfaEnrollmentState.GRACE) {\n await this.credentialOps.updateById(ec, cred._id, { mfaEnrollmentState: MfaEnrollmentState.GRACE } as Partial<UserCredentials>);\n }\n\n const graceStart = cred.firstMfaPromptAt ?? new Date();\n const graceEnd = new Date(graceStart.getTime() + graceDays * 86_400_000);\n if (new Date() < graceEnd) {\n return NOT_REQUIRED;\n }\n\n await this.credentialOps.updateById(ec, cred._id, { mfaEnrollmentState: MfaEnrollmentState.PENDING } as Partial<UserCredentials>);\n }\n\n return { required: true, enrolledMethods };\n }\n\n if (cred?.totpVerified) {\n return { required: true, enrolledMethods };\n }\n } catch {\n if (policyRequiresMFA) {\n return { required: true, enrolledMethods: [] };\n }\n }\n\n return NOT_REQUIRED;\n }\n\n // ===============================\n // AUTH POLICY MERGE (M13)\n // ===============================\n\n // W2.10: _mergeAuthPolicies removed — the runtime AuthPolicyBase resource has since been removed.\n // All MFA requirements now come solely from config (mfaPolicy).\n\n // ===============================\n // SSO GRACE LOGIN TRACKING (M14)\n // ===============================\n\n /** Redis key prefix for SSO grace login counters — scope-aware format: sso_grace_logins:{scopeType}:{scopeId}:{userId} */\n\n /**\n * Read the tenant's branding for the sign-in screen (#410).\n *\n * NEVER throws. This runs on the pre-authentication identification path, so every failure mode —\n * no profile row, a profile with no branding block, a store that is momentarily unavailable —\n * resolves to `undefined` and the caller falls back to the application's brand. Letting a\n * cosmetic read refuse an identification would turn a missing logo into an outage.\n *\n * `ORGANIZATION_PROFILES` had no backend reader at all before this; the audit note on\n * `OrganizationBrandingSchema` records why, and why that reasoning was wrong.\n *\n * **Reads the REPOSITORY, not the service, and that is the difference between working and inert.**\n * `ORGANIZATION_PROFILES`'s default READ variant requires `ORG_MEMBER`, and an identification\n * request carries no roles at all — it is what happens BEFORE anyone is authenticated. Going\n * through `servicesRegistryHandler.read` would therefore be refused by the operation pipeline,\n * the refusal would be swallowed by the catch below, and the tenant's logo would silently never\n * appear while every test stayed green. This is a SYSTEM read on the system's own behalf, to\n * decorate a login screen; the repository is where a system read belongs. Same shape as the\n * notifications dispatcher reading a recipient's preferences.\n */\n private async readOrganizationBrandingForIdentification(\n ec: ExecutionContext<any>,\n organizationId: string,\n ): Promise<OrganizationBranding | undefined> {\n try {\n const repository = this.repositoriesRegistry.getRepository(CoreResourceType.ORGANIZATION_PROFILES);\n const profile = await repository?.read<{ branding?: OrganizationBranding }>(ec, { organizationId });\n return profile?.branding ?? undefined;\n } catch {\n this.logger.warn('Organization branding lookup failed (non-fatal, falling back to application brand)', { organizationId });\n return undefined;\n }\n }\n\n /**\n * M14: Check if password login is allowed under SSO grace policy.\n * If the scope requires SSO and grace logins are exhausted, throws AUTHENTICATION error.\n *\n * ## Runs AFTER the credential is verified\n *\n * See the note at the `authenticatePassword` call site. Two consequences for anyone editing this:\n * `email` is the address of a user whose password has been checked — never a caller-supplied\n * claim — and every refusal here is one a caller could only reach by knowing that password.\n *\n * ## The break-glass exemption (#423)\n *\n * A named account in `emergencyAccess.breakGlassAccounts` is exempt from this refusal, including\n * grace exhaustion, and from nothing else: same password, same lockout counters, same rate limits.\n * Every use emits `EMERGENCY_ACCESS_USED` at CRITICAL, which is the control that makes a standing\n * bypass acceptable at all — Microsoft Entra's emergency-access guidance asks for an alert on\n * every sign-in of such an account and a post-mortem after each one, and the alert is the half a\n * framework can provide.\n *\n * The emit is best-effort and never blocks the sign-in. That is deliberate and it is the same\n * trade every audit emission on this path makes: refusing a break-glass sign-in because the audit\n * store is unavailable would take the door away during exactly the outage it exists for.\n */\n private async _checkSSOGraceLoginAllowed(\n ec: ExecutionContext<any>,\n scopeType: AuthScopeType,\n scopeId: string,\n userId: string,\n email?: string,\n provenance?: { sessionId: string; ipAddress: string; userAgent: string },\n ): Promise<void> {\n try {\n const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n if (!ssoConfig) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SSO_REQUIRED,\n });\n }\n\n const { enforcement } = ssoConfig;\n if (!enforcement.requireSSO) return;\n\n /*\n * Checked before every refusal below, and before the grace counter — a break-glass account is\n * exempt from the whole policy, not merely from running out of attempts. Placed after the\n * `requireSSO` early return so an ordinary tenant emits nothing.\n */\n if (isBreakGlassAccount(ssoConfig.emergencyAccess, email)) {\n /*\n * Recorded under whichever scope the policy belongs to.\n *\n * `emergencyAccess` lives on the POLYMORPHIC SSO config, so an APPLICATION-scope policy\n * names break-glass accounts for the application itself. This branch REFUSED that case for\n * one release, because `EMERGENCY_ACCESS_USED` required an `organizationId` and admitting\n * an unrecordable bypass is the one outcome the mechanism exists to prevent. The event now\n * carries either scope and refuses anything but exactly one, so the refusal is gone and the\n * use is audited either way.\n */\n void this.auditLogsService?.logEmergencyAccessUsed({\n userId,\n email: email!,\n scopeType,\n ...(scopeType === AuthScopeType.ORGANIZATION\n ? { organizationId: scopeId }\n : { applicationId: scopeId }),\n ipAddress: provenance?.ipAddress ?? '',\n userAgent: provenance?.userAgent ?? '',\n sessionId: provenance?.sessionId ?? '',\n })?.catch((error: unknown) => {\n this.logger.warn('Emergency-access audit emit failed (sign-in allowed)', {\n scopeType,\n scopeId,\n ...projectCaughtErrorLogFields(error),\n });\n });\n return;\n }\n\n if (!enforcement.allowPasswordFallback) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SSO_REQUIRED,\n });\n }\n\n const maxGrace = enforcement.graceLoginAttempts;\n if (maxGrace <= 0) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SSO_REQUIRED,\n });\n }\n\n if (!userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SSO_REQUIRED,\n });\n }\n\n // rate-limit-relaxation: N/A — `graceLoginAttempts` is a TENANT POLICY, not an abuse\n // throttle. Relaxing it in DEVELOPMENT/TEST would make local runs disagree with the\n // configured product semantics (SSO enforcement would appear never to bite), which is\n // the opposite of the relaxation's purpose. See\n // `rate-limit-environment-relaxation.backend.utils`.\n const identifier = `${AUTH_REDIS_KEYS.SSO_GRACE_LOGINS}${scopeType}:${scopeId}:${userId}`;\n let currentCount: number;\n try {\n currentCount = await this.redisService.getRateLimitCount(identifier);\n } catch (error) {\n this.logDebug('SSO grace login count read failed (fail-closed)', {\n scopeType,\n scopeId,\n userId,\n ...projectCaughtErrorLogFields(error),\n });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SSO_REQUIRED,\n });\n }\n\n if (currentCount >= maxGrace) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SSO_REQUIRED,\n context: {\n // diagnostic (log-only)\n graceLoginsUsed: currentCount,\n graceLoginsMax: maxGrace,\n },\n });\n }\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n this.logDebug('SSO grace login check failed (fail-closed)', {\n scopeType,\n scopeId,\n userId,\n ...projectCaughtErrorLogFields(error),\n });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SSO_REQUIRED,\n });\n }\n }\n\n /** 1 year in seconds — effectively permanent for grace counter, but avoids orphaned keys */\n private static readonly SSO_GRACE_TTL_SECONDS = 365 * 24 * 60 * 60;\n\n /**\n * M14: Atomically increment SSO grace login counter after successful password auth.\n * Uses Redis INCR (via incrementRateLimit) for atomic increment — no TOCTOU race.\n * TTL is 1 year (effectively permanent but avoids orphaned keys if scope config changes).\n */\n private async _incrementSSOGraceLogin(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string, userId: string): Promise<void> {\n try {\n const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n if (!ssoConfig) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SSO_REQUIRED,\n });\n }\n if (!ssoConfig.enforcement.requireSSO) return;\n\n const identifier = `${AUTH_REDIS_KEYS.SSO_GRACE_LOGINS}${scopeType}:${scopeId}:${userId}`;\n const newCount = await this.redisService.incrementRateLimit(\n identifier,\n AuthenticationOrchestratorBackendService.SSO_GRACE_TTL_SECONDS,\n );\n\n if (newCount > ssoConfig.enforcement.graceLoginAttempts) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SSO_REQUIRED,\n context: {\n // diagnostic (log-only)\n graceLoginsUsed: newCount,\n graceLoginsMax: ssoConfig.enforcement.graceLoginAttempts,\n },\n });\n }\n\n this.logDebug('SSO grace login counter incremented', {\n scopeType,\n scopeId,\n userId,\n graceLoginsUsed: newCount,\n graceLoginsMax: ssoConfig.enforcement.graceLoginAttempts,\n });\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n this.logDebug('SSO grace login counter increment failed (fail-closed)', {\n scopeType,\n scopeId,\n userId,\n ...projectCaughtErrorLogFields(error),\n });\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SSO_REQUIRED,\n });\n }\n }\n\n // ===============================\n // MAGIC LINK (Phase G2)\n // ===============================\n\n /**\n * Send a magic link email to the user.\n * Anti-enumeration: always returns success regardless of whether the user exists.\n * Rate limited per email.\n */\n public async sendMagicLink(ec: ExecutionContext<any>, request: MagicLinkSendRequest, deviceInfo?: { ipAddress?: string; userAgent?: string }, skipGlobalEnablementCheck = false): Promise<{\n success: true;\n token?: string;\n submissionId?: string;\n email?: string;\n userId?: string;\n expiresInMinutes?: number;\n }> {\n // The GLOBAL enablement check is a coarse PRE-identification guard for the login flow (the user\n // type is unknown there — it asks \"does ANY base user-type enable MAGIC_LINK\"). Callers that have\n // ALREADY authorized MAGIC_LINK against a precise, org-EXPANDED policy for a KNOWN user type — the\n // invitation accept — pass `skipGlobalEnablementCheck`. Otherwise an org that opts into MAGIC_LINK\n // only via `authOverrides` (EXPAND_WITHIN_SET / UNRESTRICTED, with no base user-type enabling it)\n // would pass the accept guard but be rejected HERE, AFTER the accept activated the invitee +\n // flipped the membership + consumed the token — stranding them (ACTIVE member, no credential, no\n // session, no retry). The org-expanded policy is the authoritative source for that path.\n if (!skipGlobalEnablementCheck && !this._isMethodEnabledGlobally(AuthMethod.MAGIC_LINK)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_MAGIC_LINK_DISABLED,\n });\n }\n\n const { email } = request;\n\n // PR 8b (rate-limit unification, Step 5 — Option D, second\n // service-layer lift): the dual-window per-email burst caps\n // (formerly `${AUTH_REDIS_KEYS.MAGIC_LINK_MIN}${email}:min` AND\n // `:hour`, both raw `checkRateLimit`) moved UP to\n // `AuthenticationController.magicLinkSend` as a single multi-\n // window declarative `checkPolicy` companion to the existing\n // per-IP cap. Bucket keys (email, IP) are HTTP-layer artefacts\n // (`request.email` is the raw body field, not session-stored\n // state) so the K-3 escape-hatch does NOT apply — the lift is\n // the framework-canonical outcome. See plan body for the full\n // Option D analysis. Net upgrade for clients: 429 responses\n // now emit `X-RateLimit-*` and `Retry-After` headers (previously\n // absent at this seam).\n\n // Look up the user (same pattern as identify())\n let user: User | null = null;\n try {\n user = await this.userLookup.findUserByEmail(ec, email);\n } catch {\n // Suppress — anti-enumeration (also covers non-active users)\n }\n\n // Audit the send (even if user doesn't exist or is inactive)\n await this.auditLogsService.logMagicLinkSent({\n email,\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n });\n\n // If user doesn't exist or is not active, return success silently (anti-enumeration)\n if (!user) {\n return { success: true };\n }\n\n const userId = user._id;\n\n // AUTH-24: refuse to ISSUE a login magic link to a directory-managed user — MAGIC_LINK is derived OFF\n // their effective policy (a local first-factor that bypasses the IdP). Silent success (no token issued)\n // keeps the response shape identical to the no-such-user branch above (anti-enumeration). Gated on\n // `!skipGlobalEnablementCheck` so the invitation-accept ESTABLISHMENT path is unaffected — that path is\n // already governed by the accept-time credential guard, and skipping here avoids stranding a legitimate\n // non-managed invitee. `verifyMagicLink` is the hard backstop for any link issued out-of-band.\n if (!skipGlobalEnablementCheck) {\n const sendPolicy = await this.userLookup.resolveEffectiveAuthPolicy(ec, userId, user.userTypes?.[0] ?? '');\n if (sendPolicy && !getEnabledMethods(sendPolicy.authMethodsEnabled).has(AuthMethod.MAGIC_LINK)) {\n return { success: true };\n }\n }\n\n // Revoke any existing MAGIC_LINK tokens for this user\n await this.consumableTokenService.revokeTokensByRelatedId(userId, CoreConsumableTokenTypes.MAGIC_LINK);\n\n // Store as consumable token (createToken auto-generates a crypto-random token value)\n const createdToken = await this.consumableTokenService.createToken({\n tokenType: CoreConsumableTokenTypes.MAGIC_LINK,\n consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n expiresIn: { value: this.magicLinkConfig.tokenExpiryMinutes, unit: DurationUnit.MINUTES },\n userId: userId,\n resourceIdentifier: CoreResourceType.USERS,\n relatedId: userId,\n metadata: { email },\n });\n\n this.logDebug('Magic link token created', { email, userId });\n\n return {\n success: true,\n token: createdToken.token,\n submissionId: String(createdToken._id),\n email,\n userId,\n expiresInMinutes: this.magicLinkConfig.tokenExpiryMinutes,\n };\n }\n\n /**\n * Verify a magic link token.\n * Returns an auth response with tokens on success.\n */\n public async verifyMagicLink(ec: ExecutionContext<any>, request: MagicLinkVerifyRequest, deviceInfo?: { ipAddress?: string; userAgent?: string }, activeUserType?: string): Promise<AuthenticationServiceResult> {\n if (!this._isMethodEnabledGlobally(AuthMethod.MAGIC_LINK)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_MAGIC_LINK_DISABLED,\n });\n }\n\n const { token } = request;\n\n // Validate the token (checks expiry, revocation, consumption)\n let validatedToken: Awaited<ReturnType<typeof this.consumableTokenService.validateToken>> | null = null;\n try {\n validatedToken = await this.consumableTokenService.validateToken(token, [CoreConsumableTokenTypes.MAGIC_LINK]);\n } catch {\n // Token invalid, expired, or already consumed\n }\n\n if (!validatedToken) {\n await this.auditLogsService.logMagicLinkFailed({\n failureReason: 'Invalid or expired magic link token',\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n });\n\n return {\n success: false,\n sessionId: '',\n userExists: false,\n factorLevel: AuthFactorLevel.FIRST,\n authMethod: AuthMethod.MAGIC_LINK,\n error: 'Invalid or expired magic link',\n errorCode: 'MAGIC_LINK_INVALID',\n retryAllowed: false,\n integrationTokens: [],\n requiresMFA: false,\n } as AuthenticationResponse;\n }\n\n // Consume the token atomically — wrap in try/catch for concurrent double-click race\n try {\n await this.consumableTokenService.consumeToken(token);\n } catch {\n // Token already consumed by concurrent request — return same error as invalid token\n await this.auditLogsService.logMagicLinkFailed({\n failureReason: 'Magic link token already consumed (concurrent request)',\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n });\n return {\n success: false,\n sessionId: '',\n userExists: false,\n factorLevel: AuthFactorLevel.FIRST,\n authMethod: AuthMethod.MAGIC_LINK,\n error: 'Invalid or expired magic link',\n errorCode: 'MAGIC_LINK_INVALID',\n retryAllowed: false,\n integrationTokens: [],\n requiresMFA: false,\n } as AuthenticationResponse;\n }\n\n const userId = validatedToken.relatedId;\n if (!userId) {\n await this.auditLogsService.logMagicLinkFailed({\n failureReason: 'Magic link token has no associated user',\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n });\n return {\n success: false,\n sessionId: '',\n userExists: false,\n factorLevel: AuthFactorLevel.FIRST,\n authMethod: AuthMethod.MAGIC_LINK,\n error: 'Invalid magic link token',\n errorCode: 'MAGIC_LINK_INVALID',\n retryAllowed: false,\n integrationTokens: [],\n requiresMFA: false,\n } as AuthenticationResponse;\n }\n const tokenMetadata = validatedToken.metadata as Record<string, unknown> | undefined;\n const email = tokenMetadata?.email as string;\n\n // Defense-in-depth: constant-time compare request email vs token email.\n // Prevents URL-tampering attacks where an attacker changes the email in the\n // magic link URL while keeping a stolen/intercepted token value.\n if (!email) {\n this.logger.warn('Magic link token metadata missing email — token integrity issue', {\n userId,\n tokenType: CoreConsumableTokenTypes.MAGIC_LINK,\n });\n await this.auditLogsService.logMagicLinkFailed({\n failureReason: 'Token metadata missing email (data integrity issue)',\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n });\n return {\n success: false,\n sessionId: '',\n userExists: false,\n factorLevel: AuthFactorLevel.FIRST,\n authMethod: AuthMethod.MAGIC_LINK,\n error: 'Invalid or expired magic link',\n errorCode: 'MAGIC_LINK_INVALID',\n retryAllowed: false,\n integrationTokens: [],\n requiresMFA: false,\n } as AuthenticationResponse;\n }\n\n const tokenEmailBuf = Buffer.from(email.toLowerCase());\n const requestEmailBuf = Buffer.from(request.email.toLowerCase());\n if (tokenEmailBuf.length !== requestEmailBuf.length || !crypto.timingSafeEqual(tokenEmailBuf, requestEmailBuf)) {\n this.logger.warn('Magic link email mismatch — possible URL tampering or token theft', {\n userId,\n requestEmail: request.email,\n });\n await this.auditLogsService.logMagicLinkFailed({\n failureReason: 'Email mismatch between request and token',\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n });\n return {\n success: false,\n sessionId: '',\n userExists: false,\n factorLevel: AuthFactorLevel.FIRST,\n authMethod: AuthMethod.MAGIC_LINK,\n error: 'Invalid or expired magic link',\n errorCode: 'MAGIC_LINK_INVALID',\n retryAllowed: false,\n integrationTokens: [],\n requiresMFA: false,\n } as AuthenticationResponse;\n }\n\n // Load the user\n let user: User | null = null;\n try {\n user = await this.userLookup.findUserById(ec, userId);\n } catch {\n // Suppress\n }\n\n /*\n * Both remaining failure arms answer with the SAME generic response every other arm of this\n * method already uses, and the reason each one refused is recorded in the audit trail instead.\n *\n * ## Why this changed\n *\n * They used to be distinguishable — `USER_NOT_FOUND` with `userExists: false`, and\n * `ACCOUNT_INACTIVE` with `userExists: true` — which told a caller holding a valid token whether\n * the account exists and whether it is usable. That contradicted the two nearest surfaces in the\n * same flow family, and the contradiction was the defect rather than the disclosure's size:\n *\n * - the magic-link SEND leg refuses silently for a non-ACTIVE user, so no fresh link can even\n * be obtained for one;\n * - `AuthPasswordResetBackendService.completePasswordReset` — the true peer, a one-off token\n * that reaches an account-state check — throws a single `AUTHENTICATION_INVALID_TOKEN` for\n * every arm, including \"no such user\";\n * - the password-reset REQUEST leg returns a generic success for a non-ACTIVE user, with the\n * reason written down in its own code as anti-enumeration.\n *\n * So three siblings had one posture and this method had another. The window it opened is narrow —\n * a link minted while the account was ACTIVE and clicked after it was suspended — but a narrow\n * window is a reason to close it cheaply, not a reason to keep it.\n *\n * ## What is NOT lost\n *\n * Nothing operational. `logMagicLinkFailed` already carries the exact status, and it did before\n * this change; the distinction moves from the client to the audit trail, which is where a\n * suspended-account signal belongs. No client branches on either code — the frontend's\n * `userExists` consumers read the IDENTIFY response, not this one.\n */\n if (!user) {\n await this.auditLogsService.logMagicLinkFailed({\n failureReason: 'Magic link token resolves to no user row',\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n });\n return {\n success: false,\n sessionId: '',\n userExists: false,\n factorLevel: AuthFactorLevel.FIRST,\n authMethod: AuthMethod.MAGIC_LINK,\n error: 'Invalid or expired magic link',\n errorCode: 'MAGIC_LINK_INVALID',\n retryAllowed: false,\n integrationTokens: [],\n requiresMFA: false,\n } as AuthenticationResponse;\n }\n\n // Verify user is active — reject suspended/locked/pending users\n const userStatus = (user as Record<string, unknown>).status as string | undefined;\n if (userStatus && userStatus !== UserStatus.ACTIVE) {\n await this.auditLogsService.logMagicLinkFailed({\n failureReason: `Account is not active (status: ${userStatus})`,\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n });\n return {\n success: false,\n sessionId: '',\n userExists: false,\n factorLevel: AuthFactorLevel.FIRST,\n authMethod: AuthMethod.MAGIC_LINK,\n error: 'Invalid or expired magic link',\n errorCode: 'MAGIC_LINK_INVALID',\n retryAllowed: false,\n integrationTokens: [],\n requiresMFA: false,\n } as AuthenticationResponse;\n }\n\n // Resolve scope via domain lookup (mirrors identify() pattern)\n let resolvedScopeType: AuthScopeType | undefined;\n let resolvedScopeId: string | undefined;\n if (email) {\n const emailDomain = email.split('@')[1]?.toLowerCase();\n if (emailDomain) {\n try {\n const domainOrgLookup = await this.domainToOrgLookup.findOrgByDomain(ec, emailDomain);\n resolvedScopeType = domainOrgLookup?.scopeType;\n resolvedScopeId = domainOrgLookup?.scopeId;\n } catch {\n this.logDebug('Domain-to-org lookup failed during magic link verify (non-fatal)', { emailDomain });\n }\n }\n }\n\n // Create a session for this auth flow\n const sessionId = this.sessionStore.generateSessionId();\n await this.createSession(sessionId, AuthenticationSessionState.FIRST_FACTOR_COMPLETED, {\n deviceInfo,\n activeUserType,\n });\n\n // Store the explicit domain-ownership scope hint for SSO enforcement only.\n await this.updateSession(sessionId, {\n email,\n userExists: true,\n userId: userId,\n completedFactors: [AuthMethod.MAGIC_LINK],\n currentFactor: AuthFactorLevel.FIRST,\n scopeType: resolvedScopeType,\n scopeId: resolvedScopeId,\n });\n\n // Audit success\n // F4 per-org SIEM routing — route ONLY on the user's VERIFIED ACTIVE member orgs. `userId` is\n // token-bound (validatedToken.relatedId), never a request-supplied value.\n const magicLinkRoutingOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, userId);\n await this.auditLogsService.logMagicLinkVerified({\n userId: userId,\n email,\n sessionId,\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n }, ec, magicLinkRoutingOrgIds);\n\n // Reset global lockout counter — magic link proves email ownership (high assurance)\n if (email) {\n await this._resetGlobalAttempts(email);\n }\n\n // AUTH-14: Use org-override-aware policy for magic link flows.\n //\n // The user type is resolved from the RESOLVED USER first, and only then from the caller's\n // `activeUserType` hint. Two reasons, both load-bearing:\n //\n // 1. AUTH-10 doctrine — `activeUserType` is a HINT derived from `X-Frontend-Service-Name`, meaningful\n // only for PRE-identification flows where the user is unknown. Here the token has already resolved\n // a concrete `user`, so the DB-stored `userTypes[0]` is the authority, exactly as the identify /\n // authenticate paths override the hint once they know the user.\n // 2. Send/verify symmetry — `sendMagicLink` decides whether to ISSUE a link using\n // `user.userTypes?.[0]`. Resolving verify from a DIFFERENT source let the two legs disagree: a link\n // the send leg was willing to mint could be refused at verify under an unrelated policy.\n //\n // This ordering is also what makes the method correct BY CONSTRUCTION rather than correct-if-the-caller-\n // remembers. It previously read the hint alone, and the sole caller\n // (`AuthenticationController.magicLinkVerify`) never passed it — so every magic-link login resolved\n // `FALLBACK_AUTH_POLICY` (`authMethodsEnabled: { PASSWORD: true }`), failed the gate below, and threw\n // `AUTHORIZATION` / `AUTHENTICATION_MAGIC_LINK_DISABLED`. Magic-link login was non-functional for every\n // app and every user, AFTER the mail had been sent and the token consumed. The controller now passes the\n // hint too, but this resolution no longer DEPENDS on it.\n const resolvedUserType = user.userTypes?.[0] ?? activeUserType;\n const magicLinkPolicy = await this._resolveAuthPolicyWithOrgOverrides(ec, resolvedUserType, userId);\n // AUTH-24: a directory-managed user's effective policy has MAGIC_LINK derived OFF (a magic link is a\n // local first-factor that bypasses the IdP). Reject here — magic-link completes on THIS path, not the\n // shared `_updateSessionAfterSuccessfulAuth` seam. The token was already consumed during validation, so\n // a rejected managed user cannot reuse the link (and `sendMagicLink` also refuses to ISSUE one).\n if (!getEnabledMethods(magicLinkPolicy.authMethodsEnabled).has(AuthMethod.MAGIC_LINK)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_MAGIC_LINK_DISABLED,\n context: { reason: 'METHOD_NOT_ENABLED_IN_EFFECTIVE_POLICY' },\n });\n }\n const mfaCheck = await this._shouldRequireMFA(ec, userId, AuthMethod.MAGIC_LINK, magicLinkPolicy);\n\n if (mfaCheck.required) {\n const mfaResolution = await this._resolveUsableMfaMethods(mfaCheck.enrolledMethods, magicLinkPolicy);\n\n await this.updateSession(sessionId, {\n state: AuthenticationSessionState.MFA_REQUIRED,\n requiresMFA: true,\n requireStrongMFA: mfaResolution.requireStrongMFA,\n availableSecondFactorMethods: mfaResolution.availableMethods,\n enrolledSecondFactorMethods: mfaCheck.enrolledMethods,\n usableSecondFactorMethods: mfaResolution.usableMethods,\n });\n\n return {\n success: false,\n sessionId,\n userExists: true,\n factorLevel: AuthFactorLevel.FIRST,\n authMethod: AuthMethod.MAGIC_LINK,\n requiresMFA: true,\n availableMFAMethods: mfaResolution.availableMethods,\n mfaMethodsRequired: AuthenticationOrchestratorBackendService.DEFAULT_MFA_METHODS_REQUIRED,\n enrolledSecondFactorMethods: mfaCheck.enrolledMethods,\n usableSecondFactorMethods: mfaResolution.usableMethods,\n completedFactors: [AuthMethod.MAGIC_LINK],\n retryAllowed: true,\n integrationTokens: [],\n } as AuthenticationResponse;\n }\n\n // Complete authentication — issue tokens\n await this.updateSession(sessionId, {\n state: AuthenticationSessionState.COMPLETED,\n });\n\n const updatedSession = await this.getSession(sessionId);\n if (!updatedSession) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_LOST,\n });\n }\n\n const tokens = await this.tokenIssuer.issueTokens(updatedSession, {\n includeRefreshToken: true,\n lastAuthenticatedAt: Math.floor(Date.now() / 1000),\n });\n\n // Audit login\n // F4 per-org SIEM routing — route ONLY on the user's VERIFIED ACTIVE member orgs (token-bound userId).\n const loginRoutingOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, userId);\n await this.auditLogsService.logUserLogin({\n userId: userId,\n ipAddress: deviceInfo?.ipAddress || 'unknown',\n userAgent: deviceInfo?.userAgent || 'unknown',\n authMethod: AuthMethod.MAGIC_LINK,\n email,\n sessionId,\n }, ec, loginRoutingOrgIds);\n\n // Clean up session\n await this.removeSession(sessionId);\n\n // W7.3a: resolve the authenticated user so the success response carries `user`\n // (the anonymous-session transposition trigger gates on `authResult.user._id`).\n // Magic-link is its own token-issuing completion path (separate from the shared\n // `authenticate()` completion), so it must populate `user` here too. Best-effort:\n // a lookup miss leaves `user` undefined (transposition no-ops, login still succeeds).\n const magicLinkUser = await this.userLookup.findUserById(ec, userId);\n\n return this._buildAuthenticationSuccessMethod(\n sessionId,\n AuthFactorLevel.FIRST,\n AuthMethod.MAGIC_LINK,\n tokens.accessToken,\n {\n refreshToken: tokens.refreshToken,\n completedFactors: [AuthMethod.MAGIC_LINK],\n user: magicLinkUser ?? undefined,\n },\n );\n }\n\n // ===============================\n // SMS OTP (Phase G2)\n // ===============================\n\n /**\n * Send an SMS OTP code to the user's verified phone number.\n * Can be used as first factor or second factor depending on config.\n * Rate limited with dual-window (burst + hourly).\n */\n public async sendSMSOTP(ec: ExecutionContext<any>, sessionId: string, phoneNumber?: string): Promise<{ sent: true; otpCode: string; targetPhone: string }> {\n if (!this._isMethodEnabledGlobally(AuthMethod.SMS_OTP)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SMS_OTP_DISABLED,\n });\n }\n const session = await this.getSession(sessionId);\n if (!session) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,\n context: { sessionId },\n });\n }\n\n // Validate session state — allow states valid for first-factor or second-factor OTP send\n const validSendStates = [\n AuthenticationSessionState.IDENTIFIED,\n AuthenticationSessionState.FIRST_FACTOR_IN_PROGRESS,\n AuthenticationSessionState.FIRST_FACTOR_COMPLETED,\n AuthenticationSessionState.MFA_REQUIRED,\n ];\n if (!validSendStates.includes(session.state as AuthenticationSessionState)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,\n });\n }\n\n // AUTH-24: refuse to ISSUE an SMS OTP to a directory-managed user — SMS_OTP is derived OFF their\n // effective policy (a FIRST-factor-capable local method whose \"credential\", a user-controlled\n // phone, bypasses the IdP and survives deprovisioning). The first-factor login seam\n // (`_updateSessionAfterSuccessfulAuth`) and the second-factor availability filter already refuse the\n // VERIFY; this refuses the ISSUE too, mirroring `sendMagicLink`. Same error as the global-disabled\n // branch above (no new enumeration surface). No-ops when the session has no resolved user/type\n // (`resolveEffectiveAuthPolicy` returns null ⇒ nothing derived) so a pre-identification send is\n // unaffected.\n if (session.userId) {\n const sendPolicy = await this.userLookup.resolveEffectiveAuthPolicy(ec, session.userId, session.activeUserType ?? '');\n if (sendPolicy && !getEnabledMethods(sendPolicy.authMethodsEnabled).has(AuthMethod.SMS_OTP)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SMS_OTP_DISABLED,\n });\n }\n }\n\n // Determine the phone number to send to\n let targetPhone = phoneNumber;\n\n if (!targetPhone) {\n const userId = session.userId;\n if (userId) {\n try {\n targetPhone = await this.credentialOps.getVerifiedPhone(ec, userId);\n } catch {\n // Suppress\n }\n }\n }\n\n if (!targetPhone) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_NO_VERIFIED_PHONE,\n });\n }\n\n // PR 8d (rate-limit unification, Step 5 — Option D, fourth\n // service-layer audit): this seam is a FRAMEWORK-CANONICAL K-3\n // ESCAPE-HATCH EXAMPLE — the dual-window per-phone burst stays\n // here as raw `checkRateLimit`. After PR 8e (Option K outcome\n // on `authenticatePassword`) and Step 7 F-23 sub-PR a (migration\n // of `sendEmailOTP` from `redisService.incrementRateLimit`)\n // plus the lockout modernization, this is one of four canonical\n // `RateLimitBackendService.checkRateLimit` call sites in the engine\n // outside `RateLimitBackendService` itself and the WebSocket\n // per-event surface (K-8 out-of-scope) — the other three being the\n // password-auth dual-bucket (`PASSWORD_EMAIL` + `PASSWORD_IP`, see\n // the `authenticatePassword` paragraph above), the global lockout\n // counter (`GLOBAL_LOCKOUT`), and the email-OTP send cap\n // (`sendEmailOTP`, the `EMAIL_OTP` constant) — and all four\n // are deliberate K-3 escape-hatches, NOT unfinished work.\n //\n // Why this stays at the service layer (Option K within Option D):\n // The cost-bearing resource we're defending against is SMS\n // spend per *physical phone number*. The bucket key is\n // `targetPhone`, which is a *resolved* value:\n // - When the caller passes `body.phoneNumber` explicitly,\n // it's an HTTP-layer artefact (would qualify for a\n // controller-side lift).\n // - When the caller omits `phoneNumber` (the dominant MFA\n // second-factor path), `targetPhone` comes from\n // `credentialOps.getVerifiedPhone(ec, session.userId)` —\n // a DB lookup keyed on the verified userId attached to\n // the session. NOT an HTTP-layer artefact.\n // Switching to per-(sessionId+IP) at the controller would let\n // an attacker spin up sessions via `controller.identify`\n // (10/min/IP cap landed in PR 8c) and burst SMS sends against\n // one victim phone with each fresh session — a 10x\n // amplification of the SMS pump fraud defense per source IP.\n // Switching to per-userId at the controller would require a\n // `getSession(body.sessionId)` Redis hit BEFORE rate-limit\n // fail-fast (defeating F-22) AND would still need a fallback\n // when `session.userId` is null (first-factor SMS-OTP for\n // unauthenticated sessions). Neither is preferable to keeping\n // the per-target-phone defense at the layer that already has\n // the resolved phone in scope.\n //\n // K-3 contract reaffirmed: the raw `checkRateLimit` API is the\n // right tool when the bucket key is NOT cheaply derivable from\n // HTTP-layer inputs. `sendSMSOTP` is the canonical engine-side\n // example; future authors hitting the same shape (DB-derived\n // bucket key, no HTTP-layer equivalent) should use this surface\n // directly rather than threading `req`/`res` into service\n // signatures or weakening the bucket dimension.\n //\n // The complementary per-IP cap at `controller.smsOTPSend`\n // (5/hour/IP, scope `auth:sms-otp:send`, landed in PR 7a) is\n // the HTTP-layer companion that defends against single-source\n // SMS pumping across many victim numbers — the two layers\n // compose for full defense in depth (the controller cap\n // catches IP-pumping; the service cap catches per-victim-phone\n // amplification regardless of IP/session/user).\n //\n // F-14 PARITY APPLIED (security upgrade, this PR): the bucket\n // key is now `AuthControllerUtils.phoneRateLimitBucketKey(targetPhone)`\n // — strips leading `+` and `00` defensively so `+33...`,\n // `0033...`, and `33...` resolve to one bucket. Without this\n // normalization, the schema regex `/^\\+?[1-9]\\d{1,14}$/` accepts\n // `+33...` and `33...` as different bucket keys for the same\n // physical number, doubling the effective cap an attacker can\n // extract per victim (matches PR 7-D-3's phone-verify fix).\n // Bucket-identity ≠ display-identity: `targetPhone` is still\n // passed unchanged to `consumableTokenService.createToken`,\n // `auditLogsService.logSMSOTPSent`, and the SMS dispatch below\n // — only the rate-limit Redis key uses the normalized form.\n const phoneBucketKey = AuthControllerUtils.phoneRateLimitBucketKey(targetPhone);\n await this.rateLimitService.checkRateLimit(\n `${AUTH_REDIS_KEYS.SMS_OTP_BURST}${phoneBucketKey}:burst`,\n this.otpConfig.smsOtp.rateLimitBurst,\n 60\n );\n await this.rateLimitService.checkRateLimit(\n `${AUTH_REDIS_KEYS.SMS_OTP_BURST}${phoneBucketKey}:hourly`,\n this.otpConfig.smsOtp.rateLimitHourly,\n 3600\n );\n\n const userId = session.userId;\n if (userId) {\n // Revoke existing SMS_OTP tokens\n await this.consumableTokenService.revokeTokensByRelatedId(userId, CoreConsumableTokenTypes.SMS_OTP);\n }\n\n // Generate OTP code\n const otpCode = this._generateOTP(this.otpConfig.smsOtp.otpLength);\n\n // Store as consumable token\n await this.consumableTokenService.createToken({\n tokenType: CoreConsumableTokenTypes.SMS_OTP,\n consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n expiresIn: { value: this.otpConfig.smsOtp.expiryMinutes, unit: DurationUnit.MINUTES },\n userId: userId,\n resourceIdentifier: CoreResourceType.USERS,\n relatedId: userId || targetPhone,\n metadata: {\n otpCode,\n sessionId,\n phoneNumber: targetPhone,\n },\n });\n\n // Audit\n await this.auditLogsService.logSMSOTPSent({\n phoneNumber: targetPhone,\n factorLevel: session.currentFactor || AuthFactorLevel.FIRST,\n sessionId,\n ipAddress: session.deviceInfo?.ipAddress || 'unknown',\n userAgent: session.deviceInfo?.userAgent || 'unknown',\n });\n\n // Update session state to reflect pending OTP verification\n const isSecondFactor = session.state === AuthenticationSessionState.FIRST_FACTOR_COMPLETED\n || session.state === AuthenticationSessionState.MFA_REQUIRED;\n await this.updateSession(sessionId, {\n state: isSecondFactor\n ? AuthenticationSessionState.MFA_REQUIRED\n : AuthenticationSessionState.FIRST_FACTOR_IN_PROGRESS,\n currentFactor: isSecondFactor ? AuthFactorLevel.SECOND : AuthFactorLevel.FIRST,\n });\n\n this.logDebug('SMS OTP generated', { sessionId, phoneNumber: targetPhone });\n\n return { sent: true, otpCode, targetPhone };\n }\n\n /**\n * Verify an SMS OTP code. Supports both first and second factor.\n * Called from authenticate() dispatch — does NOT issue tokens (authenticate() handles completion).\n * Uses constant-time comparison for the OTP code.\n */\n public async authenticateSMSOTP(ec: ExecutionContext<any>, request: SMSOTPAuthRequest): Promise<AuthenticationServiceResult> {\n if (!this._isMethodEnabledGlobally(AuthMethod.SMS_OTP)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_SMS_OTP_DISABLED,\n });\n }\n\n const { sessionId, token, factorLevel } = request;\n\n const session = await this.getSession(sessionId);\n if (!session) {\n return this.__buildAuthenticationErrorMethod(sessionId, factorLevel, { retryAllowed: false });\n }\n\n // Allow-list: SMS OTP can be first or second factor, so accept states valid for either.\n // Reject unexpected states (COMPLETED, LOCKED, CREATED) to prevent replay or abuse.\n const validSMSOTPStates = [\n AuthenticationSessionState.IDENTIFIED,\n AuthenticationSessionState.FIRST_FACTOR_IN_PROGRESS,\n AuthenticationSessionState.FIRST_FACTOR_COMPLETED,\n AuthenticationSessionState.MFA_REQUIRED,\n AuthenticationSessionState.SECOND_FACTOR_IN_PROGRESS,\n ];\n if (!validSMSOTPStates.includes(session.state as AuthenticationSessionState)) {\n return this.__buildAuthenticationErrorMethod(sessionId, factorLevel, {\n retryAllowed: false,\n authMethod: AuthMethod.SMS_OTP,\n });\n }\n\n if (!token) {\n return this.__buildAuthenticationErrorMethod(sessionId, factorLevel, {\n retryAllowed: true,\n authMethod: AuthMethod.SMS_OTP,\n });\n }\n\n // Update session to in-progress\n const inProgressState = factorLevel === AuthFactorLevel.SECOND\n ? AuthenticationSessionState.SECOND_FACTOR_IN_PROGRESS\n : AuthenticationSessionState.FIRST_FACTOR_IN_PROGRESS;\n await this.updateSession(sessionId, {\n state: inProgressState,\n currentFactor: factorLevel,\n });\n\n const userId = session.userId;\n if (!userId) {\n return this.__buildAuthenticationErrorMethod(sessionId, factorLevel, { retryAllowed: false });\n }\n\n // Find matching SMS_OTP token and verify with constant-time comparison\n const isValid = await this._verifySMSOTP(userId, sessionId, token);\n\n if (!isValid) {\n const { locked } = await this.incrementSessionAttempts(ec, sessionId);\n\n await this.auditLogsService.logSMSOTPFailed({\n phoneNumber: request.phoneNumber,\n factorLevel,\n failureReason: locked ? 'Account locked after too many attempts' : 'Invalid OTP code',\n sessionId,\n ipAddress: session.deviceInfo?.ipAddress || 'unknown',\n userAgent: session.deviceInfo?.userAgent || 'unknown',\n });\n\n return this.__buildAuthenticationErrorMethod(sessionId, factorLevel, {\n retryAllowed: !locked,\n authMethod: AuthMethod.SMS_OTP,\n });\n }\n\n // Audit success\n // F4 per-org SIEM routing — route ONLY on the user's VERIFIED ACTIVE member orgs\n // (OTP-verified session userId), never a request-supplied value.\n const routingOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, userId);\n await this.auditLogsService.logSMSOTPVerified({\n userId: userId,\n phoneNumber: request.phoneNumber || 'unknown',\n factorLevel,\n sessionId,\n ipAddress: session.deviceInfo?.ipAddress || 'unknown',\n userAgent: session.deviceInfo?.userAgent || 'unknown',\n }, ec, routingOrgIds);\n\n // Update session (mirrors authenticateEmailOTP pattern)\n await this._updateSessionAfterSuccessfulAuth(ec, sessionId, userId, AuthMethod.SMS_OTP);\n\n const updatedSession = await this.getSession(sessionId);\n return this._buildAuthenticationSuccessMethod(\n sessionId,\n factorLevel,\n AuthMethod.SMS_OTP,\n '', // Tokens issued by authenticate() after completion check\n { completedFactors: updatedSession?.completedFactors || [] },\n );\n }\n\n /**\n * Verify an SMS OTP code using constant-time comparison.\n * Mirrors the _verifyEmailOTP pattern.\n */\n private async _verifySMSOTP(userId: string, sessionId: string, submittedCode: string): Promise<boolean> {\n try {\n const tokens = await this.consumableTokenService.findTokensByRelatedId(\n userId,\n CoreConsumableTokenTypes.SMS_OTP,\n );\n\n for (const tokenDoc of tokens) {\n const metadata = tokenDoc.metadata as Record<string, unknown> | undefined;\n if (!metadata?.otpCode || !metadata?.sessionId) continue;\n\n const storedCode = String(metadata.otpCode);\n const storedSession = String(metadata.sessionId);\n if (storedCode.length !== submittedCode.length || storedSession.length !== sessionId.length) continue;\n\n const codeMatch = crypto.timingSafeEqual(Buffer.from(storedCode), Buffer.from(submittedCode));\n const sessionMatch = crypto.timingSafeEqual(Buffer.from(storedSession), Buffer.from(sessionId));\n\n if (codeMatch && sessionMatch) {\n try {\n await this.consumableTokenService.consumeToken(tokenDoc.token);\n return true;\n } catch {\n continue;\n }\n }\n }\n\n return false;\n } catch (error) {\n if (isWildoBackendError(error)) {\n throw error;\n }\n this.logger.error('Failed to verify SMS OTP', {\n userId,\n sessionId,\n ...projectCaughtErrorLogFields(error),\n });\n return false;\n }\n }\n\n /**\n * Generate a cryptographically random N-digit numeric OTP.\n */\n private _generateOTP(length: number): string {\n const max = Math.pow(10, length);\n const min = Math.pow(10, length - 1);\n // Use crypto.randomInt for unbiased random number generation\n const { randomInt } = crypto;\n return String(randomInt(min, max));\n }\n\n // ===============================\n // COMPLETION LOGIC\n // ===============================\n\n private _isAuthenticationComplete(\n session: AuthenticationSession,\n currentFactorLevel: AuthFactorLevel,\n authMethod: AuthMethod,\n ): boolean {\n const completedFactors = session.completedFactors || [];\n\n const hasFirstFactor = completedFactors.some((factor) => AuthUtils.canBeFirstFactor(factor));\n const hasSecondFactor = completedFactors.some((factor) => AuthUtils.canBeSecondFactor(factor));\n\n switch (currentFactorLevel) {\n case AuthFactorLevel.FIRST:\n // If MFA is required for this session (set during first-factor success based on\n // app MFA policy + user's enrolled second-factor methods), first factor alone is not enough.\n if (session.requiresMFA) {\n return false;\n }\n return session.state === AuthenticationSessionState.FIRST_FACTOR_COMPLETED && hasFirstFactor;\n case AuthFactorLevel.SECOND:\n return hasFirstFactor && hasSecondFactor && completedFactors.length >= 2;\n default:\n return false;\n }\n }\n\n // ===============================\n // RESPONSE BUILDERS\n // ===============================\n\n private _buildIdentificationErrorResponse(\n sessionId: string,\n factorLevel: AuthFactorLevel,\n retryAllowed: boolean = true,\n session?: AuthenticationSession | null,\n ): AuthenticationResponse {\n return AuthenticationResponseSchema.parse({\n success: false,\n sessionId,\n userExists: session?.userExists ?? false,\n factorLevel,\n retryAllowed,\n remainingAttempts: session ? session.maxAttempts - session.attempts : undefined,\n lockoutUntil: session?.lockoutUntil,\n requiresMFA: false,\n integrationTokens: [],\n });\n }\n\n /**\n * Build the orchestrator's success-path return shape.\n *\n * Returns `AuthenticationServiceResult` (= `AuthenticationResponse &\n * { refreshToken?: string }`) — the wire-shape `AuthenticationResponse`\n * (parsed from `AuthenticationResponseSchema`) augmented with the\n * cookie-bound `refreshToken` value. The schema parse intentionally\n * STRIPS `refreshToken` from the wire body (Auth-hardening Slice A\n * Step 6, 2026-04-13 — schema no longer carries the field); we then\n * re-attach it on the returned object so the controller can pull it\n * out and pass it to `_jsonSuccessWithRefreshCookie(res, body, refreshToken)`.\n *\n * Why parse-strip-then-reattach (instead of building the literal\n * directly): `AuthenticationResponseSchema.parse(...)` applies the\n * schema's defaults (e.g. `integrationTokens: []`, `requiresMFA:\n * false`, `retryAllowed: true`, `enrolledSecondFactorMethods: []`)\n * AND strips any unknown keys. Removing the parse step would\n * duplicate that default logic at every call site of the factory —\n * a maintenance burden + a subtle source of drift if the schema\n * defaults ever shift. Re-attach is one line and preserves the\n * single-source-of-truth contract.\n */\n private _buildAuthenticationSuccessMethod(\n sessionId: string,\n factorLevel: AuthFactorLevel,\n authMethod: AuthMethod,\n accessToken: string,\n options: {\n refreshToken?: string;\n expiresIn?: number;\n user?: any;\n integrationTokens?: Array<{\n integrationId: string;\n accessToken: string;\n refreshToken?: string;\n expiresIn?: number;\n scopes: string[];\n }>;\n requiresMFA?: boolean;\n availableMFAMethods?: AvailableMethod[];\n mfaMethodsRequired?: number;\n enrolledSecondFactorMethods?: AuthMethod[];\n usableSecondFactorMethods?: AuthMethod[];\n completedFactors?: AuthMethod[];\n challengeData?: Record<string, any>;\n redirectUrl?: string;\n nextStep?: string;\n availableEnrollmentMethods?: AuthMethod[];\n } = {},\n ): AuthenticationServiceResult {\n const wireBody = AuthenticationResponseSchema.parse({\n success: !options.requiresMFA,\n sessionId,\n userExists: true,\n factorLevel,\n authMethod,\n accessToken,\n // Auth-hardening Slice A Step 6: `refreshToken` is intentionally\n // NOT passed to `.parse(...)` — the schema no longer carries the\n // field, so passing it here would be silently stripped. We\n // re-attach it on the returned object below for the controller's\n // cookie-emit seam.\n expiresIn: options.expiresIn,\n user: options.user,\n integrationTokens: options.integrationTokens || [],\n requiresMFA: options.requiresMFA || false,\n availableMFAMethods: options.availableMFAMethods,\n mfaMethodsRequired: options.mfaMethodsRequired,\n enrolledSecondFactorMethods: options.enrolledSecondFactorMethods || [],\n usableSecondFactorMethods: options.usableSecondFactorMethods || [],\n completedFactors: options.completedFactors || [authMethod],\n retryAllowed: true,\n challengeData: options.challengeData,\n redirectUrl: options.redirectUrl,\n nextStep: options.nextStep,\n availableEnrollmentMethods: options.availableEnrollmentMethods || [],\n });\n return { ...wireBody, refreshToken: options.refreshToken };\n }\n\n private __buildAuthenticationErrorMethod(\n sessionId: string,\n factorLevel: AuthFactorLevel,\n options: {\n authMethod?: AuthMethod;\n retryAllowed?: boolean;\n remainingAttempts?: number;\n lockoutUntil?: Date;\n requiresMFA?: boolean;\n availableMFAMethods?: AvailableMethod[];\n mfaMethodsRequired?: number;\n completedFactors?: AuthMethod[];\n challengeData?: Record<string, any>;\n redirectUrl?: string;\n } = {},\n ): AuthenticationResponse {\n // Note: we don't call getSession here synchronously because this is used in sync error builders.\n // The session data is passed through options when available.\n return AuthenticationResponseSchema.parse({\n success: false,\n sessionId,\n userExists: false,\n factorLevel,\n authMethod: options.authMethod,\n retryAllowed: options.retryAllowed ?? true,\n remainingAttempts: options.remainingAttempts,\n lockoutUntil: options.lockoutUntil,\n requiresMFA: options.requiresMFA ?? false,\n availableMFAMethods: options.availableMFAMethods,\n mfaMethodsRequired: options.mfaMethodsRequired,\n completedFactors: options.completedFactors || [],\n integrationTokens: [],\n challengeData: options.challengeData,\n redirectUrl: options.redirectUrl,\n });\n }\n\n private async _buildAvailableMethodObject(\n ec: ExecutionContext<any> | undefined,\n method: AuthMethod,\n domainOrgLookup?: DomainOrgLookupResult | null,\n authPolicy?: UserTypeAuthPolicy,\n ): Promise<AvailableMethod | null> {\n const globalAuth = this.appConfigService.config.auth;\n const policy = authPolicy ?? AuthenticationOrchestratorBackendService.FALLBACK_AUTH_POLICY;\n\n const isEnabled = policy.authMethodsEnabled[method];\n if (!isEnabled) {\n return null;\n }\n\n const factorType = AuthUtils.getFactorType(method);\n const category = AuthUtils.getMethodCategory(method);\n const canBeFirstFactor = AuthUtils.canBeFirstFactor(method);\n const canBeSecondFactor = AuthUtils.canBeSecondFactor(method);\n const organizationRestricted = AuthUtils.isOrganizationRestricted(method);\n const supportsIntegrations = AuthUtils.supportsIntegrationAccess(method);\n\n let required = false;\n if (canBeSecondFactor && policy.mfaPolicy.requireMFA) {\n required = true;\n }\n let oauth2ProviderRefs: string[] = [];\n let ssoIds: string[] = [];\n let availableIntegrations: string[] = [];\n let config: AvailableMethodConfig | undefined;\n\n switch (method) {\n case AuthMethod.EXTERNAL_OAUTH2: {\n let oauth2Providers = Object.entries(globalAuth.socialOAuth2Providers || {})\n .filter(([, providerConfig]) => isEnabledSocialOAuth2LoginProvider(providerConfig))\n .map(([providerRef]) => providerRef);\n if (domainOrgLookup && ec) {\n oauth2Providers = await this.oauth2Resolver.filterProviders(\n ec,\n domainOrgLookup.scopeType,\n domainOrgLookup.scopeId,\n oauth2Providers,\n );\n }\n if (oauth2Providers.length === 0) return null;\n availableIntegrations = oauth2Providers;\n oauth2ProviderRefs = oauth2Providers;\n break;\n }\n case AuthMethod.MAGIC_LINK:\n case AuthMethod.SMS_OTP:\n break;\n case AuthMethod.PASSKEY:\n config = globalAuth.passkeyConfig\n ? { rpName: globalAuth.passkeyConfig.rpName, rpId: globalAuth.passkeyConfig.rpId }\n : undefined;\n break;\n case AuthMethod.ORG_OPENID_CONNECT: {\n if (\n !domainOrgLookup\n || domainOrgLookup.matchedProviderType !== SsoProtocol.OIDC\n ) {\n return null;\n }\n const providerInfo = this.domainToOrgLookup.getSSOProviderInfo(domainOrgLookup);\n if (!providerInfo) return null;\n ssoIds = [providerInfo.connectionId];\n config = {\n displayName: providerInfo.displayName,\n providerRef: providerInfo.providerRef,\n connectionId: providerInfo.connectionId,\n scopeType: domainOrgLookup.scopeType,\n scopeId: domainOrgLookup.scopeId,\n };\n if (domainOrgLookup.enforcement?.requireSSO) {\n required = true;\n }\n break;\n }\n case AuthMethod.ORG_SAML: {\n if (\n !domainOrgLookup\n || domainOrgLookup.matchedProviderType !== SsoProtocol.SAML\n ) {\n return null;\n }\n const samlProviderInfo = this.domainToOrgLookup.getSSOProviderInfo(domainOrgLookup);\n if (!samlProviderInfo) return null;\n ssoIds = [samlProviderInfo.connectionId];\n config = {\n displayName: samlProviderInfo.displayName,\n providerRef: samlProviderInfo.providerRef,\n connectionId: samlProviderInfo.connectionId,\n loginUrl: `/auth/saml/login/${samlProviderInfo.connectionId}`,\n scopeType: domainOrgLookup.scopeType,\n scopeId: domainOrgLookup.scopeId,\n };\n if (domainOrgLookup.enforcement?.requireSSO) {\n required = true;\n }\n break;\n }\n default:\n break;\n }\n\n return {\n method,\n factorType,\n category,\n canBeFirstFactor,\n canBeSecondFactor,\n required,\n oauth2ProviderRefs,\n ssoIds,\n organizationRestricted,\n supportsIntegrations,\n availableIntegrations,\n config,\n };\n }\n}\n"]}