@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

package/dist/esm/security/authentications/services/oidc-authorization-code.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-authorization-code.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/oidc-authorization-code.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAChJ,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AAGxI,OAAO,EACL,WAAW,EACX,+BAA+B,EAC/B,wBAAwB,EACxB,qBAAqB,EACrB,gBAAgB,EAChB,2BAA2B,EAC3B,SAAS,EACT,qCAAqC,EACrC,mBAAmB,EACnB,iBAAiB,EACjB,8BAA8B,EAC9B,cAAc,EACd,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,yCAAyC,EAAE,MAAM,uBAAuB,CAAC;AAIlF,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,qEAAqE,CAAC;AACrI,OAAO,EAAE,qBAAqB,EAAE,MAAM,iFAAiF,CAAC;AACxH,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,+EAA+E,CAAC;AAElJ,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,EAAE,8BAA8B,EAAE,MAAM,uFAAuF,CAAC;AACvI,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,yFAAyF,CAAC;AA0FjG;;;;;;;;;;;GAWG;AAEI,IAAM,mCAAmC,GAAzC,MAAM,mCAAmC;IAEW;IACH;IACa;IACG;IAJtE,YACyD,SAAoB,EACvB,MAAqB,EACR,YAAwC,EACrC,gBAA+C;QAH5D,cAAS,GAAT,SAAS,CAAW;QACvB,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QACrC,qBAAgB,GAAhB,gBAAgB,CAA+B;IAClH,CAAC;IAEG,KAAK,CAAC,sBAAsB,CAAC,OAAqC;QACvE,IAAI,OAAO,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;YAC3C,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,iBAAiB,EAAE,6BAA6B,CAAC,CAAC;QACnG,CAAC;QACD,wGAAwG;QACxG,+FAA+F;QAC/F,6EAA6E;QAC7E,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,iBAAiB,EAAE,8CAA8C,CAAC,CAAC;QACpH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAE/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC;YACtD,SAAS,EAAE,wBAAwB,CAAC,uBAAuB;YAC3D,eAAe,EAAE,+BAA+B,CAAC,UAAU;YAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;YACnD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE;gBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9I,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IACjC,CAAC;IAEM,KAAK,CAAC,yBAAyB,CAAC,MAAqH;QAC1J,iGAAiG;QACjG,wGAAwG;QACxG,sGAAsG;QACtG,2GAA2G;QAC3G,yGAAyG;QACzG,yGAAyG;QACzG,IAAI,QAAqF,CAAC;QAC1F,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAoB,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,4FAA4F;YAC5F,IAAI,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrH,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,sDAAsD,CAAC,CAAC;QAC3H,CAAC;QAED,IAAI,QAAQ,CAAC,SAAS,KAAK,wBAAwB,CAAC,uBAAuB,EAAE,CAAC;YAC5E,IAAI,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrH,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,oCAAoC,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACzG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,mCAAmC,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAiJ,CAAC;QAEvL,4FAA4F;QAC5F,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC/I,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,qDAAqD,CAAC,CAAC;QAC1H,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5C,IAAI,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrJ,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,uDAAuD,CAAC,CAAC;QAC5H,CAAC;QAED,sGAAsG;QACtG,wGAAwG;QACxG,wGAAwG;QACxG,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,wBAAwB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxJ,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,0BAA0B,CAAC,CAAC;QAC/F,CAAC;QACD,kFAAkF;QAClF,MAAM,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC/F,+GAA+G;QAC/G,0GAA0G;QAC1G,2GAA2G;QAC3G,4GAA4G;QAC5G,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,iBAAiB,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YACpE,IAAI,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,wBAAwB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxJ,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,0BAA0B,CAAC,CAAC;QAC/F,CAAC;QAED,gGAAgG;QAChG,gGAAgG;QAChG,iGAAiG;QACjG,8FAA8F;QAC9F,kEAAkE;QAClE,EAAE;QACF,gGAAgG;QAChG,+FAA+F;QAC/F,4FAA4F;QAC5F,mGAAmG;QACnG,qFAAqF;QACrF,IAAI,MAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,+FAA+F;YAC/F,iEAAiE;YACjE,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,yBAAyB,CAAC,UAAU;eACjE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1G,IAAI,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC/I,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,4BAA4B,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC/I,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,qBAAqB,EAAE,iEAAiE,CAAC,CAAC;QAC3I,CAAC;QAED,oGAAoG;QACpG,qGAAqG;QACrG,oGAAoG;QACpG,iGAAiG;QACjG,sGAAsG;QACtG,8FAA8F;QAC9F,iGAAiG;QACjG,iGAAiG;QACjG,gGAAgG;QAChG,mFAAmF;QACnF,IAAI,MAAM,CAAC,MAAM,KAAK,yBAAyB,CAAC,UAAU,EAAE,CAAC;YAC3D,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACnF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC/I,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,iCAAiC,CAAC,QAAgB,EAAE,WAAmB,EAAE,MAAc;QAClG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QAC/D,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAExD,uFAAuF;QACvF,EAAE;QACF,kGAAkG;QAClG,mGAAmG;QACnG,oGAAoG;QACpG,kGAAkG;QAClG,+FAA+F;QAC/F,sFAAsF;QACtF,EAAE;QACF,6FAA6F;QAC7F,2FAA2F;QAC3F,gFAAgF;QAChF,IAAI,gCAAgC,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,OAAO;gBACL,eAAe,EAAE,IAAI;gBACrB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;gBAC5B,gGAAgG;gBAChG,8FAA8F;gBAC9F,+FAA+F;gBAC/F,qBAAqB;gBACrB,mBAAmB,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;gBACjD,0BAA0B,EAAE,MAAM,CAAC,2BAA2B;aAC/D,CAAC;QACJ,CAAC;QAED,IAAI,eAAe,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAElD,uCAAuC;QACvC,0EAA0E;QAC1E,oGAAoG;QACpG,qGAAqG;QACrG,qGAAqG;QACrG,mGAAmG;QACnG,qGAAqG;QACrG,oGAAoG;QACpG,8FAA8F;QAC9F,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,0BAA0B,CAAC,YAAY,EAAE,CAAC;YACxF,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC7D,eAAe,GAAG,IAAI,CAAC;YACzB,CAAC;QACH,CAAC;QAED,OAAO;YACL,eAAe;YACf,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YAC5B,mBAAmB,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YACjD,6FAA6F;YAC7F,0FAA0F;YAC1F,8FAA8F;YAC9F,0FAA0F;YAC1F,WAAW;YACX,0BAA0B,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,0BAA0B,CAAC,YAAY;mBACtF,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;mBAC9B,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;SACtE,CAAC;IACJ,CAAC;IAED,gGAAgG;IACxF,kBAAkB,CAAC,GAAW;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YACjD,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;QAC5F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,UAAU,CAAC,WAAmB;QACpC,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,cAAsB;QACpE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAwC,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;YACtI,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA4C,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;YACnI,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,oCAAoC,CAAC;gBAC9D,YAAY,EAAE,gBAAgB,CAAC,oBAAoB;gBACnD,mBAAmB,EAAE,qBAAqB,CAAC,IAAI;aAChD,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK;iBACvB,aAAa,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;iBACpD,IAAI,CAAkB,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,wBAAwB,CAAC,MAAM,EAAE,CAAC,CAAC;YAClG,OAAO,CAAC,CAAC,MAAM,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE;gBAC7E,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,mBAAmB,CAAC,KAAK,CAAC;aAC3D,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,oBAAoB,CAAC,OAA2B;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAE/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC;YACtD,SAAS,EAAE,wBAAwB,CAAC,oBAAoB;YACxD,eAAe,EAAE,+BAA+B,CAAC,UAAU;YAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;YACpD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE;gBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD;SACF,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACzG,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,qBAAqB,CAAC,YAAoB;QACrD,IAAI,QAAqF,CAAC;QAC1F,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,YAAY,CAAoB,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,mDAAmD,CAAC,CAAC;QACxH,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,KAAK,wBAAwB,CAAC,oBAAoB,EAAE,CAAC;YACzE,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,gCAAgC,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,gCAAgC,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAA6I,CAAC;QACnL,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,8BAA8B,CAAC,CAAC;QACnG,CAAC;QACD,OAAO;YACL,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACvB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,wBAAwB,CAAC,OAKrC;QACC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC;YACtD,SAAS,EAAE,wBAAwB,CAAC,wBAAwB;YAC5D,eAAe,EAAE,+BAA+B,CAAC,UAAU;YAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;YACpD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,qGAAqG;YACrG,sGAAsG;YACtG,qFAAqF;YACrF,QAAQ,EAAE;gBACR,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,6BAA6B,EAAE,OAAO,CAAC,6BAA6B;gBACpE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D;SACF,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACjF,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,yBAAyB,CAAC,iBAAyB;QAM9D,IAAI,QAAqF,CAAC;QAC1F,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,iBAAiB,CAAoB,CAAC;QAC5F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,KAAK,wBAAwB,CAAC,wBAAwB,EAAE,CAAC;YAC7E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAuF,CAAC;QAC7H,OAAO;YACL,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;SAClE,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E;;;;;;;;;;;;OAYG;IACH;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,iCAAiC,CAAC,QAAgB,EAAE,GAAW;QAC1E,IAAI,MAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC;IAC/D,CAAC;IAEO,KAAK,CAAC,0BAA0B,CAAC,QAAgB;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAmC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;QACzG,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,qCAAqC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAED,sFAAsF;IAC9E,KAAK,CAAC,wBAAwB,CAAC,QAAgB;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAwC,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;QACtI,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA4C,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;QACnI,KAAK,MAAM,YAAY,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,CAAC;YACrH,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,oCAAoC,CAAC,EAAE,YAAY,EAAE,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC;YACnI,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,IAAI,CAAkB,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;YACpG,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,qBAAqB,CAAC,MAAuB;QACnD,4FAA4F;QAC5F,iGAAiG;QACjG,6FAA6F;QAC7F,wFAAwF;QACxF,MAAM,SAAS,GAAG,MAAM,CAAC,kBAAkB,KAAK,6BAA6B,CAAC,OAAO,CAAC;QACtF,OAAO;YACL,MAAM,EAAE,yBAAyB,CAAC,UAAU;YAC5C,QAAQ,EAAE,MAAM,CAAC,GAAG;YACpB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YACvC,mGAAmG;YACnG,kGAAkG;YAClG,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,IAAI,EAAE;YAC3D,sFAAsF;YACtF,4FAA4F;YAC5F,6FAA6F;YAC7F,yFAAyF;YACzF,qDAAqD;YACrD,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;YACxF,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;YACzC,OAAO,EAAE,SAAS;gBAChB,CAAC,CAAC,EAAE,IAAI,EAAE,0BAA0B,CAAC,YAAY,EAAE;gBACnD,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,WAAW,CAAC,YAAY;oBACzC,CAAC,CAAC,EAAE,IAAI,EAAE,0BAA0B,CAAC,YAAY,EAAE,cAAc,EAAG,MAAkC,CAAC,cAAc,EAAE;oBACvH,CAAC,CAAC,EAAE,IAAI,EAAE,0BAA0B,CAAC,WAAW,EAAE;YACtD,0FAA0F;YAC1F,+FAA+F;YAC/F,wFAAwF;YACxF,mBAAmB,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,KAAK,IAAI;YACxE,MAAM;SACP,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACK,KAAK,CAAC,qCAAqC,CACjD,IAAsC,EACtC,QAAgB;QAEhB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAChF,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC7B,0FAA0F;YAC1F,+FAA+F;YAC/F,yFAAyF;YACzF,uFAAuF;YACvF,8FAA8F;YAC9F,uBAAuB;YACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YACvH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;YACnG,KAAK,SAAS,CAAC,oBAAoB,CAAC;gBAClC,QAAQ;gBACR,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yDAAyD,EAAE;gBACnG,GAAG,2BAA2B,CAAC,UAAU,CAAC;aAC3C,CAAC,CAAC,CAAC;YACJ,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,gBAAgB,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACrC,MAAM,cAAc,GAAG,QAAQ,CAAC,WAAW,CAAC;QAC5C,MAAM,aAAa,GAAG,cAAc,KAAK,SAAS;YAChD,CAAC,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAC;YACrC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAA2B,EAAE,CAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3H,OAAO;YACL,MAAM,EAAE,yBAAyB,CAAC,2BAA2B;YAC7D,QAAQ;YACR,IAAI,EAAE,QAAQ,CAAC,WAAW;YAC1B,YAAY,EAAE,QAAQ,CAAC,aAAa;YACpC,4FAA4F;YAC5F,+FAA+F;YAC/F,6FAA6F;YAC7F,2FAA2F;YAC3F,mFAAmF;YACnF,EAAE;YACF,2FAA2F;YAC3F,4FAA4F;YAC5F,2DAA2D;YAC3D,sBAAsB,EAAE,QAAQ,CAAC,yBAAyB,IAAI,EAAE;YAChE,aAAa,EAAE,8BAA8B;YAC7C,aAAa;YACb,OAAO,EAAE,EAAE,IAAI,EAAE,0BAA0B,CAAC,YAAY,EAAE;YAC1D,2BAA2B,EAAE,IAAI,CAAC,2BAA2B,CAAC,QAAQ,CAAC;YACvE,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,6EAA6E;IACrE,6BAA6B,CAAC,MAA0C,EAAE,WAAmB;QACnG,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;QACpG,CAAC;QACD,gGAAgG;QAChG,kGAAkG;QAClG,+FAA+F;QAC/F,mDAAmD;QACnD,IAAI,MAAM,CAAC,MAAM,KAAK,yBAAyB,CAAC,UAAU,EAAE,CAAC;YAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxF,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;YACpG,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,qBAAqB,EAAE,2DAA2D,CAAC,CAAC;QACrI,CAAC;QACD,mGAAmG;QACnG,yFAAyF;QACzF,6FAA6F;QAC7F,iEAAiE;QACjE,yGAAyG;QACzG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,iBAAiB,EAAE,gDAAgD,CAAC,CAAC;QACtH,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,MAAmC,EAAE,KAAe;QAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,CAAC;QACrC,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,eAAe,EAAE,yBAAyB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtH,CAAC;IACH,CAAC;IAED,8FAA8F;IAE9F;;;;OAIG;IACK,yBAAyB,CAAC,MAAsC,EAAE,GAA8D;QACtI,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QACnG,KAAK,SAAS,CAAC,0BAA0B,CAAC;YACxC,MAAM;YACN,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACvB,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0DAA0D,EAAE;YACpG,GAAG,2BAA2B,CAAC,UAAU,CAAC;SAC3C,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;OAKG;IACK,qCAAqC,CAAC,eAAmC;QAC/E,MAAM,gBAAgB,GAAG,eAAe,EAAE,UAAU,CAAC,SAAS,CAAC;YAC7D,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,eAAe,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QACnG,KAAK,SAAS,CAAC,oBAAoB,CAAC;YAClC,cAAc,EAAE,cAAc;YAC9B,gBAAgB;YAChB,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;YAC7F,GAAG,2BAA2B,CAAC,UAAU,CAAC;SAC3C,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;OAGG;IACK,2BAA2B,CAAC,MAAc,EAAE,QAAgB,EAAE,QAA4B,EAAE,MAAgB,EAAE,UAAmB;QACvI,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QACnG,KAAK,SAAS,CAAC,6BAA6B,CAAC;YAC3C,MAAM;YACN,QAAQ;YACR,QAAQ;YACR,MAAM;YACN,UAAU;SACX,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6DAA6D,EAAE;YACvG,GAAG,2BAA2B,CAAC,UAAU,CAAC;SAC3C,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;;;;OAQG;IACK,8BAA8B,CAAC,MAAuB,EAAE,qBAAyC;QACvG,IAAI,CAAC,qCAAqC,CAAC,MAAM,CAAC,uBAAuB,IAAI,4BAA4B,CAAC,IAAI,CAAC,EAAE,CAAC;YAChH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,4FAA4F;YAC5F,uEAAuE;YACvE,IAAI,CAAC,qCAAqC,CAAC,qBAAqB,CAAC,CAAC;YAClE,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,gBAAgB,EAAE,mEAAmE,CAAC,CAAC;QACzI,CAAC;QACD,MAAM,aAAa,GAAG,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;QACnE,qGAAqG;QACrG,wGAAwG;QACxG,2GAA2G;QAC3G,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,aAAa,KAAK,MAAM,CAAC,YAAY,CAAC;QACtF,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,oBAAoB;eACrD,aAAa,KAAK,MAAM,CAAC,oBAAoB;eAC7C,yBAAyB,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACtE,IAAI,CAAC,cAAc,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC7C,sGAAsG;YACtG,sGAAsG;YACtG,+DAA+D;YAC/D,2GAA2G;YAC3G,sGAAsG;YACtG,2GAA2G;YAC3G,6DAA6D;YAC7D,IAAI,CAAC,qCAAqC,CAAC,qBAAqB,CAAC,CAAC;YAClE,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,KAAK,CAAC,2BAA2B,CAAC,QAAgB,EAAE,YAAoB;QAC7E,6FAA6F;QAC7F,gGAAgG;QAChG,+FAA+F;QAC/F,sEAAsE;QACtE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACnG,qGAAqG;YACrG,sFAAsF;YACtF,IAAI,CAAC,qCAAqC,CAAC,YAAY,CAAC,CAAC;YACzD,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAC1D,wGAAwG;QACxG,yGAAyG;QACzG,2GAA2G;QAC3G,2EAA2E;QAC3E,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,aAAa,KAAK,MAAM,CAAC,YAAY,CAAC;QACtF,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,oBAAoB;eACrD,aAAa,KAAK,MAAM,CAAC,oBAAoB;eAC7C,yBAAyB,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACtE,IAAI,CAAC,cAAc,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC7C,0GAA0G;YAC1G,8FAA8F;YAC9F,IAAI,CAAC,qCAAqC,CAAC,YAAY,CAAC,CAAC;YACzD,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E;;;;;;OAMG;IACI,KAAK,CAAC,uBAAuB,CAAC,MAAc,EAAE,QAAgB,EAAE,QAA4B,EAAE,eAAyB;QAC5H,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACtE,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YACzB,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,OAAO,KAAK,CAAC;YACvF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;YAC5C,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,QAAgB,EAAE,QAA4B,EAAE,MAAgB;QAC9G,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA6B,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;QAC5G,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,gGAAgG;QAChG,iGAAiG;QACjG,qBAAqB;QACrB,MAAM,IAAI,GAA4B,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QACzG,IAAI,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,cAAc,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;YAC/E,wGAAwG;YACxG,oGAAoG;YACpG,kHAAkH;YAClH,IAAI,CAAC,2BAA2B,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qFAAqF;YACrF,qGAAqG;YACrG,iGAAiG;YACjG,mGAAmG;YACnG,wGAAwG;YACxG,wGAAwG;YACxG,qFAAqF;YACrF,uHAAuH;YACvH,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,QAAQ;gBAAE,MAAM,KAAK,CAAC;YAClF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACvE,IAAI,CAAC,MAAM;gBAAE,MAAM,KAAK,CAAC,CAAC,2EAA2E;YACrG,MAAM,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACK,kBAAkB;QACxB,IAAI,YAAY,GAAG,yCAAyC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC;gBACjG,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,CAAC;YAC3C,IAAI,OAAO,UAAU,KAAK,QAAQ;gBAAE,YAAY,GAAG,UAAU,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;QACD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACnE,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,uBAAuB,CAAC,YAAwC,EAAE,QAA2B,EAAE,MAAgB;QAC3H,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5E,+FAA+F;QAC/F,8FAA8F;QAC9F,+EAA+E;QAC/E,qEAAqE;QACrE,MAAM,YAAY,CAAC,cAAc,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,QAAQ,CAAC,GAAG,EAAE;YACrF,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,IAAI,CAAC,kBAAkB,EAAE;SACrC,CAAC,CAAC;QACH,yGAAyG;QACzG,2FAA2F;QAC3F,iHAAiH;QACjH,IAAI,CAAC,2BAA2B,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACzG,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,QAAgB,EAAE,QAA4B;QAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAwC,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;QACtI,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA4C,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;QACnI,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,oCAAoC,CAAC;YAC9D,YAAY,EAAE,gBAAgB,CAAC,oBAAoB;YACnD,mBAAmB,EAAE,qBAAqB,CAAC,IAAI;SAChD,CAAC,CAAC;QACH,OAAO,KAAK;aACT,aAAa,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;aACpD,IAAI,CAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;IAEO,UAAU,CAAC,IAAe,EAAE,UAAkB,EAAE,MAAc;QACpE,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE;YACnD,sBAAsB,EAAE,IAAI,KAAK,SAAS,CAAC,cAAc;gBACvD,CAAC,CAAC,2BAA2B,CAAC,8BAA8B;gBAC5D,CAAC,CAAC,2BAA2B,CAAC,4BAA4B;YAC5D,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;SAChC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA92BY,mCAAmC;IAD/C,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAA;IACpC,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;+CAFU,aAAa;QACM,0BAA0B;QACnB,6BAA6B;GAL1G,mCAAmC,CA82B/C","sourcesContent":["import 'reflect-metadata';\nimport { inject, injectable } from 'inversify';\nimport type { Container } from 'inversify';\nimport { createHash } from 'crypto';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { ConsumableTokenBackendService } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport type { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport {\n  ApiKeyScope,\n  ConsumableToken_ConsumptionMode,\n  CoreConsumableTokenTypes,\n  CoreResourceOperation,\n  CoreResourceType,\n  ErrorCustomMessageReference,\n  ErrorType,\n  isConfidentialTokenEndpointAuthMethod,\n  isWildoBackendError,\n  OAuthClientStatus,\n  OAuthCodeExchangeFailureReason,\n  OAuthGrantType,\n  OAuthClientRegistrationOrigin,\n  OAuthTokenEndpointAuthMethod,\n  OrganizationMemberStatus,\n} from '@wildo-ai/saas-models';\nimport { OAUTH_CONSENT_GRANT_DEFAULT_LIFETIME_DAYS } from '@wildo-ai/saas-models';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { OAuthClientBase, OAuthClientOrganization, OAuthConsentGrant } from '@wildo-ai/saas-models';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { isCredentialExpired, isRotationGraceWindowOpen } from '~wildo-backend-lib/security/credential-rotation-grace.backend.utils';\nimport { hashOAuthClientSecret } from '~wildo-backend-lib/security/oauth-clients/oauth-client-generation.backend.utils';\nimport { isValidPkceCodeVerifier, isValidS256CodeChallenge } from '~wildo-backend-lib/security/authentications/services/utils/pkce.backend.utils';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport { DurationUnit } from '@wildo-ai/zod-decorators';\nimport type { CimdClientMetadataBackendService } from '~wildo-backend-lib/security/authentications/services/cimd-client-metadata.backend.service';\nimport { OIDC_SUPPORTED_IDENTITY_SCOPES } from '~wildo-backend-lib/security/authentications/services/oidc-user-claims.backend.service';\nimport {\n  AuthorizationClientOrigin,\n  AuthorizationClientTenancy,\n  isClientIdMetadataDocumentClient,\n} from '~wildo-backend-lib/security/authentications/models/authorization-client.backend.schemas';\nimport type {\n  ClientIdMetadataDocumentAuthorizationClient,\n  RegisteredAuthorizationClient,\n  ResolvedAuthorizationClient,\n} from '~wildo-backend-lib/security/authentications/models/authorization-client.backend.schemas';\n\n/** The authorization request the authorize endpoint hands over AFTER the user has consented. */\nexport interface OidcAuthorizationCodeRequest {\n  userId: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[];\n  codeChallenge: string;\n  codeChallengeMethod: 'S256';\n  nonce?: string;\n  /**\n   * RFC 8707 resource indicator — the canonical audience of the resource server the client\n   * wants the access token for (an A2A / MCP endpoint URI). Captured at authorize time and\n   * bound into the token's `aud` at exchange. MANDATORY for the delegated-token exchange:\n   * `issueAuthorizationCodeToken` fail-closes with `invalid_target` when it is absent (a\n   * delegated user token MUST be audience-bound — B-S2). Optional on THIS type only because the\n   * authorize endpoint accepts the request before the token exchange enforces it.\n   */\n  resource?: string;\n  /**\n   * revocation-C: the End-User's OP login `sessionId`, captured from the first-party access token at\n   * authorize/consent. Carried through the code into the id_token's `sid` so the RP-Initiated Logout\n   * endpoint can terminate exactly this session. Optional — absent if the authorizing token carried no\n   * session (should not happen for a first-party interactive authorize, but the pipeline stays lenient).\n   */\n  sessionId?: string;\n}\n\n/** The binding recovered when an authorization code is redeemed, used to mint the tokens. */\nexport interface OidcAuthorizationCodeGrant {\n  userId: string;\n  clientId: string;\n  scope: string[];\n  nonce?: string;\n  /** RFC 8707 resource indicator captured at authorize (see {@link OidcAuthorizationCodeRequest.resource}). */\n  resource?: string;\n  /** revocation-C: the End-User's OP login `sessionId` → the id_token `sid` (see {@link OidcAuthorizationCodeRequest.sessionId}). */\n  sessionId?: string;\n}\n\n/**\n * The authorization request stashed in a single-use consent-request token at `/oauth/authorize` for\n * a `requiresConsent` client (INSTEAD of the code), and recovered at `/oauth/authorize/decision` to\n * mint the code on APPROVE. Carries the SAME fields the code would bind PLUS the OAuth `state` (echoed\n * back on the final redirect). Stored server-side so the consent decision cannot tamper with the\n * parameters — the client/redirect/scope the user approved are exactly the ones the code binds.\n */\nexport interface OidcConsentRequest {\n  userId: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[];\n  codeChallenge: string;\n  nonce?: string;\n  resource?: string;\n  state?: string;\n}\n\n/**\n * What the authorize endpoint needs to know about a client before it decides whether to prompt.\n *\n * Carries the DISPLAY obligations alongside the decision, because the specification makes display a\n * requirement rather than a nicety for a client whose identity is only a domain: the redirect\n * hostname must be shown, and a loopback-only redirect set warrants an extra warning.\n */\nexport interface AuthorizationClientConsentPosture {\n  requiresConsent: boolean;\n  clientName: string;\n  /** Which mechanism established this identity — the consent screen presents the two differently. */\n  origin: AuthorizationClientOrigin;\n  /**\n   * Whether any tenant of this application vouches for the client — the actual trust signal.\n   *\n   * `origin` alone is misleading for a dynamically registered client: it IS a registered row, so it\n   * reports `REGISTERED`, while nobody with standing here ever vetted it. `UNAFFILIATED` is the\n   * value the consent screen must key on when it decides how cautious to be.\n   */\n  tenancy: AuthorizationClientTenancy;\n  /** The hostname the user will be sent back to; `null` only if the URI is unparseable. */\n  redirectUriHostname: string | null;\n  /** Every redirect URI this client claims is loopback — show the impersonation warning. */\n  warnsLoopbackOnlyRedirects: boolean;\n}\n\n/**\n * OIDC authorization_code engine (Wildo-as-provider). Two halves:\n *  - {@link issueAuthorizationCode} — after the user consents, validate the request against\n *    the registered client and mint a single-use, short-TTL code bound to the user + client +\n *    scope + redirect_uri + PKCE challenge (+ nonce).\n *  - {@link exchangeAuthorizationCode} — at the token endpoint, atomically consume the code and\n *    verify the client + redirect_uri binding and PKCE (RFC 7636 S256), then return the binding.\n *\n * Built on the `OIDC_AUTHORIZATION_CODE` consumable token (Mongo, atomic SINGLE_USE, TTL) — the\n * same hardened primitive behind `AUTH_CODE_EXCHANGE`. PKCE is MANDATORY (S256 only). Every\n * failure is fail-closed and carries the RFC 6749 error code in `context.oauthError`.\n */\n@injectable()\nexport class OidcAuthorizationCodeBackendService {\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Container) private readonly container: Container,\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ConsumableTokenService) private readonly consumableTokens: ConsumableTokenBackendService,\n  ) {}\n\n  public async issueAuthorizationCode(request: OidcAuthorizationCodeRequest): Promise<{ code: string }> {\n    if (request.codeChallengeMethod !== 'S256') {\n      throw this.oauthError(ErrorType.AUTHORIZATION, 'invalid_request', 'only PKCE S256 is supported');\n    }\n    // RFC 7636 §4.2: reject a malformed S256 code_challenge at mint (defense-in-depth over the controller's\n    // entry check) — a valid challenge is 43 unreserved-base64url chars, so a client cannot bind a\n    // low-entropy / garbage challenge that would weaken the exchange-time proof.\n    if (!isValidS256CodeChallenge(request.codeChallenge)) {\n      throw this.oauthError(ErrorType.AUTHORIZATION, 'invalid_request', 'a valid PKCE S256 code_challenge is required');\n    }\n    const client = await this.resolveAuthorizationClient(request.clientId);\n    this.assertAuthorizationCodeClient(client, request.redirectUri);\n    this.assertScopeAllowed(client, request.scope);\n\n    const created = await this.consumableTokens.createToken({\n      tokenType: CoreConsumableTokenTypes.OIDC_AUTHORIZATION_CODE,\n      consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n      expiresIn: { value: 5, unit: DurationUnit.MINUTES },\n      userId: request.userId,\n      metadata: {\n        clientId: request.clientId,\n        scope: request.scope,\n        redirectUri: request.redirectUri,\n        codeChallenge: request.codeChallenge,\n        ...(request.nonce ? { nonce: request.nonce } : {}),\n        ...(request.resource ? { resource: request.resource } : {}),\n        ...(request.sessionId ? { sessionId: request.sessionId } : {}),\n      },\n    });\n\n    this.logger.debug('Issued OIDC authorization code', { clientId: request.clientId, userId: request.userId, scopeCount: request.scope.length });\n    return { code: created.token };\n  }\n\n  public async exchangeAuthorizationCode(params: { code: string; clientId: string; redirectUri: string; codeVerifier: string; presentedClientSecret?: string }): Promise<OidcAuthorizationCodeGrant> {\n    // A-6: every rejection below is a potential attack signal (code replay, PKCE downgrade, redirect\n    // tampering, cross-client redemption). Each emits `OAUTH_CODE_EXCHANGE_FAILED` with a closed-vocabulary\n    // `reason` BEFORE its (client-indistinguishable) `invalid_grant`. Post-decode branches also carry the\n    // code's `userId`/`resource`; the atomic replay/consume failure carries only the request-supplied clientId\n    // (the code never decoded). assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — failed delegated\n    // exchange + monitoring. Fire-and-forget (helper `_auditCodeExchangeFailure`) — never affects the throw.\n    let consumed: { tokenType?: string; userId?: string; metadata?: Record<string, unknown> };\n    try {\n      consumed = await this.consumableTokens.consumeToken(params.code) as typeof consumed;\n    } catch {\n      // Not found / expired / already used — all indistinguishable to the client (RFC 6749 §5.2).\n      this._auditCodeExchangeFailure(OAuthCodeExchangeFailureReason.CODE_REPLAY_OR_INVALID, { clientId: params.clientId });\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'authorization code invalid, expired, or already used');\n    }\n\n    if (consumed.tokenType !== CoreConsumableTokenTypes.OIDC_AUTHORIZATION_CODE) {\n      this._auditCodeExchangeFailure(OAuthCodeExchangeFailureReason.NOT_AUTHORIZATION_CODE, { clientId: params.clientId });\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'token is not an authorization code');\n    }\n    const userId = consumed.userId;\n    if (!userId) {\n      this._auditCodeExchangeFailure(OAuthCodeExchangeFailureReason.NO_SUBJECT, { clientId: params.clientId });\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'authorization code has no subject');\n    }\n    const meta = (consumed.metadata ?? {}) as { clientId?: string; scope?: string[]; redirectUri?: string; codeChallenge?: string; nonce?: string; resource?: string; sessionId?: string };\n\n    // RFC 6749 §4.1.3: the client + redirect_uri MUST match the original authorization request.\n    if (meta.clientId !== params.clientId) {\n      this._auditCodeExchangeFailure(OAuthCodeExchangeFailureReason.CLIENT_MISMATCH, { clientId: params.clientId, userId, resource: meta.resource });\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'authorization code was issued to a different client');\n    }\n    if (meta.redirectUri !== params.redirectUri) {\n      this._auditCodeExchangeFailure(OAuthCodeExchangeFailureReason.REDIRECT_URI_MISMATCH, { clientId: params.clientId, userId, resource: meta.resource });\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'redirect_uri does not match the authorization request');\n    }\n\n    // RFC 7636 §4.1: the code_verifier MUST be 43–128 chars of the unreserved set. Enforce the shape here\n    // — AFTER the atomic consume, so a malformed verifier still BURNS the single-use code (no retry oracle,\n    // same as a wrong verifier) — and reject it even if it would otherwise match a non-compliant challenge.\n    if (!isValidPkceCodeVerifier(params.codeVerifier)) {\n      this._auditCodeExchangeFailure(OAuthCodeExchangeFailureReason.PKCE_VERIFICATION_FAILED, { clientId: params.clientId, userId, resource: meta.resource });\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'PKCE verification failed');\n    }\n    // RFC 7636: base64url(sha256(code_verifier)) MUST equal the bound code_challenge.\n    const computedChallenge = createHash('sha256').update(params.codeVerifier).digest('base64url');\n    // security-decision (accepted-low — H-57, see .claude/plans/oidc-provider-test-coverage.md § \"ACCEPTED RISK\"):\n    // the `!==` below is not constant-time, but both operands are fixed-length base64url SHA-256 digests of a\n    // 43-char PKCE verifier — a timing side-channel leaks nothing brute-forceable, so `crypto.timingSafeEqual`\n    // is not warranted. Revisit only if a compare ever moves onto a low-entropy / attacker-chosen-length input.\n    if (!meta.codeChallenge || computedChallenge !== meta.codeChallenge) {\n      this._auditCodeExchangeFailure(OAuthCodeExchangeFailureReason.PKCE_VERIFICATION_FAILED, { clientId: params.clientId, userId, resource: meta.resource });\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'PKCE verification failed');\n    }\n\n    // Defense-in-depth (RFC 6749 §4.1.3): re-verify the client is STILL active and STILL authorized\n    // for the authorization_code grant at REDEMPTION time — the code outlives its 5-minute TTL past\n    // the issue-time checks in `issueAuthorizationCode`, so a client deactivated (or whose grant was\n    // revoked) within that window must not be able to complete the exchange. Read by the already-\n    // matched `params.clientId` (== `meta.clientId`, verified above).\n    //\n    // Resolved through the SAME union as issuance, so a CIMD client is re-checked too: its document\n    // must still resolve, still be trusted by the deployment's current policy, and still claim the\n    // authorization_code grant. A CIMD document that was taken down, or a policy narrowed to an\n    // allow-list that no longer admits it, must not be redeemable on a code minted before the change —\n    // that is precisely the revocation path the cache's upper TTL bound exists to bound.\n    let client: ResolvedAuthorizationClient | null;\n    try {\n      client = await this.resolveAuthorizationClient(params.clientId);\n    } catch {\n      // A CIMD refusal throws `invalid_client`; at REDEMPTION the client-indistinguishable answer is\n      // `invalid_grant`, same as every other post-decode failure here.\n      client = null;\n    }\n    if (!client || (client.origin === AuthorizationClientOrigin.REGISTERED\n      && (client.record.status !== OAuthClientStatus.ACTIVE || isCredentialExpired(client.record.expiresAt)))) {\n      this._auditCodeExchangeFailure(OAuthCodeExchangeFailureReason.CLIENT_INACTIVE, { clientId: params.clientId, userId, resource: meta.resource });\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'client is no longer active');\n    }\n    if (!client.allowedGrants.includes(OAuthGrantType.AUTHORIZATION_CODE)) {\n      this._auditCodeExchangeFailure(OAuthCodeExchangeFailureReason.GRANT_TYPE_LOST, { clientId: params.clientId, userId, resource: meta.resource });\n      throw this.oauthError(ErrorType.AUTHORIZATION, 'unauthorized_client', 'client is no longer authorized for the authorization_code grant');\n    }\n\n    // F-OIDC-11: a CONFIDENTIAL client (`tokenEndpointAuthMethod !== NONE`) MUST additionally present a\n    // valid `client_secret` — defense-in-depth over PKCE. A PUBLIC client (the default) is PKCE-only and\n    // presents no secret. Enforced here at the same client re-read as the active/grant checks; like the\n    // accepted F-OIDC-9 wrinkle, a wrong secret on a valid code burns that single-use code, which is\n    // acceptable (the caller already holds a live high-entropy code, and issuance is fail-closed anyway).\n    // Registered clients only. A CIMD client is public by construction — the resolver REFUSES any\n    // document declaring a shared-secret `token_endpoint_auth_method` (the draft forbids them) or an\n    // asymmetric one this provider does not implement, so there is no CIMD client for which a secret\n    // check could ever be meaningful. Narrowed on the discriminant rather than on a nullable secret\n    // field, so the impossibility is enforced by the type rather than by this comment.\n    if (client.origin === AuthorizationClientOrigin.REGISTERED) {\n      this.assertConfidentialClientSecret(client.record, params.presentedClientSecret);\n    }\n\n    return { userId, clientId: params.clientId, scope: meta.scope ?? [], nonce: meta.nonce, resource: meta.resource, sessionId: meta.sessionId };\n  }\n\n  /**\n   * Read + validate the client for an authorization request, and report whether it requires\n   * INTERACTIVE CONSENT. The authorize endpoint calls this BEFORE issuing anything: a\n   * `requiresConsent` client is routed to {@link createConsentRequest} (→ `consent_required`); a\n   * trusted/first-party client (`requiresConsent` false) proceeds straight to\n   * {@link issueAuthorizationCode}. Applies the SAME client validation as `issueAuthorizationCode`\n   * (active, authorization_code-grant-allowed, exact redirect_uri) so an invalid client fails\n   * identically on either path.\n   */\n  public async resolveAuthorizationClientConsent(clientId: string, redirectUri: string, userId: string): Promise<AuthorizationClientConsentPosture> {\n    const client = await this.resolveAuthorizationClient(clientId);\n    this.assertAuthorizationCodeClient(client, redirectUri);\n\n    // A CIMD client ALWAYS sees the consent screen, and its own document has no say in it.\n    //\n    // The registered path lets a client declare itself consent-free, because someone with standing in\n    // this application registered it and made that call. A client metadata document is authored by the\n    // party being trusted, so honouring a consent-free declaration from it would be self-certification:\n    // anyone who can host a JSON file could mint an identity that skips the user's approval. There is\n    // deliberately no `declaresConsentFree` on the CIMD arm at all — the field cannot be read here\n    // because it does not exist there, which is stronger than remembering not to read it.\n    //\n    // This is also what the specification depicts: in the Client ID Metadata Documents flow, the\n    // authorization server's step after validation is \"Display consent page with client_name\".\n    // spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Documents Flow\n    if (isClientIdMetadataDocumentClient(client)) {\n      return {\n        requiresConsent: true,\n        clientName: client.name,\n        origin: client.origin,\n        tenancy: client.tenancy.kind,\n        // \"Authorization servers … MUST clearly display the redirect URI hostname during authorization\"\n        // — so the hostname travels to the consent screen as DATA rather than being re-derived there.\n        // spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Document Security → Localhost\n        // Redirect URI Risks\n        redirectUriHostname: this.hostnameOf(redirectUri),\n        warnsLoopbackOnlyRedirects: client.claimsOnlyLoopbackRedirects,\n      };\n    }\n\n    let requiresConsent = !client.declaresConsentFree;\n\n    // D4 option B — SAME-ORG consent gate.\n    // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — a user must\n    // explicitly authorize third-party delegated access to their account. A client that declares itself\n    // consent-free (`requiresConsent:false`) may skip the prompt ONLY inside its own trust boundary: for\n    // an ORG-scoped client that is an ACTIVE member of its OWN org. A CROSS-ORG user (not a member) is a\n    // third-party delegation and MUST see the consent screen — otherwise an ORG_ADMIN could register a\n    // no-consent client and silently harvest OTHER orgs' users' delegated tokens by phishing them to the\n    // authorize endpoint. APP-scoped clients are platform-operator-created (first-party) and keep their\n    // declared posture. Fail-closed: any membership-read error forces consent (the safe default).\n    if (!requiresConsent && client.tenancy.kind === AuthorizationClientTenancy.ORGANIZATION) {\n      const orgId = client.tenancy.organizationId;\n      if (!orgId || !(await this.isActiveOrgMember(userId, orgId))) {\n        requiresConsent = true;\n      }\n    }\n\n    return {\n      requiresConsent,\n      clientName: client.name,\n      origin: client.origin,\n      tenancy: client.tenancy.kind,\n      redirectUriHostname: this.hostnameOf(redirectUri),\n      // A DYNAMICALLY registered client earns the same loopback warning as a CIMD one: it asserted\n      // its own name and redirect URIs, so \"the app you recognise\" and \"the app that registered\n      // this name\" are not the same claim. An OPERATOR-registered client was vetted by someone with\n      // standing here, and warning on those would train users to click through the warning that\n      // matters.\n      warnsLoopbackOnlyRedirects: client.tenancy.kind === AuthorizationClientTenancy.UNAFFILIATED\n        && client.redirectUris.length > 0\n        && client.redirectUris.every((uri) => this.isLoopbackRedirect(uri)),\n    };\n  }\n\n  /** Loopback test shared by the registered-but-unaffiliated path and the CIMD resolver's own. */\n  private isLoopbackRedirect(uri: string): boolean {\n    try {\n      const host = new URL(uri).hostname.toLowerCase();\n      return host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]';\n    } catch {\n      return false;\n    }\n  }\n\n  /**\n   * The hostname a redirect URI will send the user to, for consent-screen display.\n   *\n   * Returns `null` rather than throwing on an unparseable URI: by the time this runs the URI has\n   * already exact-matched the client's registered/claimed set, so an unparseable value here is a\n   * data-integrity oddity, and failing the whole authorize request over a DISPLAY field would trade a\n   * working flow for a cosmetic one.\n   */\n  private hostnameOf(redirectUri: string): string | null {\n    try {\n      return new URL(redirectUri).hostname;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * D4/B membership check (fail-closed): is `userId` an ACTIVE member of `organizationId`? Reads\n   * `ORGANIZATION_MEMBERS` by the `(userId, organizationId, status=ACTIVE)` grain with an internal system\n   * EC. Returns FALSE on any error so the caller forces consent rather than silently skipping it.\n   */\n  private async isActiveOrgMember(userId: string, organizationId: string): Promise<boolean> {\n    try {\n      const ecCreator = this.container.get<ExecutionContextCreatorBackendService>(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService);\n      const repos = this.container.get<RepositoriesRegistryHandlerBackendService>(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService);\n      const ec = await ecCreator.createForInternalRepositoryOperation({\n        resourceType: CoreResourceType.ORGANIZATION_MEMBERS,\n        operationIdentifier: CoreResourceOperation.READ,\n      });\n      const member = await repos\n        .getRepository(CoreResourceType.ORGANIZATION_MEMBERS)\n        .read<{ _id: string }>(ec, { userId, organizationId, status: OrganizationMemberStatus.ACTIVE });\n      return !!member;\n    } catch (error) {\n      this.logger.warn('Org-membership check failed; forcing consent (fail-closed)', {\n        userId, organizationId, reason: describeCaughtError(error),\n      });\n      return false;\n    }\n  }\n\n  /**\n   * Mint a single-use consent-request token for a `requiresConsent` client (used INSTEAD of the\n   * authorization code at authorize time). Re-validates the client + scope (defense-in-depth, mirrors\n   * {@link issueAuthorizationCode}). The returned token is handed to the caller in the\n   * `consent_required` response and redeemed at {@link consumeConsentRequest} on the user's decision.\n   */\n  public async createConsentRequest(request: OidcConsentRequest): Promise<{ consentToken: string }> {\n    const client = await this.resolveAuthorizationClient(request.clientId);\n    this.assertAuthorizationCodeClient(client, request.redirectUri);\n    this.assertScopeAllowed(client, request.scope);\n\n    const created = await this.consumableTokens.createToken({\n      tokenType: CoreConsumableTokenTypes.OIDC_CONSENT_REQUEST,\n      consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n      expiresIn: { value: 10, unit: DurationUnit.MINUTES },\n      userId: request.userId,\n      metadata: {\n        clientId: request.clientId,\n        scope: request.scope,\n        redirectUri: request.redirectUri,\n        codeChallenge: request.codeChallenge,\n        ...(request.nonce ? { nonce: request.nonce } : {}),\n        ...(request.resource ? { resource: request.resource } : {}),\n        ...(request.state ? { state: request.state } : {}),\n      },\n    });\n    this.logger.debug('Issued OIDC consent request', { clientId: request.clientId, userId: request.userId });\n    return { consentToken: created.token };\n  }\n\n  /**\n   * Atomically consume a consent-request token (single-use) → the stashed authorization request. The\n   * decision endpoint then binds this to the AUTHENTICATED user (the token subject MUST match) and, on\n   * APPROVE, feeds it to {@link issueAuthorizationCode}. Not-found / expired / already-used are all\n   * indistinguishable `invalid_grant` (RFC 6749 §5.2), same as the code exchange.\n   */\n  public async consumeConsentRequest(consentToken: string): Promise<OidcConsentRequest> {\n    let consumed: { tokenType?: string; userId?: string; metadata?: Record<string, unknown> };\n    try {\n      consumed = await this.consumableTokens.consumeToken(consentToken) as typeof consumed;\n    } catch {\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'consent request invalid, expired, or already used');\n    }\n    if (consumed.tokenType !== CoreConsumableTokenTypes.OIDC_CONSENT_REQUEST) {\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'token is not a consent request');\n    }\n    const userId = consumed.userId;\n    if (!userId) {\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'consent request has no subject');\n    }\n    const meta = (consumed.metadata ?? {}) as { clientId?: string; scope?: string[]; redirectUri?: string; codeChallenge?: string; nonce?: string; resource?: string; state?: string };\n    if (!meta.clientId || !meta.redirectUri || !meta.codeChallenge) {\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'consent request is malformed');\n    }\n    return {\n      userId,\n      clientId: meta.clientId,\n      redirectUri: meta.redirectUri,\n      scope: meta.scope ?? [],\n      codeChallenge: meta.codeChallenge,\n      nonce: meta.nonce,\n      resource: meta.resource,\n      state: meta.state,\n    };\n  }\n\n  /**\n   * Mint a single-use logout-confirmation token (revocation-C §6 — the logout-confirmation prompt).\n   * Called at `GET /oauth/end-session` for a NON-trusted logout (a valid `id_token_hint` whose\n   * `post_logout_redirect_uri` is absent / unregistered / mismatched), INSTEAD of terminating the\n   * session inline — the Keycloak-style posture skips the prompt only for a trusted RP (valid hint +\n   * exact-match registered redirect). The already-validated `{ userId, sessionId }` is stashed\n   * server-side so the confirmation cannot tamper with WHICH session ends. The returned token is\n   * carried to the frontend `/oauth/logout-confirm` prompt and redeemed at\n   * {@link consumeLogoutConfirmation} when the End-User confirms. Minted ONLY when a real session was\n   * identified (a valid hint) — a request with nothing to terminate lands on the signed-out page with\n   * no prompt, so the token always names a session.\n   */\n  public async createLogoutConfirmation(request: {\n    userId: string;\n    sessionId: string;\n    clientId?: string;\n    postLogoutRedirectUriRejected: boolean;\n  }): Promise<{ confirmationToken: string }> {\n    const created = await this.consumableTokens.createToken({\n      tokenType: CoreConsumableTokenTypes.OIDC_LOGOUT_CONFIRMATION,\n      consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n      expiresIn: { value: 10, unit: DurationUnit.MINUTES },\n      userId: request.userId,\n      // The RP the hint named (`clientId`) and whether a presented `post_logout_redirect_uri` was rejected\n      // are stashed alongside the session, so the confirm-endpoint audit keeps FULL attribution — the token\n      // is the only thing `POST /oauth/end-session/confirm` sees (it re-verifies no hint).\n      metadata: {\n        sessionId: request.sessionId,\n        postLogoutRedirectUriRejected: request.postLogoutRedirectUriRejected,\n        ...(request.clientId ? { clientId: request.clientId } : {}),\n      },\n    });\n    this.logger.debug('Issued OIDC logout confirmation', { userId: request.userId });\n    return { confirmationToken: created.token };\n  }\n\n  /**\n   * Atomically consume a logout-confirmation token → the stashed `{ userId, sessionId }`. Unlike\n   * {@link consumeConsentRequest}, a not-found / expired / already-used token is NOT an error: the\n   * End-User confirmed a logout, so a stale token yields `null` and the caller simply lands them on the\n   * signed-out page WITHOUT terminating (the session is most likely already gone, and revealing whether\n   * the token was live would be a session-state oracle). A wrong token type is treated identically.\n   */\n  public async consumeLogoutConfirmation(confirmationToken: string): Promise<{\n    userId?: string;\n    sessionId?: string;\n    clientId?: string;\n    postLogoutRedirectUriRejected?: boolean;\n  } | null> {\n    let consumed: { tokenType?: string; userId?: string; metadata?: Record<string, unknown> };\n    try {\n      consumed = await this.consumableTokens.consumeToken(confirmationToken) as typeof consumed;\n    } catch {\n      return null;\n    }\n    if (consumed.tokenType !== CoreConsumableTokenTypes.OIDC_LOGOUT_CONFIRMATION) {\n      return null;\n    }\n    const meta = (consumed.metadata ?? {}) as { sessionId?: string; clientId?: string; postLogoutRedirectUriRejected?: boolean };\n    return {\n      userId: consumed.userId,\n      sessionId: meta.sessionId,\n      clientId: meta.clientId,\n      postLogoutRedirectUriRejected: meta.postLogoutRedirectUriRejected,\n    };\n  }\n\n  // ── client resolution ─────────────────────────────────────────────────────\n  /**\n   * Resolve a `client_id` to the identity behind it, from EITHER source this provider accepts.\n   *\n   * Triage is on the SHAPE of the identifier, which is what makes the two mechanisms coexist without\n   * a mode flag: a CIMD `client_id` is an `https://` URL, and a registered one is a Mongo `_id`.\n   * Neither can be mistaken for the other, and the CIMD branch is entered ONLY for a URL — so a\n   * deployment with the policy `DISABLED` never fetches anything, and a registered lookup never\n   * touches the network.\n   *\n   * Returns `null` for \"no such client\"; THROWS for a URL-shaped client_id that resolved and was\n   * refused, because those two are not the same fact: the first is a typo, the second is a policy or\n   * security decision whose reason the operator needs.\n   */\n  /**\n   * revocation-C: is `uri` a registered POST-LOGOUT redirect for `clientId`? The `/oauth/end-session`\n   * handler calls this to validate a presented `post_logout_redirect_uri` before it redirects the browser\n   * back to the relying party. EXACT string match against the resolved client's `postLogoutRedirectUris`\n   * allowlist — the SAME anti-open-redirect discipline as the authorization-code `redirect_uri` gate\n   * (`exchangeAuthorizationCode`), never a prefix or origin match. A client that cannot be resolved, or\n   * that registered no post-logout URIs, admits none — fail closed. (A CIMD client CAN register\n   * them since #464; before that, none could.)\n   * spec-cite: OpenID Connect RP-Initiated Logout 1.0 §3 (the OP \"MUST NOT perform post-logout redirection\n   * if the `post_logout_redirect_uri` value supplied does not exactly match one of the previously\n   * registered `post_logout_redirect_uris` values\"; registration of those values is §2).\n   */\n  public async isRegisteredPostLogoutRedirectUri(clientId: string, uri: string): Promise<boolean> {\n    let client: ResolvedAuthorizationClient | null;\n    try {\n      client = await this.resolveAuthorizationClient(clientId);\n    } catch {\n      client = null;\n    }\n    return client?.postLogoutRedirectUris.includes(uri) ?? false;\n  }\n\n  private async resolveAuthorizationClient(clientId: string): Promise<ResolvedAuthorizationClient | null> {\n    const cimd = this.container.get<CimdClientMetadataBackendService>(SAAS_SERVICE_TYPES.CimdClientMetadata);\n    if (cimd.isCimdClientId(clientId)) {\n      return this.resolveClientIdMetadataDocumentClient(cimd, clientId);\n    }\n    const record = await this.readRegisteredClientById(clientId);\n    return record ? this.adaptRegisteredClient(record) : null;\n  }\n\n  /** Read a registered client by `_id` across both scope collections (org then app). */\n  private async readRegisteredClientById(clientId: string): Promise<OAuthClientBase | null> {\n    const ecCreator = this.container.get<ExecutionContextCreatorBackendService>(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService);\n    const repos = this.container.get<RepositoriesRegistryHandlerBackendService>(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService);\n    for (const resourceType of [CoreResourceType.OAUTH_CLIENTS_ORGANIZATION, CoreResourceType.OAUTH_CLIENTS_APPLICATION]) {\n      const ec = await ecCreator.createForInternalRepositoryOperation({ resourceType, operationIdentifier: CoreResourceOperation.READ });\n      const client = await repos.getRepository(resourceType).read<OAuthClientBase>(ec, { _id: clientId });\n      if (client) return client;\n    }\n    return null;\n  }\n\n  /**\n   * Project a registered client row onto the union arm that describes it.\n   *\n   * `scope` (an `ApiKeyScope`) becomes `tenancy`, and that translation is the reason this type exists\n   * at all — downstream, `tenancy` is the field the consent gate reads, and it can now express a\n   * client that belongs to NO tenant, which `ApiKeyScope` cannot.\n   */\n  private adaptRegisteredClient(record: OAuthClientBase): RegisteredAuthorizationClient {\n    // A DYNAMICALLY registered client is stored on the APPLICATION collection because it has no\n    // organization — and `scope: APPLICATION` otherwise means platform-operator first-party. Reading\n    // tenancy from `scope` alone would therefore hand a stranger the most trusted posture in the\n    // system purely because of where its row had to be filed. Provenance wins over storage.\n    const isDynamic = record.registrationOrigin === OAuthClientRegistrationOrigin.DYNAMIC;\n    return {\n      origin: AuthorizationClientOrigin.REGISTERED,\n      clientId: record._id,\n      name: record.name,\n      redirectUris: record.redirectUris ?? [],\n      // revocation-C: the RP-Initiated Logout post-logout allowlist. Same `?? []` fail-closed default as\n      // `redirectUris` — a registered client with none configured admits no `post_logout_redirect_uri`.\n      postLogoutRedirectUris: record.postLogoutRedirectUris ?? [],\n      // Identity scopes only for a self-registered client, whatever the row says. The row's\n      // `allowedScopes` was authored by the registration request — i.e. by the client itself — so\n      // honouring it would be the client granting itself permission. `/register` already refuses a\n      // wider request, and this is the second half of that invariant: even a row that acquired\n      // wider scopes by any other means cannot spend them.\n      allowedScopes: isDynamic ? OIDC_SUPPORTED_IDENTITY_SCOPES : (record.allowedScopes ?? []),\n      allowedGrants: record.allowedGrants ?? [],\n      tenancy: isDynamic\n        ? { kind: AuthorizationClientTenancy.UNAFFILIATED }\n        : record.scope === ApiKeyScope.ORGANIZATION\n          ? { kind: AuthorizationClientTenancy.ORGANIZATION, organizationId: (record as OAuthClientOrganization).organizationId }\n          : { kind: AuthorizationClientTenancy.APPLICATION },\n      // A self-registered client can never declare itself consent-free. Same reasoning as CIMD:\n      // self-certification by the party being trusted. The row's `requiresConsent` is ignored rather\n      // than trusted-and-checked, so a future write path that forgot to force it cannot leak.\n      declaresConsentFree: isDynamic ? false : record.requiresConsent !== true,\n      record,\n    };\n  }\n\n  /**\n   * Resolve a URL-shaped `client_id` through CIMD and project the document onto its union arm.\n   *\n   * ## The two ceilings this applies, and why they are not negotiable\n   *\n   * **Scopes are IDENTITY-ONLY.** A CIMD client asks for `openid`/`profile`/`email` and nothing else.\n   * A registered client's `allowedScopes` is a decision an operator or organization administrator\n   * made about a client THEY registered; a CIMD document is authored by the client itself, so reading\n   * a scope ceiling out of it would be the client granting itself permission. Identity scopes are the\n   * one set where that is harmless, because they authorize nothing: authorization in this framework\n   * is roles-only, and scope-as-authorization was removed in 2026-07-21.\n   *\n   * **Grants default to `authorization_code`.** The draft says the metadata values \"are the values\n   * defined in the OAuth Dynamic Client Registration Metadata OAuth Parameters registry\"\n   * (spec-cite: draft-ietf-oauth-client-id-metadata-document-00 § 4.1), so RFC 7591 § 2 supplies the\n   * default: \"If omitted, the default behavior is that the client will use only the\n   * `authorization_code` Grant Type.\" (spec-cite: RFC 7591 § 2). An UNKNOWN grant string is dropped\n   * rather than refused — this provider simply does not offer it, and refusing would break a client\n   * whose document legitimately advertises a grant to some OTHER authorization server.\n   */\n  private async resolveClientIdMetadataDocumentClient(\n    cimd: CimdClientMetadataBackendService,\n    clientId: string,\n  ): Promise<ClientIdMetadataDocumentAuthorizationClient> {\n    const resolution = await cimd.resolve(clientId, cimd.deploymentConfiguration());\n    if (resolution.kind !== 'ok') {\n      // assurance-control: WILDO.IDENTITY.CLIENT_IDENTITY_ASSERTION — a refused client-identity\n      // assertion. The reason vocabulary spans a misconfiguration (`host_not_allowed`) and an active\n      // attack (`ssrf_target_refused`); both arrive at the same endpoint from the same kind of\n      // unauthenticated caller, so only the reason tells them apart and an operator needs it\n      // queryable rather than buried in a log line. Fire-and-forget: auditing must never change the\n      // refusal it observes.\n      this.logger.warn('CIMD client resolution refused', { clientId, reason: resolution.reason, detail: resolution.detail });\n      const auditLogs = this.container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService);\n      void auditLogs.logCimdClientRefused({\n        clientId,\n        reason: resolution.reason,\n        detail: resolution.detail,\n      }).catch((auditError) => this.logger.warn('OAUTH_CIMD_CLIENT_REFUSED audit emit failed (non-fatal)', {\n        ...projectCaughtErrorLogFields(auditError),\n      }));\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_client', resolution.detail);\n    }\n    const metadata = resolution.metadata;\n    const declaredGrants = metadata.grant_types;\n    const allowedGrants = declaredGrants === undefined\n      ? [OAuthGrantType.AUTHORIZATION_CODE]\n      : declaredGrants.filter((grant): grant is OAuthGrantType => (Object.values(OAuthGrantType) as string[]).includes(grant));\n    return {\n      origin: AuthorizationClientOrigin.CLIENT_ID_METADATA_DOCUMENT,\n      clientId,\n      name: metadata.client_name,\n      redirectUris: metadata.redirect_uris,\n      // revocation-C: RP-Initiated Logout post-logout redirects, honoured for a CIMD client since\n      // 2026-09-08 (#464). The document's `post_logout_redirect_uris` is carried through and matched\n      // EXACTLY by `isRegisteredPostLogoutRedirectUri` — the same anti-open-redirect discipline as\n      // the authorization-code `redirect_uri` gate, and the same trust model, since both members\n      // come from the same client-authored document fetched through the same SSRF guard.\n      //\n      // A document that registers none still admits none: fail-closed empty, which is what every\n      // CIMD client got while the member was undeclared. What changed is that a client which DOES\n      // register one stops having its redirect silently ignored.\n      postLogoutRedirectUris: metadata.post_logout_redirect_uris ?? [],\n      allowedScopes: OIDC_SUPPORTED_IDENTITY_SCOPES,\n      allowedGrants,\n      tenancy: { kind: AuthorizationClientTenancy.UNAFFILIATED },\n      claimsOnlyLoopbackRedirects: cimd.claimsOnlyLoopbackRedirects(metadata),\n      metadata,\n    };\n  }\n\n  // ── helpers ───────────────────────────────────────────────────────────────\n  private assertAuthorizationCodeClient(client: ResolvedAuthorizationClient | null, redirectUri: string): asserts client {\n    if (!client) {\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_client', 'client not found or inactive');\n    }\n    // Status and expiry are properties of a ROW this application minted; a client metadata document\n    // has neither, and its liveness is the document's continued resolvability — already proven by the\n    // fact that we are holding it. Narrowed on the discriminant so the compiler, not a convention,\n    // is what keeps a row-only check off the CIMD arm.\n    if (client.origin === AuthorizationClientOrigin.REGISTERED) {\n      const record = client.record;\n      if (record.status !== OAuthClientStatus.ACTIVE || isCredentialExpired(record.expiresAt)) {\n        throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_client', 'client not found or inactive');\n      }\n    }\n    if (!client.allowedGrants.includes(OAuthGrantType.AUTHORIZATION_CODE)) {\n      throw this.oauthError(ErrorType.AUTHORIZATION, 'unauthorized_client', 'client is not authorized for the authorization_code grant');\n    }\n    // Anti-open-redirect (RFC 6749 §3.1.2): exact-match allowlist, no wildcards/substrings. For a CIMD\n    // client the allow-list is the document's own `redirect_uris`, which is exactly what the\n    // specification requires: authorization servers \"MUST validate redirect URIs presented in an\n    // authorization request against those in the metadata document\".\n    // spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Documents → Implementation Requirements\n    if (!client.redirectUris.includes(redirectUri)) {\n      throw this.oauthError(ErrorType.AUTHORIZATION, 'invalid_request', 'redirect_uri is not registered for this client');\n    }\n  }\n\n  private assertScopeAllowed(client: ResolvedAuthorizationClient, scope: string[]): void {\n    const allowed = client.allowedScopes;\n    const unauthorized = scope.filter((s) => !allowed.includes(s));\n    if (unauthorized.length > 0) {\n      throw this.oauthError(ErrorType.AUTHORIZATION, 'invalid_scope', `scope(s) not allowed: ${unauthorized.join(', ')}`);\n    }\n  }\n\n  // ── Compliance audit helpers (fire-and-forget; auditing must never affect the OAuth flow) ──\n\n  /**\n   * A-6 — emit `OAUTH_CODE_EXCHANGE_FAILED` for a rejected authorization_code exchange. `userId`/`resource`\n   * are present only for post-decode causes (never for the atomic replay/consume failure). Audit is pulled\n   * lazily via the container (mirrors this file's other lazy-service pattern) and never throws onto the flow.\n   */\n  private _auditCodeExchangeFailure(reason: OAuthCodeExchangeFailureReason, ctx: { clientId?: string; userId?: string; resource?: string }): void {\n    const auditLogs = this.container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService);\n    void auditLogs.logOAuthCodeExchangeFailed({\n      reason,\n      clientId: ctx.clientId,\n      userId: ctx.userId,\n      resource: ctx.resource,\n    }).catch((auditError) => this.logger.warn('OAUTH_CODE_EXCHANGE_FAILED audit emit failed (non-fatal)', {\n      ...projectCaughtErrorLogFields(auditError),\n    }));\n  }\n\n  /**\n   * A-7 — emit the `MACHINE_AUTH_FAILED` audit for a confidential-client authentication failure on the\n   * code / refresh / revoke secret front (the code-flow twin of the existing client_credentials front).\n   * Never the raw secret — only the human-routable prefix (`oc_org_` / `oc_app_`), derived the same way as\n   * the client_credentials emitter. No request/IP is in scope at these service methods.\n   */\n  private _auditConfidentialClientSecretFailure(presentedSecret: string | undefined): void {\n    const credentialPrefix = presentedSecret?.startsWith('oc_org_')\n      ? 'oc_org_'\n      : presentedSecret?.startsWith('oc_app_') ? 'oc_app_' : undefined;\n    const auditLogs = this.container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService);\n    void auditLogs.logMachineAuthFailed({\n      credentialKind: 'oauth_client',\n      credentialPrefix,\n      reason: 'invalid_client',\n    }).catch((auditError) => this.logger.warn('MACHINE_AUTH_FAILED audit emit failed (non-fatal)', {\n      ...projectCaughtErrorLogFields(auditError),\n    }));\n  }\n\n  /**\n   * A-3 — emit `OAUTH_CONSENT_GRANT_PERSISTED` for a created (`isNewGrant`) or widened persistent consent\n   * grant. `scopes` is the set the grant covers AFTER the write (the union on a widen). Fire-and-forget.\n   */\n  private _auditConsentGrantPersisted(userId: string, clientId: string, resource: string | undefined, scopes: string[], isNewGrant: boolean): void {\n    const auditLogs = this.container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService);\n    void auditLogs.logOAuthConsentGrantPersisted({\n      userId,\n      clientId,\n      resource,\n      scopes,\n      isNewGrant,\n    }).catch((auditError) => this.logger.warn('OAUTH_CONSENT_GRANT_PERSISTED audit emit failed (non-fatal)', {\n      ...projectCaughtErrorLogFields(auditError),\n    }));\n  }\n\n  /**\n   * F-OIDC-11 confidential-client authentication. For a client whose `tokenEndpointAuthMethod` is not\n   * `NONE`, the presented `client_secret` MUST resolve to the client's current `hashedSecret` (or its\n   * `previousHashedSecret` while the rotation-grace window is open — mirroring the client_credentials\n   * secret front, so a confidential client can rotate without a hard cutover). A PUBLIC (`NONE`) client\n   * requires no secret and is a no-op. `tokenEndpointAuthMethod` is `?? NONE`-defaulted so a client row\n   * persisted before this field existed reads as public (back-compat). Fail-closed: a confidential\n   * client with a missing or wrong secret is rejected `invalid_client`.\n   */\n  private assertConfidentialClientSecret(client: OAuthClientBase, presentedClientSecret: string | undefined): void {\n    if (!isConfidentialTokenEndpointAuthMethod(client.tokenEndpointAuthMethod ?? OAuthTokenEndpointAuthMethod.NONE)) {\n      return;\n    }\n    if (!presentedClientSecret) {\n      // A-7: a confidential client that presented NO secret failed authentication — audit it (the\n      // code-flow twin of the client_credentials MACHINE_AUTH_FAILED front).\n      this._auditConfidentialClientSecretFailure(presentedClientSecret);\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_client', 'this confidential client must authenticate with its client_secret');\n    }\n    const presentedHash = hashOAuthClientSecret(presentedClientSecret);\n    // security-decision (accepted-low — H-57, see the coverage plan § \"ACCEPTED RISK\"): the `===` secret\n    // compares below are not constant-time, but both operands are fixed-length SHA-256 digests of a 256-bit\n    // secret — a timing side-channel leaks nothing brute-forceable; `crypto.timingSafeEqual` is not warranted.\n    const matchesCurrent = !!client.hashedSecret && presentedHash === client.hashedSecret;\n    const matchesRotationGrace = !!client.previousHashedSecret\n      && presentedHash === client.previousHashedSecret\n      && isRotationGraceWindowOpen(client.previousSecretInvalidationDate);\n    if (!matchesCurrent && !matchesRotationGrace) {\n      // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — a confidential-client secret failure is an\n      // authentication failure, audited as the code-flow twin of the client_credentials MACHINE_AUTH_FAILED\n      // front (never the raw secret; carries the credential prefix).\n      // security-decision (accepted-low — D11, see the coverage plan § \"ACCEPTED RISK\"): the code/refresh/revoke\n      // secret fronts are DELIBERATELY not per-endpoint rate-limited — 256-bit secrets make online guessing\n      // infeasible and the global ~1000/min/IP limiter caps DoS. This front is now audited (above), so a lockout\n      // counter is cheap to add IF the decision is ever revisited.\n      this._auditConfidentialClientSecretFailure(presentedClientSecret);\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_client', 'client authentication failed');\n    }\n  }\n\n  /**\n   * F-OIDC-6 (RFC 7009 §2.1): authenticate a client that presents credentials at the token-revocation\n   * endpoint. The presented `client_secret` MUST match the client's current `hashedSecret` (or its\n   * rotation-grace `previousHashedSecret`) and the client must be ACTIVE — else `invalid_client`. Called\n   * ONLY when the revoke request actually carries credentials; an unauthenticated bearer revoke stays\n   * allowed (RFC 7009 permits it for a public client, and the refresh token itself is the bearer\n   * credential). NOTE: Wildo's revoke operates on first-party user refresh tokens that no OAuth client\n   * owns, so there is no client↔token binding to additionally enforce — this adds the client-authentication\n   * capability §2.1 expects, and closes the \"no client authentication\" finding.\n   *\n   * spec-cite: RFC 7009 §2.1 — \"The authorization server first validates the client credentials (in case\n   * of a confidential client) and then verifies whether the token was issued to the client making the\n   * revocation request.\" The parenthetical is what permits an unauthenticated (public-client) revoke; the\n   * second clause is the binding check, which is N/A here for the reason stated above.\n   * The quoted \"no client authentication\" is NOT specification text — it is the name of the internal audit\n   * finding this method closes. https://www.rfc-editor.org/rfc/rfc7009#section-2.1\n   */\n  public async verifyPresentedClientSecret(clientId: string, clientSecret: string): Promise<void> {\n    // REGISTERED clients only, and deliberately so: a CIMD client has no secret this server ever\n    // minted, so a URL-shaped client_id here resolves to nothing and fails `invalid_client` — which\n    // is the correct answer, not a gap. Routing it through the CIMD resolver instead would make an\n    // outbound fetch on an unauthenticated revoke request for no benefit.\n    const client = await this.readRegisteredClientById(clientId);\n    if (!client || client.status !== OAuthClientStatus.ACTIVE || isCredentialExpired(client.expiresAt)) {\n      // A-7: confidential-client authentication failure on the refresh/revoke secret front (the client did\n      // not resolve or is inactive) — audited as the code-flow twin of MACHINE_AUTH_FAILED.\n      this._auditConfidentialClientSecretFailure(clientSecret);\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_client', 'client not found or inactive');\n    }\n    const presentedHash = hashOAuthClientSecret(clientSecret);\n    // security-decision (accepted-low, see the coverage plan § \"ACCEPTED RISK\"): this refresh/revoke secret\n    // front is DELIBERATELY not per-endpoint rate-limited (D11) and its `===` compares are not constant-time\n    // (H-57) — 256-bit secrets + the global IP limiter make brute-force infeasible, and a fixed-length SHA-256\n    // compare leaks no exploitable timing. Revisit conditions are in the plan.\n    const matchesCurrent = !!client.hashedSecret && presentedHash === client.hashedSecret;\n    const matchesRotationGrace = !!client.previousHashedSecret\n      && presentedHash === client.previousHashedSecret\n      && isRotationGraceWindowOpen(client.previousSecretInvalidationDate);\n    if (!matchesCurrent && !matchesRotationGrace) {\n      // A-7: a wrong secret on the refresh/revoke front — audited as the code-flow twin of MACHINE_AUTH_FAILED.\n      // assurance-control: WILDO.AUDIT.SECURITY_EVENT — confidential-client authentication failure.\n      this._auditConfidentialClientSecretFailure(clientSecret);\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_client', 'client authentication failed');\n    }\n  }\n\n  // ── Persistent consent grants (\"remember this app\") ────────────────────────\n  /**\n   * PERSISTENT-CONSENT lookup (Item 3). Returns true iff a stored, non-expired grant for\n   * `(userId, clientId, resource)` already covers EVERY requested scope — in which case\n   * `/oauth/authorize` skips the consent prompt for a `requiresConsent` client. Fail-closed: no grant,\n   * insufficient scopes (a requested scope not in the grant), expiry, or any read error ⇒ false, so the\n   * user is re-prompted. Scope matching is SUBSET, never expansion.\n   */\n  public async hasCoveringConsentGrant(userId: string, clientId: string, resource: string | undefined, requestedScopes: string[]): Promise<boolean> {\n    try {\n      const grant = await this.readConsentGrant(userId, clientId, resource);\n      if (!grant) return false;\n      if (grant.expiresAt && new Date(grant.expiresAt).getTime() <= Date.now()) return false;\n      const granted = new Set(grant.scopes ?? []);\n      return requestedScopes.every((s) => granted.has(s));\n    } catch {\n      return false;\n    }\n  }\n\n  /**\n   * Store or widen the user's persistent consent grant when they approve WITH \"remember this app\".\n   * Upserts on the `(userId, clientId, resource)` business key: widen an existing grant's scopes to the\n   * UNION of prior + newly-approved, else create a fresh grant. System write (createAsSystem /\n   * updateAsSystem — the CREATE DTO strips the context FK `userId`, re-attached from the schema allowlist).\n   */\n  public async upsertConsentGrant(userId: string, clientId: string, resource: string | undefined, scopes: string[]): Promise<void> {\n    const systemAccess = this.container.get<SystemAccessBackendService>(SAAS_SERVICE_TYPES.SystemAccessService);\n    const existing = await this.readConsentGrant(userId, clientId, resource);\n    if (existing) {\n      await this.widenConsentGrantScopes(systemAccess, existing, scopes);\n      return;\n    }\n    // #465: every affirmative consent carries an expiry. The field had a reader and no writer, so a\n    // remembered approval lived until the person revoked it while reading to an operator as a policy\n    // knob that existed.\n    const data: Record<string, unknown> = { userId, clientId, scopes, expiresAt: this.consentGrantExpiry() };\n    if (resource) data.resource = resource;\n    try {\n      await systemAccess.createAsSystem(CoreResourceType.OAUTH_CONSENT_GRANTS, data);\n      // A-3: a NEW persistent consent grant was created (\"remember this app\") — a durable delegated-authority\n      // artifact that lets future authorize flows SKIP the prompt, so its creation is a first-class audit\n      // concern. assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — persistent delegated-access authorization.\n      this._auditConsentGrantPersisted(userId, clientId, resource, scopes, true);\n    } catch (error) {\n      // CONCURRENCY — race-safe upsert on the `(userId, clientId, resource)` business key.\n      // Two approvals for the SAME app+resource can interleave: both `readConsentGrant` above return null,\n      // both reach here, and the compound UNIQUE index (which the runtime really emits — proven by the\n      // consent-grant persistence integration test) rejects the SECOND insert with `ErrorType.CONFLICT`.\n      // That is NOT a failure of the \"remember this app\" intent — re-read the grant the winning racer created\n      // and widen it to the union, so both converge on ONE grant carrying the union of their approved scopes.\n      // Without this, the losing approval surfaced an unhandled 5xx (the bug this closes).\n      // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — the user's consent is recorded exactly once, never lost to a race.\n      if (!isWildoBackendError(error) || error.type !== ErrorType.CONFLICT) throw error;\n      const winner = await this.readConsentGrant(userId, clientId, resource);\n      if (!winner) throw error; // a CONFLICT on some OTHER key (not ours) — surface it rather than mask it\n      await this.widenConsentGrantScopes(systemAccess, winner, scopes);\n    }\n  }\n\n  /**\n   * When a consent granted NOW should lapse (#465).\n   *\n   * The operator's `auth.consentGrantLifetimeDays` when authored, else the framework default — whose\n   * reasoning is at `OAUTH_CONSENT_GRANT_DEFAULT_LIFETIME_DAYS`. There is no \"never\": that was the\n   * state this replaced.\n   *\n   * Reads config through the container and TOLERATES its absence, deliberately. A consent the user\n   * has just given must not fail to persist because a policy lookup threw — losing the grant is a\n   * worse outcome than applying the default, and the default is the safer of the two anyway.\n   */\n  private consentGrantExpiry(): Date {\n    let lifetimeDays = OAUTH_CONSENT_GRANT_DEFAULT_LIFETIME_DAYS;\n    try {\n      const configured = this.container.get<AppConfigurationService>(SAAS_SERVICE_TYPES.AppConfigService)\n        ?.config?.auth?.consentGrantLifetimeDays;\n      if (typeof configured === 'number') lifetimeDays = configured;\n    } catch {\n      // Unbound in a harness that never looks at consent policy — the default stands.\n    }\n    return new Date(Date.now() + lifetimeDays * 24 * 60 * 60 * 1000);\n  }\n\n  /**\n   * Widen an existing consent grant's scopes to the UNION of its current scopes + the newly-approved set,\n   * via a system update. Shared by the initial-existing path and the concurrency-recovery path so the\n   * union semantics never drift between them.\n   */\n  private async widenConsentGrantScopes(systemAccess: SystemAccessBackendService, existing: OAuthConsentGrant, scopes: string[]): Promise<void> {\n    const merged = Array.from(new Set([...(existing.scopes ?? []), ...scopes]));\n    // The expiry RESTARTS on a widen (#465): a widen only happens because the user approved again,\n    // and a re-affirmation that left the old clock running would expire a consent the person gave\n    // moments ago. Both callers of this method — the initial-existing path and the\n    // concurrency-recovery path — are affirmative acts, so both refresh.\n    await systemAccess.updateAsSystem(CoreResourceType.OAUTH_CONSENT_GRANTS, existing._id, {\n      scopes: merged,\n      expiresAt: this.consentGrantExpiry(),\n    });\n    // A-3: an existing persistent consent grant was WIDENED (scopes unioned). Shared by the initial-existing\n    // path AND the concurrency-recovery path, so both audit the durable-authority change once.\n    // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — persistent delegated-access authorization (widen).\n    this._auditConsentGrantPersisted(existing.userId, existing.clientId, existing.resource, merged, false);\n  }\n\n  /**\n   * Read the single grant for the `(userId, clientId, resource)` business key, or null. A resource-less\n   * grant (OIDC-only login) is stored with `resource` absent; the `?? null` filter matches it (Mongo\n   * `{ resource: null }` matches a null OR absent field), while a resource-bound grant matches exactly.\n   */\n  private async readConsentGrant(userId: string, clientId: string, resource: string | undefined): Promise<OAuthConsentGrant | null> {\n    const ecCreator = this.container.get<ExecutionContextCreatorBackendService>(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService);\n    const repos = this.container.get<RepositoriesRegistryHandlerBackendService>(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService);\n    const ec = await ecCreator.createForInternalRepositoryOperation({\n      resourceType: CoreResourceType.OAUTH_CONSENT_GRANTS,\n      operationIdentifier: CoreResourceOperation.READ,\n    });\n    return repos\n      .getRepository(CoreResourceType.OAUTH_CONSENT_GRANTS)\n      .read<OAuthConsentGrant>(ec, { userId, clientId, resource: resource ?? null });\n  }\n\n  private oauthError(type: ErrorType, oauthError: string, detail: string) {\n    return this.errorBuilder.buildError(type, undefined, {\n      customMessageReference: type === ErrorType.AUTHENTICATION\n        ? ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID\n        : ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED,\n      context: { oauthError, detail },\n    });\n  }\n}\n"]}
+{"version":3,"file":"oidc-authorization-code.backend.service.js","sourceRoot":"","sources":["../../../../../src/security/authentications/services/oidc-authorization-code.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAChJ,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AAGxI,OAAO,EACL,WAAW,EACX,+BAA+B,EAC/B,wBAAwB,EACxB,qBAAqB,EACrB,gBAAgB,EAChB,2BAA2B,EAC3B,SAAS,EACT,qCAAqC,EACrC,mBAAmB,EACnB,iBAAiB,EACjB,8BAA8B,EAC9B,cAAc,EACd,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,yCAAyC,EAAE,MAAM,uBAAuB,CAAC;AAIlF,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,qEAAqE,CAAC;AACrI,OAAO,EAAE,qBAAqB,EAAE,MAAM,iFAAiF,CAAC;AACxH,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,+EAA+E,CAAC;AAElJ,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,EAAE,8BAA8B,EAAE,MAAM,uFAAuF,CAAC;AACvI,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,yFAAyF,CAAC;AA0FjG;;;;;;;;;;;GAWG;AAEI,IAAM,mCAAmC,GAAzC,MAAM,mCAAmC;IAEW;IACH;IACa;IACG;IAJtE,YACyD,SAAoB,EACvB,MAAqB,EACR,YAAwC,EACrC,gBAA+C;QAH5D,cAAS,GAAT,SAAS,CAAW;QACvB,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QACrC,qBAAgB,GAAhB,gBAAgB,CAA+B;IAClH,CAAC;IAEG,KAAK,CAAC,sBAAsB,CAAC,OAAqC;QACvE,IAAI,OAAO,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;YAC3C,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,iBAAiB,EAAE,6BAA6B,CAAC,CAAC;QACnG,CAAC;QACD,wGAAwG;QACxG,+FAA+F;QAC/F,6EAA6E;QAC7E,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,iBAAiB,EAAE,8CAA8C,CAAC,CAAC;QACpH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAE/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC;YACtD,SAAS,EAAE,wBAAwB,CAAC,uBAAuB;YAC3D,eAAe,EAAE,+BAA+B,CAAC,UAAU;YAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;YACnD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE;gBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9I,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IACjC,CAAC;IAEM,KAAK,CAAC,yBAAyB,CAAC,MAAqH;QAC1J,iGAAiG;QACjG,wGAAwG;QACxG,sGAAsG;QACtG,2GAA2G;QAC3G,yGAAyG;QACzG,yGAAyG;QACzG,IAAI,QAAqF,CAAC;QAC1F,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAoB,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,4FAA4F;YAC5F,IAAI,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrH,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,sDAAsD,CAAC,CAAC;QAC3H,CAAC;QAED,IAAI,QAAQ,CAAC,SAAS,KAAK,wBAAwB,CAAC,uBAAuB,EAAE,CAAC;YAC5E,IAAI,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrH,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,oCAAoC,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACzG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,mCAAmC,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAiJ,CAAC;QAEvL,4FAA4F;QAC5F,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC/I,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,qDAAqD,CAAC,CAAC;QAC1H,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5C,IAAI,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrJ,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,uDAAuD,CAAC,CAAC;QAC5H,CAAC;QAED,sGAAsG;QACtG,wGAAwG;QACxG,wGAAwG;QACxG,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,wBAAwB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxJ,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,0BAA0B,CAAC,CAAC;QAC/F,CAAC;QACD,kFAAkF;QAClF,MAAM,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC/F,+GAA+G;QAC/G,0GAA0G;QAC1G,2GAA2G;QAC3G,4GAA4G;QAC5G,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,iBAAiB,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YACpE,IAAI,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,wBAAwB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxJ,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,0BAA0B,CAAC,CAAC;QAC/F,CAAC;QAED,gGAAgG;QAChG,gGAAgG;QAChG,iGAAiG;QACjG,8FAA8F;QAC9F,kEAAkE;QAClE,EAAE;QACF,gGAAgG;QAChG,+FAA+F;QAC/F,4FAA4F;QAC5F,mGAAmG;QACnG,qFAAqF;QACrF,IAAI,MAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,+FAA+F;YAC/F,iEAAiE;YACjE,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,yBAAyB,CAAC,UAAU;eACjE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1G,IAAI,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC/I,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,4BAA4B,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC/I,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,qBAAqB,EAAE,iEAAiE,CAAC,CAAC;QAC3I,CAAC;QAED,oGAAoG;QACpG,qGAAqG;QACrG,oGAAoG;QACpG,iGAAiG;QACjG,sGAAsG;QACtG,8FAA8F;QAC9F,iGAAiG;QACjG,iGAAiG;QACjG,gGAAgG;QAChG,mFAAmF;QACnF,IAAI,MAAM,CAAC,MAAM,KAAK,yBAAyB,CAAC,UAAU,EAAE,CAAC;YAC3D,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACnF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC/I,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,iCAAiC,CAAC,QAAgB,EAAE,WAAmB,EAAE,MAAc;QAClG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QAC/D,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAExD,uFAAuF;QACvF,EAAE;QACF,kGAAkG;QAClG,mGAAmG;QACnG,oGAAoG;QACpG,kGAAkG;QAClG,+FAA+F;QAC/F,sFAAsF;QACtF,EAAE;QACF,6FAA6F;QAC7F,2FAA2F;QAC3F,gFAAgF;QAChF,IAAI,gCAAgC,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,OAAO;gBACL,eAAe,EAAE,IAAI;gBACrB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;gBAC5B,gGAAgG;gBAChG,8FAA8F;gBAC9F,+FAA+F;gBAC/F,qBAAqB;gBACrB,mBAAmB,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;gBACjD,0BAA0B,EAAE,MAAM,CAAC,2BAA2B;aAC/D,CAAC;QACJ,CAAC;QAED,IAAI,eAAe,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAElD,uCAAuC;QACvC,0EAA0E;QAC1E,oGAAoG;QACpG,qGAAqG;QACrG,qGAAqG;QACrG,mGAAmG;QACnG,qGAAqG;QACrG,oGAAoG;QACpG,8FAA8F;QAC9F,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,0BAA0B,CAAC,YAAY,EAAE,CAAC;YACxF,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC7D,eAAe,GAAG,IAAI,CAAC;YACzB,CAAC;QACH,CAAC;QAED,OAAO;YACL,eAAe;YACf,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YAC5B,mBAAmB,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YACjD,6FAA6F;YAC7F,0FAA0F;YAC1F,8FAA8F;YAC9F,0FAA0F;YAC1F,WAAW;YACX,0BAA0B,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,0BAA0B,CAAC,YAAY;mBACtF,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;mBAC9B,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;SACtE,CAAC;IACJ,CAAC;IAED,gGAAgG;IACxF,kBAAkB,CAAC,GAAW;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YACjD,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;QAC5F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,UAAU,CAAC,WAAmB;QACpC,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,cAAsB;QACpE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAwC,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;YACtI,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA4C,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;YACnI,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,oCAAoC,CAAC;gBAC9D,YAAY,EAAE,gBAAgB,CAAC,oBAAoB;gBACnD,mBAAmB,EAAE,qBAAqB,CAAC,IAAI;aAChD,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK;iBACvB,aAAa,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;iBACpD,IAAI,CAAkB,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,wBAAwB,CAAC,MAAM,EAAE,CAAC,CAAC;YAClG,OAAO,CAAC,CAAC,MAAM,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE;gBAC7E,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,mBAAmB,CAAC,KAAK,CAAC;aAC3D,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,oBAAoB,CAAC,OAA2B;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAE/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC;YACtD,SAAS,EAAE,wBAAwB,CAAC,oBAAoB;YACxD,eAAe,EAAE,+BAA+B,CAAC,UAAU;YAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;YACpD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE;gBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD;SACF,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACzG,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,qBAAqB,CAAC,YAAoB;QACrD,IAAI,QAAqF,CAAC;QAC1F,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,YAAY,CAAoB,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,mDAAmD,CAAC,CAAC;QACxH,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,KAAK,wBAAwB,CAAC,oBAAoB,EAAE,CAAC;YACzE,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,gCAAgC,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,gCAAgC,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAA6I,CAAC;QACnL,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,8BAA8B,CAAC,CAAC;QACnG,CAAC;QACD,OAAO;YACL,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACvB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,wBAAwB,CAAC,OAKrC;QACC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC;YACtD,SAAS,EAAE,wBAAwB,CAAC,wBAAwB;YAC5D,eAAe,EAAE,+BAA+B,CAAC,UAAU;YAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;YACpD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,qGAAqG;YACrG,sGAAsG;YACtG,qFAAqF;YACrF,QAAQ,EAAE;gBACR,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,6BAA6B,EAAE,OAAO,CAAC,6BAA6B;gBACpE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D;SACF,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACjF,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,yBAAyB,CAAC,iBAAyB;QAM9D,IAAI,QAAqF,CAAC;QAC1F,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,iBAAiB,CAAoB,CAAC;QAC5F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,KAAK,wBAAwB,CAAC,wBAAwB,EAAE,CAAC;YAC7E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAuF,CAAC;QAC7H,OAAO;YACL,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;SAClE,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E;;;;;;;;;;;;OAYG;IACH;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,iCAAiC,CAAC,QAAgB,EAAE,GAAW;QAC1E,IAAI,MAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC;IAC/D,CAAC;IAEO,KAAK,CAAC,0BAA0B,CAAC,QAAgB;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAmC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;QACzG,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,qCAAqC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAED,sFAAsF;IAC9E,KAAK,CAAC,wBAAwB,CAAC,QAAgB;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAwC,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;QACtI,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA4C,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;QACnI,KAAK,MAAM,YAAY,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,CAAC;YACrH,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,oCAAoC,CAAC,EAAE,YAAY,EAAE,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC;YACnI,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,IAAI,CAAkB,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;YACpG,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,qBAAqB,CAAC,MAAuB;QACnD,4FAA4F;QAC5F,iGAAiG;QACjG,6FAA6F;QAC7F,wFAAwF;QACxF,MAAM,SAAS,GAAG,MAAM,CAAC,kBAAkB,KAAK,6BAA6B,CAAC,OAAO,CAAC;QACtF,OAAO;YACL,MAAM,EAAE,yBAAyB,CAAC,UAAU;YAC5C,QAAQ,EAAE,MAAM,CAAC,GAAG;YACpB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YACvC,mGAAmG;YACnG,kGAAkG;YAClG,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,IAAI,EAAE;YAC3D,sFAAsF;YACtF,4FAA4F;YAC5F,6FAA6F;YAC7F,yFAAyF;YACzF,qDAAqD;YACrD,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;YACxF,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;YACzC,OAAO,EAAE,SAAS;gBAChB,CAAC,CAAC,EAAE,IAAI,EAAE,0BAA0B,CAAC,YAAY,EAAE;gBACnD,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,WAAW,CAAC,YAAY;oBACzC,CAAC,CAAC,EAAE,IAAI,EAAE,0BAA0B,CAAC,YAAY,EAAE,cAAc,EAAG,MAAkC,CAAC,cAAc,EAAE;oBACvH,CAAC,CAAC,EAAE,IAAI,EAAE,0BAA0B,CAAC,WAAW,EAAE;YACtD,0FAA0F;YAC1F,+FAA+F;YAC/F,wFAAwF;YACxF,mBAAmB,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,KAAK,IAAI;YACxE,MAAM;SACP,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACK,KAAK,CAAC,qCAAqC,CACjD,IAAsC,EACtC,QAAgB;QAEhB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAChF,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC7B,0FAA0F;YAC1F,+FAA+F;YAC/F,yFAAyF;YACzF,uFAAuF;YACvF,8FAA8F;YAC9F,uBAAuB;YACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YACvH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;YACnG,KAAK,SAAS,CAAC,oBAAoB,CAAC;gBAClC,QAAQ;gBACR,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yDAAyD,EAAE;gBACnG,GAAG,2BAA2B,CAAC,UAAU,CAAC;aAC3C,CAAC,CAAC,CAAC;YACJ,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,gBAAgB,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACrC,MAAM,cAAc,GAAG,QAAQ,CAAC,WAAW,CAAC;QAC5C,MAAM,aAAa,GAAG,cAAc,KAAK,SAAS;YAChD,CAAC,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAC;YACrC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAA2B,EAAE,CAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3H,OAAO;YACL,MAAM,EAAE,yBAAyB,CAAC,2BAA2B;YAC7D,QAAQ;YACR,IAAI,EAAE,QAAQ,CAAC,WAAW;YAC1B,YAAY,EAAE,QAAQ,CAAC,aAAa;YACpC,4FAA4F;YAC5F,+FAA+F;YAC/F,6FAA6F;YAC7F,2FAA2F;YAC3F,mFAAmF;YACnF,EAAE;YACF,2FAA2F;YAC3F,4FAA4F;YAC5F,2DAA2D;YAC3D,sBAAsB,EAAE,QAAQ,CAAC,yBAAyB,IAAI,EAAE;YAChE,aAAa,EAAE,8BAA8B;YAC7C,aAAa;YACb,OAAO,EAAE,EAAE,IAAI,EAAE,0BAA0B,CAAC,YAAY,EAAE;YAC1D,2BAA2B,EAAE,IAAI,CAAC,2BAA2B,CAAC,QAAQ,CAAC;YACvE,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,6EAA6E;IACrE,6BAA6B,CAAC,MAA0C,EAAE,WAAmB;QACnG,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;QACpG,CAAC;QACD,gGAAgG;QAChG,kGAAkG;QAClG,+FAA+F;QAC/F,mDAAmD;QACnD,IAAI,MAAM,CAAC,MAAM,KAAK,yBAAyB,CAAC,UAAU,EAAE,CAAC;YAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxF,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;YACpG,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,qBAAqB,EAAE,2DAA2D,CAAC,CAAC;QACrI,CAAC;QACD,mGAAmG;QACnG,yFAAyF;QACzF,6FAA6F;QAC7F,iEAAiE;QACjE,yGAAyG;QACzG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,iBAAiB,EAAE,gDAAgD,CAAC,CAAC;QACtH,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,MAAmC,EAAE,KAAe;QAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,CAAC;QACrC,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,eAAe,EAAE,yBAAyB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtH,CAAC;IACH,CAAC;IAED,8FAA8F;IAE9F;;;;OAIG;IACK,yBAAyB,CAAC,MAAsC,EAAE,GAA8D;QACtI,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QACnG,KAAK,SAAS,CAAC,0BAA0B,CAAC;YACxC,MAAM;YACN,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACvB,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0DAA0D,EAAE;YACpG,GAAG,2BAA2B,CAAC,UAAU,CAAC;SAC3C,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;OAKG;IACK,qCAAqC,CAAC,eAAmC;QAC/E,MAAM,gBAAgB,GAAG,eAAe,EAAE,UAAU,CAAC,SAAS,CAAC;YAC7D,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,eAAe,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QACnG,KAAK,SAAS,CAAC,oBAAoB,CAAC;YAClC,cAAc,EAAE,cAAc;YAC9B,gBAAgB;YAChB,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;YAC7F,GAAG,2BAA2B,CAAC,UAAU,CAAC;SAC3C,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;OAGG;IACK,2BAA2B,CAAC,MAAc,EAAE,QAAgB,EAAE,QAA4B,EAAE,MAAgB,EAAE,UAAmB;QACvI,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QACnG,KAAK,SAAS,CAAC,6BAA6B,CAAC;YAC3C,MAAM;YACN,QAAQ;YACR,QAAQ;YACR,MAAM;YACN,UAAU;SACX,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6DAA6D,EAAE;YACvG,GAAG,2BAA2B,CAAC,UAAU,CAAC;SAC3C,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;;;;OAQG;IACK,8BAA8B,CAAC,MAAuB,EAAE,qBAAyC;QACvG,IAAI,CAAC,qCAAqC,CAAC,MAAM,CAAC,uBAAuB,IAAI,4BAA4B,CAAC,IAAI,CAAC,EAAE,CAAC;YAChH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,4FAA4F;YAC5F,uEAAuE;YACvE,IAAI,CAAC,qCAAqC,CAAC,qBAAqB,CAAC,CAAC;YAClE,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,gBAAgB,EAAE,mEAAmE,CAAC,CAAC;QACzI,CAAC;QACD,MAAM,aAAa,GAAG,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;QACnE,qGAAqG;QACrG,wGAAwG;QACxG,2GAA2G;QAC3G,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,aAAa,KAAK,MAAM,CAAC,YAAY,CAAC;QACtF,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,oBAAoB;eACrD,aAAa,KAAK,MAAM,CAAC,oBAAoB;eAC7C,yBAAyB,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACtE,IAAI,CAAC,cAAc,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC7C,sGAAsG;YACtG,sGAAsG;YACtG,+DAA+D;YAC/D,2GAA2G;YAC3G,sGAAsG;YACtG,2GAA2G;YAC3G,6DAA6D;YAC7D,IAAI,CAAC,qCAAqC,CAAC,qBAAqB,CAAC,CAAC;YAClE,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,KAAK,CAAC,2BAA2B,CAAC,QAAgB,EAAE,YAAoB;QAC7E,6FAA6F;QAC7F,gGAAgG;QAChG,+FAA+F;QAC/F,sEAAsE;QACtE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACnG,qGAAqG;YACrG,sFAAsF;YACtF,IAAI,CAAC,qCAAqC,CAAC,YAAY,CAAC,CAAC;YACzD,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAC1D,wGAAwG;QACxG,yGAAyG;QACzG,2GAA2G;QAC3G,2EAA2E;QAC3E,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,aAAa,KAAK,MAAM,CAAC,YAAY,CAAC;QACtF,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,oBAAoB;eACrD,aAAa,KAAK,MAAM,CAAC,oBAAoB;eAC7C,yBAAyB,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACtE,IAAI,CAAC,cAAc,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC7C,0GAA0G;YAC1G,8FAA8F;YAC9F,IAAI,CAAC,qCAAqC,CAAC,YAAY,CAAC,CAAC;YACzD,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E;;;;;;OAMG;IACI,KAAK,CAAC,uBAAuB,CAAC,MAAc,EAAE,QAAgB,EAAE,QAA4B,EAAE,eAAyB;QAC5H,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACtE,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YACzB,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,OAAO,KAAK,CAAC;YACvF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;YAC5C,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,QAAgB,EAAE,QAA4B,EAAE,MAAgB;QAC9G,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA6B,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;QAC5G,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,gGAAgG;QAChG,iGAAiG;QACjG,qBAAqB;QACrB,MAAM,IAAI,GAA4B,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QACzG,IAAI,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,cAAc,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;YAC/E,wGAAwG;YACxG,oGAAoG;YACpG,kHAAkH;YAClH,IAAI,CAAC,2BAA2B,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qFAAqF;YACrF,qGAAqG;YACrG,iGAAiG;YACjG,mGAAmG;YACnG,wGAAwG;YACxG,wGAAwG;YACxG,qFAAqF;YACrF,uHAAuH;YACvH,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,QAAQ;gBAAE,MAAM,KAAK,CAAC;YAClF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACvE,IAAI,CAAC,MAAM;gBAAE,MAAM,KAAK,CAAC,CAAC,2EAA2E;YACrG,MAAM,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACK,kBAAkB;QACxB,IAAI,YAAY,GAAG,yCAAyC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC;gBACjG,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,CAAC;YAC3C,IAAI,OAAO,UAAU,KAAK,QAAQ;gBAAE,YAAY,GAAG,UAAU,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;QACD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACnE,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,uBAAuB,CAAC,YAAwC,EAAE,QAA2B,EAAE,MAAgB;QAC3H,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5E,+FAA+F;QAC/F,8FAA8F;QAC9F,+EAA+E;QAC/E,qEAAqE;QACrE,MAAM,YAAY,CAAC,cAAc,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,QAAQ,CAAC,GAAG,EAAE;YACrF,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,IAAI,CAAC,kBAAkB,EAAE;SACrC,CAAC,CAAC;QACH,yGAAyG;QACzG,2FAA2F;QAC3F,iHAAiH;QACjH,IAAI,CAAC,2BAA2B,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACzG,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,QAAgB,EAAE,QAA4B;QAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAwC,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;QACtI,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA4C,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;QACnI,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,oCAAoC,CAAC;YAC9D,YAAY,EAAE,gBAAgB,CAAC,oBAAoB;YACnD,mBAAmB,EAAE,qBAAqB,CAAC,IAAI;SAChD,CAAC,CAAC;QACH,OAAO,KAAK;aACT,aAAa,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;aACpD,IAAI,CAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;IAEO,UAAU,CAAC,IAAe,EAAE,UAAkB,EAAE,MAAc;QACpE,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE;YACnD,sBAAsB,EAAE,IAAI,KAAK,SAAS,CAAC,cAAc;gBACvD,CAAC,CAAC,2BAA2B,CAAC,8BAA8B;gBAC5D,CAAC,CAAC,2BAA2B,CAAC,4BAA4B;YAC5D,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;SAChC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA92BY,mCAAmC;IAD/C,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAA;IACpC,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;+CAFU,aAAa;QACM,0BAA0B;QACnB,6BAA6B;GAL1G,mCAAmC,CA82B/C","sourcesContent":["import 'reflect-metadata';\nimport { inject, injectable } from 'inversify';\nimport type { Container } from 'inversify';\nimport { createHash } from 'crypto';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { ConsumableTokenBackendService } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport type { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport {\n  ApiKeyScope,\n  ConsumableToken_ConsumptionMode,\n  CoreConsumableTokenTypes,\n  CoreResourceOperation,\n  CoreResourceType,\n  ErrorCustomMessageReference,\n  ErrorType,\n  isConfidentialTokenEndpointAuthMethod,\n  isWildoBackendError,\n  OAuthClientStatus,\n  OAuthCodeExchangeFailureReason,\n  OAuthGrantType,\n  OAuthClientRegistrationOrigin,\n  OAuthTokenEndpointAuthMethod,\n  OrganizationMemberStatus,\n} from '@wildo-ai/saas-models';\nimport { OAUTH_CONSENT_GRANT_DEFAULT_LIFETIME_DAYS } from '@wildo-ai/saas-models';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { OAuthClientBase, OAuthClientOrganization, OAuthConsentGrant } from '@wildo-ai/saas-models';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { isCredentialExpired, isRotationGraceWindowOpen } from '~wildo-backend-lib/security/credential-rotation-grace.backend.utils';\nimport { hashOAuthClientSecret } from '~wildo-backend-lib/security/oauth-clients/oauth-client-generation.backend.utils';\nimport { isValidPkceCodeVerifier, isValidS256CodeChallenge } from '~wildo-backend-lib/security/authentications/services/utils/pkce.backend.utils';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport { DurationUnit } from '@wildo-ai/zod-decorators';\nimport type { CimdClientMetadataBackendService } from '~wildo-backend-lib/security/authentications/services/cimd-client-metadata.backend.service';\nimport { OIDC_SUPPORTED_IDENTITY_SCOPES } from '~wildo-backend-lib/security/authentications/services/oidc-user-claims.backend.service';\nimport {\n  AuthorizationClientOrigin,\n  AuthorizationClientTenancy,\n  isClientIdMetadataDocumentClient,\n} from '~wildo-backend-lib/security/authentications/models/authorization-client.backend.schemas';\nimport type {\n  ClientIdMetadataDocumentAuthorizationClient,\n  RegisteredAuthorizationClient,\n  ResolvedAuthorizationClient,\n} from '~wildo-backend-lib/security/authentications/models/authorization-client.backend.schemas';\n\n/** The authorization request the authorize endpoint hands over AFTER the user has consented. */\nexport interface OidcAuthorizationCodeRequest {\n  userId: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[];\n  codeChallenge: string;\n  codeChallengeMethod: 'S256';\n  nonce?: string;\n  /**\n   * RFC 8707 resource indicator — the canonical audience of the resource server the client\n   * wants the access token for (an A2A / MCP endpoint URI). Captured at authorize time and\n   * bound into the token's `aud` at exchange. MANDATORY for the delegated-token exchange:\n   * `issueAuthorizationCodeToken` fail-closes with `invalid_target` when it is absent (a\n   * delegated user token MUST be audience-bound — B-S2). Optional on THIS type only because the\n   * authorize endpoint accepts the request before the token exchange enforces it.\n   */\n  resource?: string;\n  /**\n   * revocation-C: the End-User's OP login `sessionId`, captured from the first-party access token at\n   * authorize/consent. Carried through the code into the id_token's `sid` so the RP-Initiated Logout\n   * endpoint can terminate exactly this session. Optional — absent if the authorizing token carried no\n   * session (should not happen for a first-party interactive authorize, but the pipeline stays lenient).\n   */\n  sessionId?: string;\n}\n\n/** The binding recovered when an authorization code is redeemed, used to mint the tokens. */\nexport interface OidcAuthorizationCodeGrant {\n  userId: string;\n  clientId: string;\n  scope: string[];\n  nonce?: string;\n  /** RFC 8707 resource indicator captured at authorize (see {@link OidcAuthorizationCodeRequest.resource}). */\n  resource?: string;\n  /** revocation-C: the End-User's OP login `sessionId` → the id_token `sid` (see {@link OidcAuthorizationCodeRequest.sessionId}). */\n  sessionId?: string;\n}\n\n/**\n * The authorization request stashed in a single-use consent-request token at `/oauth/authorize` for\n * a `requiresConsent` client (INSTEAD of the code), and recovered at `/oauth/authorize/decision` to\n * mint the code on APPROVE. Carries the SAME fields the code would bind PLUS the OAuth `state` (echoed\n * back on the final redirect). Stored server-side so the consent decision cannot tamper with the\n * parameters — the client/redirect/scope the user approved are exactly the ones the code binds.\n */\nexport interface OidcConsentRequest {\n  userId: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[];\n  codeChallenge: string;\n  nonce?: string;\n  resource?: string;\n  state?: string;\n}\n\n/**\n * What the authorize endpoint needs to know about a client before it decides whether to prompt.\n *\n * Carries the DISPLAY obligations alongside the decision, because the specification makes display a\n * requirement rather than a nicety for a client whose identity is only a domain: the redirect\n * hostname must be shown, and a loopback-only redirect set warrants an extra warning.\n */\nexport interface AuthorizationClientConsentPosture {\n  requiresConsent: boolean;\n  clientName: string;\n  /** Which mechanism established this identity — the consent screen presents the two differently. */\n  origin: AuthorizationClientOrigin;\n  /**\n   * Whether any tenant of this application vouches for the client — the actual trust signal.\n   *\n   * `origin` alone is misleading for a dynamically registered client: it IS a registered row, so it\n   * reports `REGISTERED`, while nobody with standing here ever vetted it. `UNAFFILIATED` is the\n   * value the consent screen must key on when it decides how cautious to be.\n   */\n  tenancy: AuthorizationClientTenancy;\n  /** The hostname the user will be sent back to; `null` only if the URI is unparseable. */\n  redirectUriHostname: string | null;\n  /** Every redirect URI this client claims is loopback — show the impersonation warning. */\n  warnsLoopbackOnlyRedirects: boolean;\n}\n\n/**\n * OIDC authorization_code engine (Wildo-as-provider). Two halves:\n *  - {@link issueAuthorizationCode} — after the user consents, validate the request against\n *    the registered client and mint a single-use, short-TTL code bound to the user + client +\n *    scope + redirect_uri + PKCE challenge (+ nonce).\n *  - {@link exchangeAuthorizationCode} — at the token endpoint, atomically consume the code and\n *    verify the client + redirect_uri binding and PKCE (RFC 7636 S256), then return the binding.\n *\n * Built on the `OIDC_AUTHORIZATION_CODE` consumable token (Mongo, atomic SINGLE_USE, TTL) — the\n * same hardened primitive behind `AUTH_CODE_EXCHANGE`. PKCE is MANDATORY (S256 only). Every\n * failure is fail-closed and carries the RFC 6749 error code in `context.oauthError`.\n */\n@injectable()\nexport class OidcAuthorizationCodeBackendService {\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Container) private readonly container: Container,\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ConsumableTokenService) private readonly consumableTokens: ConsumableTokenBackendService,\n  ) {}\n\n  public async issueAuthorizationCode(request: OidcAuthorizationCodeRequest): Promise<{ code: string }> {\n    if (request.codeChallengeMethod !== 'S256') {\n      throw this.oauthError(ErrorType.AUTHORIZATION, 'invalid_request', 'only PKCE S256 is supported');\n    }\n    // RFC 7636 §4.2: reject a malformed S256 code_challenge at mint (defense-in-depth over the controller's\n    // entry check) — a valid challenge is 43 unreserved-base64url chars, so a client cannot bind a\n    // low-entropy / garbage challenge that would weaken the exchange-time proof.\n    if (!isValidS256CodeChallenge(request.codeChallenge)) {\n      throw this.oauthError(ErrorType.AUTHORIZATION, 'invalid_request', 'a valid PKCE S256 code_challenge is required');\n    }\n    const client = await this.resolveAuthorizationClient(request.clientId);\n    this.assertAuthorizationCodeClient(client, request.redirectUri);\n    this.assertScopeAllowed(client, request.scope);\n\n    const created = await this.consumableTokens.createToken({\n      tokenType: CoreConsumableTokenTypes.OIDC_AUTHORIZATION_CODE,\n      consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n      expiresIn: { value: 5, unit: DurationUnit.MINUTES },\n      userId: request.userId,\n      metadata: {\n        clientId: request.clientId,\n        scope: request.scope,\n        redirectUri: request.redirectUri,\n        codeChallenge: request.codeChallenge,\n        ...(request.nonce ? { nonce: request.nonce } : {}),\n        ...(request.resource ? { resource: request.resource } : {}),\n        ...(request.sessionId ? { sessionId: request.sessionId } : {}),\n      },\n    });\n\n    this.logger.debug('Issued OIDC authorization code', { clientId: request.clientId, userId: request.userId, scopeCount: request.scope.length });\n    return { code: created.token };\n  }\n\n  public async exchangeAuthorizationCode(params: { code: string; clientId: string; redirectUri: string; codeVerifier: string; presentedClientSecret?: string }): Promise<OidcAuthorizationCodeGrant> {\n    // A-6: every rejection below is a potential attack signal (code replay, PKCE downgrade, redirect\n    // tampering, cross-client redemption). Each emits `OAUTH_CODE_EXCHANGE_FAILED` with a closed-vocabulary\n    // `reason` BEFORE its (client-indistinguishable) `invalid_grant`. Post-decode branches also carry the\n    // code's `userId`/`resource`; the atomic replay/consume failure carries only the request-supplied clientId\n    // (the code never decoded). assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — failed delegated\n    // exchange + monitoring. Fire-and-forget (helper `_auditCodeExchangeFailure`) — never affects the throw.\n    let consumed: { tokenType?: string; userId?: string; metadata?: Record<string, unknown> };\n    try {\n      consumed = await this.consumableTokens.consumeToken(params.code) as typeof consumed;\n    } catch {\n      // Not found / expired / already used — all indistinguishable to the client (RFC 6749 §5.2).\n      this._auditCodeExchangeFailure(OAuthCodeExchangeFailureReason.CODE_REPLAY_OR_INVALID, { clientId: params.clientId });\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'authorization code invalid, expired, or already used');\n    }\n\n    if (consumed.tokenType !== CoreConsumableTokenTypes.OIDC_AUTHORIZATION_CODE) {\n      this._auditCodeExchangeFailure(OAuthCodeExchangeFailureReason.NOT_AUTHORIZATION_CODE, { clientId: params.clientId });\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'token is not an authorization code');\n    }\n    const userId = consumed.userId;\n    if (!userId) {\n      this._auditCodeExchangeFailure(OAuthCodeExchangeFailureReason.NO_SUBJECT, { clientId: params.clientId });\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'authorization code has no subject');\n    }\n    const meta = (consumed.metadata ?? {}) as { clientId?: string; scope?: string[]; redirectUri?: string; codeChallenge?: string; nonce?: string; resource?: string; sessionId?: string };\n\n    // RFC 6749 §4.1.3: the client + redirect_uri MUST match the original authorization request.\n    if (meta.clientId !== params.clientId) {\n      this._auditCodeExchangeFailure(OAuthCodeExchangeFailureReason.CLIENT_MISMATCH, { clientId: params.clientId, userId, resource: meta.resource });\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'authorization code was issued to a different client');\n    }\n    if (meta.redirectUri !== params.redirectUri) {\n      this._auditCodeExchangeFailure(OAuthCodeExchangeFailureReason.REDIRECT_URI_MISMATCH, { clientId: params.clientId, userId, resource: meta.resource });\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'redirect_uri does not match the authorization request');\n    }\n\n    // RFC 7636 §4.1: the code_verifier MUST be 43–128 chars of the unreserved set. Enforce the shape here\n    // — AFTER the atomic consume, so a malformed verifier still BURNS the single-use code (no retry oracle,\n    // same as a wrong verifier) — and reject it even if it would otherwise match a non-compliant challenge.\n    if (!isValidPkceCodeVerifier(params.codeVerifier)) {\n      this._auditCodeExchangeFailure(OAuthCodeExchangeFailureReason.PKCE_VERIFICATION_FAILED, { clientId: params.clientId, userId, resource: meta.resource });\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'PKCE verification failed');\n    }\n    // RFC 7636: base64url(sha256(code_verifier)) MUST equal the bound code_challenge.\n    const computedChallenge = createHash('sha256').update(params.codeVerifier).digest('base64url');\n    // security-decision (accepted-low — H-57, see .claude/plans/oidc-provider-test-coverage.md § \"ACCEPTED RISK\"):\n    // the `!==` below is not constant-time, but both operands are fixed-length base64url SHA-256 digests of a\n    // 43-char PKCE verifier — a timing side-channel leaks nothing brute-forceable, so `crypto.timingSafeEqual`\n    // is not warranted. Revisit only if a compare ever moves onto a low-entropy / attacker-chosen-length input.\n    if (!meta.codeChallenge || computedChallenge !== meta.codeChallenge) {\n      this._auditCodeExchangeFailure(OAuthCodeExchangeFailureReason.PKCE_VERIFICATION_FAILED, { clientId: params.clientId, userId, resource: meta.resource });\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'PKCE verification failed');\n    }\n\n    // Defense-in-depth (RFC 6749 §4.1.3): re-verify the client is STILL active and STILL authorized\n    // for the authorization_code grant at REDEMPTION time — the code outlives its 5-minute TTL past\n    // the issue-time checks in `issueAuthorizationCode`, so a client deactivated (or whose grant was\n    // revoked) within that window must not be able to complete the exchange. Read by the already-\n    // matched `params.clientId` (== `meta.clientId`, verified above).\n    //\n    // Resolved through the SAME union as issuance, so a CIMD client is re-checked too: its document\n    // must still resolve, still be trusted by the deployment's current policy, and still claim the\n    // authorization_code grant. A CIMD document that was taken down, or a policy narrowed to an\n    // allow-list that no longer admits it, must not be redeemable on a code minted before the change —\n    // that is precisely the revocation path the cache's upper TTL bound exists to bound.\n    let client: ResolvedAuthorizationClient | null;\n    try {\n      client = await this.resolveAuthorizationClient(params.clientId);\n    } catch {\n      // A CIMD refusal throws `invalid_client`; at REDEMPTION the client-indistinguishable answer is\n      // `invalid_grant`, same as every other post-decode failure here.\n      client = null;\n    }\n    if (!client || (client.origin === AuthorizationClientOrigin.REGISTERED\n      && (client.record.status !== OAuthClientStatus.ACTIVE || isCredentialExpired(client.record.expiresAt)))) {\n      this._auditCodeExchangeFailure(OAuthCodeExchangeFailureReason.CLIENT_INACTIVE, { clientId: params.clientId, userId, resource: meta.resource });\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'client is no longer active');\n    }\n    if (!client.allowedGrants.includes(OAuthGrantType.AUTHORIZATION_CODE)) {\n      this._auditCodeExchangeFailure(OAuthCodeExchangeFailureReason.GRANT_TYPE_LOST, { clientId: params.clientId, userId, resource: meta.resource });\n      throw this.oauthError(ErrorType.AUTHORIZATION, 'unauthorized_client', 'client is no longer authorized for the authorization_code grant');\n    }\n\n    // F-OIDC-11: a CONFIDENTIAL client (`tokenEndpointAuthMethod !== NONE`) MUST additionally present a\n    // valid `client_secret` — defense-in-depth over PKCE. A PUBLIC client (the default) is PKCE-only and\n    // presents no secret. Enforced here at the same client re-read as the active/grant checks; like the\n    // accepted F-OIDC-9 wrinkle, a wrong secret on a valid code burns that single-use code, which is\n    // acceptable (the caller already holds a live high-entropy code, and issuance is fail-closed anyway).\n    // Registered clients only. A CIMD client is public by construction — the resolver REFUSES any\n    // document declaring a shared-secret `token_endpoint_auth_method` (the draft forbids them) or an\n    // asymmetric one this provider does not implement, so there is no CIMD client for which a secret\n    // check could ever be meaningful. Narrowed on the discriminant rather than on a nullable secret\n    // field, so the impossibility is enforced by the type rather than by this comment.\n    if (client.origin === AuthorizationClientOrigin.REGISTERED) {\n      this.assertConfidentialClientSecret(client.record, params.presentedClientSecret);\n    }\n\n    return { userId, clientId: params.clientId, scope: meta.scope ?? [], nonce: meta.nonce, resource: meta.resource, sessionId: meta.sessionId };\n  }\n\n  /**\n   * Read + validate the client for an authorization request, and report whether it requires\n   * INTERACTIVE CONSENT. The authorize endpoint calls this BEFORE issuing anything: a\n   * `requiresConsent` client is routed to {@link createConsentRequest} (→ `consent_required`); a\n   * trusted/first-party client (`requiresConsent` false) proceeds straight to\n   * {@link issueAuthorizationCode}. Applies the SAME client validation as `issueAuthorizationCode`\n   * (active, authorization_code-grant-allowed, exact redirect_uri) so an invalid client fails\n   * identically on either path.\n   */\n  public async resolveAuthorizationClientConsent(clientId: string, redirectUri: string, userId: string): Promise<AuthorizationClientConsentPosture> {\n    const client = await this.resolveAuthorizationClient(clientId);\n    this.assertAuthorizationCodeClient(client, redirectUri);\n\n    // A CIMD client ALWAYS sees the consent screen, and its own document has no say in it.\n    //\n    // The registered path lets a client declare itself consent-free, because someone with standing in\n    // this application registered it and made that call. A client metadata document is authored by the\n    // party being trusted, so honouring a consent-free declaration from it would be self-certification:\n    // anyone who can host a JSON file could mint an identity that skips the user's approval. There is\n    // deliberately no `declaresConsentFree` on the CIMD arm at all — the field cannot be read here\n    // because it does not exist there, which is stronger than remembering not to read it.\n    //\n    // This is also what the specification depicts: in the Client ID Metadata Documents flow, the\n    // authorization server's step after validation is \"Display consent page with client_name\".\n    // spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Documents Flow\n    if (isClientIdMetadataDocumentClient(client)) {\n      return {\n        requiresConsent: true,\n        clientName: client.name,\n        origin: client.origin,\n        tenancy: client.tenancy.kind,\n        // \"Authorization servers … MUST clearly display the redirect URI hostname during authorization\"\n        // — so the hostname travels to the consent screen as DATA rather than being re-derived there.\n        // spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Document Security → Localhost\n        // Redirect URI Risks\n        redirectUriHostname: this.hostnameOf(redirectUri),\n        warnsLoopbackOnlyRedirects: client.claimsOnlyLoopbackRedirects,\n      };\n    }\n\n    let requiresConsent = !client.declaresConsentFree;\n\n    // D4 option B — SAME-ORG consent gate.\n    // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — a user must\n    // explicitly authorize third-party delegated access to their account. A client that declares itself\n    // consent-free (`requiresConsent:false`) may skip the prompt ONLY inside its own trust boundary: for\n    // an ORG-scoped client that is an ACTIVE member of its OWN org. A CROSS-ORG user (not a member) is a\n    // third-party delegation and MUST see the consent screen — otherwise an ORG_ADMIN could register a\n    // no-consent client and silently harvest OTHER orgs' users' delegated tokens by phishing them to the\n    // authorize endpoint. APP-scoped clients are platform-operator-created (first-party) and keep their\n    // declared posture. Fail-closed: any membership-read error forces consent (the safe default).\n    if (!requiresConsent && client.tenancy.kind === AuthorizationClientTenancy.ORGANIZATION) {\n      const orgId = client.tenancy.organizationId;\n      if (!orgId || !(await this.isActiveOrgMember(userId, orgId))) {\n        requiresConsent = true;\n      }\n    }\n\n    return {\n      requiresConsent,\n      clientName: client.name,\n      origin: client.origin,\n      tenancy: client.tenancy.kind,\n      redirectUriHostname: this.hostnameOf(redirectUri),\n      // A DYNAMICALLY registered client earns the same loopback warning as a CIMD one: it asserted\n      // its own name and redirect URIs, so \"the app you recognise\" and \"the app that registered\n      // this name\" are not the same claim. An OPERATOR-registered client was vetted by someone with\n      // standing here, and warning on those would train users to click through the warning that\n      // matters.\n      warnsLoopbackOnlyRedirects: client.tenancy.kind === AuthorizationClientTenancy.UNAFFILIATED\n        && client.redirectUris.length > 0\n        && client.redirectUris.every((uri) => this.isLoopbackRedirect(uri)),\n    };\n  }\n\n  /** Loopback test shared by the registered-but-unaffiliated path and the CIMD resolver's own. */\n  private isLoopbackRedirect(uri: string): boolean {\n    try {\n      const host = new URL(uri).hostname.toLowerCase();\n      return host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]';\n    } catch {\n      return false;\n    }\n  }\n\n  /**\n   * The hostname a redirect URI will send the user to, for consent-screen display.\n   *\n   * Returns `null` rather than throwing on an unparseable URI: by the time this runs the URI has\n   * already exact-matched the client's registered/claimed set, so an unparseable value here is a\n   * data-integrity oddity, and failing the whole authorize request over a DISPLAY field would trade a\n   * working flow for a cosmetic one.\n   */\n  private hostnameOf(redirectUri: string): string | null {\n    try {\n      return new URL(redirectUri).hostname;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * D4/B membership check (fail-closed): is `userId` an ACTIVE member of `organizationId`? Reads\n   * `ORGANIZATION_MEMBERS` by the `(userId, organizationId, status=ACTIVE)` grain with an internal system\n   * EC. Returns FALSE on any error so the caller forces consent rather than silently skipping it.\n   */\n  private async isActiveOrgMember(userId: string, organizationId: string): Promise<boolean> {\n    try {\n      const ecCreator = this.container.get<ExecutionContextCreatorBackendService>(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService);\n      const repos = this.container.get<RepositoriesRegistryHandlerBackendService>(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService);\n      const ec = await ecCreator.createForInternalRepositoryOperation({\n        resourceType: CoreResourceType.ORGANIZATION_MEMBERS,\n        operationIdentifier: CoreResourceOperation.READ,\n      });\n      const member = await repos\n        .getRepository(CoreResourceType.ORGANIZATION_MEMBERS)\n        .read<{ _id: string }>(ec, { userId, organizationId, status: OrganizationMemberStatus.ACTIVE });\n      return !!member;\n    } catch (error) {\n      this.logger.warn('Org-membership check failed; forcing consent (fail-closed)', {\n        userId, organizationId, reason: describeCaughtError(error),\n      });\n      return false;\n    }\n  }\n\n  /**\n   * Mint a single-use consent-request token for a `requiresConsent` client (used INSTEAD of the\n   * authorization code at authorize time). Re-validates the client + scope (defense-in-depth, mirrors\n   * {@link issueAuthorizationCode}). The returned token is handed to the caller in the\n   * `consent_required` response and redeemed at {@link consumeConsentRequest} on the user's decision.\n   */\n  public async createConsentRequest(request: OidcConsentRequest): Promise<{ consentToken: string }> {\n    const client = await this.resolveAuthorizationClient(request.clientId);\n    this.assertAuthorizationCodeClient(client, request.redirectUri);\n    this.assertScopeAllowed(client, request.scope);\n\n    const created = await this.consumableTokens.createToken({\n      tokenType: CoreConsumableTokenTypes.OIDC_CONSENT_REQUEST,\n      consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n      expiresIn: { value: 10, unit: DurationUnit.MINUTES },\n      userId: request.userId,\n      metadata: {\n        clientId: request.clientId,\n        scope: request.scope,\n        redirectUri: request.redirectUri,\n        codeChallenge: request.codeChallenge,\n        ...(request.nonce ? { nonce: request.nonce } : {}),\n        ...(request.resource ? { resource: request.resource } : {}),\n        ...(request.state ? { state: request.state } : {}),\n      },\n    });\n    this.logger.debug('Issued OIDC consent request', { clientId: request.clientId, userId: request.userId });\n    return { consentToken: created.token };\n  }\n\n  /**\n   * Atomically consume a consent-request token (single-use) → the stashed authorization request. The\n   * decision endpoint then binds this to the AUTHENTICATED user (the token subject MUST match) and, on\n   * APPROVE, feeds it to {@link issueAuthorizationCode}. Not-found / expired / already-used are all\n   * indistinguishable `invalid_grant` (RFC 6749 §5.2), same as the code exchange.\n   */\n  public async consumeConsentRequest(consentToken: string): Promise<OidcConsentRequest> {\n    let consumed: { tokenType?: string; userId?: string; metadata?: Record<string, unknown> };\n    try {\n      consumed = await this.consumableTokens.consumeToken(consentToken) as typeof consumed;\n    } catch {\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'consent request invalid, expired, or already used');\n    }\n    if (consumed.tokenType !== CoreConsumableTokenTypes.OIDC_CONSENT_REQUEST) {\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'token is not a consent request');\n    }\n    const userId = consumed.userId;\n    if (!userId) {\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'consent request has no subject');\n    }\n    const meta = (consumed.metadata ?? {}) as { clientId?: string; scope?: string[]; redirectUri?: string; codeChallenge?: string; nonce?: string; resource?: string; state?: string };\n    if (!meta.clientId || !meta.redirectUri || !meta.codeChallenge) {\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_grant', 'consent request is malformed');\n    }\n    return {\n      userId,\n      clientId: meta.clientId,\n      redirectUri: meta.redirectUri,\n      scope: meta.scope ?? [],\n      codeChallenge: meta.codeChallenge,\n      nonce: meta.nonce,\n      resource: meta.resource,\n      state: meta.state,\n    };\n  }\n\n  /**\n   * Mint a single-use logout-confirmation token (revocation-C §6 — the logout-confirmation prompt).\n   * Called at `GET /oauth/end-session` for a NON-trusted logout (a valid `id_token_hint` whose\n   * `post_logout_redirect_uri` is absent / unregistered / mismatched), INSTEAD of terminating the\n   * session inline — the Keycloak-style posture skips the prompt only for a trusted RP (valid hint +\n   * exact-match registered redirect). The already-validated `{ userId, sessionId }` is stashed\n   * server-side so the confirmation cannot tamper with WHICH session ends. The returned token is\n   * carried to the frontend `/oauth/logout-confirm` prompt and redeemed at\n   * {@link consumeLogoutConfirmation} when the End-User confirms. Minted ONLY when a real session was\n   * identified (a valid hint) — a request with nothing to terminate lands on the signed-out page with\n   * no prompt, so the token always names a session.\n   */\n  public async createLogoutConfirmation(request: {\n    userId: string;\n    sessionId: string;\n    clientId?: string;\n    postLogoutRedirectUriRejected: boolean;\n  }): Promise<{ confirmationToken: string }> {\n    const created = await this.consumableTokens.createToken({\n      tokenType: CoreConsumableTokenTypes.OIDC_LOGOUT_CONFIRMATION,\n      consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n      expiresIn: { value: 10, unit: DurationUnit.MINUTES },\n      userId: request.userId,\n      // The RP the hint named (`clientId`) and whether a presented `post_logout_redirect_uri` was rejected\n      // are stashed alongside the session, so the confirm-endpoint audit keeps FULL attribution — the token\n      // is the only thing `POST /oauth/end-session/confirm` sees (it re-verifies no hint).\n      metadata: {\n        sessionId: request.sessionId,\n        postLogoutRedirectUriRejected: request.postLogoutRedirectUriRejected,\n        ...(request.clientId ? { clientId: request.clientId } : {}),\n      },\n    });\n    this.logger.debug('Issued OIDC logout confirmation', { userId: request.userId });\n    return { confirmationToken: created.token };\n  }\n\n  /**\n   * Atomically consume a logout-confirmation token → the stashed `{ userId, sessionId }`. Unlike\n   * {@link consumeConsentRequest}, a not-found / expired / already-used token is NOT an error: the\n   * End-User confirmed a logout, so a stale token yields `null` and the caller simply lands them on the\n   * signed-out page WITHOUT terminating (the session is most likely already gone, and revealing whether\n   * the token was live would be a session-state oracle). A wrong token type is treated identically.\n   */\n  public async consumeLogoutConfirmation(confirmationToken: string): Promise<{\n    userId?: string;\n    sessionId?: string;\n    clientId?: string;\n    postLogoutRedirectUriRejected?: boolean;\n  } | null> {\n    let consumed: { tokenType?: string; userId?: string; metadata?: Record<string, unknown> };\n    try {\n      consumed = await this.consumableTokens.consumeToken(confirmationToken) as typeof consumed;\n    } catch {\n      return null;\n    }\n    if (consumed.tokenType !== CoreConsumableTokenTypes.OIDC_LOGOUT_CONFIRMATION) {\n      return null;\n    }\n    const meta = (consumed.metadata ?? {}) as { sessionId?: string; clientId?: string; postLogoutRedirectUriRejected?: boolean };\n    return {\n      userId: consumed.userId,\n      sessionId: meta.sessionId,\n      clientId: meta.clientId,\n      postLogoutRedirectUriRejected: meta.postLogoutRedirectUriRejected,\n    };\n  }\n\n  // ── client resolution ─────────────────────────────────────────────────────\n  /**\n   * Resolve a `client_id` to the identity behind it, from EITHER source this provider accepts.\n   *\n   * Triage is on the SHAPE of the identifier, which is what makes the two mechanisms coexist without\n   * a mode flag: a CIMD `client_id` is an `https://` URL, and a registered one is a Mongo `_id`.\n   * Neither can be mistaken for the other, and the CIMD branch is entered ONLY for a URL — so a\n   * deployment with the policy `DISABLED` never fetches anything, and a registered lookup never\n   * touches the network.\n   *\n   * Returns `null` for \"no such client\"; THROWS for a URL-shaped client_id that resolved and was\n   * refused, because those two are not the same fact: the first is a typo, the second is a policy or\n   * security decision whose reason the operator needs.\n   */\n  /**\n   * revocation-C: is `uri` a registered POST-LOGOUT redirect for `clientId`? The `/oauth/end-session`\n   * handler calls this to validate a presented `post_logout_redirect_uri` before it redirects the browser\n   * back to the relying party. EXACT string match against the resolved client's `postLogoutRedirectUris`\n   * allowlist — the SAME anti-open-redirect discipline as the authorization-code `redirect_uri` gate\n   * (`exchangeAuthorizationCode`), never a prefix or origin match. A client that cannot be resolved, or\n   * that registered no post-logout URIs, admits none — fail closed. (A CIMD client CAN register\n   * them since #464; before that, none could.)\n   * spec-cite: OpenID Connect RP-Initiated Logout 1.0 §3 (the OP \"MUST NOT perform post-logout redirection\n   * if the `post_logout_redirect_uri` value supplied does not exactly match one of the previously\n   * registered `post_logout_redirect_uris` values\"; registration of those values is §2).\n   */\n  public async isRegisteredPostLogoutRedirectUri(clientId: string, uri: string): Promise<boolean> {\n    let client: ResolvedAuthorizationClient | null;\n    try {\n      client = await this.resolveAuthorizationClient(clientId);\n    } catch {\n      client = null;\n    }\n    return client?.postLogoutRedirectUris.includes(uri) ?? false;\n  }\n\n  private async resolveAuthorizationClient(clientId: string): Promise<ResolvedAuthorizationClient | null> {\n    const cimd = this.container.get<CimdClientMetadataBackendService>(SAAS_SERVICE_TYPES.CimdClientMetadata);\n    if (cimd.isCimdClientId(clientId)) {\n      return this.resolveClientIdMetadataDocumentClient(cimd, clientId);\n    }\n    const record = await this.readRegisteredClientById(clientId);\n    return record ? this.adaptRegisteredClient(record) : null;\n  }\n\n  /** Read a registered client by `_id` across both scope collections (org then app). */\n  private async readRegisteredClientById(clientId: string): Promise<OAuthClientBase | null> {\n    const ecCreator = this.container.get<ExecutionContextCreatorBackendService>(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService);\n    const repos = this.container.get<RepositoriesRegistryHandlerBackendService>(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService);\n    for (const resourceType of [CoreResourceType.OAUTH_CLIENTS_ORGANIZATION, CoreResourceType.OAUTH_CLIENTS_APPLICATION]) {\n      const ec = await ecCreator.createForInternalRepositoryOperation({ resourceType, operationIdentifier: CoreResourceOperation.READ });\n      const client = await repos.getRepository(resourceType).read<OAuthClientBase>(ec, { _id: clientId });\n      if (client) return client;\n    }\n    return null;\n  }\n\n  /**\n   * Project a registered client row onto the union arm that describes it.\n   *\n   * `scope` (an `ApiKeyScope`) becomes `tenancy`, and that translation is the reason this type exists\n   * at all — downstream, `tenancy` is the field the consent gate reads, and it can now express a\n   * client that belongs to NO tenant, which `ApiKeyScope` cannot.\n   */\n  private adaptRegisteredClient(record: OAuthClientBase): RegisteredAuthorizationClient {\n    // A DYNAMICALLY registered client is stored on the APPLICATION collection because it has no\n    // organization — and `scope: APPLICATION` otherwise means platform-operator first-party. Reading\n    // tenancy from `scope` alone would therefore hand a stranger the most trusted posture in the\n    // system purely because of where its row had to be filed. Provenance wins over storage.\n    const isDynamic = record.registrationOrigin === OAuthClientRegistrationOrigin.DYNAMIC;\n    return {\n      origin: AuthorizationClientOrigin.REGISTERED,\n      clientId: record._id,\n      name: record.name,\n      redirectUris: record.redirectUris ?? [],\n      // revocation-C: the RP-Initiated Logout post-logout allowlist. Same `?? []` fail-closed default as\n      // `redirectUris` — a registered client with none configured admits no `post_logout_redirect_uri`.\n      postLogoutRedirectUris: record.postLogoutRedirectUris ?? [],\n      // Identity scopes only for a self-registered client, whatever the row says. The row's\n      // `allowedScopes` was authored by the registration request — i.e. by the client itself — so\n      // honouring it would be the client granting itself permission. `/register` already refuses a\n      // wider request, and this is the second half of that invariant: even a row that acquired\n      // wider scopes by any other means cannot spend them.\n      allowedScopes: isDynamic ? OIDC_SUPPORTED_IDENTITY_SCOPES : (record.allowedScopes ?? []),\n      allowedGrants: record.allowedGrants ?? [],\n      tenancy: isDynamic\n        ? { kind: AuthorizationClientTenancy.UNAFFILIATED }\n        : record.scope === ApiKeyScope.ORGANIZATION\n          ? { kind: AuthorizationClientTenancy.ORGANIZATION, organizationId: (record as OAuthClientOrganization).organizationId }\n          : { kind: AuthorizationClientTenancy.APPLICATION },\n      // A self-registered client can never declare itself consent-free. Same reasoning as CIMD:\n      // self-certification by the party being trusted. The row's `requiresConsent` is ignored rather\n      // than trusted-and-checked, so a future write path that forgot to force it cannot leak.\n      declaresConsentFree: isDynamic ? false : record.requiresConsent !== true,\n      record,\n    };\n  }\n\n  /**\n   * Resolve a URL-shaped `client_id` through CIMD and project the document onto its union arm.\n   *\n   * ## The two ceilings this applies, and why they are not negotiable\n   *\n   * **Scopes are IDENTITY-ONLY.** A CIMD client asks for `openid`/`profile`/`email` and nothing else.\n   * A registered client's `allowedScopes` is a decision an operator or organization administrator\n   * made about a client THEY registered; a CIMD document is authored by the client itself, so reading\n   * a scope ceiling out of it would be the client granting itself permission. Identity scopes are the\n   * one set where that is harmless, because they authorize nothing: authorization in this framework\n   * is roles-only, and scope-as-authorization was removed in 2026-07-21.\n   *\n   * **Grants default to `authorization_code`.** The draft says the metadata values \"are the values\n   * defined in the OAuth Dynamic Client Registration Metadata OAuth Parameters registry\"\n   * (spec-cite: draft-ietf-oauth-client-id-metadata-document-00 § 4.1), so RFC 7591 § 2 supplies the\n   * default: \"If omitted, the default behavior is that the client will use only the\n   * `authorization_code` Grant Type.\" (spec-cite: RFC 7591 § 2). An UNKNOWN grant string is dropped\n   * rather than refused — this provider simply does not offer it, and refusing would break a client\n   * whose document legitimately advertises a grant to some OTHER authorization server.\n   */\n  private async resolveClientIdMetadataDocumentClient(\n    cimd: CimdClientMetadataBackendService,\n    clientId: string,\n  ): Promise<ClientIdMetadataDocumentAuthorizationClient> {\n    const resolution = await cimd.resolve(clientId, cimd.deploymentConfiguration());\n    if (resolution.kind !== 'ok') {\n      // assurance-control: WILDO.IDENTITY.CLIENT_IDENTITY_ASSERTION — a refused client-identity\n      // assertion. The reason vocabulary spans a misconfiguration (`host_not_allowed`) and an active\n      // attack (`ssrf_target_refused`); both arrive at the same endpoint from the same kind of\n      // unauthenticated caller, so only the reason tells them apart and an operator needs it\n      // queryable rather than buried in a log line. Fire-and-forget: auditing must never change the\n      // refusal it observes.\n      this.logger.warn('CIMD client resolution refused', { clientId, reason: resolution.reason, detail: resolution.detail });\n      const auditLogs = this.container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService);\n      void auditLogs.logCimdClientRefused({\n        clientId,\n        reason: resolution.reason,\n        detail: resolution.detail,\n      }).catch((auditError) => this.logger.warn('OAUTH_CIMD_CLIENT_REFUSED audit emit failed (non-fatal)', {\n        ...projectCaughtErrorLogFields(auditError),\n      }));\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_client', resolution.detail);\n    }\n    const metadata = resolution.metadata;\n    const declaredGrants = metadata.grant_types;\n    const allowedGrants = declaredGrants === undefined\n      ? [OAuthGrantType.AUTHORIZATION_CODE]\n      : declaredGrants.filter((grant): grant is OAuthGrantType => (Object.values(OAuthGrantType) as string[]).includes(grant));\n    return {\n      origin: AuthorizationClientOrigin.CLIENT_ID_METADATA_DOCUMENT,\n      clientId,\n      name: metadata.client_name,\n      redirectUris: metadata.redirect_uris,\n      // revocation-C: RP-Initiated Logout post-logout redirects, honoured for a CIMD client since\n      // 2026-09-08 (#464). The document's `post_logout_redirect_uris` is carried through and matched\n      // EXACTLY by `isRegisteredPostLogoutRedirectUri` — the same anti-open-redirect discipline as\n      // the authorization-code `redirect_uri` gate, and the same trust model, since both members\n      // come from the same client-authored document fetched through the same SSRF guard.\n      //\n      // A document that registers none still admits none: fail-closed empty, which is what every\n      // CIMD client got while the member was undeclared. What changed is that a client which DOES\n      // register one stops having its redirect silently ignored.\n      postLogoutRedirectUris: metadata.post_logout_redirect_uris ?? [],\n      allowedScopes: OIDC_SUPPORTED_IDENTITY_SCOPES,\n      allowedGrants,\n      tenancy: { kind: AuthorizationClientTenancy.UNAFFILIATED },\n      claimsOnlyLoopbackRedirects: cimd.claimsOnlyLoopbackRedirects(metadata),\n      metadata,\n    };\n  }\n\n  // ── helpers ───────────────────────────────────────────────────────────────\n  private assertAuthorizationCodeClient(client: ResolvedAuthorizationClient | null, redirectUri: string): asserts client {\n    if (!client) {\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_client', 'client not found or inactive');\n    }\n    // Status and expiry are properties of a ROW this application minted; a client metadata document\n    // has neither, and its liveness is the document's continued resolvability — already proven by the\n    // fact that we are holding it. Narrowed on the discriminant so the compiler, not a convention,\n    // is what keeps a row-only check off the CIMD arm.\n    if (client.origin === AuthorizationClientOrigin.REGISTERED) {\n      const record = client.record;\n      if (record.status !== OAuthClientStatus.ACTIVE || isCredentialExpired(record.expiresAt)) {\n        throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_client', 'client not found or inactive');\n      }\n    }\n    if (!client.allowedGrants.includes(OAuthGrantType.AUTHORIZATION_CODE)) {\n      throw this.oauthError(ErrorType.AUTHORIZATION, 'unauthorized_client', 'client is not authorized for the authorization_code grant');\n    }\n    // Anti-open-redirect (RFC 6749 §3.1.2): exact-match allowlist, no wildcards/substrings. For a CIMD\n    // client the allow-list is the document's own `redirect_uris`, which is exactly what the\n    // specification requires: authorization servers \"MUST validate redirect URIs presented in an\n    // authorization request against those in the metadata document\".\n    // spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Documents → Implementation Requirements\n    if (!client.redirectUris.includes(redirectUri)) {\n      throw this.oauthError(ErrorType.AUTHORIZATION, 'invalid_request', 'redirect_uri is not registered for this client');\n    }\n  }\n\n  private assertScopeAllowed(client: ResolvedAuthorizationClient, scope: string[]): void {\n    const allowed = client.allowedScopes;\n    const unauthorized = scope.filter((s) => !allowed.includes(s));\n    if (unauthorized.length > 0) {\n      throw this.oauthError(ErrorType.AUTHORIZATION, 'invalid_scope', `scope(s) not allowed: ${unauthorized.join(', ')}`);\n    }\n  }\n\n  // ── Compliance audit helpers (fire-and-forget; auditing must never affect the OAuth flow) ──\n\n  /**\n   * A-6 — emit `OAUTH_CODE_EXCHANGE_FAILED` for a rejected authorization_code exchange. `userId`/`resource`\n   * are present only for post-decode causes (never for the atomic replay/consume failure). Audit is pulled\n   * lazily via the container (mirrors this file's other lazy-service pattern) and never throws onto the flow.\n   */\n  private _auditCodeExchangeFailure(reason: OAuthCodeExchangeFailureReason, ctx: { clientId?: string; userId?: string; resource?: string }): void {\n    const auditLogs = this.container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService);\n    void auditLogs.logOAuthCodeExchangeFailed({\n      reason,\n      clientId: ctx.clientId,\n      userId: ctx.userId,\n      resource: ctx.resource,\n    }).catch((auditError) => this.logger.warn('OAUTH_CODE_EXCHANGE_FAILED audit emit failed (non-fatal)', {\n      ...projectCaughtErrorLogFields(auditError),\n    }));\n  }\n\n  /**\n   * A-7 — emit the `MACHINE_AUTH_FAILED` audit for a confidential-client authentication failure on the\n   * code / refresh / revoke secret front (the code-flow twin of the existing client_credentials front).\n   * Never the raw secret — only the human-routable prefix (`oc_org_` / `oc_app_`), derived the same way as\n   * the client_credentials emitter. No request/IP is in scope at these service methods.\n   */\n  private _auditConfidentialClientSecretFailure(presentedSecret: string | undefined): void {\n    const credentialPrefix = presentedSecret?.startsWith('oc_org_')\n      ? 'oc_org_'\n      : presentedSecret?.startsWith('oc_app_') ? 'oc_app_' : undefined;\n    const auditLogs = this.container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService);\n    void auditLogs.logMachineAuthFailed({\n      credentialKind: 'oauth_client',\n      credentialPrefix,\n      reason: 'invalid_client',\n    }).catch((auditError) => this.logger.warn('MACHINE_AUTH_FAILED audit emit failed (non-fatal)', {\n      ...projectCaughtErrorLogFields(auditError),\n    }));\n  }\n\n  /**\n   * A-3 — emit `OAUTH_CONSENT_GRANT_PERSISTED` for a created (`isNewGrant`) or widened persistent consent\n   * grant. `scopes` is the set the grant covers AFTER the write (the union on a widen). Fire-and-forget.\n   */\n  private _auditConsentGrantPersisted(userId: string, clientId: string, resource: string | undefined, scopes: string[], isNewGrant: boolean): void {\n    const auditLogs = this.container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService);\n    void auditLogs.logOAuthConsentGrantPersisted({\n      userId,\n      clientId,\n      resource,\n      scopes,\n      isNewGrant,\n    }).catch((auditError) => this.logger.warn('OAUTH_CONSENT_GRANT_PERSISTED audit emit failed (non-fatal)', {\n      ...projectCaughtErrorLogFields(auditError),\n    }));\n  }\n\n  /**\n   * F-OIDC-11 confidential-client authentication. For a client whose `tokenEndpointAuthMethod` is not\n   * `NONE`, the presented `client_secret` MUST resolve to the client's current `hashedSecret` (or its\n   * `previousHashedSecret` while the rotation-grace window is open — mirroring the client_credentials\n   * secret front, so a confidential client can rotate without a hard cutover). A PUBLIC (`NONE`) client\n   * requires no secret and is a no-op. `tokenEndpointAuthMethod` is `?? NONE`-defaulted so a client row\n   * persisted before this field existed reads as public (back-compat). Fail-closed: a confidential\n   * client with a missing or wrong secret is rejected `invalid_client`.\n   */\n  private assertConfidentialClientSecret(client: OAuthClientBase, presentedClientSecret: string | undefined): void {\n    if (!isConfidentialTokenEndpointAuthMethod(client.tokenEndpointAuthMethod ?? OAuthTokenEndpointAuthMethod.NONE)) {\n      return;\n    }\n    if (!presentedClientSecret) {\n      // A-7: a confidential client that presented NO secret failed authentication — audit it (the\n      // code-flow twin of the client_credentials MACHINE_AUTH_FAILED front).\n      this._auditConfidentialClientSecretFailure(presentedClientSecret);\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_client', 'this confidential client must authenticate with its client_secret');\n    }\n    const presentedHash = hashOAuthClientSecret(presentedClientSecret);\n    // security-decision (accepted-low — H-57, see the coverage plan § \"ACCEPTED RISK\"): the `===` secret\n    // compares below are not constant-time, but both operands are fixed-length SHA-256 digests of a 256-bit\n    // secret — a timing side-channel leaks nothing brute-forceable; `crypto.timingSafeEqual` is not warranted.\n    const matchesCurrent = !!client.hashedSecret && presentedHash === client.hashedSecret;\n    const matchesRotationGrace = !!client.previousHashedSecret\n      && presentedHash === client.previousHashedSecret\n      && isRotationGraceWindowOpen(client.previousSecretInvalidationDate);\n    if (!matchesCurrent && !matchesRotationGrace) {\n      // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — a confidential-client secret failure is an\n      // authentication failure, audited as the code-flow twin of the client_credentials MACHINE_AUTH_FAILED\n      // front (never the raw secret; carries the credential prefix).\n      // security-decision (accepted-low — D11, see the coverage plan § \"ACCEPTED RISK\"): the code/refresh/revoke\n      // secret fronts are DELIBERATELY not per-endpoint rate-limited — 256-bit secrets make online guessing\n      // infeasible and the global ~1000/min/IP limiter caps DoS. This front is now audited (above), so a lockout\n      // counter is cheap to add IF the decision is ever revisited.\n      this._auditConfidentialClientSecretFailure(presentedClientSecret);\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_client', 'client authentication failed');\n    }\n  }\n\n  /**\n   * F-OIDC-6 (RFC 7009 §2.1): authenticate a client that presents credentials at the token-revocation\n   * endpoint. The presented `client_secret` MUST match the client's current `hashedSecret` (or its\n   * rotation-grace `previousHashedSecret`) and the client must be ACTIVE — else `invalid_client`. Called\n   * ONLY when the revoke request actually carries credentials; an unauthenticated bearer revoke stays\n   * allowed (RFC 7009 permits it for a public client, and the refresh token itself is the bearer\n   * credential). NOTE: Wildo's revoke operates on first-party user refresh tokens that no OAuth client\n   * owns, so there is no client↔token binding to additionally enforce — this adds the client-authentication\n   * capability §2.1 expects, and closes the \"no client authentication\" finding.\n   *\n   * spec-cite: RFC 7009 §2.1 — \"The authorization server first validates the client credentials (in case\n   * of a confidential client) and then verifies whether the token was issued to the client making the\n   * revocation request.\" The parenthetical is what permits an unauthenticated (public-client) revoke; the\n   * second clause is the binding check, which is N/A here for the reason stated above.\n   * The quoted \"no client authentication\" is NOT specification text — it is the name of the internal audit\n   * finding this method closes. https://www.rfc-editor.org/rfc/rfc7009#section-2.1\n   */\n  public async verifyPresentedClientSecret(clientId: string, clientSecret: string): Promise<void> {\n    // REGISTERED clients only, and deliberately so: a CIMD client has no secret this server ever\n    // minted, so a URL-shaped client_id here resolves to nothing and fails `invalid_client` — which\n    // is the correct answer, not a gap. Routing it through the CIMD resolver instead would make an\n    // outbound fetch on an unauthenticated revoke request for no benefit.\n    const client = await this.readRegisteredClientById(clientId);\n    if (!client || client.status !== OAuthClientStatus.ACTIVE || isCredentialExpired(client.expiresAt)) {\n      // A-7: confidential-client authentication failure on the refresh/revoke secret front (the client did\n      // not resolve or is inactive) — audited as the code-flow twin of MACHINE_AUTH_FAILED.\n      this._auditConfidentialClientSecretFailure(clientSecret);\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_client', 'client not found or inactive');\n    }\n    const presentedHash = hashOAuthClientSecret(clientSecret);\n    // security-decision (accepted-low, see the coverage plan § \"ACCEPTED RISK\"): this refresh/revoke secret\n    // front is DELIBERATELY not per-endpoint rate-limited (D11) and its `===` compares are not constant-time\n    // (H-57) — 256-bit secrets + the global IP limiter make brute-force infeasible, and a fixed-length SHA-256\n    // compare leaks no exploitable timing. Revisit conditions are in the plan.\n    const matchesCurrent = !!client.hashedSecret && presentedHash === client.hashedSecret;\n    const matchesRotationGrace = !!client.previousHashedSecret\n      && presentedHash === client.previousHashedSecret\n      && isRotationGraceWindowOpen(client.previousSecretInvalidationDate);\n    if (!matchesCurrent && !matchesRotationGrace) {\n      // A-7: a wrong secret on the refresh/revoke front — audited as the code-flow twin of MACHINE_AUTH_FAILED.\n      // assurance-control: WILDO.AUDIT.SECURITY_EVENT — confidential-client authentication failure.\n      this._auditConfidentialClientSecretFailure(clientSecret);\n      throw this.oauthError(ErrorType.AUTHENTICATION, 'invalid_client', 'client authentication failed');\n    }\n  }\n\n  // ── Persistent consent grants (\"remember this app\") ────────────────────────\n  /**\n   * PERSISTENT-CONSENT lookup (Item 3). Returns true iff a stored, non-expired grant for\n   * `(userId, clientId, resource)` already covers EVERY requested scope — in which case\n   * `/oauth/authorize` skips the consent prompt for a `requiresConsent` client. Fail-closed: no grant,\n   * insufficient scopes (a requested scope not in the grant), expiry, or any read error ⇒ false, so the\n   * user is re-prompted. Scope matching is SUBSET, never expansion.\n   */\n  public async hasCoveringConsentGrant(userId: string, clientId: string, resource: string | undefined, requestedScopes: string[]): Promise<boolean> {\n    try {\n      const grant = await this.readConsentGrant(userId, clientId, resource);\n      if (!grant) return false;\n      if (grant.expiresAt && new Date(grant.expiresAt).getTime() <= Date.now()) return false;\n      const granted = new Set(grant.scopes ?? []);\n      return requestedScopes.every((s) => granted.has(s));\n    } catch {\n      return false;\n    }\n  }\n\n  /**\n   * Store or widen the user's persistent consent grant when they approve WITH \"remember this app\".\n   * Upserts on the `(userId, clientId, resource)` business key: widen an existing grant's scopes to the\n   * UNION of prior + newly-approved, else create a fresh grant. System write (createAsSystem /\n   * updateAsSystem — the CREATE DTO strips the context FK `userId`, re-attached from the schema allowlist).\n   */\n  public async upsertConsentGrant(userId: string, clientId: string, resource: string | undefined, scopes: string[]): Promise<void> {\n    const systemAccess = this.container.get<SystemAccessBackendService>(SAAS_SERVICE_TYPES.SystemAccessService);\n    const existing = await this.readConsentGrant(userId, clientId, resource);\n    if (existing) {\n      await this.widenConsentGrantScopes(systemAccess, existing, scopes);\n      return;\n    }\n    // #465: every affirmative consent carries an expiry. The field had a reader and no writer, so a\n    // remembered approval lived until the person revoked it while reading to an operator as a policy\n    // knob that existed.\n    const data: Record<string, unknown> = { userId, clientId, scopes, expiresAt: this.consentGrantExpiry() };\n    if (resource) data.resource = resource;\n    try {\n      await systemAccess.createAsSystem(CoreResourceType.OAUTH_CONSENT_GRANTS, data);\n      // A-3: a NEW persistent consent grant was created (\"remember this app\") — a durable delegated-authority\n      // artifact that lets future authorize flows SKIP the prompt, so its creation is a first-class audit\n      // concern. assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — persistent delegated-access authorization.\n      this._auditConsentGrantPersisted(userId, clientId, resource, scopes, true);\n    } catch (error) {\n      // CONCURRENCY — race-safe upsert on the `(userId, clientId, resource)` business key.\n      // Two approvals for the SAME app+resource can interleave: both `readConsentGrant` above return null,\n      // both reach here, and the compound UNIQUE index (which the runtime really emits — proven by the\n      // consent-grant persistence integration test) rejects the SECOND insert with `ErrorType.CONFLICT`.\n      // That is NOT a failure of the \"remember this app\" intent — re-read the grant the winning racer created\n      // and widen it to the union, so both converge on ONE grant carrying the union of their approved scopes.\n      // Without this, the losing approval surfaced an unhandled 5xx (the bug this closes).\n      // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — the user's consent is recorded exactly once, never lost to a race.\n      if (!isWildoBackendError(error) || error.type !== ErrorType.CONFLICT) throw error;\n      const winner = await this.readConsentGrant(userId, clientId, resource);\n      if (!winner) throw error; // a CONFLICT on some OTHER key (not ours) — surface it rather than mask it\n      await this.widenConsentGrantScopes(systemAccess, winner, scopes);\n    }\n  }\n\n  /**\n   * When a consent granted NOW should lapse (#465).\n   *\n   * The operator's `auth.consentGrantLifetimeDays` when authored, else the framework default — whose\n   * reasoning is at `OAUTH_CONSENT_GRANT_DEFAULT_LIFETIME_DAYS`. There is no \"never\": that was the\n   * state this replaced.\n   *\n   * Reads config through the container and TOLERATES its absence, deliberately. A consent the user\n   * has just given must not fail to persist because a policy lookup threw — losing the grant is a\n   * worse outcome than applying the default, and the default is the safer of the two anyway.\n   */\n  private consentGrantExpiry(): Date {\n    let lifetimeDays = OAUTH_CONSENT_GRANT_DEFAULT_LIFETIME_DAYS;\n    try {\n      const configured = this.container.get<AppConfigurationService>(SAAS_SERVICE_TYPES.AppConfigService)\n        ?.config?.auth?.consentGrantLifetimeDays;\n      if (typeof configured === 'number') lifetimeDays = configured;\n    } catch {\n      // Unbound in a harness that never looks at consent policy — the default stands.\n    }\n    return new Date(Date.now() + lifetimeDays * 24 * 60 * 60 * 1000);\n  }\n\n  /**\n   * Widen an existing consent grant's scopes to the UNION of its current scopes + the newly-approved set,\n   * via a system update. Shared by the initial-existing path and the concurrency-recovery path so the\n   * union semantics never drift between them.\n   */\n  private async widenConsentGrantScopes(systemAccess: SystemAccessBackendService, existing: OAuthConsentGrant, scopes: string[]): Promise<void> {\n    const merged = Array.from(new Set([...(existing.scopes ?? []), ...scopes]));\n    // The expiry RESTARTS on a widen (#465): a widen only happens because the user approved again,\n    // and a re-affirmation that left the old clock running would expire a consent the person gave\n    // moments ago. Both callers of this method — the initial-existing path and the\n    // concurrency-recovery path — are affirmative acts, so both refresh.\n    await systemAccess.updateAsSystem(CoreResourceType.OAUTH_CONSENT_GRANTS, existing._id, {\n      scopes: merged,\n      expiresAt: this.consentGrantExpiry(),\n    });\n    // A-3: an existing persistent consent grant was WIDENED (scopes unioned). Shared by the initial-existing\n    // path AND the concurrency-recovery path, so both audit the durable-authority change once.\n    // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — persistent delegated-access authorization (widen).\n    this._auditConsentGrantPersisted(existing.userId, existing.clientId, existing.resource, merged, false);\n  }\n\n  /**\n   * Read the single grant for the `(userId, clientId, resource)` business key, or null. A resource-less\n   * grant (OIDC-only login) is stored with `resource` absent; the `?? null` filter matches it (Mongo\n   * `{ resource: null }` matches a null OR absent field), while a resource-bound grant matches exactly.\n   */\n  private async readConsentGrant(userId: string, clientId: string, resource: string | undefined): Promise<OAuthConsentGrant | null> {\n    const ecCreator = this.container.get<ExecutionContextCreatorBackendService>(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService);\n    const repos = this.container.get<RepositoriesRegistryHandlerBackendService>(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService);\n    const ec = await ecCreator.createForInternalRepositoryOperation({\n      resourceType: CoreResourceType.OAUTH_CONSENT_GRANTS,\n      operationIdentifier: CoreResourceOperation.READ,\n    });\n    return repos\n      .getRepository(CoreResourceType.OAUTH_CONSENT_GRANTS)\n      .read<OAuthConsentGrant>(ec, { userId, clientId, resource: resource ?? null });\n  }\n\n  private oauthError(type: ErrorType, oauthError: string, detail: string) {\n    return this.errorBuilder.buildError(type, undefined, {\n      customMessageReference: type === ErrorType.AUTHENTICATION\n        ? ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID\n        : ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED,\n      context: { oauthError, detail },\n    });\n  }\n}\n"]}

package/dist/esm/security/authentications/services/oidc-user-claims.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-user-claims.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/oidc-user-claims.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAkB7F;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAAqD,CAAC;AAElH;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,EAAE,SAAS,MAAM,EAQ7D,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,qBACa,4BAA4B;IAEC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADH,SAAS,EAAE,SAAS,EACvB,MAAM,EAAE,aAAa;IAG3E;;;;;;;;;;OAUG;IACU,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CA+D1G"}
+{"version":3,"file":"oidc-user-claims.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/services/oidc-user-claims.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAkB7F;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAAqD,CAAC;AAElH;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,EAAE,SAAS,MAAM,EAQ7D,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,qBACa,4BAA4B;IAEC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADH,SAAS,EAAE,SAAS,EACvB,MAAM,EAAE,aAAa;IAG3E;;;;;;;;;;OAUG;IACU,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CA+D1G"}

package/dist/esm/security/authentications/services/resolve-active-member-orgs.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-active-member-orgs.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/resolve-active-member-orgs.backend.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAsB,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI;;;;;;;;;;;;;;;;;GAiBG;AAEH,wBAAsB,yBAAyB,CAC7C,mBAAmB,EAAE,0BAA0B,EAC/C,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,aAAa,EAAE,CAAC,CAqB1B"}
+{"version":3,"file":"resolve-active-member-orgs.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/services/resolve-active-member-orgs.backend.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAsB,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI;;;;;;;;;;;;;;;;;GAiBG;AAEH,wBAAsB,yBAAyB,CAC7C,mBAAmB,EAAE,0BAA0B,EAC/C,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,aAAa,EAAE,CAAC,CAqB1B"}

package/dist/esm/security/authentications/services/utils/__tests__/mock-auth-user-lookup.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mock-auth-user-lookup.service.d.ts","sourceRoot":"","sources":["../../../../../../../../src/security/authentications/services/utils/__tests__/mock-auth-user-lookup.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,kBAAkB,CAAC;AAI1B,qBACa,yBAAyB;IACpC,OAAO,CAAC,aAAa,CAAiB;IACtC,OAAO,CAAC,gBAAgB,CAAiB;IACzC,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,eAAe,CAAM;IAC7B,OAAO,CAAC,yBAAyB,CAAiB;IAGlD,kBAAkB,8CAAyC;IAE3D,eAAe,8CAA4C;IAE3D,YAAY,6CAA2C;IAEvD,YAAY,6CAAuE;IAEnF,0BAA0B,8CAAqD;IAE/E,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAIzC,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAItC,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAI1C,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIvC,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAInD,KAAK,IAAI,IAAI;CAYd"}
+{"version":3,"file":"mock-auth-user-lookup.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/utils/__tests__/mock-auth-user-lookup.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,kBAAkB,CAAC;AAI1B,qBACa,yBAAyB;IACpC,OAAO,CAAC,aAAa,CAAiB;IACtC,OAAO,CAAC,gBAAgB,CAAiB;IACzC,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,eAAe,CAAM;IAC7B,OAAO,CAAC,yBAAyB,CAAiB;IAGlD,kBAAkB,8CAAyC;IAE3D,eAAe,8CAA4C;IAE3D,YAAY,6CAA2C;IAEvD,YAAY,6CAAuE;IAEnF,0BAA0B,8CAAqD;IAE/E,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAIzC,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAItC,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAI1C,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIvC,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAInD,KAAK,IAAI,IAAI;CAYd"}

package/dist/esm/security/authentications/services/utils/auth-controller.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-controller.utils.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/utils/auth-controller.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wFAAwF,CAAC;AAC3I,OAAO,EAAsB,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE/E;;;;;;;;GAQG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,yBAAyB,oBAAoB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,yBAAyB,iBAA+B,CAAC;AAEtE;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,6BAA6B,yBAAyB,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,YAAqB,CAAC;AAEhE,qBAAa,mBAAmB;IAC9B;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,gCAAgC,CAAC,cAAc,EAAE,MAAM,GAAG,4BAA4B,GAAG,SAAS;IA8CzG;;;;;;OAMG;IACH,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAepG,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAI9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACH,MAAM,CAAC,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IAc3D;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,oBAAoB,CAAC,cAAc,EAAE,kBAAkB,GAAG,OAAO;IAKxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,MAAM,CAAC,gBAAgB,CACrB,GAAG,EAAE,QAAQ,EACb,YAAY,EAAE,MAAM,EACpB,0BAA0B,EAAE,MAAM,EAClC,cAAc,EAAE,kBAAkB,GACjC,IAAI;IAUP;;;;;;;;;OASG;IACH,MAAM,CAAC,kBAAkB,CACvB,GAAG,EAAE,QAAQ,EACb,cAAc,EAAE,kBAAkB,GACjC,IAAI;IAUP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,MAAM,CAAC,6BAA6B,CAClC,GAAG,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GACnD,MAAM,GAAG,IAAI;IAQhB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,yBAAyB,CAC9B,GAAG,EAAE,QAAQ,EACb,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,cAAc,EAAE,kBAAkB,EAClC,aAAa,EAAE,MAAM,GACpB,IAAI;IAWP;;;;;;OAMG;IACH,MAAM,CAAC,2BAA2B,CAChC,GAAG,EAAE,QAAQ,EACb,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,cAAc,EAAE,kBAAkB,GACjC,IAAI;IAWP;;;;;;;;;OASG;IACH,MAAM,CAAC,iCAAiC,CACtC,GAAG,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GACnD,MAAM,GAAG,IAAI;CAQjB"}
+{"version":3,"file":"auth-controller.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/utils/auth-controller.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wFAAwF,CAAC;AAC3I,OAAO,EAAsB,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE/E;;;;;;;;GAQG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,yBAAyB,oBAAoB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,yBAAyB,iBAA+B,CAAC;AAEtE;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,6BAA6B,yBAAyB,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,YAAqB,CAAC;AAEhE,qBAAa,mBAAmB;IAC9B;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,gCAAgC,CAAC,cAAc,EAAE,MAAM,GAAG,4BAA4B,GAAG,SAAS;IA8CzG;;;;;;OAMG;IACH,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAepG,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAI9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACH,MAAM,CAAC,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IAc3D;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,oBAAoB,CAAC,cAAc,EAAE,kBAAkB,GAAG,OAAO;IAKxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,MAAM,CAAC,gBAAgB,CACrB,GAAG,EAAE,QAAQ,EACb,YAAY,EAAE,MAAM,EACpB,0BAA0B,EAAE,MAAM,EAClC,cAAc,EAAE,kBAAkB,GACjC,IAAI;IAUP;;;;;;;;;OASG;IACH,MAAM,CAAC,kBAAkB,CACvB,GAAG,EAAE,QAAQ,EACb,cAAc,EAAE,kBAAkB,GACjC,IAAI;IAUP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,MAAM,CAAC,6BAA6B,CAClC,GAAG,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GACnD,MAAM,GAAG,IAAI;IAQhB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,yBAAyB,CAC9B,GAAG,EAAE,QAAQ,EACb,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,cAAc,EAAE,kBAAkB,EAClC,aAAa,EAAE,MAAM,GACpB,IAAI;IAWP;;;;;;OAMG;IACH,MAAM,CAAC,2BAA2B,CAChC,GAAG,EAAE,QAAQ,EACb,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,cAAc,EAAE,kBAAkB,GACjC,IAAI;IAWP;;;;;;;;;OASG;IACH,MAAM,CAAC,iCAAiC,CACtC,GAAG,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GACnD,MAAM,GAAG,IAAI;CAQjB"}

package/dist/esm/security/authentications/services/utils/auth-credential-ops.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-credential-ops.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/utils/auth-credential-ops.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,EAAoB,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,qBACa,+BAA+B;IAIL,OAAO,CAAC,QAAQ,CAAC,MAAM;IACC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IASnD,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAbtF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACG,uBAAuB,EAAE,qCAAqC,EASzE,mBAAmB,EAAE,0BAA0B;IAUlH,6DAA6D;IACvD,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAI9F;;;;;;;;;;;;;;;;;OAiBG;IACG,UAAU,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAQpI;;;;OAIG;IACG,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IASvH;;;OAGG;IACG,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5E;;;OAGG;IACG,qBAAqB,CACzB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,kBAAkB,EACzB,IAAI,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,IAAI,CAAA;KAAE,GACjC,OAAO,CAAC,IAAI,CAAC;IAYhB;;;OAGG;IACG,sBAAsB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWtF;;;OAGG;IACG,iBAAiB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAcxG;;;OAGG;IACG,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAQzF;;;;;;;;;;;;;;;;OAgBG;IACG,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBxG;;;OAGG;IACG,cAAc,CAClB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,EAAE,CAAA;KAAE,GAC5D,OAAO,CAAC,IAAI,CAAC;IAShB;;;OAGG;IACG,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtF;;;OAGG;IACG,iBAAiB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhH"}
+{"version":3,"file":"auth-credential-ops.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/utils/auth-credential-ops.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,EAAoB,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,qBACa,+BAA+B;IAIL,OAAO,CAAC,QAAQ,CAAC,MAAM;IACC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IASnD,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAbtF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACG,uBAAuB,EAAE,qCAAqC,EASzE,mBAAmB,EAAE,0BAA0B;IAUlH,6DAA6D;IACvD,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAI9F;;;;;;;;;;;;;;;;;OAiBG;IACG,UAAU,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAQpI;;;;OAIG;IACG,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IASvH;;;OAGG;IACG,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5E;;;OAGG;IACG,qBAAqB,CACzB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,kBAAkB,EACzB,IAAI,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,IAAI,CAAA;KAAE,GACjC,OAAO,CAAC,IAAI,CAAC;IAYhB;;;OAGG;IACG,sBAAsB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWtF;;;OAGG;IACG,iBAAiB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAcxG;;;OAGG;IACG,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAQzF;;;;;;;;;;;;;;;;OAgBG;IACG,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBxG;;;OAGG;IACG,cAAc,CAClB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,EAAE,CAAA;KAAE,GAC5D,OAAO,CAAC,IAAI,CAAC;IAShB;;;OAGG;IACG,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtF;;;OAGG;IACG,iBAAiB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhH"}

package/dist/esm/security/authentications/services/utils/auth-policy-resolution.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-policy-resolution.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/utils/auth-policy-resolution.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EACV,gBAAgB,EACjB,MAAM,6DAA6D,CAAC;AAErE;;;;GAIG;AACH,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACpC,iBAAiB,CAAC,EAAE,kBAAkB,GAAG,IAAI,GAC5C,kBAAkB,GAAG,IAAI,CA6B3B;AAED;;;;;;;GAOG;AACH,wBAAgB,6CAA6C,CAC3D,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAiCT"}
+{"version":3,"file":"auth-policy-resolution.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/utils/auth-policy-resolution.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EACV,gBAAgB,EACjB,MAAM,6DAA6D,CAAC;AAErE;;;;GAIG;AACH,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACpC,iBAAiB,CAAC,EAAE,kBAAkB,GAAG,IAAI,GAC5C,kBAAkB,GAAG,IAAI,CA6B3B;AAED;;;;;;;GAOG;AACH,wBAAgB,6CAA6C,CAC3D,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAiCT"}

package/dist/esm/security/authentications/services/utils/auth-policy-resolution.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-policy-resolution.backend.utils.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/utils/auth-policy-resolution.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,8BAA8B,EAC9B,2BAA2B,EAC3B,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,uBAAuB,CAAC;AAM/B;;;;GAIG;AACH,MAAM,UAAU,oCAAoC,CAClD,MAAwB,EACxB,QAAgB,EAChB,gBAAoC,EACpC,iBAA6C;IAE7C,MAAM,SAAS,GACb,iBAAiB,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;IAC1D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,sBAAsB,GAAG,gBAAgB;QAC7C,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,gBAAgB,CAAC;QAC9C,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,YAAY,GAAG,sBAAsB,EAAE,aAAa,CAAC;IAC3D,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAEpD,MAAM,QAAQ,GAAG,iBAAiB,CAAC;QACjC,YAAY,EAAE,SAAS;QACvB,YAAY,EAAE,CAAC,YAAY,CAAC;QAC5B,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB;QACpD,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB;KACvD,CAAC,CAAC;IAEH,OAAO;QACL,GAAG,SAAS;QACZ,kBAAkB,EAChB,QAAQ,CAAC,kBAA8D;QACzE,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,8FAA8F;QAC9F,6FAA6F;QAC7F,gGAAgG;QAChG,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6CAA6C,CAC3D,MAAwB;IAExB,KAAK,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CACzD,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAC/B,EAAE,CAAC;QACF,MAAM,gBAAgB,GAAG,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC;QACpD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,iBAAiB;YAAE,SAAS;QAEjC,MAAM,WAAW,GAAG,2BAA2B,CAC7C,MAAM,CAAC,SAAS,EAChB,gBAAgB,EAChB,EAAE,EACF,8BAA8B,CAAC,UAAU,CAC1C,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,OAAO;YAAE,SAAS;QAEnC,MAAM,eAAe,GAAG,oCAAoC,CAC1D,MAAM,EACN,iBAAiB,EACjB,gBAAgB,CACjB,CAAC;QACF,IACE,eAAe,EAAE,YAAY,CAAC,cAAc,CAAC,QAAQ,CACnD,UAAU,CAAC,QAAQ,CACpB;eACE,iBAAiB,CAClB,eAAe,CAAC,kBAAkB,CACnC,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAC1B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import {\n  AuthMethod,\n  RegistrationAcquisitionChannel,\n  evaluateUserTypeAcquisition,\n  getEnabledMethods,\n  resolveAuthConfig,\n  type UserTypeAuthPolicy,\n} from '@wildo-ai/saas-models';\n\nimport type {\n  AppConfiguration,\n} from '~wildo-backend-lib/config/models/app-config.backend.schemas';\n\n/**\n * Resolve one user type's effective policy for a hypothetical member of an\n * organization type. This is the shared no-I/O core used by both runtime\n * invitation policy and startup persistence-boundary reachability.\n */\nexport function resolveAuthPolicyForOrganizationType(\n  config: AppConfiguration,\n  userType: string,\n  organizationType: string | undefined,\n  rawPolicyOverride?: UserTypeAuthPolicy | null,\n): UserTypeAuthPolicy | null {\n  const rawPolicy =\n    rawPolicyOverride ?? config.userTypes?.[userType]?.auth;\n  if (!rawPolicy) return null;\n\n  const organizationDefinition = organizationType\n    ? config.organizationTypes?.[organizationType]\n    : undefined;\n  const orgOverrides = organizationDefinition?.authOverrides;\n  if (!orgOverrides || !config.auth) return rawPolicy;\n\n  const resolved = resolveAuthConfig({\n    userTypeAuth: rawPolicy,\n    orgOverrides: [orgOverrides],\n    orgAuthMethodPolicy: config.auth.orgAuthMethodPolicy,\n    expandableOrgMethods: config.auth.expandableOrgMethods,\n  });\n\n  return {\n    ...rawPolicy,\n    authMethodsEnabled:\n      resolved.authMethodsEnabled as UserTypeAuthPolicy['authMethodsEnabled'],\n    mfaPolicy: resolved.mfaPolicy,\n    passwordPolicy: resolved.passwordPolicy,\n    // #527. Spread first, then overwrite: `stepUpAuth` is optional on the user-type policy, and a\n    // user type declaring none resolves to `undefined` here — which is the same value the spread\n    // already carried, so an organisation cannot introduce a gate the application never configured.\n    stepUpAuth: resolved.stepUpAuth,\n  };\n}\n\n/**\n * Whether a brand-new invitation accept can persist a password credential.\n *\n * Existing holders keep the acceptance boundary reachable but cannot set a\n * password through this flow. For a new user, every type granted by the\n * organization must allow INVITATION acquisition, while the first granted type\n * is the governing auth policy used by the runtime accept flow.\n */\nexport function isPublicInvitationPasswordCredentialReachable(\n  config: AppConfiguration,\n): boolean {\n  for (const [organizationType, definition] of Object.entries(\n    config.organizationTypes ?? {},\n  )) {\n    const grantedUserTypes = definition.userTypes ?? [];\n    const governingUserType = grantedUserTypes[0];\n    if (!governingUserType) continue;\n\n    const acquisition = evaluateUserTypeAcquisition(\n      config.userTypes,\n      grantedUserTypes,\n      [],\n      RegistrationAcquisitionChannel.INVITATION,\n    );\n    if (!acquisition.allowed) continue;\n\n    const effectivePolicy = resolveAuthPolicyForOrganizationType(\n      config,\n      governingUserType,\n      organizationType,\n    );\n    if (\n      effectivePolicy?.registration.allowedMethods.includes(\n        AuthMethod.PASSWORD,\n      )\n      && getEnabledMethods(\n        effectivePolicy.authMethodsEnabled,\n      ).has(AuthMethod.PASSWORD)\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n"]}
+{"version":3,"file":"auth-policy-resolution.backend.utils.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/utils/auth-policy-resolution.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,8BAA8B,EAC9B,2BAA2B,EAC3B,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,uBAAuB,CAAC;AAM/B;;;;GAIG;AACH,MAAM,UAAU,oCAAoC,CAClD,MAAwB,EACxB,QAAgB,EAChB,gBAAoC,EACpC,iBAA6C;IAE7C,MAAM,SAAS,GACb,iBAAiB,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;IAC1D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,sBAAsB,GAAG,gBAAgB;QAC7C,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,gBAAgB,CAAC;QAC9C,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,YAAY,GAAG,sBAAsB,EAAE,aAAa,CAAC;IAC3D,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAEpD,MAAM,QAAQ,GAAG,iBAAiB,CAAC;QACjC,YAAY,EAAE,SAAS;QACvB,YAAY,EAAE,CAAC,YAAY,CAAC;QAC5B,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB;QACpD,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB;KACvD,CAAC,CAAC;IAEH,OAAO;QACL,GAAG,SAAS;QACZ,kBAAkB,EAChB,QAAQ,CAAC,kBAA8D;QACzE,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,8FAA8F;QAC9F,6FAA6F;QAC7F,gGAAgG;QAChG,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6CAA6C,CAC3D,MAAwB;IAExB,KAAK,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CACzD,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAC/B,EAAE,CAAC;QACF,MAAM,gBAAgB,GAAG,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC;QACpD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,iBAAiB;YAAE,SAAS;QAEjC,MAAM,WAAW,GAAG,2BAA2B,CAC7C,MAAM,CAAC,SAAS,EAChB,gBAAgB,EAChB,EAAE,EACF,8BAA8B,CAAC,UAAU,CAC1C,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,OAAO;YAAE,SAAS;QAEnC,MAAM,eAAe,GAAG,oCAAoC,CAC1D,MAAM,EACN,iBAAiB,EACjB,gBAAgB,CACjB,CAAC;QACF,IACE,eAAe,EAAE,YAAY,CAAC,cAAc,CAAC,QAAQ,CACnD,UAAU,CAAC,QAAQ,CACpB;eACE,iBAAiB,CAClB,eAAe,CAAC,kBAAkB,CACnC,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAC1B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import {\n  AuthMethod,\n  RegistrationAcquisitionChannel,\n  evaluateUserTypeAcquisition,\n  getEnabledMethods,\n  resolveAuthConfig,\n  type UserTypeAuthPolicy,\n} from '@wildo-ai/saas-models';\n\nimport type {\n  AppConfiguration,\n} from '~wildo-backend-lib/config/models/app-config.backend.schemas';\n\n/**\n * Resolve one user type's effective policy for a hypothetical member of an\n * organization type. This is the shared no-I/O core used by both runtime\n * invitation policy and startup persistence-boundary reachability.\n */\nexport function resolveAuthPolicyForOrganizationType(\n  config: AppConfiguration,\n  userType: string,\n  organizationType: string | undefined,\n  rawPolicyOverride?: UserTypeAuthPolicy | null,\n): UserTypeAuthPolicy | null {\n  const rawPolicy =\n    rawPolicyOverride ?? config.userTypes?.[userType]?.auth;\n  if (!rawPolicy) return null;\n\n  const organizationDefinition = organizationType\n    ? config.organizationTypes?.[organizationType]\n    : undefined;\n  const orgOverrides = organizationDefinition?.authOverrides;\n  if (!orgOverrides || !config.auth) return rawPolicy;\n\n  const resolved = resolveAuthConfig({\n    userTypeAuth: rawPolicy,\n    orgOverrides: [orgOverrides],\n    orgAuthMethodPolicy: config.auth.orgAuthMethodPolicy,\n    expandableOrgMethods: config.auth.expandableOrgMethods,\n  });\n\n  return {\n    ...rawPolicy,\n    authMethodsEnabled:\n      resolved.authMethodsEnabled as UserTypeAuthPolicy['authMethodsEnabled'],\n    mfaPolicy: resolved.mfaPolicy,\n    passwordPolicy: resolved.passwordPolicy,\n    // #527. Spread first, then overwrite: `stepUpAuth` is optional on the user-type policy, and a\n    // user type declaring none resolves to `undefined` here — which is the same value the spread\n    // already carried, so an organisation cannot introduce a gate the application never configured.\n    stepUpAuth: resolved.stepUpAuth,\n  };\n}\n\n/**\n * Whether a brand-new invitation accept can persist a password credential.\n *\n * Existing holders keep the acceptance boundary reachable but cannot set a\n * password through this flow. For a new user, every type granted by the\n * organization must allow INVITATION acquisition, while the first granted type\n * is the governing auth policy used by the runtime accept flow.\n */\nexport function isPublicInvitationPasswordCredentialReachable(\n  config: AppConfiguration,\n): boolean {\n  for (const [organizationType, definition] of Object.entries(\n    config.organizationTypes ?? {},\n  )) {\n    const grantedUserTypes = definition.userTypes ?? [];\n    const governingUserType = grantedUserTypes[0];\n    if (!governingUserType) continue;\n\n    const acquisition = evaluateUserTypeAcquisition(\n      config.userTypes,\n      grantedUserTypes,\n      [],\n      RegistrationAcquisitionChannel.INVITATION,\n    );\n    if (!acquisition.allowed) continue;\n\n    const effectivePolicy = resolveAuthPolicyForOrganizationType(\n      config,\n      governingUserType,\n      organizationType,\n    );\n    if (\n      effectivePolicy?.registration.allowedMethods.includes(\n        AuthMethod.PASSWORD,\n      )\n      && getEnabledMethods(\n        effectivePolicy.authMethodsEnabled,\n      ).has(AuthMethod.PASSWORD)\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n"]}

package/dist/esm/security/authentications/services/utils/auth-response-helper.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-response-helper.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/utils/auth-response-helper.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,uDAAuD,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAkB,MAAM,qCAAqC,CAAC;AAEnH;;;GAGG;AACH,qBACa,gCAAgC;IAIN,OAAO,CAAC,QAAQ,CAAC,MAAM;IAClB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAEpE,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IANnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EAChB,WAAW,EAAE,kBAAkB,EAEvE,gBAAgB,EAAE,uBAAuB;IAM5D,eAAe,CAAC,GAAG,EAAE,sBAAsB,GAAG;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAQrF,WAAW,CAAC,GAAG,EAAE,oBAAoB,EAAE,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,MAAM;CAUlF"}
+{"version":3,"file":"auth-response-helper.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/utils/auth-response-helper.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,uDAAuD,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAkB,MAAM,qCAAqC,CAAC;AAEnH;;;GAGG;AACH,qBACa,gCAAgC;IAIN,OAAO,CAAC,QAAQ,CAAC,MAAM;IAClB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAEpE,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IANnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EAChB,WAAW,EAAE,kBAAkB,EAEvE,gBAAgB,EAAE,uBAAuB;IAM5D,eAAe,CAAC,GAAG,EAAE,sBAAsB,GAAG;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAQrF,WAAW,CAAC,GAAG,EAAE,oBAAoB,EAAE,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,MAAM;CAUlF"}

package/dist/esm/security/authentications/services/utils/auth-user-lookup.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-user-lookup.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/utils/auth-user-lookup.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,kBAAkB,EAAwC,MAAM,uBAAuB,CAAC;AAI7H,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yEAAyE,CAAC;AAC/H,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qEAAqE,CAAC;AAK1G;;;;GAIG;AACH,qBACa,4BAA4B;IAIF,OAAO,CAAC,QAAQ,CAAC,MAAM;IACC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACtD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAGzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IACvC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IATtF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACG,uBAAuB,EAAE,qCAAqC,EAC5E,gBAAgB,EAAE,uBAAuB,EAGjC,iBAAiB,EAAE,+BAA+B,EACvD,mBAAmB,EAAE,0BAA0B;IAMlH;;;OAGG;IACG,eAAe,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAIrF;;;OAGG;IACG,kBAAkB,CACtB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,KAAK,EAAE,MAAM,EACb,cAAc,CAAC,EAAE,cAAc,GAC9B,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IASvB;;;OAGG;IACG,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKxE,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAI7E,2BAA2B,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAI7G;;;;;;;;;;;;;OAaG;IACG,0BAA0B,CAI9B,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAsHrC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,2BAA2B,CACzB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,kBAAkB,GAAG,IAAI;CAQ7B"}
+{"version":3,"file":"auth-user-lookup.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/utils/auth-user-lookup.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,kBAAkB,EAAwC,MAAM,uBAAuB,CAAC;AAI7H,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yEAAyE,CAAC;AAC/H,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qEAAqE,CAAC;AAK1G;;;;GAIG;AACH,qBACa,4BAA4B;IAIF,OAAO,CAAC,QAAQ,CAAC,MAAM;IACC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACtD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAGzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IACvC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IATtF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACG,uBAAuB,EAAE,qCAAqC,EAC5E,gBAAgB,EAAE,uBAAuB,EAGjC,iBAAiB,EAAE,+BAA+B,EACvD,mBAAmB,EAAE,0BAA0B;IAMlH;;;OAGG;IACG,eAAe,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAIrF;;;OAGG;IACG,kBAAkB,CACtB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,KAAK,EAAE,MAAM,EACb,cAAc,CAAC,EAAE,cAAc,GAC9B,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IASvB;;;OAGG;IACG,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKxE,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAI7E,2BAA2B,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAI7G;;;;;;;;;;;;;OAaG;IACG,0BAA0B,CAI9B,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAsHrC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,2BAA2B,CACzB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,kBAAkB,GAAG,IAAI;CAQ7B"}